Madzikanda v Australian Information Commissioner

Link copied
Case Copied 66 min read

FEDERAL COURT OF AUSTRALIA

Madzikanda v Australian Information Commissioner [2023] FCA 1445  

File number(s): VID 594 of 2021
Judgment of: WHEELAHAN J
Date of judgment: 24 November 2023
Catchwords: ADMINISTRATIVE LAW — application for judicial review of a decision of a delegate of the Australian Information Commissioner under the Administrative Decisions (Judicial Review) Act 1977 (Cth) – where the applicant complained to the Commissioner under the Privacy Act 1988 (Cth) that his former employer had interfered with his privacy under the Act regarding personal information, in the form of personal emails and passwords to email and cloud-based storage accounts, stored on his former work laptop – where the delegate decided not to investigate the complaint further because he was not satisfied that interference with privacy was established or alternatively that further investigation was not warranted in all the circumstances – where pursuant to s 5(1)(a) of ADJR Act the applicant alleged apprehended bias and breaches of the duty to provide a fair opportunity to be heard against delegate regarding the delegate’s treatment of the evidence in the delegate’s decision and certain of the delegate’s conclusions – where pursuant to ss 5(1)(e) and 5(2)(b) of ADJR Act the applicant alleged various failures to take into account relevant considerations or the taking into account of irrelevant considerations – where pursuant to 5(1)(f) of ADJR Act the applicant alleged errors of law – where pursuant to s 5(1)(g) of ADJR Act the applicant alleged the delegate’s decision was induced or affected by fraud because the employer had allegedly provided concocted documents to the delegate on which the delegate relied – apprehended bias not shown – breach of duty to afford a fair opportunity to be heard not shown - no failure to take into account relevant considerations and no taking into account of irrelevant considerations – s 41(1)(da) discretion not to further investigate where the delegate satisfied further investigation not warranted in all circumstances is broad and makes the Commissioner the administrative gatekeeper of complaints about breaches of privacy – Privacy Act does not create a directly and immediately enforceable scheme of rights in relation to privacy – the delegate exercised the s 41(1)(da) discretion validly and independently of any alleged errors of law such that any alleged errors of law were not material – fraud allegations not material because allegedly concocted documents were not a necessary element of the delegate’s reasoning – application dismissed
Legislation:

Administrative Decisions (Judicial Review) Act 1977 (Cth), s 5

Evidence Act 1995 (Cth), s 140(2)

Migration Act 1958 (Cth), s 476(1)(f) (as previously in force)

Privacy Act 1988 (Cth), ss 2A, 6, 7B, 15, 36, 40, 41(1), 41(1)(a), 41(1)(da), 43, 44, 45, 52, 55A; Sch 1

Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth), Item 85 of Sch 4

Privacy and Data Protection Act 2014 (Vic), s 13; Sch 1

Surveillance Devices Act 1999 (Vic), s 3(1)

Australian Law Reform Commission Report 108 of May 2008 – For Your Information Report: Australian Privacy Law and Practice

Cases…
CaseChat AU logo

Keep reading for free

Create a free CaseChat account to read Madzikanda v Australian Information Commissioner and more:

  • Read every judgment in full
  • Ask AI and get answers linked to paragraphs
  • See how each paragraph was cited in later cases
  • Download judgments as PDF or Word
Continue with Google

One click creates your free account or signs you in.

By continuing you agree to the Terms and Privacy Policy.

Details
Case
[2023] FCA 1445
Decision Date

CaseChat Overview and Summary

The applicant, Madzikanda, sought judicial review of a decision by the Australian Information Commissioner's delegate not to investigate a complaint about the handling of personal information. The dispute centred on the Commissioner's decision not to investigate Madzikanda's complaint that his former employer had interfered with his privacy by accessing personal emails and passwords stored on his work laptop. The Federal Court was tasked with determining whether the delegate's decision was legally sound, particularly in light of the various grounds of review raised by Madzikanda under the Administrative Decisions (Judicial Review) Act 1977 (Cth).

