TYGJ and Freedom of Information Division - [2017] AATA 1560

TYGJ and Freedom of Information Division [2017] AATA 1560 (27 September 2017)

Division:Freedom of Information Division
File Number(s): 2014/6300
Re:TYGJ
APPLICANT

AndInformation Commissioner
RESPONDENT
Secretary, Department of Veterans’ Affairs
JOINED PARTY

DECISION

Tribunal:Deputy President S A Forgie
Date:27 September 2017
Place:Melbourne

The Tribunal decides to:

set aside the decision of the respondent dated 13 November 2014; and
substitute a decision to make a determination dismissing the complaint dated 21 November 2011.

.........[sgd]............................................................

Deputy President S A Forgie

Catchwords

PRIVACY – whether breach of Information Privacy Principles – compensation claim by serving member of Australian Defence Force - disclosures of personal information to a senior medical officer, the Head of Joint Health Command in the Department of Defence and to the Chief of Air Force – whether information of that kind usually passed on - whether disclosure necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another – whether disclosure required or authorised under law – decision set aside

Legislation

Administrative Appeals Tribunal Act 1975 ss 25, 27, 30, 37, 43
Defence Force Discipline Act 1982 ss 3, 33, 60, 61
Freedom of Information Act 1982 s 93A
Migration Act 1958 ss 499
Military Rehabilitation and Compensation Act 2004 ss 324, 328, 409
Occupational Health and Safety (Commonwealth Employment) Act 1991 s 16
Privacy Act 1988 ss 6, 13, 36, 37, 40, 41, 52, 72, 96; and Sch 1 and IPP 11
Privacy Amendment (Enhancing Privacy Protection) Act 2012 ss 2, 3; and Schs 1, 4, 6
Safety, Rehabilitation and Compensation Act 1988 ss 89A, 89C
Statute Law Revision Act (No.1) 2015 s 3, Sch 2
Veterans’ Entitlements Act 1986
Work Health and Safety (Transitional and Consequential Provisions) Act 2011 ss 2, 3; and Schs 1, 2

Military Rehabilitation and Compensation Regulations 2004 r 21

Cases

Al-Kateb v Godwin [2004] HCA 37; (2004) 219 CLR; 562; 208 ALR 124

Australian Crime Commission v AA Pty Ltd [2006] FCAFC 30; 149 FCR 540

Bochenski v Minister for Immigration and Border Protection [2017] FCAFC 68

Chief of the General Staff v Stuart [1995] FCA 1746; (1995) 58 FCR 299

‘DO’ and Department of Veterans’ Affairs [2014] AICmr 124

Fagan v Crimes Compensation Tribunal [1982] HCA 49; (1982) 150 CLR 666

Minister for Aboriginal Affairs v Peko-Wallsend Ltd [1986] HCA 40; (1986) 162 CLR 24; 66 ALR 299

Mocicka v Chief of Army [2003] ADFDAT 1

Plaintiff S157/2002 v Commonwealth [2003] HCA 2; (2003) 211 CLR 476; 195 ALR 24; 72 ALD 1

Project Blue Sky Inc v Australian Broadcasting Authority [1998] HCA 28; (1998) 194 CLR 355; 72 ALJR 841; 153 ALR 490

Ray v Superannuation Complaints Tribunal [2004] FCA 1120

Re Drake and Minister for Immigration and Ethnic Affairs (No 2) (1979) 2 ALD 634

Re Skase and Minister for Immigration and Multicultural and Indigenous Affairs [2005] AATA 200

Re TYGJ and Privacy Commissioner and Secretary, Department of Veterans' Affairs (Party Joined) [2015] AATA 112

Shi v Migration Agents’ Registration Authority [2008] HCA 31; (2008) 235 CLR 286; 248 ALR 390; 48 AAR 345; 103 ALD 467; 82 ALJR 1147

Surinakova v Minister for Immigration and Ethnic Affairs [1991] FCA 596; (1991) 33 FCR 87; 26 ALD 203

The Hospital Benefit Fund of Western Australia Inc v Minister for Health, Housing and Community Services [1992] FCA 599; (1992) 39 FCR 225; 111 ALR 1; 28 ALD 50; 16 AAR 566

The Queen v Australian Broadcasting Tribunal and Others; Ex Parte Hardiman [1980] HCA 13; (1980) 144 CLR 131

Yager v The Queen (1977) 139 CLR 28

Secondary Materials

Chambers 21st Century Dictionary, 1999, reprinted 2004, Chambers
Diagnostic and Statistical Manual of Mental Disorders Fourth edition, Text Revisions,
Guidelines on the Protection of Privacy and Transborder Flows of Personal Data, Council of the Organisation for Economic Co-operation and Development
Macquarie Dictionary, revised 3rd edition, 2001, The Macquarie Library Pty Ltd
Shorter Oxford English Dictionary, Fifth edition, 2002, Oxford University Press
Washington, DC, American Psychiatric Association, 2000
Partners in Defence English Guidelines to Information Privacy Principles 8-11

Privacy Bill 1988, Second Reading Speech

REASONS FOR DECISION

Deputy President S A Forgie

On 21 November 2011, TYGJ lodged a complaint with the Information Commissioner (Commissioner) under the Privacy Act 1988 (Privacy Act) against the Department of Veterans’ Affairs (DVA). TYGJ alleged that DVA had breached the Information Privacy Principles established under the Privacy Act on three occasions in October 2011 when it disclosed his personal information in three separate disclosures. In a decision dated 13 November 2014, the Information Commissioner determined that DVA had interfered with the complainant’s privacy by disclosing his personal information, in breach of Information Privacy Principle (IPP) 11.1 of the Privacy Act.[1]
[1] Re Do and Department of Veterans’ Affairs [2014] AICmr 124

BACKGROUND

In this section of my reasons, I will set out a broad outline of the events leading to TYGJ’s complaint to the Commissioner. Those broad facts are not in dispute between the parties.

TYGJ enlisted in the Royal Australian Air Force (RAAF) in August 2001 and so was a member of the Australian Defence Force (ADF). He remained a serving member at the time of the disclosures in issue in this case. As such, his treating health care provider was located within the Defence structure. As a result of injuries he has suffered, he claimed compensation from the Department of Veterans’ Affairs (DVA). Following what he regards as a less than satisfactory response and service by DVA to his claims and some time in or about September 2011,[2] TYGJ created a website on which he outlined his criticism of DVA and wrote to it expressing his dissatisfaction. He has since taken it down.[3] During September and October 2011, TYGJ expressed his assessment of his engagement with DVA and its staff in a series of communications with its officers. Those communications were made by way of email, phone and sms text messaging.
[2] Transcript, 30 March 2016 at 253 and see email sent by TYGJ at 12:12pm on 30 September 2011
[3] He took the website down on or about the day on which the result of the 2013 Federal election was announced and the Coalition government was elected. That was so “… because the whole intent and purpose of the site essentially was to talk about how Labor was essentially screwing veterans over.”: Transcript 30 March 2016 at 256-257.

Against this background, DVA took several steps, to which I will return later in these reasons. As a result of those steps, TYGJ complained to DVA that it had breached Information Privacy Principle 11.1 in three ways:
Claim 1 (Disclosure 1): On 20 October 2011, it had disclosed his personal information to an ADF Senior Medical Officer (SMO).[4]
[4] The disclosure is set out at Exhibit JP1 at [27] and repeated at [167] below

Claim 2 (Disclosure 2): On 20 October 2011, DVA had disclosed his personal information to the Head of Joint Health Command in the Department of Defence.[5]

Claim 3 (Disclosure 3): On 28 October 2011, DVA had disclosed his personal information to the Chief of Air Force.[6]

TYGJ sought an apology from DVA together with compensation for their deliberate and reckless disregard of his privacy.[7]

[5] The disclosure is set out at T4 at 47-48 and Exhibit JP1 at [28] repeated at [170] below

[6] The disclosure is set out at Exhibit A at A-232-233 and repeated at [206] below. Documents lodged under s 37 of the Administrative Appeals Tribunal Act 1975 (T documents); T3 at 18

[7] T documents; T3 at 18

On 21 November 2011, TYGJ lodged a complaint with the Commissioner under s 36 of the Privacy Act. He stated that DVA had disclosed his personal information to third parties. He asked the Commissioner to investigate.[8]
[8] T documents; T3 at 11-12

After investigating the complaint, the Commissioner set out a summary of events that had occurred before TYGJ lodged his complaint. He did so in dot point form in relation to events extending over five days from 19 October 2011 to 28 October 2011. Eighteen of those dot points related to actions taken by DVA from 20 to 28 October and I will come back to them. I will also return to the first dot point which related to the actions taken by TYGJ. It stated that:
“The complainant sent emails and text messages to the work email addresses and work mobile phones of Departmental staff that were drawn to the attention of the Department. …”[9]

In support of this summary, the Commissioner referred in a footnote to a File Note dated 22 October 2011 by the Acting General Manager Support. I have set out the text of that File Note as well as the text of emails exchanged between TYGJ and officers of DVA below.[10]

[9] T documents; T2 at 10c

[10] The File Note is found at T documents; T4 at 47-48 and is reproduced at [203] below

The Commissioner made the following determination in DO and Department of Veterans’ Affairs:[11]
“107. I declare in accordance with s 52(1)(b)(i)(B) of the Privacy Act that the complainant’s complaint is substantiated and that the Department breached IPP11.1 by disclosing the personal information of the complainant.
108.I declare in accordance with s 52(1)(b)(ii) of the Privacy Act that:
·The Department shall apologise in writing to the complainant within two weeks of this determination; and
·The Secretary will initiate a review of the management of privacy complaints within the Department and advise me of the results of the review no later than two months from the date of this determination. In undertaking this review, particular consideration should be given to the steps undertaken by the Department in handling this matter.”[12]
[11] [2014] AICmr 124
[12] T documents; T2 at 10u

In accordance with the Commissioner’s decision, the Secretary of DVA wrote to TYGJ on 21 November 2014. After referring to TYGJ’s complaint, Mr Lewis PSM, the Secretary wrote:
“I note that the Australian Privacy Commissioner has now made a determination on the matter … The Commissioner found that the disclosures made were inappropriate as he considered your behaviour did not present a sufficiently serious and imminent threat, in spite of medical advice received by the Department and the concerns raised by staff. The Commissioner also found no basis under the Defence Force Discipline Act 1982 to authorise the disclosure action where investigative action under that Act had not been initiated by Defence. However, the Commissioner further found that the disclosure in respect of your contact with the former Minister was lawful.
I advise that the Department will not be seeking a review of the Commissioner’s findings. In accordance with the Commissioner’s determination, I apologise on behalf of the Department for any distress that these disclosures may have caused.
I note you have discontinued your contact with the Department in relation to these issues and trust that this letter represents an end to the matter.”[13]
[13] T documents; T21 at 151

Also in accordance with the Commissioner’s decision, DVA undertook a review of its management of privacy complaints. It did so by engaging the services of a private law firm. In relation to its current procedures, the review concluded that DVA’s:
“2) … procedures in handling privacy complaints are satisfactory and appear to have significantly evolved and improved since the time that the complaint was made in 2011, including:
a)the creation of the Information Law Section within the Legal Services, Assurance & Deregulation Branch with responsibility for privacy complaints; and
b)the recent adoption by the Information Law section of a sophisticated software-based system for tracking and managing privacy complaints.
3)Nevertheless, there are some improvements that the Department could still make both in relation to its privacy complaints process and its personal information handling practices more generally. The review recommended, in line with best practice in the handling of privacy issues, that the Department provide additional targeted training to relevant staff and to develop further specific privacy-related documentation and procedures.
I have carefully considered the report and accepted all findings of the review. … I have asked for a briefing … with the view all recommendations will be fully implemented within the coming months.”[14]
[14] T documents; T22 at 153

