NX v Office of the Director of Public Prosecutions

[2005] NSWADT 74

CITATION:	NX v Office of the Director of Public Prosecutions [2005] NSWADT 74
DIVISION:	General Division
PARTIES:	APPLICANT NX RESPONDENT Office of the Director of Public Prosecutions
FILE NUMBER:	043071
HEARING DATES:	On the papers
SUBMISSIONS CLOSED:	11/03/2004
DATE OF DECISION:	04/04/2005
BEFORE:	Montgomery S - Judicial Member
APPLICATION:	Privacy - information protection principle - collection - unlawful - Privacy - information protection principle - disclosure to third party - Privacy - information protection principle - personal information - use
MATTER FOR DECISION:	Principal matter
LEGISLATION CITED:	Criminal Records Act 1991 Criminal Records Regulation 1999 Director of Public Prosecutions Act 1986 Privacy & Personal Information Protection Act 1998
CASES CITED:	FM v Vice Chancellor, Macquarie University [2003] NSW ADT 78 GV v Office of the Director of Public Prosecutions [2003] NSWADT 177 HW v Director of Public Prosecutions (No 2) [2004] NSWADT 73 KJ v Wentworth Area Health Service [2004] NSWADT 84 MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 Taikato v The Queen (1996) 186 CLR 454
REPRESENTATION:	APPLICANT In person RESPONDENT R Gray, solicitor
ORDERS:	1. I find that there have been contraventions of sections 9, 12(3) and 12(4) of the Privacy and Personal Information Protection Act 1998; 2. NX’s application for an award of damages is dismissed; 3. In my view no further order is warranted

1 NX is a private contractor who undertook work for the Office of the Director of Public Prosecutions (“the ODPP”) at various times during 2002 and 2003. He provided goods and services to the Property Services Branch of the ODPP and is neither a staff member nor a consultant.

2 In September 2003 a staff member of the Property Services Branch, Mr Weblin, told NX that the ODPP needed to run a criminal history check on him for security reasons. NX provided the details required for the check and the request for a criminal history check was sent to the NSW Police shortly afterwards. NSW Police undertook the check and provided a printout from the Computerised Operational Policing System (“the criminal history record”) to Mr Richardson, the ODPP’s Assistant Manager of Personnel Services. The criminal history record disclosed a "spent conviction" within the meaning of the Criminal Records Act 1991.

3 The definition of "spent conviction" is contained in sections 7 and 8 of the Criminal Records Act 1991. In general, eligible convictions under section 7 become "spent" according to section 8 when the "relevant crime-free period" has been completed. Section 10 provides that the "relevant crime-free period" is a period of not less than 10 consecutive years after the date of the person's conviction during which time he or she has not been convicted of an offence punishable by imprisonment and has not been in prison and not unlawfully at large.

4 The consequences of a conviction becoming spent are set out in section 12 of the Criminal Records Act 1991. One consequence is that the person the subject of the conviction is not required to disclose to any person, for any purposes, information concerning the spent conviction. A question relating to criminal history is deemed to relate only to convictions which are not spent; and references in Acts and statutory instructions to convictions are deemed to be references only to convictions which are not spent and a reference to a person's fitness or character in Acts and statutory instruments is not to be taken as permitting or requiring account to be taken of spent convictions.

5 There is some disagreement as to what happened after Mr Richardson received the criminal history record. Mr Richardson advised Mr Bridge, Manager of the Property Services Branch, of the result of the criminal history check. NX contends that Mr Bridge received a copy of the criminal history record. He stated that Mr Bridge told him that he had a full criminal history printout on NX in his possession and that he quoted verbatim a spent offence dating back to 1987.

6 NX points to a letter of 25 March 2004 from Mr Dart, Assistant solicitor for Public Prosecutions, as support for the assertion that Mr Bridge was given a copy of this document.

