Nicholson v Federal Privacy Commissioner
[2010] FMCA 716
•16 September 2010
FEDERAL MAGISTRATES COURT OF AUSTRALIA
| NICHOLSON v FEDERAL PRIVACY COMMISSIONER & ANOR | [2010] FMCA 716 |
| ADMINISTRATIVE LAW – Application to review decision of the Office of the Privacy Commissioner – jurisdiction of the Privacy Commissioner – application for review dismissed. |
| Administrative Decisions (Judicial Review) Act 1977, s.16(1) Employment Services Act 1994, ss.4, 58(1) and Part 4.3 Privacy Act 1988, ss.6, 7, 27(1), 13A(1)(c)(ii), 36, 41(1) |
| Ayan v Minister for Immigration and Multicultural Affairs (2003) 196 ALR 332 Nicholson v Federal Privacy Commissioner & Anor [2010] FMCA 190 Rashid v Minister for Immigration and Citizenship [2007] FCAFC 25 Re Wakim; Ex Parte McNally [1999] HCA 27; 198 CLR 511; (1999) 163 ALR 270; (1999) 73 ALJR 839; (1999) 24 Fam LR 669 |
| Applicant: | EVELYN NICHOLSON |
| First Respondent: | FEDERAL PRIVACY COMMISSIONER |
| Second Respondent: | ADULT MULTICULTURAL EDUCATION SERVICES |
| File Number: | MLG 170 of 2010 |
| Judgment of: | Riethmuller FM |
| Hearing date: | 13 May 2010 |
| Date of Last Submission: | 13 May 2010 |
| Delivered at: | Melbourne |
| Delivered on: | 16 September 2010 |
REPRESENTATION
| Counsel for the Applicant: | The applicant appearing in person |
| Solicitors for the First Respondent: | Mr Rogers – Australian Government Solicitor |
| Solicitors for the Second Respondent: | No appearance by or on behalf of the Second Respondent. |
ORDERS
The application for review is dismissed.
| FEDERAL MAGISTRATES COURT OF AUSTRALIA AT MELBOURNE |
MLG 170 of 2010
| EVELYN NICHOLSON |
Applicant
And
| FEDERAL PRIVACY COMMISSIONER |
First Respondent
| ADULT MULTICULTURAL EDUCATION SERVICES |
Second Respondent
REASONS FOR JUDGMENT
Background
The application concerns the applicant’s complaint to the Privacy Commissioner alleging the Adult Multicultural Education Service (‘AMES’) interfered with her privacy. In January 2010 the Assistant Privacy Commissioner found that AMES was not within the jurisdiction of the Privacy Act 1988.
On 25 March 2010 an application to summarily dismiss the applicant’s application for judicial review was refused: see Nicholson v Federal Privacy Commissioner & Anor [2010] FMCA 190.
For an act to be an interference with privacy within the meaning of the Privacy Act, it must be carried out by an entity or person covered by the Act. Such an entity can be a ‘contracted service provider’, an ‘organisation’, or an ‘agency’: see ss. 27(1) and 13A(1)(c)(ii). In the interlocutory judgment I found that AMES was not an ‘organisation’ as defined in the Act.
However, the precise relationship between AMES and the Commonwealth via the Department of Education, Employment, and Workplace Relations (‘DEEWR’) was then unclear. The nature of this relationship needed to be ascertained in order to determine whether AMES is an ‘agency’ within the meaning of the Act. The parties were given an opportunity to provide evidence to establish whether AMES is within the jurisdiction of the Act.
