DQU v University of New England

[2020] NSWCATAD 226

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

DQU v University of New England [2020] NSWCATAD 226

Hearing dates:

24 April 2019 and 24 January 2020

Date of orders:

11 September 2020

Decision date:

11 September 2020

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

S Higgins, Senior Member

Decision:

(1) Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 the publication of the name of each applicant in these proceedings is prohibited.

(2) Time within which the applicants are to bring this application is extended to 29 November 2018.

(3) Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 the publication of the name of each applicant is prohibited.

(4) Pursuant to s 55(2), the Tribunal decides not to take any action in this matter.

Catchwords:

ADMINISTRATIVE LAW – privacy – review of conduct of a public sector agency in collecting personal information from the applicants for the purpose of assessing whether a prospective overseas student will meet the Genuine Temporary Entrant (GTE) and financial requirements specified by the Australian Government for the issue of a student visa – whether the collection of this information for this purpose is a lawful purpose that is directly related to a function or activity of the University and the collection of that information is reasonably necessary for that purpose (s 8 of the Privacy and Personal Information Protection Act 1998) – whether the conduct of the public sector agency contravened the information protection principles in s 9, 10 and 11 of Privacy and Personal Information Protection Act 1998.

Legislation Cited:

Administrative Decisions Review Act 1997 (NSW)

Civil and Administrative Tribunal Act 2013 (NSW)

Civil and Administrative Tribunal Rules 2014 (NSW)

Education Services for Overseas Student Act 2000 (Cth)

Migration Act 1958 (Cth)

Migration Regulation 1994 (Cth)

Privacy Act 1988 (Cth)

Privacy and Personal Information Protection Act 1998 (NSW)

University of New England Act 1993 (NSW)

Cases Cited:

ALZ v SafeWork NSW [2017] NSWCATAP 51

ALZ v WorkCover NSW [2015] NSWCATAP 138

CFZ v Department of Education [2015] NSWCATAD 231

DO v University of New South Wales [2003] NSWADTAP 9

Jackson v NSW Land and Housing Corporation [2014] NSWCATAP 22

KJ v Wentworth Area Heath Service [2004] NSWADT 84

KO v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56

Minister for Immigration and Multicultural and Indigenous Affairs v QAAH of 2004 [2006] HCA 53; (2006) 231 CLR 1

Texts Cited:

None cited

Category:

Principal judgment

Parties:

DQU (First Applicant)
DQV (Second Applicant)
University of New England (Respondent)

Representation:

Solicitors:
Second Applicant (Self Represented)
Spark Helmore Lawyers (Respondent)
C Emery (NSW Privacy Commissioner)

File Number(s):

2018/00367583

Publication restriction:

Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 the publication of the name of each applicant in these proceedings is prohibited.
Note: A reference to the name of the applicant includes a reference to any information, picture or other material that identifies the applicant or is likely to lead to the identification of the applicant.

reasons for decision

Introduction

1. The applicants, DQU and DQV, seek external review of the conduct of the respondent, the University of New England (‘the University’), in collecting their personal information and that of their immediate family, which they assert to have been collected or sought to be collected in contravention of the collection information protection principles in ss 8, 9, 10 and 11 of the Privacy and Information Protection Act 1998 (NSW) (‘PPIP Act’).

2. In 2018, DQU (the first applicant and a citizen and resident of another country) wanted to come to Australia, as an overseas student, to undertake post-graduate courses of study at the University for one year.

3. As an overseas student, seeking to undertake a course of post graduate study in Australia, DQU first needed to obtain a formal offer of admission from an Australian University registered, under Part 2 of the Commonwealth Education Services for Overseas Student Act 2000 (ESOS Act). The University, established under the University of New England Act 1993 (NSW) (UNE Act) is an education provider registered under the ESOS Act. As a registered education provider, the University is authorised to offer to provide and to provide postgraduate courses of study to overseas students. Any offer the University makes to an overseas student is subject to the student being grated a student visa. Without being granted a student visa (e.g. a subclass 500 student visa), the overseas student cannot take up any formal offer of admission that is made.

4. Student visas are granted under the provisions of the Commonwealth Migration Act 1958 (Cth) (‘Migration Act’) and the regulations made pursuant to that Act: see Migration Regulations 1994 (Cth) (‘Migration Regulations’), Sch 2. The Commonwealth, through its Minister (currently the Minister for Immigration, Citizen and Multicultural Affairs) and the Department of Home Affairs is responsible for implementing the Migration Act and Migration and Regulations. A student visa can only be issued/granted by the Minister or his delegate. The University is not a delegate of the Minister.

5. As DQU wanted to bring his wife and son with him, they also needed to apply for and be granted a student visa.

6. DQV (the second applicant) is a naturalised Australian citizen and resides and works in Sydney NSW. He is the brother of DQU and has at all times acted as DQU’s sponsor and agent.

7. DQU submitted his on-line application for admission to the University in April 2018. In his application, he applied for two courses. In 16 May 2018, the University made a conditional offer of admission to DQU for the courses of study he had applied for. Two days later, on 18 May 2018, the University issued a revised conditional offer of admission for the same courses, but with later commencement dates. The conditions on which each offer was made was that DQU:

•   [met] the ‘Genuine Temporary Entrant’ (GTE) requirements as specified by the Australian Government Home Affairs. You must complete the attached GTE form and return it to [email protected]. Your GTE application will be assessed by UNE and you will be advised whether you can proceed with your admissions;

•    [met] UNE’s English Language Requirements for Admission Rule for your nominated course …; and

•    [used] an official UNE education agent (…) to progress his admission to UNE (including undergoing Genuine Temporary Entrant (GTE) assessment, accepting your offer, paying your initial fees and OSHC, receiving your confirmation of enrolment (COE) and applying for your Student Visa)

8. The GTE requirements are those prescribed in cl 500.212 of Sch 2 of the Migration Regulations for the issue/grant of a subclass 500 student visa. While the University does not have authority to issue/grant a student visa, in 2016, it elected, as an ESOS registered education provider, to be part of the Commonwealth ‘Simplified Student Visa Framework’ (‘SSVF’). Under the terms of the SSVF the University elected to ensure, as part of its admission processes, that international students to whom it made an offer of admission:

1. had an appropriate level of English (Migration Regulations, Sch 2 cl 500.213);

2. had sufficient funds to support themselves and their dependents in Australia (Migration Regulations, Sch 2 cl 500.214); and

3. were a genuine temporary entrant (as noted above Migration Regulations, Sch 2 cl 200.212).

9. The SSVF is an administrative arrangement whereby the University is authorised, by the Commonwealth Department of Home Affairs, to make its own enquiries during its admission processes, on whether a prospective overseas student can satisfy the prescribed criteria for the issue/grant of a student visa in the event a formal offer of admission is made and accepted by the student. The object of this arrangement was to streamline student visa applications so that there would be minimal delay between a formal offer of admission being made by the University and the student applying for and being granted or refused a student visa by the Commonwealth.

10. While DQU and DQV accept that the University was authorised to make some preliminary enquiries in regard to any subsequent visa application DQU might make if a formal offer of admission was made, they contended that the personal information collected or sought to be collected by the University went beyond that which the University was entitled to lawfully collect. They also contend that the information collected or sought to be collected was excessive and intruded to an unreasonable extent on their personal affairs. DQU and DQV also contend that the University failed to make them aware that the supply of their personal information was required by law or it was voluntary and the consequences for them if the information (or part thereof) was not provided.

11. On 16 August 2018, DQU and DQV made an application for internal review, under s 53(1) of the PPIP Act. On 28 August 2018, they provided some clarification of the scope of their complaint. The University completed its internal review on 22 October 2018 and found that it had complied with the collection information protection principles in the PPIP Act.

Proceedings before the Tribunal

12. On 29 November 2018, DQU and DQV made this application for external review of the conduct of the University. In accordance with s 55(6) of the PPIP Act, the Privacy Commissioner was given notice of the application having been lodged.

13. In accordance with the practices of the Tribunal, on the lodgement of an application under the PPIP Act, the Tribunal Registry assigns a pseudonym to the name of the applicant(s). Subject to any objections, a formal order prohibiting the publication of the name of the applicant is then made by the Tribunal at the first directions hearing, pursuant to s 64(1) of the Civil and Administrative Tribunal Act 2013 (NSW). In this case, I note that the pseudonyms allocated to the applicants has been used consistently throughout the proceedings. However, on my examination of the file no order has been made to this effect. In my opinion, given the nature of the personal information in issue in these proceedings it is appropriate to make such an order.

14. There is no dispute that the information the subject of this application is personal information about DQU, DQV and personal information of DQU’s wife and son.

15. DQU and DQV’s application was heard on 24 April 2019. At the conclusion of the hearing, I reserved my decision and made orders for the filing and serving of further written submissions by the University, DQU and DQV and the Information Commissioner.