7 The ODPP maintains that Mr Bridge never received a copy of the criminal history record and maintains that Mr Dart’s letter is inaccurate. The ODPP’s position is that during the time the criminal history record was retained by the ODPP the only persons who accessed it were officers with the need to do so for the performance of their duties. It contends that Mr Richardson filed the document in his personal filing cabinet for about two weeks until he gave it to Mr McMahon, the manager with overall responsibility for the Property Services Branch and the Personnel Branch, so that it could be returned to NX. No evidence has been provided in support of this assertion or to contradict NX’s assertions.

8 The ODPP concedes that Mr Bridge told Mr Weblin that the criminal history record contained a "violence charge" and that NX could not work at the ODPP until further information was obtained. Mr Bridge then spoke with NX, advised him of the outcome of the criminal history check and sought further information from him. NX says that Mr Bridge told him that he could not work on ODPP premises without an escort.

9 NX asserted that the ODPP had breached the Criminal Records Act 1991 by conducting a criminal history search of a spent conviction and complained to Mr McMahon about the check. Mr McMahon advised NX that the ODPP was authorised to conduct a criminal history search extending back beyond 10 years and including spent convictions. NX disputed this interpretation of the law.

10 NX asserts that the release of the information regarding his spent conviction by Mr Bridge to Mr Weblin is an offence under section 13 of the Criminal Records Act 1991. He contends that Mr Bridge had no lawful right to be in possession of information regarding his spent conviction and disclosure of the information to Mr Weblin was not "reasonable" under the circumstances.

11 The ODPP subsequently introduced amended procedures relating to criminal history checks. Mr McMahon met with NX and apologised to him for any embarrassment caused and expressed regret for any inconvenience caused. Mr McMahon provided NX with the copy of the criminal history record held by the ODPP and told him that he would be welcome to provide services to the ODPP in the future. NX said he no longer wanted to work with the ODPP.

12 In December 2003 NX filed an application for review of conduct pursuant to section 53 of the Privacy and Personal Information Protection Act 1998 (“the PPIP Act”). He sought a written apology, a change in procedure and policy and damages if applicable. The review concluded that as a "contractor" NX was "staff within section 32 of the Director of Public Prosecutions Act 1986. As a result of the application of clause 4 of the Criminal Records Regulation 1999, which was then in force, the reviewer concluded that section 12 of the Criminal Records Act 1991 did not apply to NX. This meant that the ODPP could obtain evidence of NX’s spent convictions. The reviewer found that the ODPP had complied with the information protection principles ("IPPs") contained in sections 8, 9, 12, 17 and 18 of the PPIP Act, and that those contained in sections 10, 11 and 19 did not apply.

13 Clause 4(1) of the Criminal Records Regulation 1999 provided:

"Section 12 of the Act does not apply in relation to an application by a person for appointment or employment as an officer within the meaning of the Director of Public Prosecutions Act 1986."

14 NX filed an application for review in the Tribunal and alleged that the IPPs in sections 8, 9,10, 11, 12, 17, 18 and 19 of the PPIP Act had been breached. NX stated that he did not consider he was "staff' within section 32 of the Director of Public Prosecutions Act 1986 and that section 12 of the Criminal Records Act 1991 therefore applied. The ODPP subsequently conceded that issue. The Director of Public Prosecutions, Mr Cowdery QC, wrote to NX and acknowledged this concession and apologised to NX for the conduct of his officers.

The issues to be determined

15 The issues of the alleged breaches of IPPs and whether any penalty should flow from such breaches remain to be determined. Each of the parties has filed written submissions on these issues and this decision is based on written material provided without the need for the parties to attend a hearing in the matter.

16 The Criminal Records Act 1991 creates offences in relation to the disclosure and obtaining of information concerning spent convictions. These are not matters for this Tribunal.

17 It is not in dispute that the ODPP is a "public sector agency" for the purposes of the PPIP Act or that the criminal history record and information relating to it is "personal information" for the purposes of that Act.

