HW v Commissioner of Police, New South Wales Police Service and Anor

[2003] NSWADT 214

CITATION:	HW v Commissioner of Police, New South Wales Police Service and Anor [2003] NSWADT 214
DIVISION:	General Division
PARTIES:	APPLICANT HW FIRST RESPONDENT Commissioner of Police New South Wales Police Service SECOND RESPONDENT Director of Public Prosecutions
FILE NUMBER:	023217; 023218
HEARING DATES:	04/082003
SUBMISSIONS CLOSED:	08/04/2003
DATE OF DECISION:	09/10/2003
BEFORE:	O'Connor K - DCJ (President)
APPLICATION:	Privacy - information protection principle - collection - unlawful
MATTER FOR DECISION:	Preliminary matter
LEGISLATION CITED:	Confiscation of Proceeds of Crime Act 1989 Criminal Assets Recovery Act 1990 Freedom of Information Act 1989 Police Act 1990 Privacy & Personal Information Protection Act 1998 Protected Disclosures Act 1994 State Records Act 1998
CASES CITED:	N (No. 3) -v- Commissioner of Police, New South Wales Police Service [2002] NSWADT 34
REPRESENTATION:	APPLICANT In person FIRST RESPONDENT M Tzannes, counsel SECOND RESPONDENT S Free, solicitor
ORDERS:	1. Application for review of the conduct of New South Wales Police Service dismissed.; 2. Application for review of the conduct of Director of Public Prosecutions dismissed, except in relation to the claim made in relation to an alleged contravention of s 11.; 3. Application for review of the conduct of Director of Public Prosecutions as it relates to s 11 to be relisted for further directions.

REASONS FOR DECISION

1 The applicant has lodged two applications for review of the conduct of public sector agencies, filed pursuant to s 55 of the Privacy and Personal Information Protection Act 1998 (the Privacy Act). The respondent to application no. 023217 is the Commissioner of Police, NSW Police Service (the Police Service) and the respondent to application no. 023218 is the Director of Public Prosecutions (DPP). The applications involve a common set of circumstances.

2 The applicant is a doctor. He has been tried once at the District Court before a jury on a charge of culpable driving (the trial), with the jury unable to reach a verdict. There is to be a retrial unless the applicant’s pending application to the Supreme Court for a permanent stay of the proceedings is successful. The conduct in issue relates to an aspect of the trial being the obtaining of personal information by way of an invalid subpoena.

3 In light of the defence’s opening at the trial on 7 May 2002, the prosecution formed the view that the defence was going to lead evidence as to the applicant’s character. Following discussion with prosecuting counsel (Mr Bonnici), the prosecuting solicitor (Mr De Silva), who is an employee of the DPP, asked the police officer (Senior Constable Stone) assisting the prosecution team to obtain any information that might be relevant to the applicant’s character. This occurred on 7 May 2002.

4 The officer went to the Medical Board of New South Wales, to the applicant’s employer, a regional Health Service (and to various locations of the Health Service) and to the Health Care Complaints Commission. The officer presented an instrument that she had prepared. It took the form of a Local Court subpoena and was signed by a Justice of the Peace, another police officer, Sergeant Saville. The Medical Board and the Health Service handed over documents relying on the validity of the subpoena. The records included registration records, employment records and health records. The process used was admitted to be invalid, giving rise to an unlawful collection of personal information. The subpoena should have been in the form of a District Court subpoena, issued and sealed by the Court and nominated a return date. The documents should have been presented sealed and delivered directly to the Court.

5 The applicant has expressed deep concern over the fact that quite sensitive personal material was among these documents and is now known to the prosecution in circumstances where, had proper procedure been followed, it might never have become known. If, for example, the same material had been collected under proper process, it would first have gone to the Court and it might have been possible for objections to be considered which, if successful, may have led to no revelation of the material to the prosecution.

6 The applicant complained to the agencies involved, ultimately giving rise to applications before the Tribunal against the Police Service, the DPP, the Medical Board and the Health Service. The proceedings in relation to the Medical Board have been resolved. The Health Service proceedings remain pending.