16. At my request, the application was again listed before me on 24 January 2020. I listed the matter as I sought clarification on the application of the Commonwealth SSVF and whether, by reason of this Commonwealth framework , the conduct of the University in collecting the GTE information of DQU, DQV and DQU’s wife and son fell within the provisions of the Commonwealth Privacy Act 1988 (Cth) and not the PPIP Act. After a short hearing, I again reserved my decision and made orders for the filing and serving of further written submissions.

The scope of the applicants’ application for review

17. In their internal review application DQU and DQV identified the following conduct as the conduct they were complaining about:

1. contrary to s 9 – ‘certain information is collected by the University non-directly from the individuals such as age, place of residence marital status of relatives and ex-spouses’;

2. contrary to s 8 – ‘there are no express authorisation by law or regulations to the University to conduct GTE assessment’ and ‘collection of irrelevant (not reasonable necessary) information such as school attestants (sic) – high school mark sheet of the applicant (who hold PhD degree)’;

3. contrary to s 11 – ‘intrusion to an unreasonable extent on the personal affairs – request of wedding photos, proof of paying taxes on Australian soil etc.’;

4. contrary to s 10 – failure to disclose whether the supply of the information is required by law or is voluntary and the consequences for the individual if the information (or any part of it) is not provided.

18. On 28 August 2018, DQV wrote to the University and provided the following clarification of their complaint:

The correct summary would be:

1. In the breach of s 8 of PPIP – information collected in the absence of express authority [to conduct the GTE].

2. In breach of section 9 of the PPIP – information collected about third parties (NOT my brother, but his and my relatives and spouses)

3. In breach of s 8 of PPIP – collection of irrelevant information

4. In breach of s 11 of PPIP – intrusion into personal affairs

5. In breach of section 10 – intended recipient was not disclosed, consequences of not-supply is not explained.

To underline – breach of section 9 means that the UNE collects information about relatives and spouses of applicant and sponsor.

I forgot to add at initial application, that, in my understanding, it should be illegal; as well to the UNE to demand to provide samples of handwriting as it is irrelevant for purpose of GTE assessment (s 8) (Email to the Respondent of 28 August 2018, the Application).

19. In response to orders made by the Tribunal on 20 January 2019, DQV identified the following as the personal information which the University collected or sought to collect from DQU and himself and which they contend to have been collected, or sought to be collected in contravention of ss 8, 9, 10(d) and 11 of the PPIP Act:

-   samples of hand-writing - all forms were demanded to be filled by hand;

-   employment history;

-   list of overseas trips and visa granted/refused;

-   brother's (who is sponsor) details including: DOB, citizenship, domicile, job, designation and employer's name.

-   marital status including previous marriages etc., wife personal details

-   dependant's (son) details;

-   spouse's education history;

-   spouse's employment history;

-   gaps in spouse academic and employment history;

-   spouse travel/visa history;

-   son's identity details (passport);

-   wife's identity details (passport);

-   visa grant number for previous travel to Australia of wife and son;

-   date of arrival to Australia and citizenship status of sponsor (DQV)

-   names, age, country of residence, marital status, sex (?) of members of family of the applicant and his wife.

-   names, domicile, age, sex marital status of family of sponsor (brother DQV), including ex-spouses.

-   personal documents (copy) such as: birth certificates, marriages certificates, copy of passport with all pages.

20. DQV also identified the following personal information of DQU and himself that he said was otherwise not reasonably necessary to be collected by the University for the purpose of its GTE assessment of DQU:

1. DQU – wedding photos and High School transcripts and Diplomas

2. DQV – personal ID of DQV, a copy of his annual salary pay slip and annual tax return.

Matters in issue

21. There are a number of preliminary matters in issue in this application. In summary, these are:

1. whether DQV was eligible to act as agent for his brother DQU in the hearing of the matter;

2. whether DQV had standing to bring this application; and

3. whether time should for DQU and DQV to bring this application, as the application was lodged outside the time prescribed for bringing an external review application under s 55(1) of the PPIP Act.

22. At the initial hearing, I made an order granting leave for DQV to act as agent for his brother, DQU. The University had contended that as DQV was a solicitor and the holder of a NSW practising certificate it was not appropriate for him to act as an agent for his brother, DQU. In response, DQU said he did not have the authority of the principal of his firm to act as the solicitor on the record in this matter. Accordingly, I granted leave for him to act as agent.

23. For the reasons that follow, I am satisfied:

1. that DQV has standing to bring this application; and

2. that time should be extended for DQU and DQV to bring this application;

24. The substantive matters in issue are those identified in DQU and DQV’s application for internal review, namely whether the conduct of the University in collecting, or seeking to collect the personal information of DQU, DQV and DQU’s wife and young son for the purpose of its GTE assessment, contravened the collection information protection principles in ss 8, 9, 10(d) and 11 of the PPIP Act.

25. For the reasons that follow, I am satisfied that, on the material before the Tribunal that the conduct of the University in collection or seeking to collect the personal information the subject of this application was not conduct that contravened the information protection principles in ss 8, 9. 10(c), or 11 of the PPIP Act.

26. While I understand DQV’s concern and frustration in being asked by the University to provide personal information relevant to the issue/grant of a student visa which falls within the responsibility of the Commonwealth and not the University, in my view, that concern and frustration appears to arise from a misunderstanding of the context in which the requests were made, in particular the role of the University as a registered ESOS higher education provider and the administrative arrangements of the Commonwealth SSVF, as they applied to the University.

The PPIP Act

27. The term ‘personal information’ is defined in s 4 of the PPIP Act. It relevantly provides as follows:

4   Definition of “personal information”

1. In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

2. Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics.

   28. There is no dispute that the University is a public sector agency for the purpose of the PPIP Act. Section 20(1) of the PPIP Act provides that the ‘information protection principles’ apply to public sector agencies. Section 21 of that Act provides that:

3. A public sector agency must not do anything, or engage in any practice, that contravenes an information protection principle applying to the agency.

4. The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies.

   29. Division 3 of Part 2 of the PPIP Act contains a number of exemptions from the need to comply with the ‘information protection principles’ set out in Division 1 of that Part. Other than the exemption in s 25, these are of no relevance to this application. In regard to s 25, I have briefly dealt with this below under the heading ‘Was the collection of the personal information directly from the individual?’

   30. The ‘information protection principles’ in Division 1 of Part 2 of the PPIP Act and prescribe the manner in which a public sector agency is to collect (ss 8, 9, 10 and 11) personal information about a person and how it is to retain (s 12), access (s 13 and 14), alter (amendment and correction) (s 15), use (ss 16 and 17) or disclose (ss 18 and 19) the personal information of a person that it holds.

   31. As I have already noted, in these proceedings, the relevant information protection principles are those set out in ss 8 to 11.

   32. Section 8 PPIP Act provides that a public sector agency can only collect personal information for a lawful purpose that is directly related to a function or activity of the agency. That section is in the following terms:

8   Collection of personal information for lawful purposes

1. A public sector agency must not collect personal information unless—

   (a)   the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and

   (b)   the collection of the information is reasonably necessary for that purpose.

1. A public sector agency must not collect personal information by any unlawful means.

   33. Section 9 of the PPIP Act provides that a public sector agency must, when collecting personal information, collect the information directly from the individual to whom it relates, unless the circumstance prescribed in that section applies. That section provides:

9   Collection of personal information directly from individual

A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless—

(a)   the individual has authorised collection of the information from someone else, or

(b)   in the case of information relating to a person who is under the age of 16 years—the information has been provided by a parent or guardian of the person.

34. Section 10 of the PPIP Act sets out what steps are to be taken by a public sector agency when it is collecting personal information. That section provides:

10   Requirements when collecting personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

(a)   the fact that the information is being collected,

(b)   the purposes for which the information is being collected,

(c)   the intended recipients of the information,

(d)   whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,

(e)   the existence of any right of access to, and correction of, the information,

(f)   the name and address of the agency that is collecting the information and the agency that is to hold the information.

35. Section 11 of the PPIP Act sets out a further step a public sector agency is to take when collecting personal information. That section provides:

11   Other requirements relating to collection of personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that:

(a)   the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and

(b)   the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.

36. Part 5 of the PPIP Act makes provision for the review of ‘conduct’ of a public sector agency, including ‘conduct’ and ‘alleged conduct’ that is a ‘contravention’ of an information protection principle that applies to that agency: PPIP Act, s 52(1)(a) and (2).

37. Section 53, in Part 5 of the PPIPA Act, gives a person who is aggrieved by the ‘conduct’ or ‘alleged conduct’ of a public sector agency the right to seek an ‘internal review’ of that conduct by the public sector agency concerned.