THE ISSUES

In my earlier decision,[15] I decided that the effect of TYGJ’s application for review was to put in issue all matters arising from the complaint he made to the Commissioner. He could not choose to leave the Commissioner’s declaration undisturbed and seek review only of the amount of compensation he was awarded by the Commissioner. Therefore, the issues that arise for consideration on review of the Commissioner’s determination are:
[15] Re TYGJ and Privacy Commissioner and Secretary, Department of Veterans' Affairs (Party Joined) [2015] AATA 112
(1)whether DVA breached IPP11.1 by disclosing TYGJ’s personal information on the three occasions to which each of the three complaints relates:
(a)Resolution of this issue will require consideration of whether DVA’s disclosures were excluded from the obligation imposed by Principle 11.1 in accordance with one or other of IPP11.1(a), (c), (d) or (e):
(i)whether TYGJ is reasonably likely to have been aware that information of the kind is usually passed to that person, body or agency: first, second and third disclosures;
(ii)whether DVA relies on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person: first, second and third disclosures;
(iii)whether the disclosure is required or authorised under law: first, second and third disclosures; and
(iv)whether disclosure is reasonably necessary for the enforcement of the criminal law or a law imposing a pecuniary penalty: third disclosure.
(2)if DVA has breached IPP11.1, whether its declaration made under s 52(1)(b)(ii) to redress the damage suffered by TYGJ was sufficient in the circumstances; and
(3)if DVA has breached IPP11.1, whether a declaration should be made under s 52(1)(b)(iii) that TYGJ is entitled to a specified amount by way of compensation for loss or damage suffered by reason of the disclosure of DVA.

PRIVACY ACT

Determination of the issues by reference to the Privacy Act as enacted before
12 March 2014

The acts of which TYGJ complains occurred in October 2011. Since then, the Privacy Act has been amended on a number of occasions. In the context of the matters arising in this case, the most significant amendments were made by the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (PAEPP Act).[16] Among others, that legislation repealed the Information Privacy Principles (IPP) and replaced them with the Australian Privacy Principles (APP) with consequential amendments to the Privacy Act.[17] Section 52 was also amended by the PAEPP Act.[18] In so far as they related to the APP, those amendments came into effect on 12 March 2014.[19] None of the transitional provisions set out in Schedule 6 applied to them.[20] Therefore, issues, such as those in this case, arising in relation to disclosures made before 12 March 2014, are determined by reference to the IPP as they were in operation at that time and not by reference to the APP.
[16] Act No. 197 of 2012 The PAEPP Act was itself amended by the Statute Law Revision Act (No. 1) 2015; Act No. 5 of 2015: s 3; Schedule 2; Items 4, 5 and 6. None of those amendments affects the date of effect of the amendments made to the Privacy Act by the PAEPP Act.
[17] PAEPP Act; s 3, Schedule 1
[18] PAEPP Act; s 3, Schedule 4, Items 106-111
[19] PAEPP Act; s 2(1); Item 2
[20] See particularly Part 2 of Schedule 6, which set out the application, transitional and savings provisions relating to amendments made by Schedule 1 of the PAEPP Act and those in Part 5 relating to amendments made by Schedule 4.

The PAEPP Act also amended provisions relating to review by the Tribunal. It repealed individual provisions providing that an application for review of a particular decision might be made the Tribunal. In their place, it enacted s 96, which provided that an application might be made to the Tribunal for review of decisions made by the Commissioner under seven categories of decision.[21] Provision had previously been made to make an application in some of those categories but some were new. Among those that were new was s 96(1)(c), which provided that an application might be made to the Tribunal for review of a decision of the Commissioner under s 52(1) or (1A) to make a determination.
[21] PAEPP Act; s 3; Schedule 4; Item 200

Schedule 6 to the PAEPP Act made a particular transitional provision affecting the operation of s 96(1)(c). Item 14 of Part 5 of Schedule 6 to the PAEPP Act provided that:
“Paragraphs 96(1)(c), (e), (f) and (g) of the Privacy Act, as inserted by Schedule 4 to this Act, apply in relation to a decision made after the commencement time.”

The “commencement time” was 14 March 2014 when Schedule 6 to the PAEPP Act commenced.[22] Item 14 does not limit the operation of ss 96(1)(c), (e), (f) or (g) to a decision made after the commencement day and in relation to a complaint made or in relation to events occurring after the commencement day. It follows that, provided the Commissioner’s decision was made after 14 March 2015, an application may be made to the Tribunal for review of that decision even though it related to a complaint made or events occurring before that day. That is the situation in this case.

[22] PAEPP Act; s 2(1); Item 19

Protection of the privacy of individuals

The Privacy Act is an Act to protect the privacy of individuals.[23] Section 13 sets out the circumstances in which an act or practice is an interference with a person’s privacy. Of relevance in this case is s 13(a) which provides:
“… an act or practice is an interference with the privacy of an individual if the act or practice:
(a)in the case of an act or practice engaged in by an agency (whether or not the agency is also a file number recipient, credit reporting agency or credit provider) – breaches an Information Privacy Principle in relation to personal information that relates to an individual”.
[23] Privacy Act; Long Title
The word “agency” is defined in s 6(1) and includes a Department. Section 6(1) also defined the expression “personal information”:
“personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.”
There is no question in this case that personal information about TYGJ was disclosed in each of the three disclosures. That was so whether the revelations were of the content of TYGJ’s emails or opinions formed by officers of DVA in light of that content.
The IPPs are set out in s 14. There are 11 IPPs but the focus of the case was on IPP11. It provides:
“1. A record-keeper who has possession or control of a record that contains personal information shall not disclose that information to a person, body or agency (other than the individual concerned) unless:
(a)the individual concerned is reasonably likely to have been aware, or made aware under Principle 2, that information of the kind is usually passed to that person, body or agency;
(b)the individual concerned has consented to the disclosure;
(c)the record-keeper believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person;
(d)the disclosure is required or authorised by or under law;
(e)the disclosure is reasonably necessary for the enforcement of the criminal law or of a law imposing a pecuniary penalty, or for the protection of the public revenue.
2.Where personal information is disclosed for the purposes of enforcement of the criminal law or of a law imposing a pecuniary penalty, or for the purpose of the protection of the public revenue, the record-keeper shall include in the record containing that information a note of the disclosure.
3.A person, body or agency to whom personal information is disclosed under clause 1 of this Principle shall not use or disclose the information for a purpose other than the purpose for which the information was given to the person, body or agency.”

A “record” is defined in s 6(1) of the Privacy Act. Putting aside the exceptions that are not relevant in this case, a “record means: (a) a document; or (b) a database (however kept); or (c) a photograph or other pictorial representation of a person; …”. IPP 2, to which reference is made in cl 1(a) of IPP11, provides:
“Where:
(a)a collector collects personal information for inclusion in a record or in a generally available publication; and
(b)the information is solicited by the collector from the individual concerned; the collector shall take such steps (if any) as are, in the circumstances, reasonable to ensure that, before the information is collected or, if that is not practicable after the information is collected, the individual concerned is generally aware of:
(c) the purpose for which the information is being collected;
(d)if the collection of the information is authorised or required by or under law – the fact that the collection of the information is so authorised or required; and
(e)any person to whom, or any body or agency to which, it is the collector’s usual practice to disclose personal information of the kind so collected, and (if known by the collector) any person to whom, or any body or agency to which, it is the usual practice of that first-mentioned person, body or agency to pass on that information.”
IPP 2 is not relevant in this case as the information that was disclosed by DVA is not information that it solicited from TYGJ. The word “solicit” used in IPP11:
“… in relation to personal information, means request a person to provide that information, or a kind of information in which that information is included.”[24]
Rather, the information was provided by TYGJ of his own volition and without his being requested to do so by DVA.
[24] Privacy Act; s 6(1)
Complaint about an act or practice
Subject to qualifications that do not apply in this case, s 36 of the Privacy Act provides that an individual may complain to the Commissioner about an act or practice that may be an interference with the privacy of the individual.[25] The complaint must be in writing and specify the respondent to the complaint.[26] Where the complaint is made about an act or practice of an agency which is a Department, the respondent to that complaint is the Secretary to the Department.[27]
[25] Privacy Act; s 36(1)
[26] Privacy Act; ss 36(3) and (5)
[27] Privacy Act; s 37, Item 1
In most instances, a person must first complain to the respondent about the act or practice before the Commissioner is obliged to investigate a complaint made under s 36.[28] Even then, the Commissioner may decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under s 36. Before making that decision, the Commissioner must be satisfied that one or other of the five matters set out in s 41(1) applies or the respondent has dealt, or is dealing, adequately with the complaint or has not yet had the opportunity to do so within the meaning of s 41(2). The Commissioner may defer an investigation or further investigation of an act or practice about which a complaint has been made under s 36 if the respondent has made an application for a determination under s 72 in relation to the act or practice and deferral would not unreasonably prejudice the interests of persons affected by the deferral.[29]
[28] Privacy Act; s 40(1A) If the Commissioner decides that it was not appropriate for the complainant to complain to the respondent, he or she may decide to investigate the complaint.
[29] Privacy Act; s 41(3)
After investigating a complaint:
“(1) … the Commissioner may:
(a) make a determination dismissing the complaint; or
(b)find the complaint substantiated and making a determination that includes one or more of the following:
(i)a declaration:
(A)where the principal executive of an agency is the respondent – that the agency has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct; or
(B)in any other case – that the respondent has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct;
(ii)a declaration that the respondent should perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant;
(iii)a declaration that the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered by reason of the act or practice the subject of the complaint;
(iv)a declaration that it would be inappropriate for any further action to be taken in the matter.
(1A)The loss or damage referred to in paragraph (1)(b) includes injury to the complainant’s feeling or humiliation suffered by the complainant.
(1B)…
(2)…
(3)In a determination under paragraph (1)(a) or (b) (other than a determination made on a representative complaint), the Commissioner may include a declaration that the complainant is entitled to a specified amount to reimburse the complainant for expenses reasonably incurred by the complainant in connection with the making of a complaint and the investigation of the complaint.
(3A)-(6) …”[30]
[30] Privacy Act; s 52
Review of determinations by the Tribunal
Section 96(1)(c) provides that an application may be made to the Tribunal for review of a decision under s 52(1) or (1A) to make a determination.
DEFENCE FORCE DISCIPLINE ACT

The Defence Force Discipline Act 1982 (DFD Act) is an Act relating to the discipline of the Defence Force. Part 3 of that legislation prescribes a number of offences by defence members. As a member of the ADF, TYGJ was a “defence member” as defined in s 3(1). Among them are those in ss 33 and 60. Section 33 provides:
“Assault, insulting or provocative words etc.
A person who is a defence member or a defence civilian is guilty of an offence if the person is on service land, in a service ship, service aircraft or service vehicle or in a public place and the person:
(a)assaults another person; or
(b)creates a disturbance or takes part in creating or continuing a disturbance; or
(c)within the view or hearing of another person, engages in conduct that is obscene; or
(d) uses insulting or provocative words to another person.
Maximum punishment: Imprisonment for 6 months.”
Section 60 is headed “Prejudicial conduct”.
“(1) A defence member is guilty of an offence if the member does an act that is likely to prejudice the discipline of, or bring discredit on, the Defence Force.
Maximum punishment: Imprisonment for 3 months.
(1A) A defence member is guilty of an offence if:

(a)the member omits to perform an act; and

(b)the omission is likely to prejudice the discipline of, or bring discredit on, the Defence Force.
Maximum punishment: Imprisonment for 3 months.