The court first considered whether the delegate had breached the rules of natural justice by failing to provide Madzikanda with a fair opportunity to be heard. Madzikanda argued that the delegate had not accepted certain evidence and had not pursued questions raised about the authenticity of documents provided by the employer. However, the court found that the delegate had adequately exercised the discretion not to investigate, considering all relevant evidence and legal principles. The court emphasised that procedural fairness is concerned with the fairness of the process, not the outcome, and that the delegate's decision-making process was fair. The court also dismissed claims of apprehended bias, noting that Madzikanda had not shown actual bias.

Next, the court examined whether the delegate had failed to take into account relevant considerations or had taken into account irrelevant considerations. Madzikanda argued that the delegate had not properly considered certain documents and policies. However, the court found that the delegate had exercised the discretion validly and had considered all relevant materials. The court highlighted that the Privacy Act does not create a directly and immediately enforceable scheme of rights, and that the Commissioner has broad discretion under s 41(1)(da) not to investigate if further investigation is not warranted. The court concluded that the delegate had exercised this discretion validly.

Finally, the court addressed Madzikanda's claims of errors of law and fraud. Madzikanda argued that the delegate had made errors of law and had been induced by fraud through the employer's alleged submission of concocted documents. The court found that any errors of law were not material because the delegate's decision was validly made. The court also found that the fraud allegations were not material because the delegate's reasoning did not depend on the authenticity of the documents in question.

The application for judicial review was dismissed, and the respondent was awarded costs.

Orders

Orders of the court

1. The application for judicial review is dismissed.

2. Subject to order 3 the applicant pay the respondent’s costs of the proceeding.

3. The respondent’s costs of the proceeding, prior to 9 May 2022, be disallowed as between party and party.

Note: Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

Background

Background to the litigation

Full text does not contain this section.

Evidence

Evidence Before The Court

Full text does not contain this section.