38. Where a person has made an application for ‘internal review’ under s 53 of the PPIP Act. Where that person is not satisfied with the findings of the public sector agency in its internal review, or the action taken by the public sector agency in relation to the internal review, s 55(1) gives that person a right to apply to the Tribunal for an administrative review under the Administrative Decisions Review Act 1997 (NSW) (ADR Act). That section is in the following terms:

55   Administrative review of conduct by Tribunal

1. If a person who has made an application for internal review under section 53 is not satisfied with—

   (a)   the findings of the review, or

   (b)   the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

39. As I have noted above, section 55(6) of the PPIP Act, provides that the Tribunal is to notify the Privacy Commissioner of any application for review lodged with the Tribunal. That section also gives the Privacy Commissioner a right to appear and be heard in any proceedings before the Tribunal.

40. Section 55(2) of the PPIP Act sets out what orders the Tribunal can make in reviewing the conduct of the public sector agency. That section relevantly provides as follows:

1. On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders—

   (a)   subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

   (b)   an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

   (c)   an order requiring the performance of an information protection principle or a privacy code of practice,

   (d)   an order requiring personal information that has been disclosed to be corrected by the public sector agency,

   (e)   an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

   (f)   an order requiring the public sector agency not to disclose personal information contained in a public register,

   (g)   such ancillary orders as the Tribunal thinks appropriate.

   41. Section 55(3) of the PPIP Act provides that nothing in s 55 limits any other powers vested in the Tribunal under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Tribunal Act 1997 (NSW) (‘NCAT Act’). This includes s 63 of the ADR Act, which h relevantly provides as follows:

63   Determination of administrative review by Tribunal

1. In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following:

   (a)   any relevant factual material,

   (b)   any applicable written or unwritten law.

2. For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.

3. In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide:

   (a)   to affirm the administratively reviewable decision, or

   (b)   to vary the administratively reviewable decision, or

   (c)   to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or

   (d)   to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal.

   42. The term ‘administratively reviewable decision’ is defined in s 7 of the ADR Act to include the ‘conduct or refusal as conduct or refusal over which the Tribunal has administrative review’.

Material before the Tribunal

43. In these proceedings, DQU and DQV relied on the material filed by DQV in support of their administrative review application and DQV’s email exchanges with the University in regard to DQU’s GTE assessment.

44. The University relied on a statement of Ingrid Ellison (Ms Ellison), dated 15 March 2019. Ms Ellison is an employee of the University. Her position is Director, UNE International. Attached to Ms Ellison’s statement are copies of the relevant policies and procedures of the University in regard to the admission of international students and the email exchanges between DQV and the University in regard to DQU’s admission application and his GTE assessment.

45. The University filed detailed written submissions for the 24 April 2019 hearing of DQU and DQV’s application. Further submissions were filed and served after that hearing and again following the short hearing on 24 January 2020.

46. In accordance with her right to be heard under s 55(6) of the PPIP Act, written submissions were also filed and served by the Privacy Commissioner, prior to the 24 April 2019 hearing.

47. DQU and DQV relied on the submissions that were submitted with their administrative review application.

Chronology of events

48. Attached to DQU’s on-line admission application to the University were his supporting documents, which included a copy of his higher education qualifications (2008 diploma) and his academic record, a certified translation of his qualifications and academic record together with his curriculum vitae.

49. As I have already noted, on 16 May 2018, the University sent a letter of offer of admission to DQU for each of the courses he had applied for. Two days later, he was sent revised letter of offer of admission for the same courses but, courses that were due to commence at a later date. Each offer of admission was conditional on DQU meeting the requirements set out in paragraph [7] above, including that he met the GTE requirements as specified by the Australian Government Home Affairs.

50. The letters of offer also contained details of what fees were payable, the requirement of compulsory health cover while studying in Australia, indicative living costs, payment options, refund options and principles, information about the ESOS Framework, Consumer Law and GE and other information about studying at the University. The following information is set out at page 5 of the letter of offer, under the ESOS Framework, Consumer Law and GE heading:

Genuine Temporary Entrant (GTE) and Financial Capacity Requirements

The Genuine Temporary Entrant (GTE) requirement is an Australian Government Home Integrity measure to ensure that the Student Visa Program is used as intended and not as a way for international students to maintain ongoing residency in Australia. The GTE criterion must be satisfied by all students who make an application for a Student Visa. To ensure that the best possible Student Visa application outcome, UNE will ask students to undergo comprehensive GTE assessment. Included in this assessment , is whether a student can demonstrate their capacity to fund their study and living costs in Australia.

…

Student Visa Applications

If you will be studying on campus at UNE on a Student Visa Subclass 500, then you will need to apply online – see for further details.

Ensure that you attach the UNE approved Statement of Purpose (SOP) to your Student Visa Application as meeting GTE requirements.

51. At page 6 of each letter of offer is the following statement in regard to ‘Personal Information and Privacy’:

UNE collects, manages, corrects and protects personal information relating to students in accordance with relevant State and Federal legislation. The personal information you provide to UNE will be used for the purpose you provided it, to assist the University in undertaking its primary purposes (outlined within the University of New England Act 1983 (NSW)) and its associated By-laws) and any secondary purposes related to the primary purposes. … UNE will not disclose your personal information without your consent unless authorised by law. …

As an international student studying at UNE on a student visa, your personal details are collected during your admission and enrolment in order to meet UNE’s obligations under the ESOS Framework and to ensure that you comply with the conditions of your Student Visa. The authority to collect this information is contained in the ESOS Framework.

52. At the end of May 2018, DQU provided the University with a copy of his passport and that of his wife and his son. He also provided a copy of the following completed pro-forma forms:

1. a Statement of Purpose (SOP), Genuine Student (GS) and Genuine Temporary Entrant (GTE) Profile Form (‘Statement of Purpose (SOP) Form’);

2. a Generic GTE Financial Capacity Matrix Form;

3. a Financial Sponsorship Declaration Form completed by DQV;

4. Details of Applicant’s (DQU) Family Unit Form; and

5. Details of Applicant’s Financial Sponsor’s (DQV) Family Unit Form.

53. On 29 May 2018, Ms Samara Rogers (Ms Rogers), Senior Admissions Officer of the University, sent an email to DQV in which she said:

The GTE Forms and SOP are almost illegible can you please complete these again in printing handwriting so that they can be read. Please provide all of the requested supporting documents in the attached GTE Forms including the Financial Matrix and Family Details Forms. All forms must be completed (Legibly) and returned, so that we can commence GTE Assessment.

54. The GTE Forms that were attached to Ms Roger’s email were a further blank copy of the Forms that had been completed and provided by DQU and DQV. Also included in the attached GTE Forms was a 10 page ‘International Student Application for GTE Assessment’ Form, with the logo of the University at the top of the front page (‘UNE GTE Assessment Form’). Also stated at the top of the front page of the Form was the following:

The information you provide in this application will assist the University of New England to determine that you meet Genuine Student (GS), Genuine Temporary Entry (GTE) and financial capacity requirements.

55. Two days later (1 June 2018), DQV sent an email to Ms Rogers to which he attached the following documents:

1. two bank statements of DQU;

2. a completed UNE GTE Assessment Form;

3. a further copy of:

1. DQV’s Family Unit Form;

2. DQU’s Family Unit Form;

3. DQV’s Financial Sponsorship Declaration Form;

4. DQU’s Generic GTE Financial Capacity Matrix Form;

5. Statement of Purpose (SOP) Form; and

4. a bank statement of DQV.

56. On 5 June 2018, Julie-Anne Johnson (Ms Johnson), UNE International Admissions, sent an email to DQV in which she said that the University required:

…[the following] additional documents to assess this application: (please also refer to the attached checklist)

•   Completed SOP – GS & GTE profile – All sections must be completed in handwriting with no missing sections and none crossed out or answered with “NA” or Not Applicable. Even if a section is not relevant to an applicant, they should say so using a full, grammatically correct sentence. Ensuring to address each question precisely within the specified space, … The SOP is a crucial document that once approved by UNE, must be submitted with any subsequent student visa application as evidence of GTE. As such it will be seen by a Home Affairs case officer. It should look the best it can be and it should read as well as the English of the applicant permits.

•   Notarised copies of ENTIRE Passport of all visa applications (including wife and child) – (each passport scanned as one document, showing all pages in numerical order)

57. Early in the morning of 12 June 2018, DQV sent an email to UNE International Admissions. Attached to the email was a further copy of DQU’s SOP, GS and GTE Form. The University responded acknowledging receipt of DQV’s email. In its response, the University said the Statement of Purpose (SOP) Form submitted by DQV was very hard to read and needed to be resubmitted. The University also reiterated what had been said in the earlier email of 5 June 2018.

58. Later that day, DQV sent an email to the University, to which he attached a further copy of the passport of DQU’s son. Shortly thereafter, DQV sent another email in which he requested the contact details of Ms Johnson’s supervisor as he wanted to discuss with her the ‘migration assessment’ because he found the University’s demands for ‘some kind of phrases’ difficult to follow.

59. The following day (13 June 2018), Amanda Lang (Mrs Lang), UNE International Admissions Officer, sent an email to DQV in which she said that ‘the statement of purpose and passport copies supplied thus far are not of a standard that is acceptable to immigration for visa application purposes’. Mrs Lang reiterated why the submitted SOP was not acceptable. She went on to say:

All passport copies must be clear and easy to read. They must be notarised or certified copies. All pages must submitted in order.