(2)An offence against subsection (1) or (1A) is an offence of strict liability.
Note:For strict liability, see section 6.1 of the Criminal Code.

(3) It is a defence to a charge under subsection (1) if the member proves that he or she had a reasonable excuse for the relevant act.

Note: The defendant bears a legal burden in relation to the matter in subsection (3). See section 13.4 of the Criminal Code.

(4)It is a defence to a charge under subsection (1A) if the member proves that he or she had a reasonable excuse for omitting to perform the relevant act.

Note:The defendant bears a legal burden in relation to the matter in subsection (4). See section 13.4 of the Criminal Code.”

Section 61 of the DFD Act is concerned with conduct that would be an offence if committed in the Jervis Bay Territory or which would be if it had been committed in that territory by a defence member or defence civilian. In so far as it is relevant, s 61 provides:
“(1) …
(2)A person who is a defence member or a defence civilian is guilty of an offence if:
(a)the person engages in conduct in a public place outside the Jervis Bay Territory; and
(b) engaging in that conduct would be a Territory offence, if it took place in a public place in the Jervis Bay Territory.

(3)A person who is a defence member or a defence civilian is guilty of an offence if:
(a)the person engages in conduct outside the Jervis Bay Territory (whether or not in a public place); and
(b)engaging in that conduct would be a Territory offence, if it took place in the Jervis Bay Territory (whether or not in a public place).

(4)The maximum punishment for an offence against this section is:
(a)if the relevant Territory offence is punishable by a fixed punishment — that fixed punishment; or
(b)otherwise — a punishment that is not more severe than the maximum punishment for the relevant Territory offence.

(5)Strict liability applies to paragraphs (1)(b), (2)(b) and (3)(b).
Note:For strict liability, see section 6.1 of the Criminal Code.

(6)To avoid doubt, section 10 of this Act does not have the effect that Chapter 2 of the Criminal Code applies to the law in force in Jervis Bay, for the purpose of determining whether an offence against this section has been committed.
Note:Section 10 of this Act applies Chapter 2 of the Criminal Code to the content of this section, but not to the content of the law in force in Jervis Bay. To determine, for the purposes of this section, whether Chapter 2 of the Code applies to Jervis Bay law, it is necessary to consult Jervis Bay law.”

OCCUPATIONAL HEALTH AND SAFETY (COMMONWEALTH EMPLOYMENT) ACT 1991

With effect from 1 January 2012,[31] the Occupational Health and Safety Act 1991[32] (OHS Act) has been repealed[33] but it continues to apply to events that occurred while it was in force. In particular:
“The OHS Act continues to apply in relation to a breach of the OHS Act that occurred before the commencing day, or is alleged to have occurred before that day, as if the OHS Act had not been repealed.”[34]
[31] Work Health and Safety (Transitional and Consequential Provisions) Act 2011; s 2(1), Item 3
[32] The OHS Act was previously known at the Occupational Health and Safety (Commonwealth Employees) Act 1991
[33] Work Health and Safety (Transitional and Consequential Provisions) Act 2011; s 3, Schedule 1, Item 1
[34] Work Health and Safety (Transitional and Consequential Provisions) Act 2011; s 3 and Schedule 2, Item 1(1)
In the context of this case, s 16(1) is relevant:
“An employer must take all reasonably practicable steps to protect the health and safety at work of the employer’s employees.”
Section 16(2) expands upon the duty imposed by s 16(1) but only ss 16(2)(a) and (b) are relevant. They provide:
“Without limiting the generality of subsection (1), an employer breaches that subsection if the employer fails to take all reasonably practicable steps:
(a)to provide and maintain a working environment (including plant and systems of work):
(i)that is safe for the employer’s employees and without risk to their health; and
(ii)that provides adequate facilities for their welfare at work; and
(b) in relation to any workplace under the employer’s control, to:
(i)ensure the workplace is safe for the employees and without risk to their health; and
(ii)provide and maintain a means of access to, and egress from, the workplace that is safe for the employees and without risk to their health; …”

ROLE OF THE PRIVACY COMMISSIONER IN THE TRIBUNAL’S REVIEW

On behalf of the Commissioner, his solicitor, Mr Holcombe raised his role in the proceeding. He understood that there had been some doubt expressed as to the Commissioner’s role in the review proceedings in the Tribunal and some suggestion that the “Hardiman principle” should exclude him. In my view, there is no doubt that the Commissioner should be a party to the proceeding and I will explain why I hold that view.

I will begin with principle arising from the decision of the High Court in The Queen v Australian Broadcasting Tribunal and Others; Ex Parte Hardiman[35] (Hardiman). Control Investments Pty Ltd (CIPL) had applied to the Australian Broadcasting Tribunal (ABT) under s 92F of the Broadcasting Act 1942 (Broadcasting Act) for approval of its acquisition of one-half of the issued share capital of Ansett Transport Industries Ltd (ATI). A wholly owned subsidiary of ATI held a commercial television licence under the Broadcasting Act. After holding a public enquiry as to whether CIPL or any other person would have a prescribed interest in three or more commercial television licences and the extent to which any changes in ownership or control of the licensee accorded with the public interest, the ABT made certain rulings as to the law and its procedures. The Australian Labor Party (ALP) and others applied for writs of prohibition and of mandamus. Stephen J had made an order nisi for those writs and an application was made to the Full Court of the High Court to make that order absolute. Counsel appeared for the ABT to contest the prosecutors’ case for relief and made substantive arguments to the Court.
[35] [1980] HCA 13; (1980) 144 CLR 13; Gibbs, Stephen, Mason, Aickin and Wilson JJ

The High Court noted that:
“… In cases of this kind the usual course is for a tribunal to submit to such order as the court may make. The course which was adopted by the Tribunal in this Court is not one which we would wish to encourage. If a tribunal becomes a protagonist in this Court there is the risk that by so doing it endangers the impartiality which it is expected to maintain in subsequent proceedings which take place if an when relief is granted. The presentation of a case in this Court by a tribunal should be regarded as exceptional and, where it occurs should, in general, be limited to submissions going to the powers and procedures of the Tribunal.”[36]
[36] [1980] HCA 13;] (1980) 144 CLR 13 at [54]; 35-36
An example of the application of the exception to the principle is found in Ray v Superannuation Complaints Tribunal[37] although that is a case that is to be contrasted with Hardiman in that there was no contradictor. By contrast, in Hardiman, there was a contradictor for issue was joined between the CIPL on the one hand and the ALP, which sought relief, on the other.
[37] [2004] FCA 1120; Goldberg J

There may be circumstances in which the application of the general principle is modified. This arose in the case of Fagan v Crimes Compensation Tribunal.[38] The applicant for compensation under the Criminal Injuries Compensation Act 1972 had been a child when his mother was murdered. He claimed compensation for nervous shock but his claim was refused by the Crimes Compensation Tribunal (CCT) on the basis that he had not been injured “by” the murder of his mother. The CCT appeared by counsel and Brennan J specifically addressed the fact of its appearance saying:
“… Where curial proceedings arise out of a matter which is contested between parties appearing before a tribunal, it is not ordinarily appropriate for the tribunal to appear to contest the curial proceedings brought by one of the parties before it (Reg. v. Australian Broadcasting Tribunal; Ex parte Hardiman [1980] HCA 13; (1980) 144 CLR 13, at pp 35-36 ). But where the proceedings before the tribunal are not inter partes, and where the Attorney-General cannot or does not intervene to represent the public interest (cf. Corporate Affairs Commission v. Bradley (1974) 1 NSWLR 391 ) and neither a law officer nor a public official is heard by the court (cf. Reg. v. Cook; Ex parte Twigg [1980] HCA 36; (1980) 147 CLR 15 ), it may be desirable that the tribunal should appear by counsel to make such submissions as it thinks calculated to assist the court and, in an appropriate case, to argue against the applicant's case. That is what was done in this case. Here, the Tribunal's function was to determine whether and to what extent a claimant was entitled under statute to a payment out of public moneys. Though the Tribunal was bound to act impartially, it was in a sense the guardian of the moneys appropriated by Parliament to answer the proper claims for compensation under the Act. In proceedings to review its decision, the Tribunal properly represents the public purse, and it was right that the Tribunal should appear by counsel as a party to respond substantially to the application. It follows that the Tribunal should then be treated as an ordinary party in the matter of costs. Therefore I would make an order awarding the applicant his costs against the Tribunal both here and in the Supreme Court.”[39]
[38] [1982] HCA 49; (1982) 150 CLR 666; Mason, Murphy, Aickin, Wilson and Brennan JJ
[39] [1982] HCA 49; (1982) 150 CLR 666 at [13]; 681-682

I have set out a very general summary of the general principles arising from the application of the principles in Hardiman but those general principles do not have any application in a case in which the parties to a proceeding have been determined by Parliament. In my view, this is such a case. Omitting situations in which the Attorney-General intervenes in a proceeding or is deemed to be a party or cases in which the Tribunal directs that a person cease to be a party under s 42A(2)(b), s 30(1) of the Administrative Appeals Tribunal Act 1975 (AAT Act) provides that:
“… the parties to a proceeding before the Tribunal for a review of a decision are:
(a)any person who, being entitled to do so, has duly applied to the Tribunal for a review of the decision;
(b)the person who made the decision;
(c)…
(d)any other person who has been made a party to the proceeding by the Tribunal on application by the person in accordance with subsection (1A).”

By virtue of ss 25(1) and 27 of the AAT Act and s 96(1)(c) of the Privacy Act, TYGJ was entitled to apply to the Tribunal for review of a decision made under ss 52(1) or (1A) to make a determination. That meant that TYGJ is a party by virtue of s 30(1)(a) of the AAT Act. The person who made the decision in this instance is the Commissioner as he made the decision under s 52 to make a determination on a complaint made under s 36.[40] Therefore, he is a party to the proceeding by virtue of s 30(1)(b). As its interests were affected by the Commissioner’s decision, DVA applied to be, and was, joined as a party under s 30(1A). Therefore, it is a party by virtue of s 30(1)(d).
[40] The position of the Commissioner is to be contrasted with, for example, the position of a veteran who has claimed a pension under the Veterans’ Entitlements Act 1986 (VE Act) and a decision has been made by the Repatriation Commission (Commission) and that decision has been reviewed by the Veterans’ Review Board (VRB). An application may be made to the Tribunal under s 175 of the VE Act for review of the Commission’s decision as affirmed, the Commission’s decision as varied or the decision of the VRB in substitution for the Commission’s decision. In each case, whether affirmed, varied or set aside and substituted, the decision that is subject to review is that of the Commission and not that of the VRB. Therefore, the Commission is the person who made the decision and a party to the proceeding and not the VRB.

