Publications

High Court confirms NCAT’s ability to award damages in privacy disputes: Why this matters for protecting personal information held by NSW public sector agencies

The Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) is an important law which sets out how NSW public sector agencies are required to handle your personal information. If you would like to find out more about this, you can read our article here.

Part 5 of the PPIP Act allows individuals to seek an internal review of an agency’s conduct in respect of personal information and privacy (s 53).  It also gives a right to apply to the NSW Civil and Administrative Tribunal (NCAT) for an external administrative review if they are not satisfied with the outcome of the agency’s internal review (s 55).

Importantly, s 55(2) of the PPIP Act also sets out a broad range of orders that may be made by NCAT upon review of the public agency’s conduct, including the power to make an order requiring the agency to pay up to $40,000 in damages to the applicant.[1]

These particular powers were recently challenged in the case of New South Wales v Wojciechowska [2025] HCA 27 when the court was asked to consider whether NCAT was unlawfully exercising judicial power (which is exclusively reserved for Courts under Chapter III of the Australian Constitution) when awarding damages under s 55(2) of the PPIP Act.

An overview of NSW v Wojciechowska [2025] HCA 27

Prior to making its way to the High Court, this matter originated in NCAT where an administrative review application was brought by the Applicant in respect of several NSW public agency decisions made on behalf of the Commissioner of the NSW Police Force under the PPIP Act. In relation to two particular decisions, the Applicant also claimed damages pursuant to s 55(2)(a). However, the Applicant then sought to challenge NCAT’s jurisdiction to determine these proceedings.

The High Court, on appeal, unanimously found that NCAT’s powers under s 55(2)(a) of the PPIP Act are not judicial, but solely administrative, and are thus constitutionally valid.

More broadly, the High Court views the PPIP Act’s review framework as being distinguished from the statutory scheme in the earlier case of Brandy v Human Rights and Equal Opportunity Commission (1995) 183 CLR 245. This is because the PPIP Act only imposes certain administrative standards (or “norms”) on NSW public sector agencies in respect of protecting personal information and which are only enforceable in limited circumstances as set out in Part 5 of the PPIP Act. This thereby preserves the constitutional validity of NCAT’s powers under s 55(2) of the Act.

Why this matters for protecting personal information in NSW

Whilst heavily rooted in administrative and constitutional law, the High Court’s judgement in NSW v Wojciechowska has important practical implications for the protection of privacy and personal information in NSW in relation to personal information held by NSW public agencies:

1. NCAT can lawfully award damages for contraventions of the PPIP Act.
2. Such orders are not confined to residents of NSW and may be sought by individuals from other states whose information has been mishandled by a NSW public sector agency.
3. The PPIP Act does not create any legally enforceable right to particular remedies under s 55(2); rather it establishes a critical framework for administrative oversight whereby individuals have a right to have the internal findings and/or proposed actions of a NSW public agency externally reviewed by NCAT who, upon finding any contravention of the PPIP Act, may or may not take action in some way as provided by s 55(2).
4. Whilst the actions available to be taken by NCAT under s 55(2) of the PPIP Act may include the making of compensation orders or other corrective orders as set out in the Act, these are intended to ensure accountability and compliance with NSW privacy standards rather than serve as alternatives to conventional civil remedies available through the Courts.
5. Any orders made by NCAT to pay money to another party may still be enforced by filing with a Court of the appropriate jurisdiction in accordance with s 78 of the NCAT Act.

NSW v Wojciechowska underscores that NCAT’s administrative oversight remains a critical tool for protecting one’s personal information by providing individuals a clear avenue to hold public agencies accountable.

Speak to us if you ever have any privacy or privacy related concern.

This article was written by Selwyn Black, Lucy Han, and Chelsea O’Grady and was published on 2 March, 2026  by Carroll & O’Dea Lawyers and is based on the relevant state of the law (legislation, regulations and case law) at that date for the jurisdiction in which it is published. Please note this article does not constitute legal advice.

If you ever need legal advice or want to discuss a legal problem, please contact us to see if we can help. You can reach us on 1800 167 267 or via the Contact Us page on our website.

[1] PPIP Act s 55(2)(a).