DHU v Commissioner of Police, NSW Police Force

[2018] NSWCATAD 126

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

DHU v Commissioner of Police, NSW Police Force [2018] NSWCATAD 126

Hearing dates:

30 April 2018

Date of orders:

30 April 2018

Decision date:

30 April 2018

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

S Montgomery, Senior Member

Decision:

1. The application is dismissed for want of jurisdiction.

Catchwords:

Privacy and Personal Information – whether an internal review was requested – jurisdiction.

Legislation Cited:

Criminal Records Act 1991 (NSW)
Police Act 1990 (NSW)
Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited:

AQK v Commissioner of Police (NSW) [2014] NSWCATAD 55
CYL v YZA [2017] NSWCATAP 105
GA v Commissioner of Police, NSW Police [2004] NSWADT 254
KO v Commissioner of Police (NSW) [2005] NSWADTAP 56
PC v University of New South Wales [2005] NSWADT 157
PC v University of New South Wales (GD) [2005] NSWADTAP 72
Y v Director-General, Department of Education [2001] NSWADT 149

Category:

Principal judgment

Parties:

DHU (Applicant)
Commissioner of Police, NSW Police Force (Respondent)

Representation:

Counsel:

 

H Mann (Applicant)

  Solicitors:
Marrickville Legal Centre (Applicant)
Crown Solicitor’s Office (Respondent)

File Number(s):

2018/0035900

Publication restriction:

The publication of the name of the applicant is prohibited under section 64(1)(a) of the Civil and Administrative Tribunal Act 2013

REASONS FOR DECISION

Introduction

1. In these reasons the name of the Applicant has been anonymised so as to preserve the privacy of his personal affairs. The Applicant is referred to as DHU.

2. DHU has applied to the Tribunal for review of the conduct of a delegate of the Commissioner of Police (“the Commissioner”) in releasing information relating to his criminal record to DHU’s employer. It is common ground that the released information disclosed convictions which were at the time spent and therefore not disclosable. DHU lost his employment as a result of this disclosure.

3. The Commissioner filed an application for dismissal of the proceedings on the basis that the Tribunal lacks jurisdiction to conduct an external review under section 55 of the Privacy and Personal Information Protection Act 1998 (“the PPIP Act”), because DHU had not made an application for internal review under section 53 prior to commencement of proceedings.

4. The dismissal application came before me for hearing on 30 April 2018. On that occasion I accepted the Commissioner’s argument that the Tribunal lacks jurisdiction and dismissed the proceedings. DHU has requested more detailed reasons for my decision and these reasons are provided in response to that request.

Background

5. In 5 October 2016 DHU sent an email (“the 5 October email”) to the Police Criminal Records Section (“the CRS”) and expressed concern about the release of his criminal record to his employer. He wrote:

“To whom it may concern,

I have recently lost my job due to the criminal record section mistakenly releasing my criminal record to my employer. This was admitted as a mistake on the 20th September by the supervisor Nadia and I was given an apology. This mistake has cost me my job, embarrassed me, damaged my reputation and caused me major stress.

This email is a formal complaint into this matter and I am seeking legal advice.

I look forward to your reply.”

6. On 9 October 2016, DHU sent a further email (“the 9 October email”) to the following effect:

"To The Criminal Section Unit,

Further to my last email above, I have not received any acknowledgement from this and am still waiting. Could I get some sort of resolve from this matter please."

7. On 11 November 2016, DHU sent a response (“the 11 November email”) to an email from a Senior Records Release Officer to the following effect:

Thank you for your email. I look forward to the response that The Criminal Records Section will conclude. This error has completely turned upside down my working career and personal life and I will be expecting a reasonable outcome. I have gained legal advice and will further make involved their services pending the response of The Criminal Records Section."

8. The Commissioner disputes DHU’s contention that his complaint was an application for internal review pursuant to the provisions of section 53 of the PPIP Act.