THE IPP GUIDELINES

On behalf of the Commissioner, it was submitted that the “Plain English Guidelines to Information Privacy Principles 8-11” (IPP Guidelines):
“… are the equivalent of endorsed and published government policy and are to be applied unless there is a sound reason in a particular case to consider that their application would result in injustice. …”[41]

Re Drake and Minister for Immigration and Ethnic Affairs (No 2)[42] (Drake) was cited in support of his submission.

[41] Respondent’s Statement of Facts, Issues and Contentions dated 31 July 2015 at [16]

[42] (1979) 2 ALD 634

DVA’s position as set out in its Statement of Facts, Issues and Contentions of the Joined Party:
“… The Guidelines are not legally binding but provide agencies with guidance as to the Privacy Commissioner’s view of ‘best practice’ and how the IPPs might affect federal government agencies.”[43]
[43] Statement of Facts, Issues and Contentions of the Joined Party dated 24 April 2015 at [28]

Unlike guidelines relating to tax file number information,[44] the Privacy Act did not, at the time the alleged breaches were committed, require the Commissioner to issue guidelines concerning the IPPs and their application and implementation in Commonwealth agencies.[45] The Commissioner was, however, entitled to issue guidelines setting out his views as to the way in which IPPs 8 to 11 work and he did so in the IPP Guidelines. As he states in his Introduction to them, those guidelines are not legally binding. What they do is to set out a framework within which an agency should develop and apply its strategies and make decisions. I will take Paragraph [26] of the IPP Guidelines as an example. It states:
[44] Privacy Act; s 17 which, at the time of the alleged breaches, read:
[45] Section 26V, which does authorise the Commissioner to issue guidelines in relation APP Codes and the CR Code, was not inserted until the Privacy Act was amended with effect from 12 March 2014: PAEPP Act; Schedule 3 and see also s 2(1); Item 2.
“What are ‘reasonable grounds’?
Note that ‘reasonable grounds’ for believing that something is the case does not mean that something must actually be the case. This is consistent with the common law on confidentiality, which allows a disclosure of personal information to appropriate authorities if:
· honestly made, and
·made in the reasonable belief that it is likely to relieve a serious and imminent threat to a person’s life or health.
The agency is responsible for deciding whether or not there are reasonable grounds for using or disclosing the personal information.
An agency should have guidelines on:
·the appropriate level of seniority in the agency at which decisions can be made about whether or not there are reasonable grounds, and
·the range of matters that should be taken into account when deciding whether or not there are reasonable grounds. These include:
- the source and reliability of the information that indicates a threat to life or health, and
-the seriousness of the indicated threat.
If there is a complaint or a privacy audit, the Privacy Commissioner (or ultimately, the Federal Court) must judge whether or not the grounds for using or disclosing the personal information are reasonable.”

This passage is a fair reflection of the approach that has been taken in the IPP Guidelines. The nature of privacy concerns and the circumstances in which they arise may be many and varied and it is understandable that the IPP Guidelines are drafted in similarly broad language to cater for those variables. At the same time, they are not prescriptive. In addressing the general rules set out in IPPs 10.1 and 11.1 and the exceptions to those rules, the Commissioner said:
“Clearly, fair and effective administration of government programs would be impossible if these rules were absolute. So, a number of exceptions in IPPs 10.1 and 11.1 list situations in which an agency may:
×use personal information for another purpose, or
×disclose personal information to someone other than the person the information is about.
When the exceptions apply
A use does not breach IPP 10.1 and a disclosure does not breach IPP 11.1 if:
·the person the information is about consents to the use or disclosure:
Exceptions
… [Exceptions 10.1(a) and 11.1( b), 10.1(b) and 11.1(c), 10.1(c) and 11.1(d) and 10.1(d) and 11.1(e) detailed as well as qualifications to those exceptions].
How the exceptions should be used
Where an exception applies, the agency should consider the spirit as well as the letter of the Act. The agency should:
×seek to disclose, or to use, no more personal information than is necessary, and
×aim to give the person the information is about as much control as possible over their personal information. This can be done by:
-being as open as possible with that person, and
-seeking their consent to a use or disclosure whenever that is practical – even if an exception not requiring their consent is available, and
-giving them a full and informative IPP2 notice so that they know how the personal information they provide will be handled.”[46]
[46] IPP Guidelines at [13]

Guidelines of these sort assist in achieving uniform implementation and operation of the IPPs across the Commonwealth administration. Given that they are made by the Commissioner, to whom Parliament has given responsibility for the day to day administration of the Privacy Act, regard should be had to them by the Tribunal as well as by Commonwealth agencies. That is so even though they have not been the subject of Parliamentary scrutiny for they are not legislative instruments. Given their provenance, it is to be expected that Commonwealth agencies would apply them unless it were shown that its application would work an injustice in a particular case, for consistency is not preferable to justice, or that they were contrary to the law. This is consistent with the principles expressed by Brennan J in Drake, who added, albeit in the context of Ministerial policy, that:
“ The general practice will require the Tribunal to determine whether the policy is lawful, not in order to supervise the exercise by the Minister of his discretion, but in order to determine whether the policy is appropriate for application by the Tribunal.”[47]
[47] (1979) 2 ALD 634 at 645

Drake was concerned with the exercise of a discretionary power in relation to an individual but the powers given to the Commissioner under the Privacy Act necessarily involve him in exercising investigative powers and powers akin to those of a tribunal in hearing and weighing evidence. This raises a question whether the IPP Guidelines he has issued apply equally to him as to the Commonwealth agencies. The Commissioner answered this question himself when he stated in his Introduction to the IPP Guidelines that:
“Nothing in these guidelines limits the Privacy Commissioner’s freedom to investigate complaints under the Privacy Act and to apply the IPPs in the way that seems most appropriate to the facts of the case being dealt with.”

That would seem to be the position in which the Tribunal finds itself when reviewing a decision made by the Commissioner personally as was the case in relation to TYGJ’s complaint. As s 43(1) of the Administrative Appeals Tribunal Act 1975 states, “For the purpose of reviewing a decision, the Tribunal may exercise all the powers and discretions that are conferred by any relevant enactment on the person who made the decision …”. When the decision under review is that of the Commissioner and he has stated that the IPP Guidelines do not limit him in his investigation of complaints or application of the IPPs in a way that is most appropriate to the facts of the case, the Tribunal is in the same position as the Commissioner. It has a statutory task to undertake and that task involves it in deciding in the first instance whether DVA was in breach of any of the IPPs. That is not a discretionary decision.

The Tribunal’s position in relation to the IPP Guidelines is to be contrasted with its position in relation to, for example, Directions given by the Minister for Immigration and Border Protection under s 499 of the Migration Act 1958 (Migration Act). Section 499(1) provides that the Minister may give written directions to a person or body having functions or powers under the Migration Act if the directions were about the performance of those functions or the exercise of those powers. Those directions must not be inconsistent with the Act or the regulations made under it and must be laid before each House of Parliament within 15 sitting days of that House after the direction was given.[48] A person or body “must comply” with a direction given under s 499(1).[49] A “person or body” includes the Tribunal and it is bound to apply them.[50] These Directions are the legislative successors of the policies previously formulated by the Minister and considered in Drake. Those that have been issued in the form of Direction No. 65 relate to discretionary decisions under the Migration Act.
[48] Migration Act; ss 499(2) and (3)
[49] Migration Act; s 499(2A)
[50] Bochenski v Minister for Immigration and Border Protection [2017] FCAFC 68; Bromberg, Bromwich and Charlesworth JJ

A comparison can be made with the legislation underpinning Direction 65 made under s 499 of the Migration Act and the Guidelines that the Commissioner may make under s 93A of the Freedom of Information Act 1982 (FOI Act). Section 93A(2) provides that, for the purposes of the performance of a function or the exercise of a power under the FOI Act, “regard must be had to any guidelines” issued by the Commissioner.

Arguably, a statutory obligation that a person “must comply with a direction” does not equate with a statutory obligation that “regard must be had” to guidelines (emphasis added). It is not relevant to consider that argument further but, when any obligation imposed upon a person is not statutory and the IPP Guidelines themselves state that they do not limit the Commissioner’s powers, it would seem to follow that, in reviewing the Commissioner’s determination, the Tribunal’s powers are equally confined only by the terms of the Privacy Act.

THE EVIDENCE
TYGJ’s claim for compensation

TYGJ enlisted in the ADF in 2001. In the last assessment before his injury, the assessing officer and the senior assessing officer both noted that TYGJ had demonstrated superior performance in all regards and he was recommended for promotion. That assessment was dated 27 February 2009.[51] Under “Comments”, TYGJ’s assessor had written:
“… [TYGJ] is an extremely bright and hard working officer, whose dedication and determination is exemplary. He actively seeks out work, and he works enthusiastically to provide his knowledge and experience to the benefit of others.
He has exceptional written communication skills, consistently seeks to develop himself, and he is a clearly highly competent … Officer who deserves to be recognised as an expert practitioner in his field. He is suitable for promotion now and will become highly suitable following further career broadening. … [TYGJ] is well suited to, and should be given priority for an operational deployment and further career development in an operating unit environment. Use of his skills outside of a staff officer role will significantly benefit both him and the Air Force.”[52]
[51] Exhibit E at 137-138
[52] Exhibit E at 137

When assessment was due a year later, TYGJ had been injured while serving with the ADF. Due to his medical condition, there was doubt whether he would be able to serve for a further 12 months when he was next assessed on 9 December 2010. Should he continue to serve, he would have been recommended for promotion as he had demonstrated that he was a highly capable officer.[53] The Senior assessor had endorsed these remarks and added that he had been particularly impressed by TYGJ’s abilities to synthesise information and to prepare well-constructed briefs, reports and the like. His staff skills were very well developed and would serve him well in his next posting.[54]
[53] Exhibit E at 135
[54] Exhibit E at 138

As a result of his injury, TYGJ was in receipt of incapacity payments from DVA under the Military Rehabilitation and Compensation Act 2004 (MRCA). On 21 June 2011 TYGJ lodged a further claim for compensation.[55] He had lodged an earlier claim on 17 June 2011.[56] At that time, he had already set a date in approximately January 2012 for his exit from the ADF on medical grounds.
[55] Exhibit 2
[56] Exhibit A at A-216

He answered a number of the questions posed in the claim form in relation to matters such as the injuries or diseases for which he was then claiming compensation or for which DVA had previously accepted liability, whether he already received compensation or a pension from DVA, his sources of income. The front page of the claim form notifies the claimant that it asks for personal details and details of the injury or disease for which compensation is claimed. Under the heading “The basis for decisions”, the form stated:
“The decision on whether your injury or disease is service-related is based on up-to-date medical and scientific evidence. This information is detailed in the Repatriation Medical Authority’s Statements of Principles.
If your claim is for a condition not included in the Statement of Principles, it will be determined based on the best scientific and medical evidence available.”[57]
[57] Exhibit 2 at 1