We do not believe that these are particularly onerous or confusing instructions. …

60. DQV responded to this email as follows:

Thank you for the explanations.

Please proceed assessment with available data, if you need any further information, you can ask specifically.

So far as I and aware, there are no provisions in Migration Act, Regulations or PALM in regards to “NA” handwriting format of statement etc. if you will update me about it, we will follow it.

At this point of time, I cannot consider all this requirements rather than administrative sophisticated games.

Ps. Initial statement was redone already, only concern was using NA. That was fixed by adding explanatory part.

PPS. Certified copies of document will be provided to DHA

…

61. On the following day (14 June 2018), Ms Johnson sent an email to DQV in which she advised that, on the information provided, DQU did not meet GTE and financial evidence requirements for admission to the University. Ms Johnson went on to say that the University was not able to provide DQU with an offer ‘without the condition of further GTE screening and so is not able to assist further with admission to on-campus study at UNE’. DQV immediately responded to this email seeking the reasons for this adverse decision.

62. Mrs Lang, on behalf of the University, responded shortly thereafter. She said that the following factors lead to the negative GTE:

1. failure to provide clear notarised copies of the entire passport of each individual on the visa application;

2. failure to provide an acceptable Statement of Purpose (SOP) Form that was neatly handwritten with all questions answered; and

3. failure to provide any evidence of marital status of DQU such as marriage certificate and photos.

63. Ms Lang ended her email by saying:

As part of the pre-visa assessment, all of these documents are essential as they can all be required by DHA as part of the student visa application. This is considered high risk and expected close scrutiny by Immigration, due to several factors including having onshore close family, changing from [DQU’s profession] to [another profession], low English proficiency, applying for a course that leads to [the other professional] status and limited incentive to return home after course.

64. In response to this email, DQV asked to be provided with the formal record of decision so that they can appeal. Mrs Lang responded and advised that the Manager Admissions (who was then Acting Director International) would review the decision and that the Manager’s decision was final.

65. Later that evening, DQV sent another email to the University in which he included a typed version of what had been hand written in the SOP, GS and GTE Form. In this regard, he said that Ministerial Direction 69 contained no reference to a requirement that this Form had to be handwritten. Mrs Lang responded the next morning to say that the fact he had typed the responses did not meet the requirements.

66. On 28 June 2018, Samara Rogers (Ms Rogers), UNE Senior Admissions Officer sent an email to DQU to inform him of her determination following her review of DQV’s application. In her response she said:

… [We] are certainly prepared to reopen your GTE case and continue reviewing and assessing this in accordance with the University written policy on GTE assessment of all International Students however until we have received the outstanding requested supporting documentation we are unable to continue assessing this GTE application and without this documentation which has been requested the case would have to be finalised as a negative outcome. Please provide the requested documentation which is crucial to the Universities GTE assessment policy. …

You have referred to the Department of Immigration and Border Protections Direction Number 69 - which refers to Assessing the Genuine Temporary Entrant criteria for student visa and student guardian visa applications; however please note that this policy is immigrations (sic) policy and all Australian Universities have their own policies separate to this outlining how they go about assessing GTE applicants; therefore the UNE policy on assessing GTE is separate to the policy of DIBP and you should be careful not to confuse the two. Whilst the UNE policy is built around the guidelines of the DIBP ministerial directive 69; UNE has its own guidelines to which we must adhere with the aim of ensuring that UNE applicants have the greatest chance of success at student visa stage.

If you wish for UNE International to reopen this GTE assessment please send through the requested documents and we will continue with the UNE GTE Assessment Process in accordance with UNE policy on GTE Assessment.

67. That evening, DQV sent an email to Ms Elliston seeking confirmation that the decision of Ms Rogers was a final decision in regard to his application for review. Ms Elliston responded to DQV’s email on 3 July 2018. In her response, Ms Elliston noted that the University did have published procedures relating to GTE assessments on the University’s website. She noted that DQU had already had his admission assessed and it was on that basis that he was given a conditional offer. She said that under the University’s international postgraduate admission procedures, the University could ask students to undergo further GTE/financial capacity assessment after having their English and academic qualifications assessed against course requirements. She concluded by saying that if DQU was able to provide the GTE-related documentation that the University needed to fully assess his case, then the University was very happy to progress his admission.

68. DQV responded to Ms Ellis’ email later that evening. He said he had not been able to find any mention in the procedures for statements to be handwritten. He said he only saw reference being made to Direction 69 which he said appeared to assume statements would be typed. He also said most education providers required forms to be filled in on line. He said that he and DQU could provide copies of the missing pages of the passport and they were also happy to print, but not handwrite, and sign a Statement of Purpose (SOP) Form.

69. On 19 July 2018, Ms Johnson, sent an email to DQV setting out the additional material the University assessor had requested for DQU’s GTE assessment. This included the following:

-   … [formal] marriage ceremony photographs covering the actual marriage rituals and both bride and groom together with both set of parents and/or other family members

-   …

-   Applicant and his spouse’s handwritten letter describing their travel history details …

-   … the Birth Certificate of his son

-   Certified copy of applicant’s [professional] Certificate of Registration

-   Certified copy of applicant’s Year 10 and Year 12 equiv. education qualification … as stated in the applicant’s CV

-   Further verification of Work Experience Claim required … we strongly recommend that he supplies additional evidence as proof of his employment claim, such as formal appointment letter, a reference letter from his seniors, salary slips and bank statements …

-   … copy of passport of his brother, [DQV] along with his current visa copy

-   …

-   Applicant’s brother [DQV] must supply evidence of his annual salary income, such as his Certificate of Employment, bank statements where salary is deposited, Payslips etc, which has been included in this visa application along with evidence of Tax payment

-   …

-   Completed GTE Financial Matrix …

-   Improved Presentation of the Applicant’s SOP -GTE Profile …

70. On 15 August 2019, DQV sent an email to the University in which he responded to each of the matters raised in Ms Johnsons’ email of 19 July 2018. In that response DQV said the following:

1. a copy of his brother’s marriage certificate was attached, but a wedding photo was not available, and ‘probably, this request is in excess of scope assessment. This is not a visa application’;

2. a handwritten letter of the travel history of his brother and his wife was ‘not reasonable, relevant or convenient’ and a typed record was provided instead;

3. a copy of the birth certificate of DQU’s son was attached, as was a certified copy of DQU’s professional certificate of registration and a reference letter from his seniors;

4. some additional financial information of the applicant and DQV was provided;

5. in regard to the request that a copy of DQV’s passport and visa be provided, DQV said: ‘[DQV] is a citizen, DHA should be aware of this fact. Provision of such documents to third unknown parties is unsafe. NSW Privacy Commissioner should be notified of such demand’; and

6. the demand for a hand writing was unreasonable and would be discussed with the NSW Privacy Commissioner or Commonwealth Authority – ‘Please rely on information provided previously in typed and hand-written form.’

71. On 28 August 2018, the University sent DQV an email to advise him that the GTE assessment of his brother had been finalised with a negative outcome. The University said that DQU’s case presented a high level of risk that the Commonwealth Department of Home Affairs would reject his student visa application because, he needed to undertake a 30 week English language course before commencing his main course, his change (i.e. downgrading) in his current discipline and career path, and his close family ties to Australia.

Does DQV have standing to bring this application?

72. It is convenient to first deal with the issue of whether DQV has standing to bring this application. The University contends that he has no standing because he does not fall within the terms of being an ‘interested person’, as required under s 55(1) of the ADR Act.

73. As noted above, s 55(1) of the PPIP Act makes provision for applications for administrative review to be made under the ADR Act. Section 55 of the ADR Act prescribes who is entitled to make an application for administrative review under that Act and how and when such an application is to be made. Section 55(1) of the ADR Act provides that an application for administrative review can only be made by an ‘interested person’, which is defined in s 4(1) of that Act to mean:

… [a] person who is entitled under enabling legislation to make an application to the Tribunal for an administrative review under this Act of an administratively reviewable decision.

74. The term ‘enabling legislation’ is defined in s 4(1) of the ADR Act to mean legislation, other than the ADR Act, that provides for applications to be made to the Tribunal for administrative review. The term ‘an administratively reviewable decision’ is defined in s 7 of the ADR Act to include the conduct of an administrator over which the Tribunal has administrative review jurisdiction. As noted above, s 55(1) of the PPIP Act satisfies both requirements in that it makes provision for applications to be made to the Tribunal for administrative review of an administratively reviewable decision (i.e. administratively reviewable conduct).

75. However, that right only applies to persons who made an application for internal review under s 53 of the PPIP Act and that person is aggrieved in the terms prescribed in s 55(1)(a) and/or (b) of the PPIP Act.