The Law
Section 27(1) of the Act sets out the Commissioner’s functions in relation to interferences with privacy:
27. [Functions of Commissioner in relation to interferences with privacy]
(1) Subject to this Part, the Commissioner has the following functions:
(a)to investigate an act or practice of an agency that may breach an Information Privacy Principle and, where the Commissioner considers it appropriate to do so, to endeavour, by conciliation, to effect a settlement of the matters that gave rise to the investigation;
…
(ab) subject to Part V – to investigate an act or practice of an organisation that may be an interference with the privacy of an individual because of section 13A and, the Commissioner considers it appropriate to do so, to attempt, by conciliation, to effect a settlement of the matters that gave rise to the investigation;
… (emphasis added)
Subsection 6(1) of the Act provides a definition for the word ‘agency’:
6. [Interpretation]
(1) In this Act, unless the contrary intention appears:
…
"agency" means:
(a) a Minister; or
(b) a Department; or
(c) a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a Commonwealth enactment, not being:
(i) an incorporated company, society or association; or
(ii) an organisation that is registered under the Fair Work (Registered Organisations) Act 2009 or a branch of such an organisation; or
(d)a body established or appointed by the Governor-General, or by a Minister, otherwise than by or under a Commonwealth enactment; or
…
(i) an eligible case manager; or
…
Appointed by, or under, a Commonwealth enactment?
In the interlocutory judgment I concluded that AMES is not a body ‘established’ for a public purpose by or under a Commonwealth enactment pursuant to s.6(1)(c) as it is a state authority established under Victorian legislation: see paras [13], [18] of Nicholson v Federal Privacy Commissioner & Anor [2010] FMCA 190.
The issue at present is whether AMES is a body ‘appointed’ for a public purpose by, or under, a Commonwealth enactment.
AMES was part of the Job Network, a national network of organisations that specialised in assisting unemployed people to find and obtain jobs. In her affidavit dated 3 May 2010 Ms Dianne Fletcher of DEEWR gave evidence that the Job Network providers, including AMES, provided services pursuant to employment services contracts made with the Commonwealth (‘the Job Network contract’). The Commonwealth through DEEWR entered into these contracts by exercising its executive powers. Therefore, the Job Network was not a scheme based on specific legislative requirements.
Counsel for the first respondent, however, was unable to identify the statutory authority that allowed the Commonwealth to operate the Job Network scheme and to engage AMES as a Job Network provider. Counsel argued that the basis for the Commonwealth to enter into the contracts was through its ordinary and independent executive powers. I find it surprising that a Commonwealth agency (the statute under which it is established not being identified), would enter into contracts and expend Commonwealth funds to operate a scheme without any legislative basis. This was the substance of the first respondent’s submissions:
‘…if…there was a provision in what was the Employment Services Act, which has now been repealed, which provided that a body, called ESRA, could contract with a case manager to provide certain services. And in that scenario, your Honour, that body would have been appointed under an enactment because that statutory provision gave the Commonwealth the authority to make the contract. In this case, the job network is independent of any legislative scheme. So the effect is that AMES appointment – if it is an appointment – as a job network provider, is not one under a legislative scheme. It’s not under a Commonwealth enactment.’ [emphasis added]
As there is no statutory basis for the contractual relationship between AMES and the Commonwealth, AMES cannot be regarded as a body appointed (for a public purpose) by or under a Commonwealth enactment. It is therefore not an agency within the meaning of the Act.
Eligible case manager
The second issue before the Court is whether AMES could be an ‘agency’ by virtue of being an ‘eligible case manager’ within the meaning of the Privacy Act.
6. [Interpretation]
…
"eligible case manager" means an entity (within the meaning of the Employment Services Act 1994 ):
(a) that is, or has at any time been, a contracted case manager within the meaning of that Act; and
(b) that is not covered by paragraph (a), (b), (c), (d), (e), (f), (g) or (h) of the definition of agency .
The meaning of contracted case manager is set out in s.4 of the Employment Services Act 1994.
4. [Definitions]
…
contracted case manager means an accredited case manager engaged under section 58.
…(emphasis added)
The engagement of an accredited case manager is set out in s.58(1) of the Employment Services Act 1994:
58. [Contracted case managers]
Engagement
(1) ESRA [Employment Services Regulatory Authority] may engage an accredited case manager to:
(a) provide case management services to participants in the case management system referred to the accredited case manager under Part 4.3; and
(b) perform functions conferred on case managers under this Act.
