Foley v Australian Information Commissioner

Link copied
Case Copied 58 min read

FEDERAL COURT OF AUSTRALIA

Foley v Australian Information Commissioner [2024] FCA 169

File number: VID 735 of 2023
Judgment of: BEACH J
Date of judgment: 1 March 2024
Catchwords: PRIVACY — breach of privacy — unauthorised access of personal information — inadequate data protection systems — breach of Australian Privacy Principles — ss 13 and 15 of Privacy Act 1988 (Cth) — investigation of representative complaint — earlier representative complaint — construction of ss 36, 38 and 39 of the Act — whether s 39 precludes investigation of subsequent representative complaint — preclusion decision made by the Australian Information Commissioner — whether an error of law — judicial review proceedings — s 5(1) of Administrative Decisions (Judicial Review) Act 1977 (Cth) — ss 39B(1) and (1A) of Judiciary Act 1903 (Cth)
Legislation:

Administrative Decisions (Judicial Review) Act 1977 (Cth) s 5(1)

Federal Court of Australia Act 1976 (Cth) ss 21, 23, 33C(1), 33J(1), 33ZB

Judiciary Act 1903 (Cth) ss 39B(1), 39B(1A)(c)

Law and Justice Legislation Amendment Act 1993 (Cth) ss 7(a), 11

Privacy Act 1988 (Cth) ss 2A(a), 6, 13(1), 15, 29, 36, 36A, 37, 38, 38A, 38B, 38C, 39, 40, 41, 43, 43A, 52, 53

Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth) ss 2A, 13, 27(1), 29

Australian Law Reform Commission, For Your Information: Australian Privacy Law and Practice (Report No 108, May 2008)

Explanatory Memorandum, Privacy Amendment (Enhancing Privacy Protection) Bill 2012 (Cth)

Explanatory Memorandum, Law and Justice Legislation Amendment Bill 1993 (Cth)
Cases cited:

Elliott-Carde v McDonald’s Australia Ltd [2023] FCAFC 162

H Lundbeck A/S v Commissioner of Patents (2017) 249 FCR 41

McKay Super Solutions Pty Ltd (Trustee) v Bellamy’s Australia Ltd [2017] FCA 947
Division: General Division
Registry: Victoria
National Practice Area: Administrative and Constitutional Law and Human Rights
Number of paragraphs: 175
Date of hearing: 18 October 2023
Counsel for the Applicant: Ms R Doyle SC and Mr O Nanlohy
Solicitor for the Applicant: Maurice Blackburn
Counsel for the Respondent: Ms F Gordon KC and Mr T Prince
Solicitor for the Respondent: Australian Government Solicitor

ORDERS

VID 735 of 2023
BETWEEN:

SEAN DONAHUGH VANDERFIELD FOLEY

Applicant
AND:

AUSTRALIAN INFORMATION COMMISSIONER

Respondent

ORDER MADE BY:

BEACH J

DATE OF ORDER:

1 MARCH 2024   

THE COURT ORDERS THAT:

1.On or before 15 March 2024 each party file and serve minutes of proposed orders to give effect to the reasons of the Court published today.

2.Costs reserved.

3.Liberty to apply.

Note:   Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.


REASONS FOR JUDGMENT

BEACH J:

  1. The present matter has its genesis in a data breach involving the systems of Singtel Optus Pty Ltd (Optus) which occurred no later than 22 September 2022 and involved the personal information of present and former customers of Optus.

  2. The applicant applies for judicial review of a decision of the Australian Information Commissioner (AIC) who decided that she was precluded from investigating the applicant’s representative complaint made against Optus pursuant to s…

CaseChat AU logo

Keep reading for free

Create a free CaseChat account to read Foley v Australian Information Commissioner and more:

  • Read every judgment in full
  • Ask AI and get answers linked to paragraphs
  • See how each paragraph was cited in later cases
  • Download judgments as PDF or Word
Continue with Google

One click creates your free account or signs you in.

By continuing you agree to the Terms and Privacy Policy.

Details
Case
[2024] FCA 169
Decision Date

CaseChat Overview and Summary

In the matter of Foley v Australian Information Commissioner, the primary issue before the court was whether the Australian Information Commissioner (AIC) erred in her decision to preclude a subsequent representative complaint based on the provisions of section 39 of the Privacy Act 1988. The applicant, an Optus customer affected by a data breach, had lodged a representative complaint against Optus with the Office of the Australian Information Commissioner (OAIC) after initially being unaware that he was a class member in an earlier representative complaint. The AIC declined to investigate the subsequent complaint on the grounds that section 39 precluded the applicant from making a separate representative complaint. The applicant sought judicial review of the AIC's decision under section 5(1) of the Administrative Decisions (Judicial Review) Act 1977.