7 This decision deals with preliminary questions relating to the application in respect of the conduct of the Police Service and questions in the nature of preliminary questions going to the application in respect of the conduct of the DPP.

8 The officer brought the documents to Court unsealed on 9 May 2002. They had been tagged in various places. They were copied, and a set given to the defence team in the court room. The hand-over occurred within earshot of the applicant’s father and he, it is said, overheard references to aspects of the applicant’s personal medical history of which he had been unaware, thus causing embarrassment to the applicant. The defence team raised concerns about the validity of the subpoena and the procedure. The applicant’s brother (a solicitor) was also in court, and has appeared for the applicant on occasions at planning meetings. The brother was once a clerk in local courts, and said that it was obvious that the process was not proper. He expressed concern over the failure of the agencies holding the records in not seeing that, and most significantly the failure of the Police Service in that regard.

9 Once objection was raised the prosecution team acknowledged the problem with the subpoena, and Mr De Silva, the solicitor who had given the initial instructions, sought advice from the DPP himself (Mr Cowdery QC). Mr De Silva adopted Mr Cowdery’s recommendation to seal the documents and present them to the Court, with a view to making submissions as to whether they should be admitted into evidence even though they had been illegally obtained. They were delivered to the Court on 13 May 2002, and remain there.

10 A further complication is that it transpired that the matters raised in opening by the defence had not - the defence considered - been properly construed by the prosecution. The applicant’s general character was not to be put in issue. Instead the matters raised for the purpose of putting in issue the applicant’s state of mind and behaviour, with a view to raising a defence based on automatism.

11 Submissions were considered by the trial judge, and on 15 May 2002 His Honour Judge Woods, QC ruled that 4 of 5 documents from the files which the prosecution applied to have admitted be admitted into evidence. His Honour said:

‘Very regrettably, the problem I am now dealing with is one which arises because of a misunderstanding by the officer in charge of the matter about the nature of the subpoena. Police officers should be aware that legal process to be used to obtain material by subpoena is controlled by and is administered by the court.’
12 The ruling of Judge Woods obviated the need for the prosecution to act on the alternative course it was considering, of having the subpoenas issued in proper form and then validly uplift the same material.

13 The above account has been drawn from:

· the statement of facts contained in the internal review of the conduct undertaken by the Police Service in response to the applicant’s application for internal review made pursuant to s 53 of the Privacy Act; and

· the evidence given at hearing by three officers of the DPP.

14 I have taken account of specific criticisms made by the applicant of aspects of the Police Service’s account, and his cross-examination of the three officers.

15 A further complication is that the documents made available in response to the bogus subpoena have not yet been produced to the Tribunal. The parties have advised that they are now located with the file at the District Court Registry.

16 The Police Service has acknowledged the problems that arose in this case, stating in its internal review report:

‘The NSW Police does not in any way proffer the view that the obtaining of personal information in the method used in this case is trifling or trivial. On the contrary, all steps are being taken to ensure that this incident is not repeated in the future. The matter has been the subject to a Part 8A Internal Investigation under the Police Act 1990. The NSW Police have implemented actions to educate and inform its members of correct procedures and lawful use of subpoenas and court issued orders.’
17 The applicant contends most of the Information Protection Principles (IPPs) in the Privacy Act have been contravened by one or both of the Police and the DPP. I will not at this point set out the text of the relevant IPPs.

(1) The breadth of the collection (especially the collection of information relating to the medical condition) went beyond the scope of what might be said to be ‘reasonably necessary’ to the purpose reflected in the original instruction. Alleged contravention of IPP s 8(1)(b).

(2) The information was collected by an unlawful means. It is clear that this was the case. Alleged contravention of IPP s 8(2).

(3) The information was not collected directly from the applicant, and the applicant had not given an authorisation for indirect collection. Alleged contravention of IPP s 9.