18 NX initially stated that he did “not seek a monetary settlement in respect of ongoing work that I would have received but I would like the fact recognised that had the situation not occurred involving Mr Bridge it would have been highly likely I would have continued to provide goods and services to the department.” However, he subsequently advised that he is seeking damages of $25,000.

Section 8 - "Collection" of personal information

19 Section 8 of the PPIP Act embodies two broad prohibitions. First, by section 8(1) a public sector agency must not collect personal information unless it is collected for a "lawful purpose" that is directly related to a function or activity or the agency and the collection of the information is reasonably necessary for that purpose. Secondly, section 8(2) provides that a public sector agency must not collect personal information by "unlawful means."

20 The first limb of section 8 raises the issue of what "lawful purpose" means. The term is not defined in the PPIP Act and it has not been considered in the Tribunal in the context of section 8 of the PPIP Act.

21 The High Court in Taikato v The Queen (1996) 186 CLR 454 considered the meaning of the term "lawful purpose" in the context of section 545E (now renumbered as section 93FB) of the Crimes Act 1900. The issue there was whether the accused had a reasonable excuse for possessing a prohibited article or possessed it “for a lawful purpose". Brennan CJ, Toohey, McHugh and Gummow JJ said at 460:

"[L]awful purpose" in s 545E(2) should be read as a purpose that is authorised, as opposed to not forbidden, by law because that meaning best gives effect to the object of the section. The meaning of "lawful" depends on its context, as Napier J pointed out in Crafter v Kelly [1941] SASR 237 at 243. As a result, a "lawful purpose" may mean a purpose not forbidden by law or not unlawful under the statute that enacts the term: Bear v Lynch (1909) 8 CLR 592 at 600, 603, 606; or it can mean a purpose that is supported by a positive rule of law: Crafter [1941] SASR 237 at 243-245.

If the term has the former meaning, the defence of "lawful purpose" covers any purpose unless the legislation or the general law prohibits it. Thus, in Bear v Lynch (1909) 8 CLR 592 this Court held that a person who was playing cards on licensed premises with a lodger during prohibited hours was there for a "lawful purpose" because the legislation did not prohibit playing the card game. That decision can be contrasted with Windsor v Denastazi [1957] SR (NSW) 462 at 464-465 where the New South Wales Court of Criminal Appeal held that, under the Gaming and Betting Act 1912 (NSW), a person playing a lawful card game in a common gaming house was not there for a "lawful purpose" because all gaming in a common gaming house was prohibited under that Act.

As a general rule, interpreting "lawful purpose" in a legislative provision to mean a purpose that is not forbidden, rather than positively authorised, by law is the interpretation that best gives effect to the legislative purpose of the enactment. This is because statutes are interpreted in accordance with the presumption that Parliament does not take away existing rights unless it does so expressly or by necessary implication Potter v Minahan (1908) 7 CLR 277 at 304; Corporate Affairs Commission (NSW) v Yuill (1991) 172 CLR 319 at 322, 338; Coco v The Queen (1994) 179 CLR 427 at 436-437.

Nevertheless, the purpose, context or subject matter of a legislative provision may indicate that Parliament has used the term "lawful purpose" to mean a purpose that is positively authorised by law. That seems to be the best interpretation of the term in the present case.”

22 I agree with the ODPP submission that in the context of section 8 of the PPIP Act, "lawful purpose" should be given the first of the two meanings discussed by the High Court above. In the present case, the purpose for which the criminal history record was collected was to assess NX's suitability to perform work unsupervised at the ODPP office. Such a purpose is lawful. It follows, in my view, that the ODPP has not breached section 8(1) in this case.

23 Under the second limb of section 8 of the PPIP Act, the question is whether the collection of the criminal history record was by "unlawful means". The term "unlawful means" is not defined in the PPIP Act. The Oxford English Dictionary defines "unlawful" to mean, "contrary to law; prohibited by law; illegal".