76. It is the contention of the University that the only person who sought internal review under s 53 of the PPIP Act was DQU. Hence, only he has a right to seek external review by the Tribunal.

77. A copy of the internal review application was attached to the University’s Outline of submissions. The application was made on a pro-forma IPC internal review form (IPC form) and it is not disputed that it was completed and lodged by DQV.

78. In section 2 of the IPC form, against the words ‘Your full name’ the following has been inserted: ‘[full name of DQV] for himself and on behalf of [full name of DQU]’. In section 4 of the IPC form, the following was inserted: ‘complaint is made on behalf of myself and my brother who I represented in his admission process at UNE’.

79. On this basis, I am satisfied that the application for internal review, made by DQV, was made on his behalf and that of DQU in that they each sought review of the conduct of the University in collecting the personal information relating to themselves and their respective families. That is, the internal review application was an application made by DQV and DQU in which they each sought review of the conduct of the University in regard to the collection of their respective personal information.

80. In response to orders made by the Tribunal on 20 January 2019, DQV identified the following as his personal information that was the subject of the internal review application and this application:

Details of family unit, including divorced wife, parents

My residential address;

My residential status and date of it obtaining;

My employment details

81. For the reasons set out above, I am satisfied that DQV is an ‘interested person’ as prescribed in s 55(1) of the ADR Act and has standing to bring this application in so far as it relates to his personal information that was collected or sought to be collected from him, by the University, in the course of its assessment of DQU’s GTE assessment.

Should time be extended?

82. Section 40 of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act) provides that an application to the Tribunal is to be made in the time and manner prescribed by the ‘enabling legislation’ or the ‘procedural rules’. The term ‘enabling legislation’ is defined in s 4 of the NCAT Act and the term ‘procedural rules’ is also defined in s 4 to mean the Tribunal Rules, made by the Rule Committee under s 25 of the NCAT Act.

83. In this case the ‘enabling legislation’ is the PPIP Act, in particular s 55 which makes provision for administrative review, by the Tribunal, of conduct of a public sector agency that is alleged to have contravened an information protection principle under that Act. While s 55(1) of the PPIP Act makes provision for administrative review, that section does not prescribe any time period within which an application for administrative review is to be made.

84. Hence, the applicable provision is rule 24 of the Civil and Administrative Tribunal Rules 2014 (NSW) (NCAT Rules), which relevantly provides as follows:

24   Administrative review applications

1. …

2. …

3. Unless the Tribunal grants an extension under section 41 of the Act, an application must be made—

   (a)   in the case where enabling legislation specifies the period within which the application is to be made—within the period specified, or

   (b)   in any other case—by the end of the default application period.

4. The default application period for the purposes of subrule (3)(b) is—

   (a)   …

   (a1) in the case of an administrative review application under section 55 of the Privacy and Personal Information Protection Act 1998—the period of 28 days after—

   (i)   if an internal review under section 53 of that Act is completed within 60 days from the day on which the application for the internal review was received by the public sector agency concerned—the day on which the applicant was notified of the result of the internal review, or

   (ii)   if an internal review under section 53 of that Act is not complete

   85. As the University had completed the internal review application of DQU and DQV within 60 days, the default application period in rule 24(4)(1a)(i) of the NCAT Rules applied. That is, the external review application of DQU and DQV was to be with the Tribunal within 28 days after the day on which they were notified of the internal review outcome of their application under s 53(1) of the PPIP Act.

   86. There is no dispute that DQU and DQV lodged this application outside of this prescribed time. On my calculations, they lodged their application nine days out of time.

   87. Section 41 of the NCAT Act gives the Tribunal the discretion to extend time. The principles to be applied in exercising this discretion were considered by the Appeal Panel in Jackson v NSW Land and Housing Corporation [2014] NSWCATAP 22, at [22], and include the following:

   1. the length of the delay;

   2. the reason for the delay;

   3. the appellant's (applicant’s) prospects of success, that is usually whether the appellant (applicant) has a fairly arguable case; and

   4. the extent of any prejudice suffered by the respondent.

   88. These principles have been widely applied by the Tribunal in the exercise of its discretion in s 41 of the NCAT Act, including in administrative review proceedings commenced in the Tribunal: CFZ v Department of Education [2015] NSWCATAD 231, at [8].

   89. In this case, the delay in DQU and DQV lodging their administrative review application was not lengthy. I also accept DQV’s explanation that he was travelling overseas at the time and that the delay was due to the need for him to make arrangements for someone located within New South Wales to actually lodge their application with the Tribunal, as at that time there was no provision for lodging an application with the Tribunal on line.

   90. In this case, the University acknowledged that it suffered no prejudice if time were extended within which DQU and DQV were to lodge their appeal.

   91. It is accepted that the appropriate test for applications to the Tribunal seeking administrative review is whether the application has merit, rather than the prospects of the applicant succeeding in his/her application. This is because, as a general rule, in applications for administrative review, neither party bears an onus of proof in establishing that the administratively reviewable ‘decision’ was, or was not, ‘the correct and preferable’ ‘decision’: see ADR Act, s 63 and Minister for Immigration and Multicultural and Indigenous Affairs v QAAH of 2004 [2006] HCA 53; (2006) 231 CLR 1 at [39]–[40].

   92. As noted above, under the terms of the ADR Act, an ‘administratively reviewable decision’ includes ‘conduct of an administrator’. In this case, there is no dispute that the conduct of the University in collecting the personal information of DQU, DQV and DQU’s wife and son is conduct falling within the terms of the PPIP Act and is reviewable by the Tribunal.

   93. As s 55(1) of the PPIP Act gives DQU and DQV a right to seek review of the conduct of the University it is difficult to see how their application lacks merit, especially where the only matter in issue is whether the conduct of the University, which is not disputed, contravened the collection information protection principles in the PPIP Act.

   94. In my opinion, on the basis of the abovementioned findings it is appropriate to extend time within which DQU and DQV are to bring their application to 29 November 2018. That is, I am satisfied on the material before the Tribunal that the delay in bringing this application is not substantial, the reasons for that delay have been satisfactorily explained, it cannot be said that the application lacks merit and an extension of time would not prejudice the University.

Review of the conduct of the University

Was the collection of the personal information for lawful purposes?

95. In ALZ v SafeWork NSW [2017] NSWCATAP 51, the Appeal Panel considered the meaning of the term ‘lawful purpose’ in the context of s 8(1) of the PPIP Act. At [82] the Appeal Panel said:

1. The Privacy legislation strikes a balance between the rights of individuals to privacy and the need for agencies to carry out their legitimate functions efficiently and effectively. In the case of s 8(1) of the PPIP Act and HPP 1, that balance is struck by requiring agencies to collect information for what we will refer to as a “permissible purpose”. The purpose will be permissible if it has three elements: it must be lawful; it must be directly related to a function or activity of the organisation; and it must be reasonable necessary for that purpose. …

   96. In DO v University of NSW [2003] NSWADTAP 9, the Appeal Panel of the former Administrative Decisions Tribunal found that the collection of academic history information in relation to students applying for admission to courses was done for a lawful purpose directly relating to the educational functions of the university. At [16], the Appeal Panel said:

2. Clearly the collection of academic history information in relation to persons applying for admission to courses is done for a lawful purpose directly relating to the educational functions of a university. Universities must engage in processes of assessment to satisfy themselves that candidates for admission are qualified and reasonably capable of undertaking courses. Having passed that threshold, universities must then make (often hard) decisions about who among the candidates will be offered places and be the subject of the commitment of resources. In this instance there was also an additional application, for a Ph D scholarship ($22,000 tax-free per annum), which was successful. …

   97. In this case, the University contends that, having regard to the context in which the information in issue was collected, it was collected for a lawful purpose that is directly related to a function of the University and the collection of the information was reasonably necessary for that purpose. As I have already noted, the context in which the University collected the information included:

   1. the role of the University as a registered higher education provider under the ESOS Act to provide courses of study to overseas students; and

   2. the University’s election to participate in the Commonwealth’s SSVF, which authorised the University to undertake a pre-visa assessment of prospective overseas students so as to minimise the immigration risk where an offer of admission is made and the student subsequently fails to be granted a student visa by the Commonwealth.

   98. While DQU and DQV accept that the University is permitted to undertake a pre-visa assessment of prospective overseas students, it is their contention that the information in issue went well beyond what is required as a pre-visa assessment. In this regard DQV noted that it was the student who made the application to the Commonwealth for a visa and not the University. Hence, it was the Commonwealth who had the authority to collect relevant personal information from the student applicant and not the University.

Consideration

UNE Act

99. The starting point is the University of New England Act 1993 (NSW) (‘UNE Act’). Section 6 sets out the objects and functions of the University as follows:

6   Object and functions of University

1. The object of the University is the promotion, within the limits of the University’s resources, of scholarship, research, free inquiry, the interaction of research and teaching, and academic excellence.