(4) Prior to making the collection, there had been a failure to give the applicant a statement as to the fact of collection, its purpose, the intended recipients of the information, whether the collection is voluntary or compulsory, the existence of any rights of access or correction, and the name of address of the agency that is holding the information. Alleged contravention of IPP s 10.

(5) The collection went beyond the limitations as to relevance and degree of intrusiveness into personal affairs set by s 11. Alleged contravention of IPP s 11.

(6) The information was not held in a secure manner. The particular focus of complaint here was the lack of clarity as to whether the documents had been kept in a sealed form by the police officer, and the decision of the police officer to make an extra set of them through photocopying and then the distribution of the photocopies to the prosecution team and the defence team. Alleged contraventions of the standards set down by IPP s 12.

(7) Reasonable steps were not taken to enable any person to ascertain whether the agency holds personal information, whether the agency holds information relevant to that person, and the nature of that information, the main purposes for which it was held, and entitlements to access. Alleged contravention of IPP s 13.

(8) The accuracy of the information was not checked before use. Alleged contravention of IPP s 16.

(9) The information was used other than for which it was collected without the consent of the applicant, or without satisfying one of the other bases upon which such use is permitted. Alleged contravention of IPP s 17.

(10) There was a failure to observe the limitations relating to the disclosure of information. Alleged contravention of IPP s 18.

(11) There was a failure to observe the special restrictions relating to disclosure of personal information of a sensitive kind (in this instance the information relating to health). Alleged contravention of IPP s 19.

(12) There was a corrupt disclosure of personal information by public sector officials constituting an offence under s 62.

Preliminary Questions

18 The Police Service and the DPP referred to various exemptions and limitations in the Privacy Act which they said applied to the circumstances, with the result that it was not open to the Tribunal to enter any findings of contravention. This decision deals with those submissions, and the applicant’s reply to them. If these submissions are wholly successful, it would be unnecessary for the Tribunal to consider the applicant’s applications for review any further.

(1) Police Service Case

19 There was a prima facie breach of IPP s 8 by the Police Service, which it acknowledges. IPP s 8 provides:

‘ 8. Collection of personal information for lawful purposes

(1) A public sector agency must not collect personal information unless:

(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and

(b) the collection of the information is reasonably necessary for that purpose.

(2) A public sector agency must not collect personal information by any unlawful means.’

20 The Police Service submitted that it was not required to comply with any of the IPPs by virtue of s 27(1) except to the extent stated by s 27(2). Section 27 provides:
‘ 27. Specific exemptions (ICAC, Police Service, PIC, Inspector of PIC and Inspector's staff and NSW Crime Commission)

(1) Despite any other provision of this Act, the Independent Commission Against Corruption, the Police Service, the Police Integrity Commission, the Inspector of the Police Integrity Commission, the staff of the Inspector of the Police Integrity Commission and the New South Wales Crime Commission are not required to comply with the information protection principles.

(2) However, the information protection principles do apply to the Independent Commission Against Corruption, the Police Service, the Police Integrity Commission, the Inspector of the Police Integrity Commission, the staff of the Inspector of the Police Integrity Commission and the New South Wales Crime Commission in connection with the exercise of their administrative and educative functions.’

21 The Police Service submitted that the conduct in issue related to its ‘law enforcement’ functions. The Police Service acknowledged that its officer had made a mistake (the applicant contended that this was an understatement of the gravity of the conduct), but the mistake was one made in the course of carrying out its law enforcement functions. These included assisting the prosecution in trials, as had been occurring here.

22 The applicant submitted that the activities in question related to the exercise of the ‘administrative’ and ‘educative’ functions of the Police Service. He contended that the officer was merely engaging in the administrative task of going out, serving a document that was said to be a valid subpoena, and bringing the documents back to the prosecution team to consider.

23 In reply the Police Service contended, submissions in which the DPP joined, that the officer was engaged in the exercise of independent judgment in deciding where to go for information about the applicant’s character and how to go about getting the information.

24 Mr De Silva, the solicitor involved, gave evidence that he had simply made a general request to the officer to obtain relevant information. He did not give her specific instructions as to what to do or where to go. The Tribunal accepts Mr De Silva’s evidence.