24 There has been limited consideration of the meaning of the term in the Tribunal. In GV v Office of the Director of Public Prosecutions [2003] NSWADT 177, Robinson JM did not come to a definitive conclusion. At paragraph 47 of his reasons he said:

“I do not consider that a telephone call from the DPP clerk to the doctor requesting the further medical certificate constituted an "unlawful means" within the meaning of that expression in section 8(2). It was plainly lawful for her to pick up a telephone and make a request. …”

25 In forming this conclusion the Judicial Member appears to have adopted the dictionary definition and formed the view that the word "unlawful" should be taken as meaning a positive legal prohibition. This seems to me to be the correct approach.

26 If this approach is applied in the context of section 8(2) it follows that "unlawful means" refers to the collection of information by means that are prohibited by the law.

27 In the present case, section 14 of the Criminal Records Act 1991 provides for a positive legal prohibition in relation to accessing information on spent convictions. Section 14 provides that a person who, fraudulently or dishonestly, obtains or attempts to obtain information concerning a spent conviction from records of convictions kept by or on behalf of a public authority is guilty of an offence. The offence prescribed by section 13 of the Criminal Records Act 1991 relates only to disclosure of such information.

28 There is no evidence of fraud or dishonesty in the present circumstances. The criminal history record was collected because of a misunderstanding of the relevant statutory framework. Accordingly, in my view, the ODPP has not breached section 8(2) of the PPIP Act.

Section 9 - "Collection" of personal information from someone other than NX

29 Section 9 of the PPIP Act prohibits a public sector agency from collecting personal information otherwise than directly from the individual to whom the information relates unless the individual has "authorised" the collection of the information from someone else. In this case, it is clear that the ODPP collected the information from someone other than NX. The ODPP has conceded that NX did not authorise the collection of information relating to spent convictions.

30 It follows, in my view, that the collection was contrary to section 9 of the PPIP Act.

Sections 10 and 11 - Requirements when collecting personal information

31 In HW v Director of Public Prosecutions (No 2) [2004] NSWADT 73 I expressed the view that sections 10 and 11 of the PPIP Act apply only where a public sector agency collects information directly from the individual whom that information concerns. I remain of that view and as the information relating to NX’s spent convictions was collected from the NSW Police, these provisions have no application to this case.

Section 12 - Retention and security of personal information

32 Section 12 of the PPIP Act relates to the retention and security of personal information. A public sector agency that holds personal information must ensure:

(a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and

(b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and

(c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and

(d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.

33 I am inclined to agree with the ODPP’s argument that an applicant would bear the burden of adducing some evidence to suggest that his or her personal information was not securely stored as required by section12 of the PPIP Act. However, if that were the case the standard would not be high because the knowledge of how the information is stored is held by the agency. Common sense dictates that a person who has relevant material in their possession should put that material before the Tribunal. If facts are peculiarly within the knowledge of one party to an issue, a failure by that party to produce evidence as to those facts may lead to an unfavourable inference being drawn. In any event I am satisfied that in this matter NX has adduced sufficient evidence to raise concern with respect to the retention and security of his personal information.

34 The ODPP contends that Mr McMahon provided the only copy of the criminal history record to NX around two weeks after it was first collected. It submits that the information was kept for no longer than necessary. There is no evidence to suggest that this was not the case. Accordingly, in my view, the ODPP cannot be said to have breached the first limb of section 12 of the PPIP Act.

35 There are no special requirements for the disposal of this kind of personal information. As no copies of the criminal history record were retained by the ODPP, it follows that the information was disposed of securely. Accordingly, in my view, the ODPP cannot be said to have breached the second limb of section 12 of the PPIP Act.

36 As to the third limb of section 12, the ODPP submits that during the period in which the ODPP held the criminal history record it was at all times securely stored in the Personnel Services Branch in a location designated by Mr Richardson and with limited access to personnel staff. This directly contradicts evidence given by NX with respect to the conversation he had with Mr Bridge in which Mr Bridge told him that he had a full criminal history printout on NX in his possession. The ODPP has presented no evidence from Mr Bridge or anyone else to contradict this evidence given by NX. In the circumstances I accept NX’s evidence. In my view either Mr Richardson or someone in his area must have provided Mr Bridge with the criminal history record. If no copy was made of the criminal history record Mr Bridge must have been given the original.