The statement is followed by the following information:
Privacy Notice
The information provided on this form and on any additional DVA forms you complete in relation to this claim, is required to assess your eligibility for benefits under one or more of the following applicable Acts: Veterans’ Entitlements Act 1986 (VEA), Safety, Rehabilitation and Compensation Act 1988 (SRCA) and MRCA. If the information you provide is used to assess your eligibility under one Act, it will not be used for the purpose of another Act unless authorised by law or you give a separate consent. Any information you provide on this form, or any other form relevant to this claim, may be disclosed to the following agencies and bodies for their lawful purposes:
∙the Department of Defence;
∙Centrelink;
∙the Australian Taxation Office;
∙the Child Support Agency;
∙Medicare Australia;
∙the legal representatives of the Department of Defence in relation to any common law (third party) damages action;
∙ComSuper (regarding any Commonwealth superannuation entitlements you may have);
∙doctors, hospitals and other health care professionals who have provided you with treatment or who are requested to assist in the investigation of your claim; and
∙your current and/or previous employer(s).”[58]

[58] Exhibit 2 at 2

At Question 25, TYGJ was required to authorise, as he did:
“… the Department of Veterans’ Affairs to obtain medical/psychological, clinical, employment or other information about me from Service Health Centres, medical practitioners, hospitals, clinics, insurance companies, Australian Government Departments or Agencies, or other organisations in relation to this claim or its review.
I agree that the Department of Veterans’ Affairs may disclose personal information about me to other Agencies and bodies, where the Department of Veterans’ Affairs or those other Agencies or bodies have legitimate interest in such personal information.
…
This authorisation will continue until I:
·revoke this authorisation; or
· nominate another representative or organisation to act for me.”[59]

TYGJ’s communications with DVA and DVA and Ministerial officers and DVA’s internal administrative responses

[59] Exhibit 2 at 7

Between August and October 2011, there was various email correspondence between TYGJ and DVA. It concerned the handling of his claim and his entitlement to compensation which DVA considered required it to consider the provisions of the Safety, Rehabilitation and Compensation Act 1988 and the Veterans’ Entitlements Act 1986 as well as of the MRCA. A number of emails were exchanged between TYGJ and DVA regarding the processing of his claim.[60] I have also included DVA’s administrative responses at the relevant points in the summary.
[60] T documents; T3 at 24-35 and see also Exhibit A at A-213-A-224

26 July 2011

At 11:36am on 26 July 2011, TYGJ wrote to Mr Michael Coleman and Ms Martha Donnellan with the Subject line: “MRCA s. 331 Document Request – … [Specialist]”:
“Thank you for finally closing the loop on this matter. It is very concerning to note that Mr Talley did not seek answers to almost all of the questions asked on the forms (particularly where my input was required – i.e. the non-economic loss questions), and that despite the letter of instruction making it quite clear that liability had been accepted for these diseases and that he was only to conduct an investigation of the degree of impairment, he was clearly engaging in liability investigation well outside the conditions stated.
This was clearly an abuse of position and authority – and I will be making a complaint to the NSW Medical Council in regards to this conduct. It seriously disappoints me that this was allowed to happen in the first place – I feel that no only was my time wasted, but that my privacy – both physically and information wise – was seriously breached. I will want to see Mr Talley’s report when DVA receives it (yes, this is a MRCA s. 331 Document Request), I am deeply concerned about the quality of a report that is based on an session that had extremely little to do with anything with the questions DVA sought answers to, or the stated terms of the investigation, and the rather critical comments about my AAT matter and the way Defence Medical has handled my case certainly does not reassure that proper and unbiased practice has been followed.”[61]
[61] Exhibit JP2 at 22-23

28 July 2011

On 28 July 2011, … [DVA officer A], the Assistant Director of Liability Determinations (NSW/ACT) replied to complaints that TYGJ had made by emails dated 16 and 22 July 2011 to DVA’s Complaints & Feedback Management System and to the Minister for Veterans’ Affairs. The main issues that … [DVA officer A] addressed were:
“… you have raised the issue of clients being transferred between different departmental case managers. Whilst I am sorry for any inconvenience arising from this practice for you I’m sure you appreciate that given the complex array of compensation and benefits we are required to administer under different legislation it is not feasible to have one Claims Manager assume sole responsibility for a client. We do endeavour to provide timely advice to our clients about changes in their Case Manager but I accept this has not been handled to your satisfaction. I note that Greg wrote to you on 19 July 2011 to advise you that your case was being transferred to a Safety, Rehabilitation and Compensation Act 1988 (SRCA) delegate.
You also raised the issue of the Department’s usage of paper files. I can assure you that it is not our intention to delay our processing of claims by continuing to use paper files. The Department is continuing to review our usage of technology to try and find scope for greater efficiency in our processing of claims; including greater usage of an electronic document management system as recommended by you. However, given the sheer volume of documentation we hold relating to compensation claims it is not feasible for us to maintain all our records in electronic form and there will still be a business need for paper files.
… Yes you are correct that under SRCA and the Military Rehabilitation and Compensation Act 2004 that you are entitled to free access to documents relating to your claims.
The Department has a responsibility to protect your privacy and to prevent unlawful access to your records by other people. It is for this reason that the Department has a policy requiring that any MRCA or SRCA veteran who wishes to access copies of their records has to submit a letter to us requesting such access and signed off with a signature that can be used for identification confirmation. We do not accept email requests given the risk that your email account could be illegally accessed by other parties.
I apologise if this process seems overly bureaucratic but I assure you it is for the purpose of protecting your privacy and for no other reason. …
You have questioned why your claims under MRCA for … have been referred to a delegate to consider under SRCA. I regret any distress this has caused you.
However, under section 322 of MRCA there is a requirement that if you are claiming a condition that has previously been rejected you are required to present new evidence to support your claims. I note that a delegate of the Military Rehabilitation and Compensation Commission (MRCC) on 21 July 2010 rejected your earlier claim for … [condition A]. Another delegate of MRCC on 31 January 2011 decided that your claim for … [condition B] had already been accepted by a SRCA delegate under the title … [condition A] and that there was no medical condition present to be determined.
Based on medical advice from Dr Sheridan and our Department Medical Adviser it has been determined that our recent claims for … [condition C] and aggravation of … [condition A] are indistinguishable from your accepted disability under SRCA of … [condition A]. As your claims related to an existing condition that liability has already been accepted for it is entirely appropriate to refer them to an SRCA delegate to consider extending the liability that has already been accepted. I’m sorry but we cannot reinstate your MRCA claim as it was not valid in the first place.
Our Medical Approvals Section have been notified of your request for the Department to pay for … you require. As the need for … arises from a condition that liability has been accepted for under SRCA you will be reimbursed for the expense of purchasing them. …”[62]
[62] Exhibit A at A-629-630

1 August 2011

At 10:34am, TYGJ wrote to Mr Cheng and Ms Saskena regarding his “SRCA s. 59 Document Request / MRCA Claim Improperly Treated as SRCA Claim”:
“It has now been more than 5 working days since my SRCA s. 59 Document Request had been sent, for copies of the advice you claim Dr Sheridan and Dr Meyerowitz made in relation to my claim, and you have still yet to acknowledge this request. This is not in keeping with the Service Charter, and appears to be a deliberate attempt on your part to stonewall.
I call upon you both to show some ethical fibre and do that which – by law – you are required to do. And while you are at it, I am still also waiting an explanation as to my MRCA claim was converted to an SRCA one, without my consent. As per the MRCA legislation – s. 324 – ‘If a claim is given to the Commission in accordance with section 323, the Commission must investigate the matters to which the claim relates’ and s. 333 ‘the Commission must determine the claim in writing in accordance with this Act’. This clearly indicates that an MRCA claim must be investigated in accordance with the MRCA – not transferred without consent to a SRCA matter.”[63]
[63] Exhibit A at A-522

It would seem from the opening paragraph of the email TYGJ sent to DVA officers at 4:47pm that he was referring to the correspondence dated 28 July 2011 that he had received from … [DVA officer A]. It is a lengthy email and I will set out only the first three paragraphs and the last of its nine paragraphs to give a flavour of it:
“Well I see that dishonesty and a lack of ethics is a endemic issue at DVA. The response of … [DVA officer A] received today was the worst piece of obfuscation in relation to answering the valid issues raised that I have ever come across – obviously … [DVA officer A] takes the attitude that if he doesn’t like the questions he’ll just make up the answer or refuse to answer the questions raised and instead make up the questions as well – no wonder you dodged mentioning anything about the contents of the correspondence Mike, I’d be ashamed too!
Firstly – in regards to case managers – it was very clear that I was talking about multiple case managers for just the one process (i.e. initial liability determination for one single claim involving at least two case managers – one who seems to do nothing but sit on the file, before flicking it on to someone else – which seems to be a regular practice at DVA), not the entirety of all DVA interaction. Your answer is therefore not only dishonest, but deliberately seeks to obfuscate the issue raised. For shame!
Secondly – your assurances mean nothing when you clearly are bullshitting out of your teeth with regards to why DVA loves using the excuse for delay in being ‘waiting for file’. Defence – which has more records that DVA would ever have – and many other Government Departments have e-Doc records management systems and certainly have greater information security issues than you and yet they have managed to do so. You have simply taken the line that it’s too hard, to use as an excuse for lack of action on your Department’s half. So, in other words, never ever? That is a weak excuse and completely undefendable – made by someone without the honesty to admit it’s because you simply don’t care (which is the attitude prevalent throughout your response).
…
Well perhaps Four Corners wants to do a follow up on your shoddy treatment again, if you can do nothing but lie, maybe the public spotlight will send you scurrying under the fridge again –along with all the other cockroaches. Needless to say, I think someone who has responded with such careless disregard for the truth and a clearly deliberate attempt to obfuscate the issues raised, deserves a Code of Conduct review because your behaviour puts the Public Service to shame (and as a former APS member I never witnessed such unethical and accountability avoiding behaviour before – you’d clearly argue black was white if it covered your arse – again, you Sir, are a disgrace! – you didn’t even have the guts to call me yourself and speak your falsehoods, you coward – you didn’t want to discuss the issues at all.”[64]
[64] Exhibit A at A-524-525

At 5:18pm, TYGJ wrote to [email protected] (DVA feedback) to complain about … [DVA officer A]:
“I wish to complain most vigorously about the very poor response by … [DVA officer A] to the issues I raised previously with the Department. Not only did … [DVA officer A] make many misrepresentations and fail to address key concerns, but he also chose not to apologise for the actions of his staff in denying (in the first instance) that there are ways other than an FOI request to obtain claim documentation when clearly they knew this was not the case (as demonstrated by the staff member concerned readily acknowledging there were other ways – than an FOI request – once I was able to cite the Act provisions – bit much to go from absolute insistence there is only one way to oh, yes there are others, in the space of a minute!).
I warn you now, given that this is not an isolated incident, but a string in DVA’s very poor attitudes towards its legal obligations and being accountable – to anyone – that I have contacted the ABC over this issue. I think everyone deserves to be reminded (I won’t say alerted because it won’t be the first time DVA come off poorly when faced with media scrutiny) just how crappily you treat veterans – with dishonesty and outright contempt!”[65]
[65] Exhibit A at A-526