25 The question therefore is where does the conduct in issue lie along the spectrum of the operational areas identified by s 27. The section seeks, I consider, to draw a distinction between the core responsibility of the Police Service and its ‘administrative’ and ‘educative’ functions.

26 The provision of ‘police services’ could perhaps be described as the core responsibility. Another way it was put in submissions was that its core responsibility was ‘law enforcement’. The Police Act 1990 s 6 provides that the Police Service has three functions, the first of which is ‘to provide police services for New South Wales’. ‘Police services’ are defined as follows:

"police services" includes:

(a) services by way of prevention and detection of crime, and

(b) the protection of persons from injury or death, and property from damage, whether arising from criminal acts or in any other way, and

(c) the provision of essential services in emergencies, and

(d) any other service prescribed by the regulations.

27 A broad interpretation of ‘administrative functions’ may be appropriate in a legislative scheme which does not otherwise compartmentalise the functions of a public sector agency (as I considered to be the case in relation to the way that expression applies to the Police Service in the setting of the amendment of personal record provisions in the Freedom of Information Act 1989: see N (No. 3) -v- Commissioner of Police, New South Wales Police Service [2002] NSWADT 34 (subject to appeal)). However in s 27 the Parliament has taken a compartmentalised approach to the functions of the law enforcement agencies mentioned. The division, as I see it, is as between their core responsibilities and those responsibilities which are not part of their core responsibilities. In particular the meaning of the word ‘administrative’ is to be read down so as not to embrace those core responsibilities. Similarly ‘educative’ responsibilities, which might on one view simply be a component of ‘administrative’ activity are to seen as separate from administrative responsibilities and again not forming part of the core responsibilities.

28 In my view the activities of a police officer in supporting a prosecution, at least where he or she is asked to exercise independent discretion and judgment in performing a task, are activities that form part of the core responsibilities of the Police Service. The fundamental responsibility of the Police Service is the investigation of crime. While the Police Service’s responsibility for investigation is usually at an end by the time a case has gone to the District Court for trial, there may be a continuing need for some activity of that kind. In this instance the prosecution team called for a further narrow work of an investigative kind to be done. The means to be used was a subpoena for documents. This in my opinion was work of a investigative nature (though not connected with the crime itself) and related to the Police Service’s core responsibilities.

29 It was not ‘administrative’ in the sense in which I consider this term is used in this Act. In order for the primary provision, s 27(1), to be given effect, the term can not be used to refer to the entirety of the administrative activity of the Police Service, which includes the investigation of crime. Read in context, I am satisfied that it is intended to have a narrower compass going to those aspects of the operation of the agency that, as I see it, do not directly involve the carrying out of the core responsibilities. As I see it, ‘administrative’ when used in contradistinction to s 27(1) and alongside the term ‘educative’ seeks to refer to those activities of the Police Service that have to do with providing administrative support for the conduct of its core responsibilities.

30 So, for example, corporate services areas performing functions such as personnel, budget and information technology involve the performance of ‘administrative’ functions. There may be areas of the Police Service where the characterisation of the activity in terms of core/administrative/educative may vary depending on context that has given rise to the conduct in issue. (The handling of criminal records may provide an example where in some instances the disclosures occur in the course of the investigation of crime, while in other instances they are done administratively, for example for background checks on prospective employees. The exception in s 27(2) may also cover licensing responsibilities vested in the Commissioner, such as for firearms licensing and security industry licensing. It is not necessary to pursue these questions any further here.)

31 As to the term ‘educative functions’ it seeks, as I see it, to refer to the work that the Police Service does in connection with community and school education programs, as well as in relation to its internal education and training programs. Section 27(2) makes the IPPs applicable to the way in which personal information is used in these contexts.

32 The applicant submitted that the ‘education’ exception applied in this case (i.e. the information was being collected for the ‘education’ of the prosecution team and ultimately it was hoped the judge and jury). This submission involves a forced and artificial use of the term ‘education’ and is rejected.

