Privacy concerns brushed aside in establishment of NSW Transport Ticketing Corporation

The legislation to establish the NSW Public Transport Ticketing Corporation passed the Legislative Council on 7 March and is now awaiting assent. We blogged earlier about issues raised in the Legislative Assembly about the Corporation not being subject to privacy legislation once it eventually becomes a State Owned Corporation (SOC).

The Government was on the front foot on the matter in the Legislative Council. It sought to explain that, while a statutory authority the Corporation would be subject to the Privacy and Personal Information Protection Act, and was part of an organisation with a well established privacy policy and a person responsible for privacy. Even though it would not formally be subject to PPIPA when it became an SOC, the Government gave a commitment that it would have policies and procedures in place to follow PPIPA.

A Greens’ amendment to require the Corporation as an SOC to comply with PPIPA drew only 4 votes with the Opposition, Government and other MPs voting against.

Our earlier blog suggested that this problem was first raised by the Opposition during debate in the Assembly. In fact these issues had been pointed out by Parliament’s Legislation Review Committee last November. The Committee wrote to the Minister asking why administrative procedures regarding privacy compliance for the Corporation as an SOC were to be preferred to legislated compliance requirements.

Its not clear what the answer was as Government speakers in the Council simply reiterated the Government’s position. Minutes of the Review Committee indicate that some advice on the matter was also received from the Acting Privacy Commissioner. However his letter of advice is not included in the published Committee records.

The only difference between administrative compliance and compliance required by PPIPA is that the latter gives a right to seek review of conduct by the Administrative Decisions Tribunal. The Tribunal has powers to award damages of up to $40,000. Both these features are absent in an administrative regime.