Applicable legislation

9. Part 5 of the PPIP Act establishes a mechanism whereby an agency reviews its own conduct regarding an alleged breach of an information protection principle (“IPP”) before an individual is entitled to seek external review in the Tribunal. Section 52 provides:

52 APPLICATION OF PART

(1) This Part applies to the following conduct:

(a) the contravention by a public sector agency of an information protection principle that applies to the agency,

(b) the contravention by a public sector agency of a privacy code of practice that applies to the agency,

(c) the disclosure by a public sector agency of personal information kept in a public register.

(2) A reference in this Part to conduct includes a reference to alleged conduct.

…

10. Section 53(1) provides:

(1) A person ("the applicant”) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct.

11. Section 55 provides:

55 ADMINISTRATIVE REVIEW OF CONDUCT BY TRIBUNAL

(1) If a person who has made an application for internal review under section 53 is not satisfied with:

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

…

12. In GA v Commissioner of Police, NSW Police [2004] NSWADT 254 Deputy President Hennessy stated at paragraph [4]:

4 There are three pre-conditions to the Tribunal’s jurisdiction under s 55:

- The person must have made an application for internal review under s 53;

- The person must be dissatisfied with the findings of the review or the action taken by the public sector agency in relation to the application; and

- The person must be asking the Tribunal to review the conduct that was the subject of the application.

13. At paragraphs [5] – [7] of GA v Commissioner of Police the Deputy President stated:

5 Section 53. Under s 53(1) "a person ... who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct." The person does not need to identify the information protection principles or privacy code of practice on which he or she relies. (GL v Director-General, Department of Education and Training [2003] NSWADT 166 at [26]; JD v Director General, NSW Department of Health [2004] NSWADT 7 (revised).) But the person does need to identify the conduct about which he or she is aggrieved. The first question is the extent to which an applicant must identify the conduct that he or she is asking to be reviewed for the request to be regarded as an application under s 53.

6 The long title of the PPIP Act includes the following purpose: "to provide for the protection of personal information, and for the protection of the privacy of individuals generally". In view of that broad purpose and the beneficial nature of the legislation, s 53(1) should be interpreted widely to ensure that applicants are not unnecessarily denied the right to have conduct about which they are aggrieved internally or externally reviewed. Nevertheless, the consequences of a broad interpretation need to be considered. The broadest possible interpretation of s 53(1) is that it would be sufficient for an applicant to advise an agency that he or she was aggrieved by some unidentified conduct in order to be entitled to a review of that conduct. That interpretation would lead to the absurd situation that an agency would have to identify and investigate every transaction or communication relating to the personal information of the applicant which could possibly constitute a breach of an information protection principle or a privacy code of practice or the disclosure of personal information kept in a public register: s 52.

7   In my view, an applicant’s entitlement to an internal review (and ultimately an external review) depends on that person identifying the conduct about which they are aggrieved in sufficient detail to allow the agency to determine whether it constitutes a breach of an information protection principle or a privacy code of practice or the disclosure of personal information kept in a public register. If the application does not identify the conduct with that level of particularity, then the agency should initially request further information from the applicant. If an applicant does not provide that information within a reasonable time, then the agency will be justified in declining to review the conduct.

14. In the present matter it is not in dispute that the conduct that DHU was complaining about was the release of his criminal record to his employer. The issue that the Respondent has raised is whether his complaint was an application for internal review for the purposes of the requirements of section 53 of the PPIP Act.

The Commissioner’s case

15. The Commissioner submits that the existence of an application for internal review is a jurisdictional prerequisite. Without an application for internal review the Tribunal has no power to engage in a review under section 55 of the PPIP Act. In support of that argument, the Commissioner relies on views expressed by Senior Member Naida Isenberg in AQK v Commissioner of Police (NSW) [2014] NSWCATAD 55. She stated at paragraphs [10] - [12]:

10. The Respondent pointed out, correctly, that the Tribunal does not have jurisdiction to review an alleged breach of the PPIP Act in circumstances where the person alleging a breach has not made an application for an internal review in respect of that alleged breach.