33 Accordingly, I am satisfied that the s 27 claim is made out, and the Police Service is not required to answer to the various alleged contraventions of the IPPs raised by the applicant.

34 There was also a claim by the applicant of breach of s 62. This is an offence provision. It provides:

‘ 62. Corrupt disclosure and use of personal information by public sector officials

(1) A public sector official must not, otherwise than in connection with the lawful exercise of his or her official functions, intentionally disclose or use any personal information about another person to which the official has or had access in the exercise of his or her official functions.

Maximum penalty: 100 penalty units or imprisonment for 2 years, or both.

(2) A person must not induce or attempt to induce a public sector official (by way of a bribe or other similar corrupt conduct) to disclose any personal information about another person to which the official has or had access in the exercise of his or her official functions.

Maximum penalty: 100 penalty units or imprisonment for 2 years, or both.

(3) Subsection (1) does not prohibit a public sector official from disclosing any personal information about another person if the disclosure is made in accordance with the Protected Disclosures Act 1994.

(4) In this section, a reference to a public sector official includes a reference to a person who was formerly a public sector official.’

35 There is no jurisdiction conferred on the Tribunal to deal with charges of criminal offences. The jurisdiction is one to hear and consider applications for review of the conduct of public sector agencies, the conduct relevant to this matter being ‘contravention of an information protection principle that applies to the agency’: Privacy Act, s 52(1)(a).

36 In light of these conclusions it is unnecessary to deal with a number of further submissions made by the Police Service addressed to the extent to which a ‘law enforcement agency’ (see further definition, s 3) or a public sector agency ‘whether or not a law enforcement agency’ is specifically exempt by virtue of various sub-sections in s 23 from compliance with particular IPPs (i.e. IPPs 8, 9, 10, 17, 18 and 19).

(2) The DPP Case

37 Section 27 does not cover the DPP. Accordingly the DPP is generally bound by the IPPs in respect of the exercise of its law enforcement functions except to the extent that its conduct is covered by a qualification contained within an IPP or is covered by a specific exemption.

38 The DPP raised the issue of which agency was responsible for the first act of collection of the information, that is the collection from the Medical Board and the Health Service based on the bogus subpoena. It contended that the Police Service not the DPP was responsible for that act. While the police officer had acted under the general instructions of the DPP’s solicitor, she was not an employee of the DPP. The DPP submitted that the particular methods and choices she made were hers and therefore those of the Police Service. So it is said even though the DPP initiated the collection it did not have responsibility under the Privacy Act for its execution. It had given that responsibility to another agency.

39 The State is, of course, responsible for the prosecution of criminal charges. In this instance, independent counsel, and officers of two State agencies made up the prosecution team. A feature of the Privacy Act, like the Freedom of Information Act, is that it attaches responsibilities to components of government described as public sector agencies and public sector officials in the case of the Privacy Act; and as agencies and Ministers in the case of the Freedom of Information Act. It is not uncommon for a State (or ‘Government’) activity to be carried on by a team from more than one agency and to include people from outside government. In contexts of that kind, the question of where responsibility falls in relation to the occurrence of privacy-intrusive conduct may have considerable significance on the extent of protection given by the Privacy Act to the citizen. In this instance the DPP points to the Police Service with the result that the more generous protections from liability enjoyed by that agency (dealt with above) come into play.

40 The facts in this case support, I consider, the DPP’s submission. The officer was given a general instruction which it was for her to fill in. The solicitor to the DPP had a reasonable expectation that the officer would be familiar with lawful methods for obtaining sensitive material in the possession of other bodies (medical registration history, workplace history, health history). The officer went to the Medical Board. It gave up the registration file. The officer went to the Health Service. It gave up material in relation to his employment history and material in relation to medical treatment of him by the Service. I am satisfied that there was a degree of independence afforded to the police officer sufficient to support the conclusion that the Police Service not the DPP was engaged in the first collection.