An accredited case manager engaged under this section is to be known as a contracted case manager.
The scope of an eligible case manager’s conduct as set out in s.58(1) of the Employment Services Act is consistent with the meaning of the Privacy Act:
7. [Acts and practices of agencies, organisations etc.]
(1) Except so far as the contrary intention appears, a reference in this Act (other than section 8) to an act or to a practice is a reference to:
…
(cb) an act done, or a practice engaged in, as the case may be, by an eligible case manager in connection with:
(i) the provision of case management services (within the meaning of the Employment Services Act 1994 ) to persons referred to the eligible case manager under Part 4.3 of that Act; or
(ii) the performance of functions conferred on the eligible case manager under that Act; or
…(emphasis added)
Ms Fletcher’s evidence indicates AMES provided job networking services pursuant to its contract with the Commonwealth. The job networking services were not provided as services offered to individuals that were referred to case managers under Part 4.3 of the Employment Services Act.
Neither was such service offered as a result of a case manager performing his or her functions under the Employment Services Act 1994. The alleged breach of the applicant’s privacy occurred on the 14 December 2006. However, the Employment Services Act 1994 was repealed on 7 April 2006, predating the acts alleged against AMES.
Therefore, AMES is not an eligible case manager within the meaning of the Privacy Act.
Contracted service provider
Section 13A(1)(c)(ii) of the Privacy Act, makes it clear that a ‘contracted service provider’ (‘CSP’) must be an ‘organisation’. In the interlocutory judgment I found AMES was not an organisation within the meaning of the Act. As pointed out in the first respondent’s submissions, given that AMES is not an organisation, it is not a CSP for the purposes of the Act.
However, the first respondent’s material in relation to the Job Network contract raises an interesting issue. The privacy clauses within the contract attempt to place AMES within the ambit of the Act:
23.3 [Privacy obligation]
The Provider agrees to be treated as a contracted service provider in respect to the conduct of a Service under this Contract:
…
(d) to notify individuals whose Personal Information it holds, that complaints about its acts or practices may be investigated by the Privacy Commissioner who has power to award compensation against the Provider in appropriate circumstances
…(emphasis added)
Under clause 23.3 of the contract the term ‘contracted service provider’ has the same meaning as in s.6 of the Privacy Act.
Importantly, clause 23.5 has the following notation:
Note: The Commonwealth Privacy Commissioner will have jurisdiction to investigate a complaint in connection with the Services provided under this Contract even after the Contract has expired or been terminated. (emphasis added)
The question that arises is whether the parties can contractually vest jurisdiction on the Privacy Commissioner under the Act. It is clear that the states cannot vest judicial power on a Commonwealth Court: see Re Wakim; Ex Parte McNally [1999] HCA 27; 198 CLR 511; (1999) 163 ALR 270; (1999) 73 ALJR 839; (1999) 24 Fam LR 669. It is also clear that parties cannot vest administrative power in a Commonwealth agency beyond its mandate, otherwise Commonwealth departments could be burdened with all manner of responsibilities by citizens generally.
It does not appear to me that it is open to parties to a contract (even if one is the Commonwealth Executive) to confer administrative or investigatory powers upon a Commonwealth agency beyond that specifically set out in the legislation establishing the agency, unless that was contemplated by the relevant legislation. To do so would be to usurp the function of the legislature.
What rights, if any, this clause of the contract may confer on the applicant at common law is not the issue I must determine. Similarly, it is not for me to speculate as to the views of the Ombudsman or relevant Minister with respect to this issue.