2. The University has the following principal functions for the promotion of its object:

   (a)   the provision of facilities for education and research of university standard,

   (b)   …,

   (c)   the provision of courses of study or instruction across a range of fields, and the carrying out of research, to meet the needs of the community,

   (d)   …

   …,

   (f)   the provision of teaching and learning that engage with advanced knowledge and inquiry,

   (g)   the development of governance, procedural rules, admission policies, financial arrangements and quality assurance processes that are underpinned by the values and goals referred to in the functions set out in this subsection, and that are sufficient to ensure the integrity of the University’s academic programs.

3. The University has other functions as follows:

   …

   (c)   the University has such general and ancillary functions as may be necessary or convenient for enabling or assisting the University to promote the object and interests of the University, or as may complement or be incidental to the promotion of the object and interests of the University,

   (d)   the University has such other functions as are conferred or imposed on it by or under this or any other Act.

1. The functions of the University may be exercised within or outside the State, including outside Australia.

   100. There is no dispute that the provision of higher education courses and the development of admission policies falls within s 6(2)(c) and (g) of the UNE Act. In my opinion, this would include the provisions of higher education courses to potential overseas students and the development of admission policies for such students.

ESOS Act and the National Code

101. However, s 8 of the Commonwealth ESOS Act prohibits a person from providing, offering to provide or holding itself out as able to provide, a course of education or training to an overseas student, at a location, unless that person is registered to provide that course at that particular location.

102. As noted in the introduction, the University is registered, under the ESOS Act, to provide, offer to provide and to hold itself out as able to provide higher education courses to overseas students.

103. The object of the ESOS Act is as follows:

4A Objects

The principal objects of this Act are: 

(a)   to provide tuition assurance, and refunds, for overseas students for courses for which they have paid; and 

(b)   to protect and enhance Australia's reputation for quality education and training services; and 

(c)   to complement Australia's migration laws by ensuring providers collect and report information relevant to the administration of the law relating to student visas.

104. As a registered provider under that ESOS Act, the University met and is required to continue to meet the requirements set out in s 11 of that Act, which includes complying with the Act and the ‘national code’.

105. Part 4 of the ESOS Act makes provision for the Minister to make a ‘national code’ that is to be called the ‘National Code of Practice for Providers of Education and Training of Overseas Students’ (‘National Code’): ESOS Act, s 33. The purpose of the National Code is to provide nationally consistent standards and procedures for registered providers and those who deliver educational services on behalf of the registered providers: ESOS Act, s 34.

106. The National Code commenced on 1 January 2018 and sets out eleven standards that a registered provider is required to meet. These are fairly prescriptive as to what information and policies a registered provider is required to provide and have in place for prospective and existing overseas students. Standard 1 relates to marketing information and practices of registered providers, standard 2 relates to the recruitment of overseas students and requires registered providers to recruit responsibly and ensure that overseas students are appropriately qualified for the course they are seeking to enrol in and that they have the necessary English language proficiency. These standards make no mention of a registered ESOS Act entity having a pre-visa assessment role of prospective overseas students seeking admission to undertake a course being offered by the entity.

107. Standard 3 makes provision for the formalisation of enrolments and written agreements with overseas students and prospective overseas students. The standard requires the agreements to be in plain English and sets out what additional matters are to be included in the agreements. This includes:

3.3.6   set out the circumstances in which personal information about the student may be disclosed by the registered provider, the Commonwealth including the TPS [i.e. a Tuition Protection Service], or state or territory agencies, in accordance with the Privacy Act 1988

3.3.7   outline the registered provider’s internal and external complaints and appeals processes, in accordance with Standard 10 (Complaints and appeals)

108. In this case, at no time did the University formalise DQU’s enrolment. Hence, I am satisfied that standard 3.3.6 and 3.3.7 does not apply to the information in issue in this application.

109. Standard 8 relates to overseas student visa requirements. These requirements apply where a registered higher education provider has made a formal offer of admission to an overseas student and the student is the holder of student visa and commenced his or her course of study in Australia. The standards include mechanisms for monitoring of overseas student progress and attendance and course duration and the reporting unsatisfactory course progress or unsatisfactory course attendance. However, this standard is of no application to prospective overseas students who have not been formally enrolled to undertake a course of study in Australia.

110. The remaining standards are also of no relevance to this application.

SSVF

111. In its published ‘Postgraduate Admission for International Students – Operating Procedures’, at Item 4, the University notes that it is a participant in the SSVF and describes its obligations under that Framework as follows:

UNE is required to ensure that all international students applying for a Student Visa under SSVF have the greatest chance of a successful visa grant. International applicants for a post graduate program that present with a high risk Student Visa Profile must undergo additional assessment to determine they meet Ministerial Direction 69 – Genuine Temporary Entrant (GTE) and … Where an applicant meets academic and English language requirements but has a high risk Student Visa Profile, they will be issued with an Offer of Admission conditional upon undergoing additional GTE assessment. …

112. The purpose of the SSVF was to make the process for applying for a student visa simpler to navigate for ‘genuine students’ to ‘reduce red tape to business’ and to deliver a more targeted approach to immigration integrity. It was also designed to ‘provide an incentive for all education providers to recruit genuine international students.’

113. The incentive offered to ESOS Act registered entities, who elected to be part of the SSVF, was the streamlining of student visa applications of overseas students to whom the entity had made a formal offer of admission. A more streamlined process for dealing with student visa applications enabled ESOS Act registered entities to better manage the risk of courses they had offered to overseas students not being undersubscribed because a large proportion of those to whom offers had been made did not subsequently succeed in being granted a student visa to overseas students. Under the standard procedures of the Commonwealth for the issue of a student visa this could take several months. As noted in the statement of Ingrid Elliston, under the SSVF, the University is able to have the student visa applications of its prospective overseas students streamlined so that they are able to convert offers of enrolment to actual enrolments in the shortest possible timeframe.

114. Student visa application are streamlined by the Commonwealth Department of Home Affairs in accordance with the immigration risk rating it gives to the registered ESOS entity that has elected to be part of the SSVF. Immigration risk ratings of these entities is determined annually, by the Department of Home Affairs. It is determined on the basis of the number of international students the entity has offered enrolment to during the previous 12 months and the number of those students who are ultimately successful in their application for a student visa.

115. The immigration risk ratings are numbered one, two or three, with one being the highest or most favourable rating. The better the immigration risk rating the more streamlined the student visa application process is for the prospective international student. In this case, the University has a rating of one.

116. Having elected to participate in the SSVF, the University created its own proforma GTE forms based on the requirements of the Commonwealth Department of Home Affairs for the issue of a student visa. Included in these forms were those that were sent to DQU and DQV following the May 2018 letters of offer of admission that were conditional on the matters set out at [7] above. These proforma forms created by the University included Statement of Purpose (SOP) Form, which, as noted at [50] above, was the Form the overseas student was required to submit with their application to the Commonwealth Department of Home Affairs for a student visa, in the event the University was satisfied that the prospective student was a genuine student and a genuine temporary entrant and a formal offer of admission was made.

117. It is my understanding that under the SSVF, it is the submission of the Statement of Purpose (SOP) Form by a prospective overseas student of an ESOS registered entity that facilitates a more streamlined student visa process by the Commonwealth. While it remains for the Commonwealth to decide whether a prospective overseas student does or does not meet the requirements for the grant of a student visa, an ESOS registered entity Statement of Purpose (SOP) Form submitted by a prospective overseas student is an indicator, subject to the applicable immigration rating, that the ESOS registered entity is satisfied (from its own inquiries during its admission processes) that the prospective student is a genuine student and meets the genuine temporary entrant and financial requirements.

118. The evidence is that the University has engaged a third party, with the necessary expertise, in progressing overseas student admissions including pre-visa assessments: statement of Ingrid Elliston, at [5].

Finding

119. On the information before the Tribunal and for the reasons set out above, I am satisfied that the SSVF authorises the University to undertake, as part of its admission processes for overseas students, a pre–student visa assessment of prospective overseas students so as to minimise its immigration risk that the courses for which has offered admission and enrolment is not undersubscribed.

120. I am also satisfied that the collection of personal information from a prospective overseas student for the purpose of a pre-visa assessment by the University is for a lawful purpose that is directly related to the functions of University as set out in s 6(2)(c) and (g) of the UNE Act.

121. Based on the requirements of Migration Regulations (see below), I make a similar finding in regard to the collection of the personal information about the family members and sponsor of the prospective overseas student.

Was the collection of the information reasonably necessary for that purpose?

122. As the aim of a pre-visa assessment is to ensure that a prospective overseas student, to whom and offer of admission is made, has the best chance of being granted a student visa by the Commonwealth, it is necessary to briefly set out:

1. the requirements that need to be satisfied for the grant of a student visa under cl 500 of Sch 2 of the Migration Regulations (Cth);

2. the relevant directions, in Direction Number 69 that was made by the former Commonwealth Minister for Immigration and Border Protection, under s 499 of the Migration Act 1958 (Cth) and

3. the Commonwealth student visa application Documentary Checklist Tool.