41 The primary importance of this conclusion is that the Police Service has been found to be the ‘collector’ of the information not the DPP. Therefore it is not open to find that the DPP collected the information by unlawful means, and thereby prima facie contravened IPP s 8(2).

42 The DPP accepted, and it follows, that there was then a collection of the information by the DPP once the material was handed to Mr De Silva and independent counsel by the Police Service. Mr De Silva held the information between 9 May and 13 May. As noted earlier, on 13 May it was delivered sealed to the Court.

43 As to that collection, it is clear in my view that the information (albeit affected by tainted process) was collected in connection with the primary prosecution responsibilities of the DPP, and was therefore ‘collected for a lawful purpose that is directly related to a function or activity of the agency’, and that it was ‘reasonably necessary for that purpose’ (IPP s 8(1)).

44 IPP s 9 provides:

‘ 9. Collection of personal information directly from individual

A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless:

(a) the individual has authorised collection of the information from someone else, or

(b) in the case of information relating to a person who is under the age of 16 years---the information has been provided by a parent or guardian of the person.’

45 The DPP is a ‘law enforcement agency’ under the Privacy Act (s 3) and is also a ‘public sector agency’. Section 23 qualifies the scope of operation of several IPPs in respect of ‘law enforcement agencies’ in some instances, and ‘public sector agencies’ in other instances. There are also qualifications in relation to the application of other IPPs. The whole of s 23 is set out below:
‘ 23. Exemptions relating to law enforcement and related matters

(1) A law enforcement agency is not required to comply with section 9 if compliance by the agency would prejudice the agency's law enforcement functions.

(2) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 9 if the information concerned is collected in connection with proceedings (whether or not actually commenced) before any court or tribunal.

(3) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 10 if the information concerned is collected for law enforcement purposes. However, this subsection does not remove any protection provided by any other law in relation to the rights of accused persons or persons suspected of having committed an offence.

(4) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 17 if the use of the information concerned for a purpose other than the purpose for which it was collected is reasonably necessary for law enforcement purposes or for the protection of the public revenue.

(5) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 18 if the disclosure of the information concerned:

(a) is made in connection with proceedings for an offence or for law enforcement purposes (including the exercising of functions under or in connection with the Confiscation of Proceeds of Crime Act 1989 or the Criminal Assets Recovery Act 1990), or

(b) is to a law enforcement agency (or such other person or organisation as may be prescribed by the regulations) for the purposes of ascertaining the whereabouts of an individual who has been reported to a police officer as a missing person, or

(c) is authorised or required by subpoena or by search warrant or other statutory instrument, or

(d) is reasonably necessary:

(i) for the protection of the public revenue, or

(ii) in order to investigate an offence where there are reasonable grounds to believe that an offence may have been committed.

(6) Nothing in subsection (5) requires a public sector agency to disclose personal information to another person or body if the agency is entitled to refuse to disclose the information in the absence of a subpoena, warrant or other lawful requirement.

(7) A public sector agency (whether or not a law enforcement agency) is not required to comply with section 19 if the disclosure of the information concerned is reasonably necessary for the purposes of law enforcement in circumstances where there are reasonable grounds to believe that an offence may have been, or may be, committed.’

46 It is clear, I consider, that s 23(2) is a complete answer to the question of whether IPP s 9 applies in the present circumstances. The IPP is not applicable to the DPP. There was another argument put based on s 23(1) which it is not necessary to consider.

47 The next IPP said to have been breached by the DPP is IPP s 10 which provides:

‘ 10. Requirements when collecting personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following:

(a) the fact that the information is being collected,

(b) the purposes for which the information is being collected,

(c) the intended recipients of the information,

(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,

(e) the existence of any right of access to, and correction of, the information,

(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.’

48 As to the reach of the notice requirements of IPP s 10 there is a question as to whether the notice is only to be given to the individuals who are the subjects of the information sought and from whom it is being collected directly; or whether any individual who is asked to give information, in particular about other individuals, must be given a notice. This issue need not be dealt with here, as I am satisfied that the DPP is immune from the application of IPP s 10 because of s 23(3). The office was clearly, in my view, engaged in the performance of law enforcement functions when conducting a trial on behalf of the State. It sought the personal information in that context.