The Privacy Commissioner’s power to cease investigating a complaint
Counsel for the first respondent states that the applicant made a complaint under s.36 of the Privacy Act. Section 36 provides, subject to certain qualifications, an individual may complain to the Privacy Commissioner about an act or practice that may be an interference with his/her privacy. Counsel argues:
The Commissioner has to investigate whether, in fact, it may have been an interference with the privacy of the individual, and section 41 gives the Commissioner the power, if satisfied that the act or practice is not an interference, to cease investigating. (emphasis added)
Section 41(1) is set out as follows:
41. [Circumstances in which Commissioner may decide not to investigate or may defer investigation]
(1) The Commissioner may decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under section 36, or which the Commissioner has accepted under subsection 40(1B), if the Commissioner is satisfied that:
(a) the act or practice is not an interference with the privacy of an individual;
…
A reading of s.27(1)(a) and (ab) shows that the Commissioner is given the power to investigate the alleged breach of privacy if the relevant act or practice is engaged by an entity covered by the Act: an agency, an organisation or a contracted service provider. If the entity is not within the ambit of the Act, the Commissioner has no jurisdiction to investigate the complaint. In such a case, the power to cease investigating (in the words of counsel for the first respondent) does not arise. Once it is clear the Commissioner has no jurisdiction that is the end of the matter as it is beyond the process of the Commissioner.
Whether remitting the matter would be futile
Counsel for the first respondent submitted that even if AMES was within the ambit of the Act, there was no interference with the applicant’s privacy. It was submitted it was therefore not appropriate to remit the matter and the Court should not exercise its discretion to grant relief under s.16(1) of the Administrative Decisions (Judicial Review) Act 1977.
By letter dated 8 December 2009 (‘preliminary letter’), a delegate from the Office of Privacy Commissioner advised the applicant that even if AMES was within the jurisdiction of the Act, she was not satisfied that the collection of the applicant’s personal information was improper. The delegate addressed each allegation raised by the applicant. However, the letter did state:
‘This is a preliminary view and does not constitute the Commissioner’s final view about your complaint’.
By letter dated 11 January 2010 the decision-maker, the Assistant Privacy Commissioner, notified the applicant of the final decision (‘final decision letter’). The first respondent submits this letter included the reasons set out in the preliminary letter. The final decision letter stated that the decision-maker had considered the file and concurred with the delegate’s opinion as expressed in the preliminary letter.
Whether or not a document records the decision maker’s reasons is a question of fact: Rashid v Minister for Immigration and Citizenship [2007] FCAFC 25 at [17], citing Ayan v Minister for Immigration and Multicultural Affairs (2003) 196 ALR 332.
Looking at the final decision letter I am not satisfied that it referred to and concurred with the delegate’s view that there was no interference with the applicant’s privacy:
‘Firstly, I have carefully considered the file and I concur with [the delegate’s] opinion on this matter. As AMES is neither an organisation nor a contracted service provider under the Act, it is not within our jurisdiction. I understand that this concerns you. However, we are unable to take further action on this matter.
…
I understand that you are disappointed with this outcome, and that you feel you should receive compensation by AMES for a number of reasons. As this Office does not have jurisdiction to handle this matter, we are not able to take further action on your complaint.
For this reason, I have decided under section 41(1)(a) of the Act to cease investigation of this matter on the grounds that in my view, AMES is not within the jurisdiction of this Office, and thus it cannot be found in breach of the Act. My file on this matter is closed.’ (emphasis added)
Taken in context, the decision-maker’s reference and concurrence to the delegate’s opinion in the preliminary letter was confined to one issue: AMES was not within the ambit of the Act. I do not accept that the statement that the decision-maker ‘concurred with [the delegate’s] opinion on this matter’ was made in an absolute sense. The final decision letter referred to the jurisdiction issue but was silent on the delegate’s views as to whether the complained conduct amounted to a breach of privacy.
However, in light of my findings as to jurisdiction, it makes no difference in this case.
Conclusion
On the material before me I find AMES is not within the ambit of the Privacy Act by virtue of being a contracted service provider as stipulated in the Job Network contract. The application is therefore dismissed.
I certify that the preceding thirty-six (36) paragraphs are a true copy of the reasons for judgment of Riethmuller FM
Date: 16 September 2010
0
5
3