Knowles v Australian Information Commissioner - [2025] FedCFamC2G 571

FEDERAL CIRCUIT AND FAMILY COURT OF AUSTRALIA
(DIVISION 2)
Knowles v Australian Information Commissioner [2025] FedCFamC2G 571

File numbers: MLG 1198 of 2023
MLG 1390 of 2023

Judgment of: DEPUTY CHIEF JUDGE MERCURI

Date of judgment: 24 April 2025

Catchwords: ADMINISTRATIVE LAW – application for judicial review of separate decisions made by the Australian Information Commissioner under Part V, Division 1 of the Privacy Act 1988 (Cth) – where the applicant separately complained to the Commissioner under sections 36(1) and 36(2) of the Act in relation to the Department of Veterans’ Affairs alleged breaches of the Australian Privacy Principles – where the delegate decided not to investigate each complaint under sections 41(1)(d) and 41(1)(da) of the Act respectively– where the applicant alleges that the delegate failed to reach the state of satisfaction required by section 41 in exercising the discretion in each case – consideration of whether the respondent acted reasonably in the exercise of that discretion – no jurisdictional error established – applications each dismissed.

Legislation: Privacy Act 1988 (Cth), ss 36(1), 36(2), 36A, 38, 38A, 40, 41(1), 41(1)(d), 41(1)(da)

Cases cited:
Foley v Australian Information Commissioner [2024] FCA 169

Jaworski v Australian Information Commissioner [2022] FCA 1400

Jones v Office of the Australian Information Commissioner [2014] FCA 285

Madzikanda v Australian Information Commissioner [2023] FCA 1445

Simjanovska v Department of Human Services [2019] FCA 499

VN and VV, VW [2020] AICmr 52

Division: Division 2 General Federal Law

Number of paragraphs: 110

Date of hearing: 4 September 2024

Place: Melbourne

Counsel for the Applicant: The applicant appeared in person

Counsel for the Respondent: Ms H Sims

Solicitor for the Respondent: Holding Redlich
ORDERS

MLG 1198 of 2023
MLG 1390 of 2023

FEDERAL CIRCUIT AND FAMILY COURT OF AUSTRALIA (DIVISION 2)

BETWEEN:
KIERAN KNOWLES

Applicant

AND:
AUSTRALIAN INFORMATION COMMISSIONER

Respondent

ORDER MADE BY:

DEPUTY CHIEF JUDGE MERCURI

DATE OF ORDER:

24 APRIL 2025

THE COURT ORDERS THAT:
1.The applicant’s application in MLG 1198 of 2023 be dismissed.
2.The applicant’s application in MLG 1390 of 2023 be dismissed.

Note: The form of the order is subject to the entry in the Court’s records.
Note: The Court may vary or set aside a judgment or order to remedy minor typographical or grammatical errors (r 17.05(2)(g) Federal Circuit and Family Court of Australia (Division 2) (General Federal Law) Rules 2021 (Cth)), or to record a variation to the order pursuant to r 17.05 Federal Circuit and Family Court of Australia (Division 2) (General Federal Law) Rules 2021 (Cth).
REASONS FOR JUDGMENT
DEPUTY CHIEF JUDGE MERCURI:
INTRODUCTION

Before the court are two applications for judicial review filed by the applicant. The first application (proceeding MLG 1198 of 2023) was filed on 5 July 2023. The second application (proceeding MLG 1390 of 2023) was filed on 3 August 2023. By those applications, the applicant seeks review of the following decisions by the Australian Information Commissioner (‘the Commissioner’) made under Part V, Division 1 of the Privacy Act 1988 (Cth) (‘the Act’):
(a)On 7 June…

Grounds of appeal

[14] The appellant contends that the primary judge erred in finding that the respondent had discharged the onus of establishing the matters required under the relevant provision.

[15] It was submitted that his Honour failed to give adequate weight to the evidence of the second witness, and that the findings of fact were not reasonably open on the material before the Court.

[16] The respondent, for its part, submits that no error is disclosed, and that the conclusions reached were well within the range of outcomes available to the primary judge.

Consideration

[17] It is convenient to deal first with the question of construction, as the resolution of that issue informs the remaining grounds advanced by the appellant.

[18] For the reasons that follow, we are of the view that the appeal should be allowed in part and the matter remitted for further determination.

Keep reading for free

Create a free CaseChat account to read Knowles v Australian Information Commissioner and more:

Read every judgment in full
Ask AI and get answers linked to paragraphs
See how each paragraph was cited in later cases
Download judgments as PDF or Word

Continue with Google

One click creates your free account or signs you in.

By continuing you agree to the Terms and Privacy Policy.