49 The next IPP said to be applicable to the present circumstances is IPP 11, which provides:

‘ 11. Other requirements relating to collection of personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that:

(a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and

(b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.’

50 There is also a question of construction as to whether IPP s 11 applies to the present context. The collection in issue is the DPP’s collection from the police officer. On one view that is a collection from an ‘individual’ for the purpose of s 11. There is no definition of ‘individual’ in the Act. A police officer fits the definition of a ‘public sector official’, i.e. ‘a person who is employed or engaged by: (i) a public sector agency’ (see s 3). There are indications in the Privacy Act that the term ‘individual’ is used in contradistinction to ‘public sector official’ (see for example s 4(3)(k)). But for the moment I will leave the issue on the table. I will proceed in dealing with this issue on the basis that the collection from the police officer is covered by s 11.

51 Ultimately, in my view the critical word in determining whether IPP s 11(a) is contravened is ‘purpose’. In this instance the intended purpose was to consider the information collected for use in the context to meet a defence in a criminal trial. As it happened the defence was mischaracterised. I am not able to form a view without scrutiny of the collected material as to whether the information collected was, even if relevant to that purpose, ‘not excessive, and is accurate, up to date and complete’ and whether it did ‘not intrude to an unreasonable extent on the personal affairs’ of the applicant.

52 This issue will be listed for further consideration.

53 The next IPP said to be infringed is IPP s 12, which provides:

‘ 12. Retention and security of personal information

A public sector agency that holds personal information must ensure:

(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.’

54 As to IPP s 12, the DPP submitted that the information in issue was only held by his office for 4 days, and that there was no evidence that during that time it was handled in any way that contravened the principles. He noted that it was furnished sealed to the Court. I accept the evidence of Mr De Silva that he remained in control of the information during those 4 days. The applicant raised concern that Mr De Silva had given a copy of all the photocopied material to the defence team, which included the applicant’s brother.

55 I am not satisfied that the transfer of information between a prosecution team and a defence team in connection with an issue thought to have been raised in a trial could, ordinarily in its own right, be considered to involve a failure to implement appropriate security safeguards. These would ordinarily be hand to hand transfers between lawyers bound by ethical requirements of confidentiality that would ordinarily furnish an adequate level of security to the information.

56 In the circumstances on the day it was said that the applicant’s father (who he wished to protect from the kind of detail that might be found in such material) was in the vicinity of this transfer of information, and obtained some knowledge of its contents. There was no direct evidence on this point, and I do not make any finding. On the other hand this complaint points to the care that must be shown in the handing over of sensitive information in public settings such as the body of a court room at hearing.

57 The next IPP put in issue is IPP s 13, which provides:

‘ 13. Information about personal information held by agencies

A public sector agency that holds personal information must take such steps as are, in the circumstances, reasonable to enable any person to ascertain:

(a) whether the agency holds personal information, and

(b) whether the agency holds personal information relating to that person, and

(c) if the agency holds personal information relating to that person:

(i) the nature of that information, and

(ii) the main purposes for which the information is used, and

(iii) that person's entitlement to gain access to the information.’

58 As to IPP s 13, I agree with the DPP that the applicant’s reliance on this provision is misconceived. The provision has, as I see it, to do with a systemic obligation owed by agencies generally to the community. The opening words are ‘A public sector agency … must take such steps as are, in the circumstances, reasonable to enable a person to ascertain: [three matters are set out].’ In any event if I am wrong, I do not see a problem. As to the first of these matters, it is clear that the DPP holds regularly personal information relevant to the conduct of criminal prosecutions; as to the second and third matters, it is clear that the applicant knows what information is held on him, the nature of that information (the advocate’s duty of disclosure is relevant), the main purposes for which it is held, and his entitlements to gain access to that information.

59 The applicant then refers to IPPs ss 17, 18 and 19. They provide as follows:

‘ 17. Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

18. Limits on disclosure of personal information

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.