37 Mr Bridge was the Manager of the Property Services Branch of the ODPP. It is arguable that it is reasonable for a person in that position to have access to information concerning individuals contracted to the ODPP. If the criminal history record had not contained information relating to NX’s spent convictions there would be no reason to be concerned about Mr Bridge having access to the information. However, the same would not apply to disclosure of NX’s personal information to Mr Weblin. NX says that Mr Weblin informed him that he had been made fully aware of the applicant's criminal history and that Mr Bridge had been in no way discreet. No evidence has been presented to rebut this evidence. I accept NX’s evidence. In my view provision of this information to Mr Weblin was unnecessary and was not reasonable in the circumstances. Accordingly, in my view, the ODPP has breached section 12(3) of the PPIP Act.

38 The fourth limb of section 12 is relevant in the circumstances of this case to the extent that NX’s personal information was given in connection with the services NX supplied to the ODPP. For the same reasons given in relation to section 12(3) it cannot be said that everything reasonably within the power of the agency was done to prevent unauthorised use or disclosure of the information. Accordingly, in my view, the ODPP has also breached section 12(4) of the PPIP Act.

Section 16 - check accuracy of personal information before use

39 Section 16 of the PPIP Act provides that public sector agencies must not "use" personal information unless they have taken such steps as are reasonable in the circumstances to ensure that the personal information is relevant, accurate, up to date, complete and not misleading, having regard to the purpose for which the information is proposed to be used.

40 In FM v Vice Chancellor, Macquarie University [2003] NSW ADT 78, Hennessy DP applied the Macquarie Dictionary definition of "use" to conclude that "use" meant "to avail one's self; apply to one's own purposes". I remain of the view that I expressed in MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 when I said at paragraph 162:

“162 I agree with the Agency’s position that, on the ordinary meaning of the word “use”, it is necessary to do more with the information than to access it and view what is contained in it. It is necessary to employ the information for some purpose, not merely to access it. The issue then is whether a broader definition of the word is to apply. Again I agree with the Agency’s position in that I prefer the approach adopted by the Deputy President in FM v Macquarie University . In my view, this definition takes into account the overall framework within which the information protection principles were developed. Further, I see no reason why "use" should have different meanings in section 16 and 17.”

41 In this matter the ODPP "used" NX’s personal information in that Mr Bridge took it into account in forming a view as to NX’s suitability to carry out work for the ODPP. It is not in dispute that Mr Bridge discussed the contents of the criminal history record with NX and sought his comment about it. I am satisfied that in doing so he took reasonable steps to ascertain the relevance and currency of the information. I accept that the steps taken by the ODPP to comply with the requirements of section 16 of the PPIP Act were reasonable in the circumstances. Accordingly, the ODPP has not breached the IPP contained in section 16 of the PPIP Act.

Section 17 – limits on use of personal information

42 Section 17 of the PPIP Act establishes a general rule that a public sector agency may use personal information only for the purpose for which it was collected. The section also provides for exceptions to that rule. In the present case I am satisfied that the criminal history record was collected for the purpose of assessing NX's suitability for engagement as a contractor to work unsupervised on the ODPP premises. I am also satisfied that it was used only for that purpose. Accordingly, the ODPP has not breached the IPP contained in section 17 of the PPIP Act.

Section 18 - limits on the disclosure of personal information

43 Section 18 of the PPIP Act imposes limits on the disclosure of personal information held by a public sector agency. Section 18(1) provides that a public sector agency that holds personal information must not disclose the information other than in the limited circumstances outlined in the section.

44 Generally speaking the expression “disclosure” refers to making personal information available to people outside an agency. In KJ v Wentworth Area Health Service [2004] NSWADT 84 I identified what I considered to be an exception to this approach ie “large public sector agencies consisting of specialised units”. The ODPP is not the kind of agency that would fall into that exception. On the evidence before me I am satisfied that the ODPP did not disclose information relating to NX's criminal history to anyone outside of the ODPP. In the circumstances I am satisfied that the ODPP has not breached the IPP contained in section 18 of the PPIP Act.