Details

Case: [2025] FedCFamC2G 571
Decision Date: 24 April 2025

CaseChat Overview and Summary

The case of Knowles v Australian Information Commissioner involved the applicant, who sought judicial review of separate decisions made by the Australian Information Commissioner under the Privacy Act 1988 (Cth). The applicant lodged two complaints with the Commissioner, alleging breaches of the Australian Privacy Principles by the Department of Veterans’ Affairs. The Commissioner decided not to investigate these complaints under sections 41(1)(d) and 41(1)(da) of the Act. The applicant argued that the Commissioner failed to reach the required state of satisfaction in exercising this discretion. The court had to determine whether the Commissioner acted reasonably in exercising the discretion and if any jurisdictional error was established.

The primary legal issue before the court was whether the Commissioner acted reasonably in exercising the discretion under section 41 of the Privacy Act not to investigate the applicant's complaints. The court needed to examine whether the Commissioner's decision not to investigate complied with the legal standards of reasonableness and whether it adhered to the statutory requirements outlined in the Act. Given that the court's role in judicial review is limited to assessing the legality of the decision and not substituting its own view for that of the decision-maker, the court focused on whether the Commissioner exercised the discretion according to law.

The court concluded that no jurisdictional error was established in the Commissioner's decisions. It held that the decisions were made within the scope of the statutory discretion provided under section 41 of the Privacy Act. The court emphasised that it was not its role to determine whether the complaints should have been investigated but rather to assess the legality of the Commissioner's decision-making process. The applicant's submissions did not demonstrate that the Commissioner failed to reach the required state of satisfaction or acted outside the bounds of the statutory discretion. Therefore, the applications for judicial review were dismissed.

In conclusion, the court dismissed the applicant's applications for judicial review of the Commissioner's decisions not to investigate the complaints. The court found that the Commissioner acted reasonably in exercising the discretion under section 41 of the Privacy Act, and no jurisdictional error was established. The decisions were within the legal parameters set by the Act, and the court's role was limited to assessing the legality of the decision-making process.

Orders

Orders of the court

Full text does not contain this section.

Background

Background to the litigation

Against this statutory context I will now consider the relevant background to the complaints. BACKGROUND - 1198 COMPLAINT On 1 July 2022, the applicant made the 1198 complaint by email to the respondent alleging the DVA’s breach of APP 11.1.[3] The applicant identified the complaint as a ‘representative complaint’ within the meaning of section 36(2) of the Act. I will come back to this issue in due course. [3] Court book at page 16 to 22. In the 1198 complaint, the applicant said:[4]The ANAO’s audit of the Department of Veterans’ Affairs’ 2020-21 financial statements raised a Category B ANAO finding which identified that the Department of Veterans’ Affairs had no processes in place to identify users who had access to systems, applications and data repositories that contained personal, and sensitive personal information, after terminations and had no process to monitor activities undertaken by these users.While the ANAO and the Department of Veterans’ Affairs have since consulted over what approach the Department of Veterans’ Affairs should take in future, this does not negate the Department of Veterans’ Affairs did not take reasonable steps under APP 11.1 to protect the class members personal information from the risk of misuse, interference, loss, unauthorised access, modification or disclosure.Breach of APP 11.1 does not require evidence of misuse, interference, loss, unauthorised access, modification or disclosure – the legislation is explicit that the obligation is that the entity must take such steps as are reasonable in the circumstances to protect such personal information. It is prospective not retrospective. As has been consistently stated by the Information Commissioner in s 52 determinations, ‘APP 11 is about the APP entity taking reasonable steps to prevent certain events, such as unauthorised disclosure in breach of APP 6, from occurring’ not a breach of disclosure itself. [4] Court book at page 16. The applicant then set out the requirements of a representative complaint and stated that the representative complaint included persons other than, but including, the applicant. The applicant described the class members of the representative complaint as:[5] … all Department of Veterans’ Affairs clients whose personal information, including sensitive personal information, was accessed by contractors of the Department of Veterans’ Affairs between 1 January 2021 and 31 Dec 2021 who have since subsequently ceased working for the Department of Veteran’s Affairs without proper and reasonable confirmation that all access to systems containing personal information, including sensitive personal information, of class members had been retracted, and those the Department of Veterans’ Affairs failed to take reasonable steps to confirm those contractors (PSPF termination/separation clearance) had agreed not to use their knowledge obtained from prior access obtained from these systems for other purposes.[5] Court book at page 17.

Evidence

Evidence Before The Court

Full text does not contain this section.

Decision

Reasons for decision

For these reasons, no reviewable error arises in relation to the 1390 complaint.CONCLUSION For each of these reasons, I therefore make the orders set out at the commencement of these written reasons for judgment.