11. In order for the Tribunal to have jurisdiction to make orders in relation to these matters the Applicant would have needed to have sought, and the Respondent would have needed to have undertaken, an internal review with respect to the alleged contraventions of the PPIP Act as a result of the publication of the Team 8 Minutes and the Core Meeting Agenda. Neither of these occurred. The Applicant lodged a complaint with Assistant Commissioner Barrie on 7 May 2012, but only raised privacy concerns in relation to the publication of the Minutes. The Respondent wrote to the Applicant on 29 August 2012 referring only to the publication of the Minutes, and notifying him of his right to request an internal review. In his letter to the Respondent dated 27 February 2013 requesting an internal review, the Applicant again only referred to a single alleged breach of privacy and made no mention of the publication of the Team 8 Minutes or the Core Meeting Agenda. As a consequence, the Respondent understood that the scope of the Applicant's privacy concerns were limited to the publication of the Minutes. In its letter to the Respondent dated 28 February 2013, the Public Service Association of NSW, writing on behalf of the Applicant, only referred to the Applicant's "request for an independent review with regards to a breach of privacy through the release of minutes 9 March 2011 onto the NSWPF Intranet', that is, publication of the Minutes. The letter did not make reference to the Team 8 Minutes or the Core Meeting Agenda. In the letter from the Respondent to the Applicant dated 11 March 2013 notifying of him of the internal review process, the Respondent stated 'We understand the nature of your complaint relates to an alleged breach of privacy due to the publishing of the minutes of the Lithgow Team Leader meeting dated 9 March 2011 onto the NSWPF Intranet'. At no stage did the Applicant seek to clarify, or broaden, the scope of his request for an internal review so as to raise issues about the publication of the Team 8 Minutes or the Core Meeting Agenda.

12.   Notwithstanding the above, in the interests of final resolution of the applicant's complaints, the Respondent did not oppose the Tribunal reviewing, as part of these proceedings, the conduct associated with the publication on the Intranet of the Team 8 Minutes and the Core Meeting Agenda. While the Tribunal welcomes the Respondent's practicality, and assumes all matters could have been ventilated at mediation, a party is not able to confer jurisdiction on the Tribunal in the interests of expediency, no matter how logical that course may seem to the parties, and indeed to the Tribunal.

16. A similar view was expressed by the Appeal panel in PC v University of New South Wales (GD) [2005] NSWADTAP 72 at paragraphs [28] - [29]:

28   In arriving at that factual determination, the Tribunal identified the correct test to be applied. In order to constitute an application for internal review, the document or documents relied upon by the applicant, must upon their face, reasonably convey to the respondent agency, that an application for internal review is sought. …

29 There is no power in the Tribunal to dispense with the requirement for an application for internal review, pursuant to section 53 Privacy and Personal Information Protection Act 1998. It follows, accordingly, that if the pre-requisite to trigger the jurisdiction of the Tribunal is absent, the Tribunal has no jurisdiction to entertain the appellant’s application for review, there being no reviewable decision, nor a failure on the part of the respondent to respond to a request for an internal review.

17. In PC v University of New South Wales [2005] NSWADT 157 President O'Connor explained at paragraphs [2] - [4]:

2 ... The precondition the Act sets for the making of applications of this kind to the Tribunal is found in s 53. It requires that the applicant first give the public sector agency an opportunity to respond to the matters of concern. There is a detailed procedure set out in s 53, including quite detailed requirements that fall upon the agency.

3   Obviously the purpose of that provision is to encourage the resolution of disputes of this kind at local level between the agency said to be responsible for the misconduct, and the applicant. So that is a fundamental premise of this legislation. ... Generally speaking a person adversely affected by a reviewable decision must first seek internal review of that decision by the agency before it can be exposed to scrutiny here.