TYGJ sent an email to Mr Cheng and … [DVA officer A] at 6:27pm on 1 August 2011:
“Oh, and … [DVA officer A], if as you contend there is no evidence to support my MRCA aggravation claim then make a determination under MRCA denying it. You have nothing to lose if you are correct, and it will certainly shut me up no? (well, at least for you, although I will still consider you as a liar and an unethical piece of work).
I cannot seek a review of decision if you do not do so, as you need to do this in the form of a determination, not an opinion (which is all it is right now) and I cannot do it against the SRCA decision as there is nothing to review (not when you accept liability). I have not had an aggravation claim rejected previously (either for this condition or any other) so there is no impediment.
Have the guts to make the call and stop trying to hide behind a non-decision to prevent the obvious fact that you and your staff have breached the Act and are engaged in just one big arse covering exercise, coming to light. Even if you don’t – given there is no reviewable decision to review – I’ll drag your work into the Federal Court to get the simple and obvious answer that you cannot bring yourself to own up to. I’ll be seeking punitive costs of course, due to your vexatious and malicious behaviour in this matter, if that’s the way you want to play it. With my medical discharge processing, I’ll certainly have the time!”[66]
[66] Exhibit A at A-527
2 August 2011
On 2 August 2011, TYGJ sent a three page complaint about a DVA staff member by email to [email protected]. The essence of the complaint was that the staff member, … [DVA officer A], had breached the Australian Public Service (APS) Code of Conduct and APS Values by dealing with TYGJ’s claim, or part of it, under the Safety, Rehabilitation and Compensation Act 1988 (SRC Act) without his express or implied consent.[67]
[67] Exhibit A at A-528 to A-530

5 August 2011

TYGJ’s 6½ page email to Mr Michael Weiss at 7:32pm on 5 August 2011 centred on the way in which DVA had processed the claims he had made on MRCA forms. He began his email with the following:
“Dear Michael and those hardy folk at VSCM,
Thank you for passing on my thanks to Mary-Anne. Her honesty with me was much appreciated and, as such, I was happy to provide leeway on that matter. It’s funny but I have found it is often your lower level employees who behave best, whereas their superiors – who should be setting the standard – seem to be the ones who behave most dishonestly and often in bad faith.
I’ll be up front with you Michael. I don’t trust you, you have certainly given me no reason to do so (Greg Chen and certainly the contemptible … [DVA officer A] having done you no favours in that regard), and therefore I’m not interested in having a ‘off the record’ discussion without at least you putting something on paper or email in relation to these issues. If you don’t like that then I suggest you consider, as the Manager of the area concerned, that you only have yourself to blame for what can only be a lack of leadership in client relations and fostering ethical practice.
I’ll also be up front here and apologise for my sometimes quite disjointed correspondence, although I think the meaning and intent where always quite clear (that being, the legislative and policy requirements having not been followed as they should have, in relation to these two MRCA claims), and my quite understandable anger at the bad faith conduct of your staff. I can only say in my defence that I am not very well, under a great deal of stress due to my poor state of health and the impact it is having on me now (and the future consequences, including the loss of employment), something that was not helped by the way your staff have continued to conduct themselves in bad faith.”[68]
[68] Exhibit A at A-531

9 August 2011

TYGJ wrote to Ms Donnellan at 1:33pm on 9 August 2017. He told her that Mr Coleman had given him a copy of DVA’s instructions to the Specialist while she had been away. He again asked for a copy of Mr Talley’s report at the earliest opportunity. He noted that the orthopaedic surgeon to whom DVA had recently referred to him was “much more the norm to be expected”.[69] Despite that, he questioned the surgeon’s not having asked him questions about a certain subject on which he had been questioned by Dr McNicol. He regarded Dr McNicol as the “gold standard … he was always very professional – perhaps helped by the fact that he was still involved in clinical practice unlike some of these retired old gents just picking up easy money).”[70] TYGJ concluded:
“I was somewhat surprised at the ‘improvement’ of my hearing compared to my last audiogram from AHS and Defence. Perhaps it was the decision to use the closed foam ear plugs instead of the standard headset used for every other hearing test? It is fair to say that that I think it is very unlikely that my hearing loss, as assessed last year by AHS, has changed in either direction). But, at this stage, it’s small beer.”[71]
[69] Exhibit JP2 at 22
[70] Exhibit JP2 at 22
[71] Exhibit JP2 at 22

10 August 2011

At 10:17am on 10 August 2011, TYGJ wrote to … [DVA officer A] and Mr Greg Cheng:
“Dear All,
I would remind you that is it [sic] almost 10 days since my email to you of 01 AUG 2011, which has yet to be acknowledged, as … [DVA officer A] held out (probably in his typical bad faith style) would at least be the case for submitting a WRITTEN AND SIGNED document request. I’ve jumped over your artificial requirement, the least you can do is follow through on the very small promise of providing a ‘formal response’ (despite the Act not making this a discretionary entitlement – if clearly states that if I ask for a document about my claim, you are required to provide it) as you have held out.”[72]
[72] Exhibit A at A-538
19 August 2011
TYGJ wrote to Mr Cheng, … [DVA officer A] and Mr Weiss by email at 6:34pm. Its subject was “HASTNER: SRCA s. 59 Document Request/MRCA Claim Improperly Treated as SRCA Claim”. It read:
“Almost 20 days have passed since my s 59 SRCA document access provision was invoked, and I am still yet to receive any indication that DVA has complied. I would remind that you are required, by the law, to provide these documents – this ongoing delay simply highlights your bad faith in ensuring accountability and transparency is avoided. The word ‘priority’ seems hardly to apply to the continual dragging of your heels in this matter – it certainly doesn’t take 20 days to press the copy button of a photocopier.
Your compliance with your legal obligations in this matter would be most appreciated.”[73]
[73] Exhibit A at A-539

27 August 2011

At 8:49pm on 27 August 2011, TYGJ sent an email to [email protected] with the subject line “Complaint Regarding the VEA s. 137 Report put together by DVA Officer Pamela Ford”. He wrote, in part:
“Subject: Comments Concerning the Section 137 Report Furnished to the VRB by DVA
…
I write to voice my disgust regarding the contents of the Veterans’ Entitlement Act 1986 s. 137 Report submitted by DVA to the VRB in relation to the application for review of the MRCC determination of 17 August 2010 (the acceptance of liability for aggravation of signs and symptoms of L4-5 and L5-S1 disc degeneration).
Firstly, I wish to voice my concern, and strong objection to, the inclusion of documents numbered 67-71 and 304-314 inclusive. The documents in question have no relevance to an entitlement case regarding lumbar spondylosis (or disc degeneration as it is otherwise known), and their inclusion appears to be nothing more than an attempt to ‘poison the well’. These documents were never submitted with my claims concerning my lumbar injury, nor where they used by the delegate in reaching her decision. Their inclusion is highly inappropriate, and I contend prejudicial. I remind you that the s.137 of the Act specifies that only documents ‘referring to the evidence under the control of the Department that is relevant to the review [emphasis added]’ should be contained in the report.
Secondly, and following on from the matter of ‘evidence under the control of the Department that is relevant to the review’, I have to ask why:
·The report of Consultant Orthopaedic Surgeon Dr David McNicol, from his lumbar assessment of me on 22 Sep 2010, requested by DVA on 20 Aug 2010 not part of the report? It is clearly relevant, and readily available to DVA, and yet it has not been included. Instead only the very limited report of Dr Bornstein has been available, which is considerably dated and certainly misrepresentative of the current clinical picture. This ‘oversight’ is remarkable (if one was not familiar with DVA’s dirty tricks).
·The Summary LBP Timeline document, of which Report Document 40 is part of, been excluded from this Report? It clearly is in DVA’s possession, it is clearly highly relevant (more so than the multiple copies of pathology reports which have no relevance) and yet it has be deliberately (given part of that document has been included) excluded. Again, remarkable – remarkably familiar behaviour from the bad faith cesspool that is DVA.
Yet another disgusting attempt by DVA to try and stick to us veterans yet again. Can’t you lot, just for once, do your jobs with honesty and integrity – or is it mandatory that you all act like slime.”[74]
[74] Exhibit A at A-540

29 August 2011

On 29 August 2011 at 9:41pm, TYGJ again wrote to [email protected]. The subject line of his email read: “DVA Caught Out Telling Lies Red-Handed”. The text read:
“I was lead to believe that members of the Australian Public Service were required, under the APS Code of Conduct, to behave at all times at all times in a way which upholds the APS Values. Specific to those Values, and the Code, is the requirement of Commonwealth Officials to behave honestly, act with integrity and not to provide false or misleading information.
For the mast part, being a former public servant myself, I have found most Commonwealth Departments and Agencies do their upmost to ensure that this is the case with their employees. I therefore find it very distressing in my dealings with the Department of Veterans’ Affairs that their seems to be a dominant culture amongst its staff which is the antithesis of these values. And tonight I found clear and irrevocable proof of that behaviour, contained in copies of documents I finally forced out of your very reluctant Department (who hate with a passion the power to compel copies of documents relating to claimants be made available under the MRCA/SRCA legislation), in a chain of internal emails between a senior DVA manager and delegate from the DVA WA office made on 19 November 2010.
Specifically, on 19 November 2010, under s.331 of the Military Rehabilitation and Compensation Act 2004, I requested a copy of a medical report on me – held by the Department – in writing. I was specifically told by … [DVA officer B] that she was unable to provide a copy of that report because ‘she had not received it yet’. This is despite the fact that I now have a copy of an email exchange between … [DVA officer B] and her senior manager … [DVA officer C] , on the same date, not only acknowledging that they did have a copy of that report in their possession, but confirming that they had deliberately mislead me regarding that report being in their possession because quote ‘early release may precipitate action’.
The fact that I was blatantly lied to, grossly mislead, and denied my right to obtain access to the document as enshrined in the legislation is not the most galling thing. The fact that this is a regular occurrence at DVA is most galling, the fact that the responsible Minister (Snowdon) shirks any responsibility for dealing with these matters is most galling, the fact that Department has the cheek to advertise they ‘Honour Our Service’ while engaging in deceptive conduct is most galling, the fact that my complaint is most unlikely to change this toxic culture is most galling, the fact this Department does more to cause the suicides of injured veterans with this behaviour is MOST GALLING OF ALL.
DVA are just going to let the APS Values be a joke – you lot are never going to do something to clean up that horrible cancer of a culture yourself. God knows, I didn’t serve my country – and bear the scars of conflict – to come home to this.”[75]
[75] Exhibit A at A-541. The matters raised in the email relate to a request made by TYGJ on or about 19 November 2011 at 9:34am when he asked DVA for a copy of Dr McNicol’s medical report made in relation to his claim for compensation. He made his claim under s 331 of the MRC Act. At 12:57pm on the same day, … [DVA officer B] wrote to … [DVA officer C] referring to a conversation she had with TYGJ on 26 October 2010 when she had returned his call. On 26 October 2010, she told him, she was waiting for Dr McNicol’s report. By the time she wrote to … [DVA officer C], she had received Dr McNicol’s report and indicated her thoughts on a possible interim determination on TYGJ’s claim. At 11:24am, … [DVA officer D] told … [DVA officer B] that, technically, DVA was obliged to release the report if it fell within the terms of DVA’s request but that it would be nice if release could be held off for a week or two until a decision was made on TYGJ’s claim. … [DVA officer C] copied … [DVA officer B] in to his response sent at 1:04pm to the issues in her email in which he said that “The medical report to which he refers is in our hands but we are reluctant to give him a copy until we make a decision based on all available medical and file evidence, as early release may precipitate actions further delaying this PI determination process”. Exhibit A at A-635-637.