Ratio Decidendi

Legal Principle Established

On 5 July 2023, the applicant filed his originating application in this court seeking judicial review of the respondent’s decision regarding the 1198 complaint.[20]CONSIDERATION AND FINDINGS – 1198 COMPLAINT [20] Court book at page 177 and following. The Court’s powers on review The principles governing this court’s powers on review of an exercise of discretion under section 41 of the Act was relevantly summarised by Greenwood J in Jones v Office of the Australian Information Commissioner [2014] FCA 285 (‘Jones’). In Jones, the court explained those principles in the following terms: 19.As to the s 41(1)(a) discretion, every statutory discretion, or discretionary power, is confined by the subject matter, scope and purpose of the legislation under which it is conferred … and every statutory decision has to be exercised according to the ‘rules of reason’ (R v Anderson;…)…22. Properly applied, a standard of legal reasonableness does not involve substituting a Court’s view as to how the discretion should be exercised for that of the decision-maker. Accepting then, that there are limits on the Court’s supervisory jurisdiction and that a ‘standard of reasonableness’ is not applied as a mechanism for merits review (or a vehicle for the Court substituting its own view of the manner of exercise of the discretion), but rather a feature of legality in decision making, leaves open the question of how the standard ‘is to be applied and how it is to be tested’ (Li, per Hayne, Kiefel and Bell JJ at [66]). The applicable principles when exercising a power of review with respect to decisions made under section 41 of the Act were also summarised by Perry J in Simjanovska v Department of Human Services [2019] FCA 499 (‘Simjanovska’) as follows: 92. … the Court is limited on judicial review to considering only the legality of the Assistant Commissioner’s decision based upon the material before him … …109. … it is not for this Court to exercise the discretion in s 41(1) of the Privacy Act for itself so as to determine whether or not the Commissioner or the Assistant Commissioner should investigate the applicant’s complaint… The only question for this Court is whether the discretion has been exercised by the Assistant Commissioner according to law. Whilst the relevant discretionary power considered in both Jones and Simjanovska, was that contained in section 41(1)(a) of the Act, the reasoning equally applies to the exercise of a discretion under section 41(1)(d) and (da). In essence, in reviewing the way in which the respondent dealt with the 1198 and 1390 complaints, the court is therefore concerned with the legality of the decision not to investigate the applicant’s complaints by reference to the discretionary conditions in section 41 of the Act. It is not for the court to exercise the discretion itself or to stand in the place of the decision maker. To do so would be to venture into the area of impermissible merits review.

File numbers:	MLG 1198 of 2023 MLG 1390 of 2023
Judgment of:	DEPUTY CHIEF JUDGE MERCURI
Date of judgment:	24 April 2025
Catchwords:	ADMINISTRATIVE LAW – application for judicial review of separate decisions made by the Australian Information Commissioner under Part V, Division 1 of the Privacy Act 1988 (Cth) – where the applicant separately complained to the Commissioner under sections 36(1) and 36(2) of the Act in relation to the Department of Veterans’ Affairs alleged breaches of the Australian Privacy Principles – where the delegate decided not to investigate each complaint under sections 41(1)(d) and 41(1)(da) of the Act respectively– where the applicant alleges that the delegate failed to reach the state of satisfaction required by section 41 in exercising the discretion in each case – consideration of whether the respondent acted reasonably in the exercise of that discretion – no jurisdictional error established – applications each dismissed.
Legislation:	Privacy Act 1988 (Cth), ss 36(1), 36(2), 36A, 38, 38A, 40, 41(1), 41(1)(d), 41(1)(da)
Cases cited:	Foley v Australian Information Commissioner [2024] FCA 169 Jaworski v Australian Information Commissioner [2022] FCA 1400 Jones v Office of the Australian Information Commissioner [2014] FCA 285 Madzikanda v Australian Information Commissioner [2023] FCA 1445 Simjanovska v Department of Human Services [2019] FCA 499 VN and VV, VW [2020] AICmr 52
Division:	Division 2 General Federal Law
Number of paragraphs:	110
Date of hearing:	4 September 2024
Place:	Melbourne
Counsel for the Applicant:	The applicant appeared in person
Counsel for the Respondent:	Ms H Sims
Solicitor for the Respondent:	Holding Redlich

MLG 1198 of 2023 MLG 1390 of 2023
FEDERAL CIRCUIT AND FAMILY COURT OF AUSTRALIA (DIVISION 2)
BETWEEN:	KIERAN KNOWLES Applicant
AND:	AUSTRALIAN INFORMATION COMMISSIONER Respondent

ORDER MADE BY:	DEPUTY CHIEF JUDGE MERCURI
DATE OF ORDER:	24 APRIL 2025