4   We see the same thinking reflected in the regulation of public sector agencies with respect to conduct that might infringe the privacy legislation. So it is really a fundamental idea of the Australian legal environment when it comes to certain classes of decisions and conduct by bodies (at least in the public sector) that they be given this opportunity. ... So that body seeks to resolve the complaint, essentially in a private manner.

18. Further, in KO v Commissioner of Police (NSW) [2005] NSWADTAP 56 the Appeal Panel noted at paragraphs [13] – [15].

13   … the scope of the application for internal review, reasonably construed, provides the scope for the agency’s examination of the application. Unless there is some widening of the application within that process which is accepted by the agency, the application for internal review, reasonably construed, sets the scope for the application for review of the conduct by the Tribunal. It is plain from the scheme of the Act that the Parliament intended that the agency have the first opportunity, always, to deal with the matters of complaint. Except in the case where the agency fails to respond to the application for internal review, the scheme of the Act contemplates that the internal review report and its outcomes will be among the material that is placed before the Tribunal. ...

14   The question of what is the scope of the application, reasonably construed, is one of fact but, as we have indicated, affecting jurisdiction. Its determination is not driven, in any significant way, in our view by any recitation of Information Protection Principles that may appear in the applicant’s application. Often there will be no recitation of Information Protection Principles. Sometimes there will be a detailed recitation seeking to bring into play many, or every one of, the Principles. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles.

15 It is necessary, once having identified the facts and circumstances, to link them to the record keeping environment of the organisation (as to which, see Vice-Chancellor Macquarie University v FM [2005] NSWCA 192) and to the Information Protection Principles.

19. Further, in Y v Director-General, Department of Education [2001] NSWADT 149 the President noted at paragraph [16]:

"16.   ... I do not see it as essential that there be express reference in correspondence with agencies to the statute under which application is made. There will be cases where it is apparent from the surrounding context, such as oral interactions between the applicant and the agency, or the internal contents of the letter, that a statutory right is being invoked. But in cases where an applicant proceeds through an informed agent (such as a legal practitioner or a union) it is reasonable for an agency ordinarily to expect to find a direct reference to any statutory right that is being invoked.

20. The test for whether an applicant has sought an internal review is an objective one. No particular formality is required on the part of the applicant. However, there needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to an IPP, whether or not the IPP itself is actually specified by the application: CYL v YZA [2017] NSWCATAP 105 at paragraph [58].

21. The Commissioner submits that it is important for the agency to know whether an internal review application has in fact been made because it triggers obligations on the part of the agency. For example, the agency must notify the Privacy Commissioner of the application and keep the Privacy Commissioner informed of the progress of the internal review, the findings of the review and the actions proposed to be taken.

22. The Commissioner submits that while there is no requirement that an applicant refer in terms to the PPIP Act or the IPPs, failure to do is a factor that tells against the document being an application for internal review under section 53. Failure to seek any particular remedy is another such factor:

23. The Commissioner submits that, on their face, the emails of 5 and 9 October 2016 and 11 November 2016 did not reasonably convey to the agency that an internal review was sought.

24. The Commissioner further submits that this is so notwithstanding that (i) the substance of DHU's grievance, as identified in these emails, is the alleged mistaken release of his criminal record to his former employer by the Criminal Records Section, and (ii) this grievance could have been framed as a complaint regarding the unlawful disclosure of his personal information under the PPIP Act.

25. The Commissioner notes that DHU's emails do not mention the PPIP Act, IPPs or privacy. Further, while DHU requested a response and, in his 11 November 2016 email, he says that he expects "a reasonable outcome", he did not seek any particular remedy. Ms Langford submitted that DHU's emails go no further than to state a grievance and to request a response to his complaint.