Migration Regulations (Cth) – subclass 500 – student visa

123. Clause 500.2 of Sch 2 of the Migration Regulations 1994 sets out the primary criteria that must be satisfied by an overseas student applicant at the time a decision is made to grant the application for a student visa. These criteria include the requirement that an applicant for a student visa is enrolled in a course of study (cl 500.211(a)) and the applicant is a genuine applicant for the entry and stay as a student because he or she satisfies the remaining requirements set out in cl 500.212 to 500.218. Clause 500.212 is a requirement that the applicant for a student visa intends to stay in Australia temporarily:

(a)   the applicant intends genuinely to stay in Australia temporarily, having regard to: 

(i)   the applicant's circumstances; and 

(ii)   the applicant's immigration history; and 

(iii)   if the applicant is a minor--the intentions of a parent, legal guardian or spouse of the applicant; and 

(iv)   any other relevant matter; and 

(b)   the applicant intends to comply with any conditions subject to which the visa is granted, having regard to: 

(i)   the applicant's record of compliance with any condition of a visa previously held by the applicant (if any); and 

(ii)   the applicant's stated intention to comply with any conditions to which the visa may be subject; and 

(c)   of any other relevant matter

124. Clause 500.213 makes provision for evidence of English language proficiency. Clause 500.214 is a requirement that an applicant for a student visa have sufficient available funds to meet his or her costs and expenses during his or her intended stay in Australia together with the costs and expenses of each member of the applicant’s family (if any) who will also be in Australia.

125. Where an overseas student also wishes to bring a member of his or her family to Australia while he or she is studying in Australia these family members must also obtain a student visa. The criteria or requirements that must be satisfied for the issue of a student visa to family members is set out in cl 500.3 of Sch 2 of the Migration Regulation, which includes requirements that are identical to those in cl 500.212 and 500.214.

Direction Number 69

126. The stated purpose of Direction Number 69 is to provide guidance to decision makers on the factors that require consideration when assessing the requirements of cl 500.212(a) (in particular the applicant’s circumstances) to determine whether an applicant for a student visa genuinely intends to stay in Australia temporarily. The factors specified in the Direction are, however, not to be seen as a checklist.

127. The factors that are specified in the Directions are very broad in nature and relate to the following matters:

1. an applicant’s circumstances;

2. an applicant’s circumstances in his or her home country;

3. an applicant’s potential circumstances in Australia;

4. the value of the course of study in Australia will have on the applicant’s future; and

5. the applicant’s immigration history.

128. It is unnecessary to set out the factors applicable to each of the abovementioned matters, other than to note that they are comprehensive and require a value judgement to be made, based on the material that is before the decision maker as to whether a student visa is or is not to be granted. It is not the role of the Tribunal to undertake this task. However, the factors identified in the Directions is a guide as to the nature of the personal information that is reasonably necessary to be collected by the University for the purpose of its pre-visa assessment of potential overseas students to whom an offer of admission is to be made.

129. The Directions also make provisions for:

1. decision makers to request additional information and/or further evidence from an applicant to demonstrate that he or she is a genuine temporary entrant, where closer scrutiny of the applicant’s circumstances may be considered appropriate. An example given of such circumstances is where the applicant intends to study in a field unrelated to their previous studies or employment; and

2. other relevant matter (i.e. factor), be it beneficial or unfavourable to the applicant, to be taken into account in determining whether an applicant for a student visa genuinely intends to stay in Australia temporarily.

Cth Documentary Checklist Tool

130. Attached, at IE35, to Ingrid Elliston’s statement is a copy of the Commonwealth Document Checklist Tool for a Russian passport holder applying for a student visa at the University. In her statement, Ms Elliston explained that the Document Checklist Tool is published on the website of the Commonwealth Department of Home Affairs and shows prospective overseas students what documents they may have to show the Department when applying for a student visa. This will vary depending on the citizenship of the overseas student and the ESOS registered education provider who has given the student a formal offer of admission. In this case, the Commonwealth Document Checklist Tool for DQU, with a formal offer of admission from the University includes the following:

• Evidence of identity – copy of passport – certified copy of birth certificate

• Proof of employment – including payslips or a contract

• Qualifications – certified copy of academic transcripts

• Evidence of relationship with spouse/de facto partner – certified copy of marriage certificate, Family Book, Household Booklet or other evidence of family composition

Consideration

131. In their internal review application DQU and DQV asserted that Ms Johnson’s conduct, in requesting DQU provide certified copies of his year 10 and year 12 equivalent education qualifications was not reasonably necessary for the purpose of the University’s pre-visa assessment. This request was made by Ms Johnson, in her email sent to DQV on 19 July 2018.

132. In its internal review, the University said that its third party GTE assessor had confirmed that ‘Year 10 and Year 12 mark sheets/official transcripts/award certificates’ were sought in order to ensure that each qualification that a prospective student applicant holds has been legitimately obtained. It was noted that in most countries Year 10 and Year 12 qualifications were the least likely of all qualifications to be obtained fraudulently. Hence, for the purpose of its GTE assessment copies of a prospective overseas student’s mark sheets, official transcripts or certificates for these years were required so as to confirm the legitimacy of the student’s latter qualifications. The internal review noted that if the prospective overseas student subsequently submitted a fraudulent document of qualification in their student visa application to the Department of Home Affairs this would jeopardise the University’s immigration risk rating as it would carry a 40% weighting in the calculation of the University’s risk rating that year.

133. DQU and DQV assert that information of this kind should not be necessary where the prospective overseas student is able to provide a copy of his or her higher education qualifications. I understand that this assertion was made purely on the basis that the enquiries of the University were preliminary. That is, had the request been made by the Department of Home Affairs a copy of the information would have been provided. Nevertheless, that is not what is in issue in this application. What is in issue is whether the information of the kind that has been collected, or sought to be collected by the University is reasonably necessary for the purpose of its pre-visa assessment.

134. In ALZ v WorkCover NSW [2015] NSWCATAP 138, the Appeal Panel considered the meaning of ‘reasonably necessary for that purpose’ in the context of the collection health privacy principle 1(1)(b) in the Health Records Information Privacy Act 2002 (NSW). At [51], the Appeal Panel said:

1. What may be seen as ‘reasonably necessary’ falls towards the higher end of a continuum that might be seen as having ‘of some relevance’ at one end and ‘essential’ at the other end.  …

   135. The Appeal Panel went on to note that it is not enough merely for the agency to make a self-serving assertion that the conduct is necessary. Its explanation must be appraised in an objective way.

Finding

136. In my opinion, having regard to the requirements of cl 500.212 of Sch 2 of the Migration Regulations and the factors set out in Direction 69, the collection of personal information of kind complained about by DQU, is reasonably necessary for the purpose of the University’s pre-visa assessments as it clearly forms an important milestone in the education history of a prospective student, especially where that student has undertaken higher studies in a country other than Australia.

137. In my opinion, , as outlined in Direction 69, the remaining personal information in issue of DQU and his wife and son relate to and are relevant to their respective personal circumstances (including photographs of their wedding and certified copies of their passports) and their education, employment and immigration history. As I have already noted, the reason why the personal information of DQU’s wife and child are relevant is because they also needed to apply for and be granted a student visa by the Commonwealth.

136. In regard to the requirement that DQU complete the Statement of Purpose (SOP) in his own handwriting, I accept that a document in DQU’s handwriting is the personal information of DQU. While the Migration Regulations nor Direction 69 make reference to this being a requirement, I accept that a document written in the handwriting of a prospective overseas student can be an important factor towards determining whether that student’s application for a student visa is genuine. Hence, I am satisfied that the collection of personal information of this kind is reasonably necessary for the purpose of the University assessing, in its admission processes, whether DQU is a genuine student and a genuine temporary entrant. I note, DQU was not singled out in being required to complete the Statement of Purpose Form (SOP), as the University’s pro-forma form expressly states that it is to be completed in the handwriting of the prospective overseas student.

137. I make a similar finding in regard to the request of the University that DQU and his wife provide a handwritten letter describing their travel history.

138. I make a similar finding in regard to:

1. the personal information of DQV as he is the nominated sponsor and an immediate family member of DQU living in Australia. Information such as DQV’s annual salary and annual tax return are relevant to his role of sponsor of DQU and it is not information that is available to the University, and

2. the personal information about the name, age, place of residence and marital status of relatives and ex-spouses of DQU and DQV.

Conclusion

141. For the reasons set out above, I find that the conduct of the University in seeking to collect certified copies of DQU’s year 10 and year 12 equivalent education qualifications was for a lawful purpose that is directly related to its function of admission processes and procedures for overseas students and the information was reasonably necessary for that purpose.

142. I make a similar finding in regard to the conduct of the University in collecting or seeking to collect the remaining personal information in issue.

143. Accordingly, I find, on the material before the Tribunal, that the conduct of the University in collecting or seeking to collect the personal information in issue (including certified copies of DQU’s year 10 and year 12 equivalent education qualifications) did not contravene the information protection principle in s 8 of the PPIP Act.

