Australian Local Council Information – Australian Privacy Foundation

THIS DOCUMENT IS AN EXPOSURE DRAFT

Introduction

Local government entities in Australia, known variously as City, Town and Shire Councils, perform many functions. Some of those functions involve the maintenance of databases containing personal data about residents of the area. Important examples include:

a register of properties and their owners, necessary to enable rates to be collected. This may interact in some manner with the land titles register operated at State Government level;
a register of development and building applications, necessary to inform residents of proposed changes to their physical environment, and to enable objections to be made;
a register of voters. This may interact in some way with the Electoral Roll(s) operated at State and Federal levels; and
one or more registers of animals, particularly dogs.

It is important that the personal data in these registers be managed carefully. Most people have a strong preference that the data that agencies have about them be used only by that agency, and only for the purposes it was provided, and for additional purposes (such as law enforcement) only with specific legal authority. This expectation is supported by international treaties and conventions, many constitutions, and the laws of many countries. The reasons people have for wanting privacy protections are mostly psychological, sociological and political. For some people, however, it is a question of physical safety.

There are contrary interests, ranging from law enforcement and public health to efficient marketing by suppliers of goods and services relevant to, for example, building and dog-care.

This document provides information about the law and practice concerning the accessibility of personal data held by local government entities.

It is important to note that most Councils are closer to their residents than are agencies of State and Federal governments. As a result, many approaches from residents have resulted in outcomes satisfactory from a privacy perspective.

If you are concerned about something that you think that your Council is doing, the APF recommends that you approach the staff at your Council, calmly explain your concerns, and listen to what they have to say about the matter. If necessary, write a clear statement of your understanding of the present situation, and why you are concerned about it, and send it to Council as a formal request. In the event that you are dissatisfied with the outcome, you may wish to resort to further measures such as complaint to a Privacy Commissioner, or a media release. But many issues are capable of resolution without using such measures.

Public Expectations

Privacy is a fundamental human right, and recognised as such in key international instruments. The fundamental principle is that personal data is collected for a particular purpose, and that use for any other purpose can only be by consent, or with specific legal authority.

A mythology has grown up about so-called ‘public registers’, which some public servants at federal and even State level would like to think are available to anyone, at any time, for any purpose. The policy position that the APF adopts is that there is no such thing as personal data that is openly available to anyone, for any purpose. Moroever, we believe that to be the appropriate interpretation of the law in most circumstances.

Where Councils enable access to personal data, they should:

obey express instructions at law, but make clear to people what that authority is, by stating the Act and section that creates the obligation;
exercise choices that they have under law in a manner sympathetic to the privacy interests of their residents; and
even where an obligation exists to provide access, seek to limit accesses to those which are consistent with the purposes of collection, are consented to, or are authorised by law.

Controlling access need not involve Councils in significant effort or expense. The primary requirement is that each person seeking access declare their purpose, so that they are committing a punishable offence if they declare falsely (and are committing a serious offence if they declare falsely many times, in order to collect bulk data).

The Legal Framework

“There are 722 local government bodies in Australia. … The largest local government authority by population is the Brisbane City Council with 900,000 residents. The average council population is 26,400. The largest council by area is the Shire of East Pilbara in WA covering 379,000 square kilometres (population 7,000)” (Australian Local Government Association).

Local government is not recognised under the Australian Constitution. Instead, it exists under the laws of State Governments. Hence the regulation of data held by Councils, and their practices in relation to that data, is subject to the laws of the States and the Territories.

In general:

in order to fulfil their functions, Councils are required (in some cases by law, and in other cases as a matter of practical necessity) to collect, store and use a range of personal data;
the data relates to people in various roles, as property owners, residents, applicants for building permits, dog owners, etc.;
the State laws that require Councils to collect, store and use data may also:
- oblige Councils to do certain things;
- provide Councils with the power to do certain things; and/or
- preclude Councils from doing certain things;
Councils may be subject to additional State laws, which may affect the application of those laws;
Councils may establish local laws and policies;
the situation in respect of each category of data that Councils hold is not always simple to discover;
many Councils work on the assumption that some of the categories of data that they hold are ‘public registers’ that are available to anyone who wants them;
some Councils even provide the data in bulk to organisations that ask for them, or pay for them;
many people work on the opposite assumption to the Councils, and believe that (whatever the law might say) each Council has an obligation to protect personal data and only use it for the purposes for which it was collected.

The following sections provide information on the situiation in the States and Territories:

N.S.W.
Victoria
Queensland
South Australia
Western Australia
Tasmania
A.C.T.
Northern Territory

The assistance of readers is requested, to check and expand the information provided here.

N.S.W.

N.S.W. was the first State to enact legislation, in 1975. The longstanding Committee was upgraded to a Commission with the enactment of the Privacy and Personal Information Protection Act 1998 (NSW), commonly referred as as the PPIPA. However, this provides only limited protections within a regime of considerable complexity. The Government has been increasingly hostile to the Office of the Privacy Commisisoner, has attempted to dis-establish it, and has starved the Office of resources.