Section 19 - Special restrictions on disclosure of personal information

45 Section 19 of the PPIP Act generally prohibits a public sector agency from disclosing personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical belief, trade union membership or sexual activities. Criminal history information is not information of a kind referred to in section 19. Accordingly, section 19 has no application to the present matter.

Damages

46 NX seeks an award for damages on the basis that he would have remained available to provide goods and services to the ODPP had the situation regarding the criminal history record not occurred, and that it is likely that he would have received ongoing work from the ODPP. He stated that for the period 4/6/02 to 10/09/03 he received approximately $7,000 in respect of the supply of goods and services, less material costs. He assessed his damages in the sum of $25,000.

47 Section 55 of the PPIP Act contemplates a two-step process in considering a damages award. Firstly, the statutory criteria upon which a damages award is based must be satisfied; and secondly, if these statutory criteria are satisfied, the Tribunal retains discretion as to whether or not to award damages.

48 Before a damages award can be made under section 55 of the PPIP Act, the Tribunal must be satisfied that an applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency. NX can therefore only recover damages for loss that has already been suffered. Compensation for loss which is likely to occur, or which is reasonably foreseeable but which has not yet been sustained is not recoverable because it travels beyond the statutory language. Further, a causal connection is required between the loss and the conduct of the public sector agency.

49 The PPIP Act is silent on the question of who bears the onus of proof. However, section 55(4)(b) of the PPIP Act provides that the Tribunal may only award damages if it is "satisfied" that the applicant has suffered loss of a defined type because of the agency's conduct. The word "satisfied" imports into the PPIP Act a standard of proof requirement in the context of applications for damages. The facts as to what if any loss NX has suffered are peculiarly within his knowledge. In that case common sense dictates that he must produce evidence as to that loss.

50 NX has not produced evidence to support his assertion that he has suffered any financial loss or psychological harm. He has pointed to his previous earnings but he has only speculated about the extent of his loss. In contrast the ODPP asserts that it has offered only two jobs to a locksmith since 17 September 2003. The first job related to the cutting of 10 duplicate keys for which payment of $30 was made on 2 August 2004. The second job involved the cutting of 7 duplicate keys for which payment of $21 was made on 16 August 2004. This would suggest that, put at its highest, NX’s financial loss from work that he may have been offered by the ODPP would be no more than $51. In order to have been offered this work he would have had to provide a competitive tender. In the circumstances I cannot be satisfied that NX has suffered more than the possibility of this financial loss.

51 In any event NX does not meet the statutory requirement of causality because the evidence shows that it was NX's decision to refuse to undertake any future ODPP work. The ODPP had made it clear to NX that it would employ him in the future if he provided a competitive tender.

52 There is no evidence to suggest that NX has suffered either psychological or physical harm. Accordingly, I am not satisfied that a damages award can be made under section 55 of the PPIP Act.

Actions taken by the ODPP

53 In his original application for review of conduct pursuant to section 53 of the PPIP Act NX sought a written apology, a change in procedure and policy and damages if applicable. The ODPP implemented new procedures on 16 September 2003. On 17 September 2003 Mr McMahon apologised in person to NX. In the light of directions from Mr Cowdery, the new procedures were amended in July 2004 so that they now reflect the law. On 29 July 2004 Mr Cowdery offered a written apology to NX.

54 I note that in the Tribunal proceedings the ODPP has made a number of concessions in a timely manner and has generally behaved as a responsible litigant. In the circumstances it is my view that no further order is warranted.

Orders

1. I find that there have been contraventions of sections 9, 12(3) and 12(4) of the Privacy and Personal Information Protection Act 1998.

2. NX’s application for an award of damages is dismissed.

3. In my view no further order is warranted.