In a recent decision, the NSW ADT discussed a form of mishandling of personal information by public sector agencies. In VK v Department of Education & Training, the Tribunal upheld the obligations of a public sector agency specified in sections 16 and 18 of the Privacy and Personal Information Protection Act 1998 (NSW) ('PPIPA').