Decision

Reasons for decision

The delegate sent the employer’s responses to the applicant for comment. By an email to the delegate dated 26 August 2021, the applicant disputed the authenticity of the Employee Handbook and the Privacy Policy. In relation to the Employee Handbook, the applicant claimed that the Handbook had been developed by another company, Calibre Workforce, in March 2018, and could not have been given to him in March 2014 when his employment commenced. The applicant further noted that the Employee Handbook contained a provision for the acknowledgement of receipt by an employee, and that the employer had not produced a copy containing the applicant’s acknowledgement. In relation to the Privacy Policy, the applicant submitted to the delegate that it purported to have come into place on 1 January 2017, but that at the time he was a senior manager with the employer, and that no such policy was developed or implemented at that time. The applicant also disputed the employer’s claim that it had returned all information to him in July 2020. He stated that the information that was returned on the USB device was corrupted, but that this was not critical information because he had managed to retrieve some of it from the servers. The applicant claimed that the employer did not return the information that he needed. The applicant also pointed to the apparent anomaly that on 21 October 2019 the employer had executed terms of settlement of his Fair Work claim (see [6(l)] above) by which it agreed to return to him any property, including personal data from his laptop.The Commissioner’s decision Following the receipt of the written information from the applicant and the employer, the delegate proceeded in two stages. The first stage was that he sent a letter dated 3 September 2021 which stated the delegate’s view that further investigation into the complaint should not occur. The letter set out the delegate’s reasons for this opinion and invited a response from the applicant before the delegate proposed making a decision not to investigate further the complaint. The second stage was a letter dated 15 September 2021 by which the delegate advised that he was satisfied that the conditions for the exercise of discretion to cease an investigation were engaged and advised that the file was closed.The 3 September 2021 letter The 3 September 2021 letter from the delegate summarised key elements of the applicant’s complaint and the employer’s response. There were a number of threads to the delegate’s reasoning, which I summarise as follows –(a)The delegate stated that it was his view that the employer had not interfered with the applicant’s privacy, as defined by the Act. The delegate referred to the exemption relating to “employee record” in s 7B(3) of the Act, stating that –An employee record means a record of personal information relating to the employment of the employee. Examples include records about the employee’s personal contact details and records about the employee’s performance or conduct. To the extent that the personal information involves records of sites or accounts that you visited, using the work computer, I am satisfied that this amounts to a record of personal information relating to your conduct during your employment.(b)The delegate also stated that he was not satisfied that the applicant’s passwords amounted to his “personal information” as defined in the Act (see s 6). The delegate stated that it was not clear in what form the passwords appeared on the records, or whether they amounted to information “about you”.(c)The delegate stated that on the available information he considered that the matter related to the applicant’s current or former relationship with the employer. The delegate stated that a work computer had been issued to the applicant by the employer for the purpose of carrying out employment duties, which was then returned to the employer upon termination of the employment.(d)The delegate referred to the copy of the employer’s Computing and Communication Policy dated 23 July 2013 and its reference to the employer being able to “view, access, retrieve, print, copy/and or distribute any material or data that is accessed or stored or transmitted on IT systems”. The delegate also referred to the copy of the Employee Handbook that the employer had supplied, stating that it indicated that all data created, stored or transmitted upon its systems was considered “work product”. The delegate referred also to the employer’s IT and Computer Policy and a provision in it that was concerned with monitoring –v) MonitoringThe Employer considers any and all data created, stored or transmitted upon the systems (the Systems) as work product and as such, expressly reserves the right to monitor and review any data upon the Systems, including your usage and history, on an intermittent basis without notice.(e)The delegate acknowledged the applicant’s claim that no IT policies existed at the time of his employment, and noted that the copy Employee Handbook was undated. However, in forming his conclusions the delegate referred to and relied on the employer’s policies –However, I have formed the view that these circumstances support a finding that such records were employee records as the respondent indicated a clear intention to monitor your use of its equipment, a work computer, provided to you for the performance of your duties of employment.I consider that you were aware that the work computer was not your private property, and that any data saved to the computer may have formed part of your employee records, as it was subject to routine monitoring and review.The respondent does not require your consent to access or use the equipment that it issued to you, to perform your employment duties. As the computer was a tool the respondent provided to you to carry out your employment duties, it remains the property of the respondent.My view in this instance is that as the data you saved on the work computer is required to be monitored in accordance with the respondent’s policy, and contravention of such policy would reflect on your performance or conduct as an employee. Therefore, I consider the data to be an employee record.As such, I am reasonably satisfied that the information collected on the respondent’s equipment while it was in your possession constitutes employee records as defined by the Privacy Act.I consider the respondent’s actions in handling your personal information, contained in the work equipment it provided to you, was:•directly related to your employment relationship with the respondent at the time; and•directly related to the employee records and relating to you.The act or practice about which you complain is the respondent taking receipt of a work computer on which you have stored your personal information, including passwords for your personal email addresses, and failing to provide you with your personal information on request. Additionally, you say that the respondent used your password to access your personal email account. I am satisfied that the acts or practices relate to employee records ‘held’ by the respondent relating to you.Therefore, I consider the respondent’s acts and practices, in relation to the records it held, are not covered by the APPs in the Privacy Act, and that the respondent has not interfered with your privacy under APP 6, APP 11 or APP 12 in this instance.As such, I am satisfied that the information stored on the work computer were [sic] employee records and that the ‘employee records’ exemption applies.(f)Importantly, the delegate then stated that in any event he was not satisfied that the employer had breached the APPs. (g)In relation to APP 12, the delegate referred to an email from the employer to the applicant dated 25 June 2019 which listed data that were sent to the applicant on USB storage devices, and an email from the applicant to the employer dated 4 July 2019 in which the applicant advised that he had received the data, save for the data associated with one email address. In relation to that data, the employer had asserted that it was available to the applicant in the cloud. The delegate concluded –Based on the above, there is a reasonable argument that the respondent has complied with APP 12 by providing you with access to the personal information in compliance with APP 12.1 or, in the alternative, that the respondent has complied with APP 12.5 by taking reasonable steps in the circumstances to give access in a way that meets the needs of both the entity and the individual, namely by pointing you to an alternative means of accessing the information – via the cloud.(h)In relation to APP 6, which related to the applicant’s claim that the employer had used his passwords to gain access to his personal email accounts, the delegate noted that the employer denied this claim, and had stated that the only email account which it had accessed was the applicant’s work email account. The delegate concluded –There is currently no evidence before me to suggest that the respondent has accessed your personal email account.(i)In relation to APP 11, which involved the applicant’s claim that the employer had used his personal data without his permission, the delegate concluded that there was no evidence that it did so.(j)Additionally, the delegate stated that he was of the view that further investigation was unlikely to provide the applicant with the remedy that he sought, which the delegate identified as access to the outstanding file, which I understand to mean the data associated with the private email account which was not returned on a USB device and which the employer claimed was available to the applicant on the cloud. The delegate relied on the advice of the employer that when a computer was returned, its hard drive would be re-formatted, and that in May the laptop computer had been reported by the employer to the police as having been stolen, together with other items. For these reasons the delegate accepted that the employer was unable to provide the applicant with access to the information which he sought.(k)Further, the delegate expressed the opinion that an investigation was not warranted. The delegate referred to the Office of the Australian Information Commissioner’s “Privacy Regulatory Action Policy” and the following circumstances –•there has been no interference with your privacy, as defined by the Privacy Act, as the employee records exemption applies•even if the employee records exemption does not apply, there are reasonable arguments that the respondent has not breached APP 6, APP 11 or APP 12•the respondent no longer holds the personal information you have requested, so any further remedy on that claim is unlikely to be achieved•there is no evidence to support further investigation of the APP 6 and APP 11 claims•an investigation is unlikely to elicit any further information or remedies.(l)The delegate concluded that further investigation of the applicant’s complaint was not warranted in all the circumstances, and foreshadowed his intention to exercise the Commissioner’s discretion under s 41(1) of the Act not to investigate the complaint further. The delegate stated that before making that decision, he invited the applicant to provide a response to the letter, should he wish to do so.The applicant’s response of 6 September 2021