19. Special restrictions on disclosure of personal information

(1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership, health or sexual activities unless the disclosure is necessary to prevent a serious or imminent threat to the life or health of the individual concerned or another person.

(2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales unless:

(a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction, or

(b) the disclosure is permitted under a privacy code of practice.

(3) For the purposes of subsection (2), a "relevant privacy law" means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned.

(4) The Privacy Commissioner is, within the year following the commencement of this section, to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales.

(5) Subsection (2) does not apply:

(a) until after the first anniversary of the commencement of this section, or

(b) until a code referred to in subsection (4) is made,

whichever is the later.’

60 As to IPPs 17, 18 and 19, public sector agencies have certain immunities from compliance conferred by s 23(4), s 23(5) and s 23(7) respectively.

61 I am satisfied that the DPP in using the information did so in connection with the purpose for which it was collected. The primary requirement of IPP s 17 was met, and therefore it is unnecessary to consider the applicability of s 23(4).

62 The position in relation to disclosure of the information (here to the prosecution team and to the Court) is more complex. IPP s 18 prevents any disclosure except under strict conditions. Here the disclosure to the defence team is, I consider, covered by s 18(1)(a). I reject the contrary submission put at hearing. That exception allows disclosure directly related to the purpose for which the information was collected and where ‘the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure’. In this instance I am satisfied that there the agency was entitled to the view that, in the context of a criminal trial, a process governed by strict requirements as to disclosure of information to be relied on by the prosecution, that it had no reason to believe that the applicant would object to the degree and nature of the disclosure that occurred. It is required of the prosecution that they not hold back material that they may seek to rely on in the proceedings. Section 23(5)(a) may also be applicable, but I will not pursue that issue here.

63 As to the disclosure to the Court, s 25 is relevant. It provides:

‘ 25. Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if:

(a) the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).’

64 The issue is the disclosure by the DPP to the Court. The requirements of IPP s 18 and IPP s 19 were not considered. I am satisfied that these were circumstances where the ‘the agency was lawfully authorised or required not to comply with the principle’ (see s 25). Had the subpoena been properly executed, the documents should have been submitted directly to the Court. As it happened the subpoena itself was not valid, the original collection was therefore unlawful, and then departure from usual subpoena practice was compounded by the documents being given direct to the prosecution team, and by them direct to the defence team. The presentation of the documents sealed to the Court was the procedure that should have been followed in the first place. In making that disclosure the DPP proceeded, I consider, lawfully and in accordance with the duty to the court to place before it for consideration any material which it was thought might be relevant and to which there may be objections. Section 25 also applies to IPP s 19, and for the same reason that is not made out.

Conclusion

65 The events identified by this application for review do not reflect well on the agencies concerned. The Police Service has undertaken a substantial internal investigation. The agencies have conducted detailed internal review of the conduct that occurred.

66 Hopefully those actions have contributed in the future to greater rigour in the process of collecting sensitive information by subpoena and ensuring that strict protocols are observed in keeping subpoenaed material secure and presenting it direct to the court or tribunal.

67 As to the application for review as it relates to the Police Service, it must, for the reasons given, be dismissed. The Police Service enjoys a substantial immunity from the application of the IPPs.

68 As to the application for review as it relates to the DPP, there is only one matter that requires, I consider, any further consideration by the Tribunal – whether IPP s 11 has been contravened. The DPP does not enjoy as substantial an immunity from the application of the IPPs, and that is the basic reason for the seemingly odd result that the Police Service has escaped any adverse finding and the DPP remains at risk of one.

69 The application for review of the DPP’s conduct is dismissed in other respects.

Order

1. Application for review of the conduct of New South Wales Police Service dismissed.

2. Application for review of the conduct of Director of Public Prosecutions dismissed, except in relation to the claim made in relation to an alleged contravention of s 11.

3. Application for review of the conduct of Director of Public Prosecutions as it relates to s 11 to be relisted for further directions.