26. The Commissioner also identified a number of regimes which potentially applied to the conduct of which DHU complained. For example, DHU may have disputed his criminal record information as part of the process of issuing a National Police Check. His complaint could also have been framed as a complaint regarding an alleged unlawful disclosure of information concerning spent convictions. He may have sought to make a complaint under Part 8A of the Police Act1990 (NSW) about the conduct of police officers. Alternatively, DHU may have given consideration to a common law action, and written to the NSWPF as a prelude to a more formal letter of demand.

20. The Commissioner submits that when considered objectively, the emails provide no indication that DHU sought an internal review of the identified conduct under section 53 of the PPIP Act. Further, the wider context provides no support for the proposition that the Commissioner ought reasonably to have construed the documents as an application for internal review.

DHU's case

28. Ms Mann, counsel for DHU, disputes that the obligation is on the member of the public lodging a complaint to identify the complaint as an application for internal review under PPIP Act. She submits that a public sector agency should be expected to know the main statutory regimes applicable to it, including PPIP Act. She contends that all that is required of an applicant is that they make it clear that the complaint is about the person's 'personal information', that is information 'about an individual whose identity is apparent or can reasonably be ascertained from the information'. A public sector agency should have procedures in place to consider all the complaints it receives and classify them accordingly.

29. She submits that DHU’s criminal record details are clearly within the definition of personal information. As a result, any inappropriate disclosure of such information by the agency has the potential to be a breach of obligations under the PPIP Act. She contends that it is reasonable to expect a specialised section such as the CRS, which deals with personal information as its main activity, to be alive to this possibility and deal with complaints accordingly.

30. She submits that the Tribunal can fairly infer that even though DHU obtained some legal advice but he probably didn’t know that the privacy legislation existed and he probably didn’t know that an internal review was required or what remedies he could seek. He probably assumed that, as the agency had caused his loss, it would look into his complaint and do something about it. He probably didn’t know what else they may nor may not owe to him because of the mistake.

31. DHU wrote to the agency asking them to review the conduct and to take appropriate steps, whatever those steps might be. Ms Mann submits that, in substance, that complaint is an application for internal review.

32. Ms Mann submits that if the 5 October email was properly considered the Commissioner could have had no doubt that: (1) the complaint was about DHU's 'personal information', and (2) it should therefore have been classified as a request for internal review and treated appropriately. What appears to have in fact happened is that DHU's complaint was largely ignored.

33. She also notes that the Commissioner has not put in place any procedures which would allow members of the public to provide information to assist the Police to appropriately classify their complaint. She contrasts this with procedures recommended by the Privacy Commissioner.

34. Ms Mann submits that whether or not a particular complaint should have been treated as an application for internal review is predominately a question of fact dependant on all the circumstances. Therefore, she submits, previous decisions in relation to specific complaints are not helpful to that exercise. In any event, Ms Mann argues that the decisions referred to by the Commissioner are relevantly different from the circumstances of this case and they can be distinguished on their facts. Alternatively, she submits that if they are not distinguishable, then they are wrong.

35. Ms Mann submits that in circumstances where there was an existing relationship between the complainant and the agency, such as an employer-employee relationship, or a student-university relationship, any complaint made between the parties is much more likely to relate to various matters relevant to their broader relationship and not be able to be classified as a request for statutory review unless specifically described as such. She says that this is not the position of members of the public who take specific steps to send a formal complaint to the Police. She contends that the only purpose of a formal complaint to the Police would be to take advantage of any rights that the complaint may have in relation to his or her grievance.

36. The agency’s task is to simply read each formal complaint and decide whether it falls within the complainant’s statutory rights.

37. Ms Mann does not agree that the lack of any reference to the PPIP Act tells against DHU’s complaint being classified as an application for internal review. She submits that this lack does not assist the Tribunal in making its decision. She says that a member of the public should not be criticised for not knowing the relevant legislative provisions. Either the complaint is about personal information, and should therefore be classified by the agency as an application for internal review, or it is not. If there is any doubt, the agency should err on the side of caution.