Ratio Decidendi

Legal Principle Established

As to bias, the applicant confirmed during the hearing that he alleged apprehended bias, and not actual bias. The applicant submitted that he believed that there was bias by the delegate in not accepting evidence that he gave, and in not pursuing obvious questions that were raised, including further investigations into the applicant’s claims that challenged the authenticity of some of the documents that the employer had placed before the delegate.Consideration of Ground 1 – breach of the rules of natural justice Generally, administrative decision-makers owe a duty to afford natural justice, or procedural fairness, absent a clear legislative intention to the contrary: Minister for Immigration and Border Protection v WZARH [2015] HCA 40; 256 CLR 326 at [30] (Kiefel, Bell, and Keane JJ). No contrary legislative intention is disclosed by the Privacy Act. In relation to the right to be heard, the content of the duty to provide a fair opportunity to be heard is a function of the relevant statutory regime and the context of the relevant decision-making. As Mason J stated in Kioa v West [1985] HCA 81; 159 CLR 550 at 585 – In this respect the expression “procedural fairness” more aptly conveys the notion of a flexible obligation to adopt fair procedures which are appropriate and adapted to the circumstances of the particular case. The statutory power must be exercised fairly, that is, in accordance with procedures that are fair to the individual considered in light of the statutory requirements, the interests of the individual and the interests and purposes, whether public or private, which the statute seeks to advance or protect or permits to be taken into account as legitimate considerations.(Citations omitted.) An obligation to afford procedural fairness is therefore concerned with a fair procedure, and not with a fair outcome: SZBEL v Minister for Immigration and Multicultural and Indigenous Affairs [2006] HCA 63; 228 CLR 152 at [25] (Gleeson CJ, Kirby, Hayne, Callinan and Heydon JJ). What is involved includes a general requirement to give a person who is the subject of a decision the opportunity to put information and submissions to the decision-maker in support of an outcome that supports his or her interests, including “to rebut or qualify … adverse material from other sources which is put before the decision maker”: Commissioner for Australian Capital Territory Revenue v Alphaone Pty Ltd [1994] FCA 293; 49 FCR 576 at 591–2, cited with evident approval in SZBEL at [29] and in BRF038 v Republic of Nauru [2017] HCA 44; 349 ALR 67 at [59] (Keane, Nettle and Edelman JJ). Further, the concept of fairness is grounded in practical justice, as explained by Gleeson CJ in Re Minister for Immigration and Multicultural Affairs; Ex parte Lam [2003] HCA 6; 214 CLR 1 at [37] –Fairness is not an abstract concept. It is essentially practical. Whether one talks in terms of procedural fairness or natural justice, the concern of the law is to avoid practical injustice.