At 9:52pm on the same day, TYGJ wrote an email to … [DVA officer D] at DVA with the subject line: “Do you make a regular habit of breaching the APS Code of Conduct?”:
“I read with disgust your email to … [DVA officer B] of Friday 19 November 2010 (11:24AM , with cc to John Reeday) where you clearly accept the Department was required to provide a copy of Dr McNicol’s report to me, but advocate deception (in breach of the legislation) to ensure the report is not provided to me until after a determination is made, even though it is clear that a copy of the report is ready to hand (quantum levels are discussed, for instance, and … [DVA officer B] indicates she had just read through it) and bluff about files is merely that.
All I can say is I think you should re-read the APS Code of Conduct which talks about honesty and not misleading the public – and suggest you owe me apology for such an appalling act of dishonesty and unethical behaviour.”[76]
[76] Exhibit A at A-542.

In the case of the Privacy Act, Parliament has clearly turned its mind to the circumstances in which it will abrogate or curtail any “right to privacy”. The Privacy Act does not confer a right to privacy as such. Rather, it imposes a duty on the record-keeper not to disclose personal information and any right to privacy is the correlative of that duty. It is clear from the drafting but also from the Attorney-General’s reference to the fact that there are exceptions to the record-keeper’s duty of non-disclosure and that those exceptions “… recognise that any claim for privacy by an individual must be considered against equally justified claims by other individuals and the community.”[276] In light of that, it seems to me that the exceptions to the record-keeper’s duty not to disclose personal information should be given their ordinary meaning and neither read restrictively nor expansively.

[276] Hansard, House of Representatives, 1 November 1988 at 2117

When that is done, there are several elements that must be satisfied before the record-keeper is not under a duty not to disclose personal information. The first two are concerned with the belief held by the record-keeper. They are that the record-keeper “believes” and, if so, that the record-keeper “believes on reasonable grounds”. I have divided the two because it is possible to have reasonable grounds for a belief but not to hold that belief. The third element is concerned with what it is that the record-keeper believes i.e. “that disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person”.

To “believe” is “… 1 to accept what is said by someone as true … 3 to think, assume or suppose …”.[277] Whether one believes “on reasonable grounds” is very much a matter to be decided on the evidence in each case. The belief that a record-keeper must have on reasonable grounds is that it is “necessary” to disclose a person’s personal information for the reason stated in IPP11.1(c). What is “necessary” is that which is “… needed; essential; indispensable; that must be done. …”[278] to prevent or lessen a serious and imminent threat to life or health be it the life or health of the individual who is the subject of the personal information or of another person. The words “prevent or lessen” seem plain but what is a “serious and imminent threat”? In this context, a “threat” is “… a source of danger …”[279] rather than simply “… a sign that something dangerous or unpleasant is or may be about to happen.”[280] It must be a threat that is both serious and imminent. That is to say, it must be both “severe” and “… likely to happen in the near future; looming or impending. …”.[281]

[277] Chambers

[278] Chambers

[279] Chambers

[280] Chambers

[281] Chambers

In this case, the question to be asked is whether DVA believed (i.e. thought that it was true) on reasonable grounds that Disclosures 1 and 2 to the SMO and the Head of Joint Health Command in the Department of Defence respectively were necessary (i.e. that which is needed or which must be done) to prevent (i.e. stop or avert[282]) or lessen a serious and imminent threat (i.e. a severe source of danger that is likely to happen) to the life or health of TYGJ or of other persons. On the evidence of Ms Collins and having regard to the nature of the disclosures in the context of the communications that had occurred between it and DVA, I find that the responsible officers in DVA made Disclosures 1 and 2 having grave concerns for the health and safety of TYGJ and of their staff. They genuinely held those concerns and, I find, did so on reasonable grounds. I have set out the text of the email communications and have described the change in context, tone and manner of communication.

[282] Chambers

I do not, however, accept that, at the time of Disclosures 1 and 2, DVA had formed the belief that disclosure was necessary to prevent or lessen a serious and imminent threat to TYGJ’s life or health or that of their staff. At that stage, they were exploring the extent of the threat and so sought advice from the SMO. DVA knew that TYGJ had not previously been thought to be suffering from a psychiatric condition but his behaviour in the email correspondence raised doubts about his mental health and led them to explore the issue further by means of Disclosure 2 to the Head of Joint Health Command and then for arrangements being made for him to have a psychiatric evaluation of his current state of mental health.

Even if I am incorrect and DVA had formed the necessary belief, I do not accept that there were, as at 20 October 2011, reasonable grounds for holding the belief that the threat was imminent even if there were grounds for holding that it was serious. There is evidence for the latter given TYGJ’s raising the level of anger and aggression in his emails. His reference to a prompt response’s avoiding hand grenades on 19 October 2011 is one example. Another is his thinking that he might try a blowtorch since he thought that DVA was not understanding that it needed to improve. Both examples might be thought to be mere rhetoric but, in the overall context, might be thought to be indicative of a more violent response that would, if it occurred, pose a threat to life or health of DVA officers.

If that more violent response were to occur, it would be serious but the issue is whether, at that stage, it would be thought to be an imminent threat. In order to come within the qualification to IPP11.1, the threat must be both serious and imminent. I note TYGJ’s submission that he could not pose a threat in view of his physical condition. That may be so but a threat to life or health that is serious and imminent can be made by means and ways other than through physical means or by physical presence. Another example of that is found in TYGJ’s emailing Ms Donnellan at her personal email. That came after Disclosures 1 and 2 and so cannot be taken into account but her reaction is indicative of the concern that TYGJ was inducing among DVA staff before that day. As she wrote to Mr McNally at 6:28pm on 21 October 2011:
“This is getting out of control, he is now contacting me on my personal email and I am about ready to break.”[283]
[283] Exhibit JP1 at Annexure JC-9
Matters were getting out of control by 20 October 2011 but I am not satisfied that TYGJ was posing a serious and imminent threat to the mental health of Ms Donnellan at that stage. It was understandable that she was “about ready to break” but she was not called to give evidence as to what she meant and there is no other evidence of her state of mind or that of other DVA officers. In view of that, I am not satisfied that there were reasonable grounds for DVA to hold the belief that Disclosures 1 and 2 were necessary to prevent or lessen a serious and imminent threat to the life and health of TYGJ or of another person. Therefore, I am not satisfied that Disclosures 1 and 2 come within IPP11.1(c).

Qualification IPP11.1(d): “the disclosure is required or authorised by or under law”

I have set out the relevant terms of s 16 of the OHS Act at [27] above. The question raised by IPP11.1(d) is whether Disclosures 1, 2 and 3 were required or authorised by or under law. They are not expressly required or authorised by s 16 or by the OHS Act more generally. The Privacy Commissioner submits that there must be such an express requirement or authorisation before the qualification in IPP 11.1(d) may apply. It must be found either in an enactment or in the common law but none is to be found in the imposition of a statutory duty to provide a safe working environment for employees. The Privacy Commissioner relies on his IPP Guidelines when he addresses the situations in which it might be said that a law impliedly requires or authorises the disclosure of information even though it has not expressly done so:
“Can a law impliedly authorise a use or disclosure?
A use or disclosure may fall within 10.1(c) or 11.1(d) if the law requires or authorises a function or activity that clearly and directly entails the use or disclosure. Here, the use or disclosure is impliedly authorised by law because it is essential to effect a scheme the law lays down.
For example:
·An industrial law says that a union must conduct an election for OHS representatives and that this must be an election of all people in the workplace (not just union members) and that it must be by postal ballot. It is impossible for this law to be complied with unless the employing agency is able to tell the union the names and addresses of its non-union employees.
·Where a function is wholly transferred from one agency to another, disclosures made by the old agency to the new agency are necessary to give effect to the new administrative arrangements. Note that this does not permit the new agency to use the personal information for a purpose other than that for which it was obtained.
·If a law authorises an agency to obtain personal information, it authorises disclosures that are an inseparable part of obtaining it. For example, telling the person from whom you are obtaining information the name of the person about whom you are asking.”

I have kept the IPP Guidelines in mind when considering whether it could be said that DVA’s disclosure or disclosures were required or authorised under law within the meaning of IPP 11.1(d). The disclosure is not expressly required or authorised by the OHS Act, on which DVA relies but, as the IPP Guidelines recognise, it may be implied. The nature of the task to determine whether there is such an implication was described by Mason J in Minister for Aboriginal Affairs v Peko-Wallsend Ltd.[284] His Honour considered whether, in exercising powers under s 11(1)(b) of the Aboriginal Land Rights (Northern Territory) Act 1976, the Minister for Aboriginal Affairs was bound to take into account the comments made by the Aboriginal Land Commissioner on matters in ss 50(3)(a) to (d) of that Act. His Honour said:
“ The Act does not expressly state that the Minister is bound to take into account the Commissioner’s comments on the matters in paras (a) to (d) of s 50(3) in exercising his power under s 11(1)(b) to decide whether or not he is satisfied that a land grant should be made. But a consideration of the subject matter, scope and purpose of the Act indicates that such a finding is necessarily implied by the Statute. The factor that leads irresistibly to this conclusion is the specific requirement in s 50(3) that the Commissioner comment in his report on each of the four matters enumerated in the subsection, including of course detriment. The provision recognises that the granting of land to a Land Trust may adversely affect the interests of many people, in some cases in a very substantial way. The legislature was clearly concerned that the Minister not overlook crucial considerations which might counterbalance or outweigh the fairness and justice of granting the land when making his decision under s 11(1)(b). Accordingly, it provided the means whereby such factors would be analyzed and drawn to his attention for the purpose of having them taken into account. That purpose would not be achieved if the Minister was merely entitled, but not bound, to consider these factors. ...
The second question, which lies at the heart of this appeal, is whether the Minister is also bound to take into account submissions made to him which correct, update or elucidate the Commissioner’s comments on detriment. Once it is accepted that the subject matter, scope and purpose of the Act indicate that the detriment that may be occasioned by a proposed land grant is a factor vital to the exercise of the Minister’s discretion, it is but a short and logical step to conclude that a consideration of that factor must be based on the most recent and accurate information that the Minister has at hand. … In one sense this conclusion may be seen as an application of the general principle that an administrative decision-maker is required to make his decision on the basis of the material available to him at the time the decision is made. But that principle is itself a reflection of the fact that there may be found in the subject-matter, scope and purpose of nearly every statute conferring power to make an administrative decision an implication that the decision is to be made on the basis of the most current material available to a decision-maker.”[285]
[284] [1986] HCA 40; (1986) 162 CLR 24; 66 ALR 299; Gibbs CJ, Mason, Brennan, Deane and Dawson JJ
[285] [1986] HCA 40; (1986) 162 CLR 24; 66 ALR 299 at 44-45 per Mason J
On behalf of the Privacy Commissioner, Mr Holcombe submitted that it is not uncommon for Commonwealth agencies to have “clients” who correspond with it in an inappropriate manner. When that happens:
“… The duty imposed by section 16 of the OHS Act means that where an agency has officers who are likely to come into contact with difficult or aggressive customers, the agency is under an obligation to ensure that those officers are equipped, trained and supported in a way in which their health and safety at work is not compromised.
As an example, the Department of Human Services, where officers administer the Medicare, Centrelink and Child Support programmes, provides training, and has support groups and consultative committees. The Department also has policies about email addresses and telephone numbers of officers and provides for staff anonymity where necessary. … Those types of action constitute ‘reasonably practicable’ and prudent steps and assist to address the issue of staff protection and an agency’s obligations as an employer.
In order to be ‘reasonably practicable’, the steps must be proportionate responses that enable the agency to discharge its duty under the OHS Act according to lawful constraints imposed on the agency. The reasonable steps for an agency will vary according to the circumstances but would include those steps mentioned above, such as having policies and support networks and, importantly, ensuring compliance with those policies and the use [of] those support networks.
As a Commonwealth agency, the Party Joined should have such policies and support networks. Evidence of those policies and mechanisms has not been placed before the Tribunal.
The information before the Tribunal did, however, demonstrate that, as regarding the Applicant’s situation, there were a number of reasonably practicable steps available to the Party Joined to discharge its duty under the OHS Act. These included referring the Applicant to the Client Liaison Office, creating a single point of contact for the Applicant, contacting the Applicant directly to discuss his behaviour, and obtaining a workplace protection order. All of these actions constitute reasonable, proportionate methods of escalation. None of these steps were taken prior to the disclosure of the Applicant’s personal information in claims 1 and 2.
One reasonably practicable step that was undertaken, even though late, was for the Applicant to be contacted by the Party Joined and the concerns about his conduct discussed. When this reasonably practicable step was done by the security office on 21 October 2011, it had an immediate and positive effect on the conduct of the Applicant.”[286]
[286] Respondent’s submissions at [51]-[56] (footnote omitted)
The objects of the OHS Act are set out in s 3:
“The objects of this Act are:
(a) to secure the health, safety and welfare at work of employees of the Commonwealth, of Commonwealth authorities and of non-Commonwealth licensees; and
(b)to protect persons at or near workplaces from risks to health and safety arising out of the activities of such employees at work; and
(c) to ensure that expert advice is available on occupational health and safety matters affecting employers, employees and contractors; and
(d) to promote an occupational environment for such employees at work that is adapted to their needs relating to health and safety; and
(e) to foster a co-operative consultative relationship between employers and employees on the health, safety and welfare of such employees at work; and
(f) to encourage and assist employers, employees and other persons on whom obligations are imposed under the Act to observe those obligations; and
(g) to provide for effective remedies if obligations are not met, through the use of civil remedies and, in serious cases, criminal sanctions.”