38. Further, Ms Mann submits that DHU’s emails made it clear that he was seeking some kind of remedy. He is not to be expected to know what remedies may be available.

39. She further contends that whether or not other legislative regimes could have potentially also applied to the complaint does not assist the Commissioner. She submits that the agency should have considered whether any of the other potential statutory regimes applied and as the complaint clearly related to DHU’s personal information it was also required to apply the PPIP Act regime.

Discussion

40. I do not agree with Ms Mann’s submission regarding the decisions that the Commissioner has identified. While I agree that each matter will turn on its own facts, it is my view that the principles set out in those decisions are relevant in regard to the construction of the PPIP Act.

41. There is no power in the Tribunal to dispense with the requirement for an application for internal review, pursuant to section 53 of the PPIP Act. In order to constitute an application for internal review, DHU’s emails must, upon their face, reasonably convey to the agency that an application for internal review is sought.

42. The test is an objective one. The Tribunal does not insist on any particular formality. It’s not necessary for DHU to have named the PPIP Act or to refer to any specific IPP.

43. I have referred to the decisions by President O’Connor in PC v University of New South Wales and Y v Director-General, Department of Education. The views that the President expressed there have been widely applied in this Tribunal and in the Administrative Decisions Tribunal.

44. I agree with the Commissioner that the test is whether or not the documents relied upon reasonably convey to the agency that DHU was seeking an internal review.

45. DHU’s emails do not mention the legislation, IPPs or the concept of privacy at all. While I agree that it’s not necessary to refer to the PPIP Act or the IPPs, in my view the absence of any reference to those matters is something the Tribunal can take into account when determining whether or not a particular document is an application under the section.

46. I also agree that contextual factors can be important, depending on the case. The absence of a pre-existing employment relationship or a similar kind of relationship might also be a factor that the Tribunal can take into account. The surrounding context such as oral interactions between the agency and an applicant might shed light on the nature of the applicant’s request. However, in this matter contextual factors do not assist DHU.

47. I note the Commissioner’s submission regarding other potential avenues available to DHU. In my view it can’t be said that the only appropriate way to deal with DHU’s emails, was to conduct an internal review under section 53 of the PPIP Act.

48. In my view it does not assist DHU that the agency took no action at all to consider his complaint in relation to any of those potential avenues. It cannot be inferred that the agency dealt with the emails as an application for an internal review. It appears that the Criminal Records Section treated it as a generalised complaint and then failed to act on that complaint.

49. DHU’s emails are clearly an expression of a grievance and a request for some review to be undertaken. That may be a request for some action to be taken under either the Criminal Records Act 1991 (NSW) or the Police Act or DHU may have intended that action would to be taken under the PPIP Act. However, DHU’s intention is not clear from the face of the emails.

50. If DHU had intended that his emails be treated as a privacy internal review request, I would have expected that the correspondence would raise something about his privacy. I would have expected that there would be some reference to privacy in the communications between DHU and the agency. There is nothing in any of this material that suggests that he referred to his privacy at all.

51. In the circumstances, the views expressed by President O’Connor in PC v University of New South Wales are apposite. I do not think that compliance with the PPIP Act requires an agency to consider every complaint that it receives in terms of the privacy legislation. To engage that obligation there would need to be some reference, either direct or by natural inference, to the release of personal information and an indication that the release was related to the complainant’s privacy. DHU’s emails do not do that directly and nor can that be naturally inferred as his intention.

52. It’s clear from the emails that DHU was concerned about the conduct. It is clear that he has identified that there were consequences as a result of the conduct and that he wants some action taken. However, it is not clear that the complaint is related to his privacy. In the circumstances, the agency was not required to consider DHU’s emails as an internal review request.

53. It was open to the agency to consider DHU’s emails as an internal review request, but it was not required to do so.

54. My view is that the Tribunal has no jurisdiction under the PPIP Act and therefore the application for dismissal succeeds.

Order

1. The application is dismissed for want of jurisdiction.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 08 June 2018