Was the collection of the personal information directly from the individual?

144. In their internal review, DQU and DQV contended that the personal information the University had collected or sought to collect from them about the age, place of residence and marital status of relatives and ex-spouses was a contravention s 9 of the PPIP Act.

145. In her published guide to the information protection principles, the Privacy Commissioner has advised that the information protection principle in s 9:

‘… [is] designed to limit the collection of personal information where the individual concerned is not aware that this is occurring. Secret or undisclosed collections … prevent individuals exercising their rights.’ (see ‘A Guide to the Information Protection Principles’ (1999), at p 8))

146. For the reasons set out above, I have found that the conduct of the University in seeking to collect personal information about the name, age, place of residence and marital status of relatives and ex-spouses of DQU and DQV was for a lawful purpose that is directly related to its function of admission processes and procedures for overseas students and the information was reasonably necessary for that purpose.

147. In its internal review, the University noted that, as the information was sought in support of DQU’s application to the University, it was assumed that he would obtain the relevant consent from the individuals to whom the information related, either prior to or at the time the information was obtained from them.

148. Given the circumstances and the context in which the information was sought to be collected, I agree it could be assumed by the University that DQU and DQV had the authority of their respective family members and ex-spouses to provide their personal information as to their name, age, place of residence and marital status.

149. In my opinion, given the purpose for which the information is sought (i.e. DQU’s circumstances in his home country) and the fact that this information is information readily known to DQU and DQV, it is arguable that the University was exempt, under s 25(b) of the PPIP Act, from complying with section 9. That section relevantly provides as follows:

25   Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if—

(a)   the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).

Finding

150. For the reasons set out above, I am satisfied that the conduct of the University in collecting or seeking to collect the personal information of the age, place of residence and marital status of relatives and ex-spouses of DQU and DQV did not contravene s 9 of the PPIP Act. In the event I am wrong, I would find that the University was exempt from complying with this information protection principle as, in the circumstances, non-compliance would be necessarily implied or reasonably contemplated under the UNE Act and the SSVF.

Were DQU and DQV informed that the supply of the information was required by law or is voluntary and the consequences of not providing it?

151. Section 10 of the PPIP Act requires a public sector agency to take such steps as are reasonable in the circumstances to ensure that the individual from whom personal information is to be collected, or was collected, is notified by the matters set out in that section. It is commonly referred to as the Collection Notification Principle.

152. The Privacy Commissioner has suggested that the notification ensures people can exercise their other rights, including deciding ‘not to provide the information’, or knowing how to exercise their rights of access and correction.

153. In KJ v Wentworth Area Heath Service [2004] NSWADT 84, at [35], the former Administrative Decisions Tribunal stated that the purpose of s 10 of the PPIP Act is to allow a person to give (or refuse) their informed consent to the collection of their personal information.

154. In this case, DQU and DQV contend that the University failed to notify them of whether the information that was collected or sought to be collected from them was required by law, or was voluntary and the consequences if the information was not provided.

155. In its internal review, the University found it had not contravened the Collection Notification principle in s 10(d) of the PPIP Act. In this regard the University noted the following:

1. in DQU’s application for GTE assessment, the recipient of the information he provided was clearly identified as being the University;

2. the published (i.e. on the website) ‘University International Student Offer Guide’ expressly noted that:

1. student visa applications were processed by the Department of Home Affairs (at the time, the Department of Immigration and Border Protection) (‘the Department’);

2. the University, was an approved ‘eligible university’ under the Department’s Streamlined Visa Processing (‘SVP’) arrangements and applicants from countries deemed by the Department to be Assessment Level 3 (risk) would need to undergo additional assessment to determine whether they met the GTE and financial evidence requirements;

3. ‘If Your Offer of Admission includes a condition that you must complete an additional ‘GTE and Financial Evidence Form’ which UNE International will have sent you with your Offer, You must submit this completed form together with all of the required documentation in order for UNE to assess if you met the SVP requirements. You will be advised of the outcome.’; and

3. DQU and DQV having been informed in a number of emails (e.g. 5, 12, 13 and 14 June 2018) of the potential consequences of the requested information not being provided.

Consideration and finding

156. While I can understand that DQU and DQV may not have fully understood the role of the University under the SSVF in so far as it related to its admission processes including an assessment as to whether DQU met the GTE and financial evidence requirements for a student visa. However, I am satisfied, on the material before the Tribunal that they were given notification of who the recipient of the information would be, why the information was being collected and the consequences of failing to provide it. As noted above, the role of the University under the SSVF was set out in the information the University had published on its web site for prospective overseas students, in particular prospective students to whom an offer of admission was made subject to the student meeting the GTE and financial evidence requirements as part of the ongoing assessment process.

157. The May 2018 letters of offer from the University to DQU, also clearly stated that, in light of the SSVF arrangements, the aim was to have DQU’s student visa applicant streamlined by the Commonwealth Department of Home Affairs on the basis of the University, as part of its admission assessment processes being satisfied that he could meet the GTE and financial evidence requirements for the grant of a student visa by the Commonwealth. Regrettably, DQU and DQV do not appear to have fully understood this.

158. At page 6, of the May 2018 letters of offer to DQU, under the heading ‘Personal Information and Privacy’ reference is made to the ‘UNE Privacy Management Rule’ which sets out the University’s policy as to how personal and health information is managed by the University and that all University staff members are required to follow the policy and the relevant legislative provisions concerning the protection of personal information.

159. Accordingly, on the information before the Tribunal, I find that the University did not contravene s 10(d) of the PPIP Act. On the contrary, at all times the University did notify DQU or DQV the basis on which the information on which their personal information and that of their immediate family was being collected or sought to be collected. They were also notified that the University was the recipient of this information and the consequences if they did not provide the information sought. In regard to the latter, they knew the likely consequences would be no formal offer of admission from the University.

Was the information collected excessive and intruded to an unreasonable extent on the personal affairs of the individual?

160. It is the contention of DQU and DQV that the request for wedding photos and proof of income and paying taxes in Australia was excessive and intruded to an unreasonable extent on the personal affairs of DQU and DQV respectively.

161. In its internal review, the University noted that Ministerial Direction 69 and the Document Checklist tool of the Commonwealth makes provision for additional information being requested from the applicant to demonstrate that they are a genuine temporary entrant. In this regard, the University noted that its third -party assessor had confirmed that ‘the ceremonial and social marriage photographs’ are sought to confirm the marriage actually occurred and to confirm that the marriage certificate is legitimate.

162. In regard to the request that DQV provide copies of his pay slips and tax returns, the University said, as DQV was DQU’s sponsor, this information would assist the University in establishing DQV’s financial status.

163. For the reasons set out above, I have already found that the collection of marriage photos of DQU and his wife is reasonably necessary for the purpose of the University admission processes in assessing whether DQU is a genuine student and meets the GTE requirements. I have also made a similar finding in regard to DQV’s pay slips and tax returns. That information is also reasonably necessary to ensure that the financial requirements of a student visa are met.

164. Hence, I am satisfied that, in the circumstances of this case, the collection of this information is neither excessive or intrudes to an unreasonable extent into the personal affairs of DQU or DQV.

165. Accordingly, I find that the University did not contravene s 11 of the PPIP Act in seeking wedding photos of DQU and his wife and the pay slips and tax returns of DQV.

Conclusion and Orders

166. For the reasons set out above, I am satisfied that:

1. It is appropriate to make a non-publication order, under s 64(1)(a) of the Civil and Administrative Tribunal Act 2013, prohibiting the publication of the name of each applicant in these proceedings. I note that s 64(4) of that Act provides that a reference to the name of the applicant includes a reference to any information, picture or other material that identifies the applicant or is likely to lead to the identification of the applicant;

2. time should be extended within which the applicants are to lodge this application for external review; and

3. DQV has standing to bring this application in so far as it relates to his personal information.

167. In regard to the substantive matter in issue in this application, for the reasons sets out above, I am satisfied that the conduct of the University in collecting and seeking to collect the personal information of DQU, DQU’s wife, DQU’s son and DQV that is in issue in this application is not conduct that contravenes the information protection principles in ss 8, 9, 10(c) and 11 of the PPIP Act. In light of this finding it is appropriate to decide not to take any further action on the matter.

168. At the hearing in April 2019, DQV indicated that he and his brother were seeking to have returned to them the information they had provided to the University. In my opinion this is a matter DQV and DQU needed to take up separately with the University, as it is not a matter arising from this application, which is confined to the matters raised in their internal review decision: KO v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56, at [13].

169. Accordingly, I make the following orders:

1. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 the publication of the name of each applicant in these proceedings is prohibited.

2. Time within which the applicants are to bring this application is extended to 29 November 2018.

3. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 the publication of the name of each applicant is prohibited.

4. Pursuant to s 55(2), the Tribunal decides not to take any action in this matter.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 11 September 2020