The court was required to determine whether the AIC's interpretation of section 39 was correct and whether it constituted an error of law. Specifically, the court had to examine the language and purpose of section 39, as well as the interplay between sections 36, 38, and 39 of the Privacy Act. The applicant argued that the AIC's interpretation of section 39 was too narrow and did not preclude a subsequent representative complaint when the complainant was unaware of their status as a class member in an earlier complaint. The court considered whether the AIC's decision to preclude the subsequent complaint was an error of law, potentially affecting the applicant's right to seek compensation for privacy breaches.

The court found that the AIC's interpretation of section 39 was indeed erroneous. The court held that section 39 did not preclude a subsequent representative complaint when the complainant was unaware of their status as a class member in an earlier complaint. The court emphasised that the purpose of section 39 was to prevent multiple complaints on the same issue rather than to deprive affected individuals of their right to seek redress. Consequently, the court quashed the AIC's preclusion decision and directed the parties to file and serve minutes of proposed orders. The court also noted that the applicant should be awarded his costs, given the circumstances of the case.

Orders

Orders of the court

1. On or before 15 March 2024 each party file and serve minutes of proposed orders to give effect to the reasons of the Court published today.

2. Costs reserved.

3. Liberty to apply.

Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

Background

Background to the litigation

Let me begin with some of the relevant factual background. Relevant factual background On 22 September 2022, Optus announced that a data breach had resulted in the possible unauthorised access of current and former customers’ information. On 28 September 2022, Maurice Blackburn created a registration portal where current and former customers of Optus could register their interest in participating in a potential legal claim against Optus in relation to the data breach. It is convenient to note at this point that on 7 October 2022, 22,161 current and former Optus customers had registered their interest in participating in a potential legal claim through that portal, which had grown in number to 75,654 as at 25 August 2023. On 4 October 2022, the JWS complaint against Optus was lodged with the OAIC. The JWS complaint was made by an individual not being the applicant, on behalf of current and former Optus customers who had suffered an interference with their privacy as a result of the data breach. The JWS complaint identified questions common to all individuals affected by the data breach as being whether Optus had breached the APPs and whether Optus’s practices, procedures and systems were consistent with the Act. The JWS complaint sought compensation for class members. I have been told that the potential affected number of present and former customers is around 9.8 million. At the time that the JWS complaint was lodged, the applicant before me was a class member under that complaint, although he was not aware of this. On 7 October 2022, the first MB complaint against Optus was lodged with the OAIC. As I have indicated, the first MB complaint was made by the applicant before me and purported to be a representative complaint for and on behalf of any individual whose personal information was exposed as a consequence of the data breach. The common questions were said to be whether the data breach constituted a breach of APP 11 and whether class members were entitled to compensation. On 11 October 2022 the AIC commenced an investigation on her own initiative under s 40(2) concerning the data breach involving the systems of Optus. On 11 January 2023, the OAIC informed Maurice Blackburn that on 4 October 2022 the OAIC had received the JWS complaint and that the applicant before me was a class member in the JWS complaint. The OAIC indicated that s 39 prevented a class member in a representative complaint (the JWS complaint) from subsequently lodging their own complaint (the first MB complaint). Accordingly, the OAIC expressed the view that because the first MB complaint was lodged after the JWS complaint, it could not proceed. The OAIC indicated the AIC’s preliminary view that she intended to accept the JWS complaint as validly made but to decline to consider further the first MB complaint on the basis that it was not validly made by reason of s 39. Between January 2023 and April 2023, communications took place between the OAIC, Maurice Blackburn and JWS the detail of which is unimportant for present purposes.

Evidence

Evidence Before The Court

Full text does not contain this section.

Decision

Reasons for decision

Fourth, as to the first MB complaint, I have indicated the approach that can or should be taken.Conclusion For the foregoing reasons, I will quash the preclusion decision. I will hear further from the parties as to the necessary and consequential orders. In terms of costs, in my view the applicant should have his costs. I am disinclined to penalise the applicant for the excess baggage associated with his fall-back positions.

Ratio Decidendi

Legal Principle Established

Full text does not contain this section.