Special provisions apply to ‘public registers’, such as the register of development and building applications.

Part 6 of the PPIPA provides that personal information can only be disclosed from a public register if the Council is satisfied that the information is to be used “for a purpose relating to the purpose of the register or the Act under which the register is kept” – s.57. In addition, s.58 provides for the suppression of personal information from a public register for safety reasons. Under s.59, these provisions cannot be overridden by other laws, whether pre-existing or subsequent. However they can be overridden by privacy codes. The Privacy Code of Practice for Local Government spells out the purpose of common public registers held by councils, and provides some
exemptions to the general rule.

By contrast the register of cat and dog owners is definitely NOT a ‘public register’ that anyone can peruse at their local council. See the the Companion Animals Act 1998 at s.75 and s.89, for the limited range of people who can access (or request information from) the statewide Companion Animals database.

Other personal data held by Council (i.e. that which is in a database that is not declared to be a public register) is covered by s.12 of the Local Government Act 1993.

Section 12(1) provides a list of documents which must be made available for inspection. Protection is provided under s.12(1A) for commercial-in-confidence information and trade secrets, but no protection is provided for any personal data these records may contain.

The remainder of personal information held by Councils is covered by s.12(6), which says that the Council “must allow inspection … unless, in the case of a particular document, it is satisfied that allowing inspection of the document would, on balance, be contrary to the public interest”. This suggests allowing access to these other records should first comply with the privacy principles covering access and disclosure (Fact Sheet 6 – ‘Local government records and the ‘public interest’ test’, March 2004).

Councils must therefore be very cautious when they provide access to personal data, even where it is on a public register. In particular, the Privacy Commissioner has warned that “providing unrestricted Internet access to public registers containing personal information would in most cases breach (the Act)” (Fact Sheet 7 – ‘Public registers and the Internet’ – April 2004).

Councils are faced with law that is both confusing and not sufficiently privacy-protective. N.S.W. residents are advised to work for better law in this area.

Where a specific problem arises, the Council should be approached, to seek an internal review of the conduct at issue. More information about making a complaint can be found on the Privacy Commissioner’s website. See in particular the Privacy Code of Practice for Local Government (July 2000), and the brochures on public registers and Can my local council give me information about my neighbours?.

Victoria

The Information Privacy Act 2000 applies to local government entities. The Office of the Victorian Privacy Commission is the reference-point for information. It also handles complaints about practices by Councils where the initial approach to the Council has not been satisfactorily addressed by the Council itself.

Register of Properties

There does not appear to be any requirement in law for a Council to maintain a register of properties. However, the Local Government Act 1989 ss.154-181 requires Councils to levy rates on owners of properties. This implies the need for such a register. But the law relating to the protection of personal data stored on such a register is unclear.

Register of Development and Building Applications

The Building Act 1993 (Vic) s.31 provides that:

(1) A council must keep a register of all building permits given to it under this Division.

(2) A council must make the register available for inspection by any person during normal office hours.

A formal study was made of the matter by the Victorian Privacy Commissioner in 2002 (OVPC Report 01.02 Public Registers and Privacy: Building Permit Data, August 2002).

The study found that “It has been difficult to identify the purpose for which the building permit public register has been maintained and how Parliament intended the register be used” (p. 9). Whatever it may have been intended for, businesses use it as a source of details about prospective customers.

The Privacy Commissioner recommended that “Two common activities associated with the register – direct marketing and compilation of industry statistics – are uses, not purposes, of the register. Both uses should be permitted to continue on certain conditions: direct marketing only to addresses where the permit applicant opts in; statistics in de-identified form” (p. 39).

It appears that the recommendation has been ignored. The report and the standards it sets have no direct force of law, but they can be drawn to the attention of Councils as an indication of the protections that residents can reasonably expect them to apply.

Register of Voters

The Local Government Act 1989 ss.21-27 requires Councils to maintain a register of voters. In addition, s.24C(5)(d) provides that a person or organisation can seek a copy of the voters’ roll for a public interest purpose.The Privacy Commissioner provides guidance as to how that section is to be interpreted (OVPC Guide to seeking access to a Council voters’ roll for public interest purposes, undated).

Registers of Animals

“The Domestic (Feral and Nuisance) Animals Act 1994 requires local councils to keep a public register of all registered dogs and cats at the council office. Any person may inspect the register and make notes or obtain a certificate of the ‘particulars of registration’. [But] Not all of this information needs to be included in the public register to achieve its purpose. It would appear that the name and description of the animal and the registration number are all that the register requires” (OVPC InfoSheet 08.02).

[Details to follow …]

Register of Voters

[Details to follow …]

Registers of Animals

The Domestic Animals Act 2000 (ACT) requires that a dog register be maintained (s.5). The Domestic Animals Regulations 2001 stipulates data that is to be included on the register (Reg.2). There appear to be no legal provisions relating to access to the register. See the Domestic Animal Services web-site.