The functions given under s 12 of the OHS Act to the Safety, Rehabilitation and Compensation Commission (which was established by s 89A of the SRC Act) and to Comcare (established by s 68 of the SRC Act) necessarily include the gathering of information about Commonwealth employees. Employers are also gatherers of information and the OHS Act imposes restrictions on the extent to which an employer may make available to a health and safety committee information of a confidential medical nature relating to a person who is or was an employee of the employer.[287] Investigators appointed by Comcare under s 40 of the OHS Act may require the production of certain information under s 43. Among other obligations, an employer is required to provide reasonable assistance and information to the investigator under that section.

[287] OHS Act; s 36(2)

The OHS Act does not specifically confer power on an employer to release information and yet it seems to me that the power to do so must be implied from the nature of its obligation. As s 16(1) states, an employer “must take all reasonable steps” to protect the health and safety at work of its employees. The OHS Act regulates specific aspects of activities that an employer may undertake but, apart from those specific examples which are found in Part 2 of the legislation, no provisions elaborate upon the way in which an employer is to fulfil its duty. That follows from the fact that what amounts to reasonably practicable steps must be assessed on a case by case basis as the nature of the risks and dangers to employees’ health and safety vary from circumstance to circumstance as do the steps that are reasonably practicable to protect their health and safety within the meaning of s 16(1) of the OHS Act.

The power to make enquiries of others and to obtain information from others must be implicit in the nature of an employer’s obligation under s 16 if it is to determine. Just as what will be regarded as reasonably practicable steps will change from case to case, so too will the enquiries and assessments that must be made as part of taking all reasonably practicable steps. If disclosure of personal information is made for that purpose, it will have been authorised under law within the meaning of IPP11.1(d).

I accept the Privacy Commissioner’s submission that DVA should have procedures and practices of the sort that he described in place to protect their staff. It is true that DVA did not produce any evidence of such practices but this does not mean that they did not have them. I do not think that the evidence would have been relevant for I find that the situation had move well past the scenario of DVA’s simply being faced with a difficult or aggressive person with whom it had to deal. It is apparent from the emails that I have set out at that DVA appears to have delayed in its response to TYGJ’s request for Dr McNicol’s report until it had made a decision. Whether that was appropriate action to take, is not relevant in this case but it does form part of the background to TYGJ’s interaction with DVA. So too do TYGJ’s emails preceding his discovery that there had been delay in giving him a copy of Dr McNicol’s report. It appears from his email dated 29 August 2011 and sent to [email protected] that he did not find out about the delay until earlier that day. It is apparent from his emails to DVA that preceded that day, that the relationship between TYGJ and DVA was already fraught.

By the time of Disclosures 1 and 2 on 20 October 2017, Ms Collins had attempted to contact TYGJ on 7 October 2011 and to offer to meet with him. She had engaged with him by email on 10 October 2011 and offered to go to a place convenient to him. On 12 October 2011, she wrote a comprehensive letter in which, in brief, she apologised for certain DVA actions, corrected certain misunderstandings TYGJ seemed to hold and dealt with the future. Ms Collins’ attempts to meet with TYGJ came after DVA had acknowledged an earlier error to TYGJ. It preceded the attempts of Mr McNally from DVA security on 21 October 2011, to which Mr Holcombe referred in his submission. It followed on … [DVA officer A’s] apology and conciliatory letter to TYGJ on 28 July 2011. Despite Ms Collins’ conciliatory approach, it was not accepted by TYGJ in those terms and he wrote shortly after to Ms Donnellan and Mr Weiss telling the latter that his clock was “… now definitely ticking, it’s time to get on with it or I will run you down and hound you until you get off your fat arse and do what – by law – you are obliged to do. There will certainly be no more pleasantries until then. I hope I make myself abundantly clear.”

It is true that, after Mr McNally spoke with TYGJ on the evening of Friday, 21 October 2011, TYGJ moderated his email correspondence. Mr McNally and TYGJ discussed ways they could repair their relationship and Mr McNally thought him amenable to the idea of a single point of contact. On the face of the conversation, there is nothing to choose between Ms Collins’ approach to TYGJ and Mr McNally’s.

By the time of Mr McNally’s conversation with TYGJ, Disclosures 1 and 2 had been made on the previous day. It could be said, as the Privacy Commissioner submits, that it was not reasonable to make them when an approach by Mr McNally had not been attempted. In the circumstances, I do not accept that submission. What it is from which employees must be protected may come from a variety of sources and influence and the interaction of those sources and influences. They may come from within the employer’s own premises, operating practices or staff but they may also come from without. On any given day, those sources, influences and interactions may change.

They did in this matter for, whereas Ms Collins’ attempts to meet with TYGJ to discuss his concerns in early October 2011 did not meet with any positive outcome for DVA or TYGJ, those of Mr McNally in the latter half of October 2011 did. When Disclosures 1 and 2 were made on 20 October 2011, the precise nature of any threat to the health and safety of DVA’s employees was unknown when the Disclosures were made. What I have found, is that there was a sound basis for DVA’s having concerns about the health and safety of its staff in view of TYGJ’s escalating behaviour. In order to form a view as to the extent of the concern that it should have and to take all the reasonably practicable steps it was required to take in order to protect the health and safety of its employees, DVA needed a proper assessment. Disclosure 1 led to its finding out TYGJ’s clear psychiatric history but not his current state of mind. Disclosure 2 led to arrangements being made for him to have a psychiatric evaluation of his current state of mental health.

Disclosure 3 was made after the positive exchange between Mr McNally and TYGJ. It was, I find, directed to minimising the potential harm to DVA’s officers as well as more broadly directed to drawing in the assistance of the Chief of Air Force to work with them in working with TYGJ. Given the long history of the exchanges between DVA and TYGJ, the nature of those exchanges and given that Disclosure 3 was made only a week after the conversation between Mr McNally and TYGJ, I am satisfied that the situation remained one in which it was reasonable for DVA to continue to have concerns for the health and safety of its employees. Disclosure to the senior person in the Air Force, of which TYGJ was a member, was a reasonable and practicable step to protect the health and safety of DVA’s employees when they were at work.

In view of my findings, I am satisfied that each of the three Disclosures was authorised under the OHS Act and so comes within the exception to IPP11.1 that is set out in IPP11.1(d).

Qualification IPP11.1(e): “the disclosure is reasonably necessary for the enforcement of the criminal law or of a law imposing a pecuniary penalty, or for the protection of the public revenue”

DVA relies on IPP11.1(e) in relation to Disclosure 3. The imposition of a pecuniary penalty and the protection of the public revenue are not in issue in this case. What is in issue is whether Disclosure 3 was reasonably necessary for the enforcement of the criminal law. It is arguable that what may be necessary for the enforcement of the criminal law may include the transmission of information by one agency to another agency having responsibility for the enforcement of the criminal law.[288] I do not think that I have a need to explore the issue further for I find that Disclosure 3 was neither made for the purpose of enforcement of the criminal law nor reasonably necessary for the enforcement of the criminal law. It was made to draw TYGJ’s behaviour and its effect on DVA staff to the attention of the Chief of Air Force. For the reasons that I have given in relation to IPP11.1(a), information of that kind is usually passed to him. It may also be said that it was necessary for DVA to take that course but, having regard to the content of the letter, I do not find that it was necessary to make that disclosure for the enforcement of the criminal law. The information relayed is not directed to particular offences or even offences broadly described as criminal. Disclosure 3 is too broadly stated to be characterised as being reasonably necessary for the enforcement of the criminal law. Therefore, I am not satisfied that it comes within the exception set out in IPP11.1(e).
[288] See generally the discussion by in Australian Crime Commission v AA Pty Ltd [2006] FCAFC 30; 149 FCR 540; Nicholson, Mansfield and Bennett JJ

DECISION

For the reasons I have given, I have decided to set aside the decision of the Information Commissioner dated 13 November 2014. In its place, I have substituted a decision to make a determination dismissing the complaint dated 21 November 2011. In summary, the grounds on which I have made that decision are:
(1)Disclosure 1 on 20 October 2011 of the TYGJ’s personal information by the DVA to an ADF Senior Medical Officer came within the exceptions specified in IPP 11.1(a) and (d);
(2)Disclosure 2 on 20 October 2011 of TYGJ’s personal information by DVA to the Head of Joint Health Command in the Department of Defence came within the exceptions specified in IPP 11.1(a) and (d);
(3)Disclosure 3 on 28 October 2011 of TYGJ’s personal information by DVA to the Chief of Air Force came within the exceptions specified in IPP 11.1(a) and (d).

I certify that the preceding 310 (three hundred and ten) paragraphs are a true copy of the reasons for the decision herein of Deputy President S A Forgie

........[sgd]..............................................................
Associate
Dated: 27 September 2017

Dates of hearing:

Date of last submission:

8 and 9 February 2016, 30 March 2016 and 27 April 2016

13 July 2016

Self-represented Applicant:

In person

Solicitor for the Respondent:

Solicitor for the Joined Party:

Mr L Holcombe
HWL Ebsworth Lawyers

Mr J Davidson
Australian Government Solicitor

“(1) The Commissioner shall, by notice in writing, issue guidelines concerning the collection, storage, use and security of tax file number information.
(2) A guideline issued under subsection (1) is a disallowable instrument for the purposes of section 46A of the Acts Interpretation Act 1901.”