Vice-Chancellor, Macquarie University v FM (GD) - [2003] NSWADTAP 43

No judgment structure available for this case.

Pending Appeal:

Appeal Panel - Internal

CITATION: Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43

PARTIES: FIRST APPELLANT
Vice-Chancellor, Macquarie University
FIRST RESPONDENT
FM
SECOND APPELLANT
FM
SECOND RESPONDENT
Vice-Chancellor, Macquarie University

FILE NUMBER: 039021, 039025

HEARING DATES: 30/06/2003

SUBMISSIONS CLOSED: 06/30/2003

DATE OF DECISION:
09/23/2003

DECISION UNDER APPEAL:
FM v Vice-Chancellor, Macquarie University [2002] NSWADT 78

BEFORE: O'Connor K - DCJ (President); Goode P - Judicial Member; Antonios Z - Member

CATCHWORDS: finding contrary to evidence - opportunity to be heard - role of Privacy Commissioner - scope of Tribunal Order - statutory interpretation

MATTER FOR DECISION: Principal matter

FILE NUMBER UNDER APPEAL: 023156

DATE OF DECISION UNDER APPEAL: 04/16/2003

LEGISLATION CITED: Freedom of Information Act 1989
Interpretation Act 1987
Official Information Act 1982 (NZ)
Privacy Act 1974 (US)
Privacy Act 1988 (Cth)
Privacy Act 1993 (NZ)
Privacy and Personal Information Protection Act 1998
Retail Leases Act 1994

CASES CITED: Brandusoiu v Commissioner of Police [1999] NSWADTAP 8
Commissioner of Police v Ombudsman [1985] 1NZLR 578
Commissioner of Police v Ombudsman [1988] 1NZLR 385
DO v University of New South Wales [2002] NSWADT 211
DO v University of New South Wales (GD) [2003] NSWADTAP 9
FM v Vice-Chancellor, Macquarie University [2002] NSWADT 78
Kline v Dept of Health & Human Services (1991) 927 Fed Rep 2d 522
Krieger v Fadely (2001) 199 FRD 10
Re Application by L (1997) 3 HRNZ 716
Re Australian Broadcasting Tribunal; ex p Hardiman (1980) 54 ALJR 314
Re Barkhorder and ACT Schools Authority (1987) 12 ALD 332
Repatriation Commission v Vietnam Veterans' Association [2000] NSWCA 65
Re Sullivan v Department of Industry Science and Technology (1996) 23 AAR 59
Thomas v US Department of Energy (1983) 719 Fed Rep 2d 342
TXU Electricity Ltd v Office of Regulator General, Victoria and ors [2001] VSC 4

REPRESENTATION: FIRST APPELLANT & SECOND RESPONDENT
M Allars, barrister
FIRST RESPONDENT & SECOND APPELLANT
In person

ORDERS: (1) Appeal by FM dismissed.; (2) Appeal by Macquarie University allowed in part. ; (3) Order of the Tribunal set aside.; (4) The application for review is to be further considered by the Appeal Panel on the question of whether to have required compliance with section 18 of the Privacy and Personal Information Protection Act 1998 would have detrimentally affected (or prevented the proper exercise of) the University’s investigative functions; and if there is a contravention the making of any Order.; (5) To be relisted for directions in February 2004.; (6) Liberty to either party to apply on 7 days’ notice in relation to the relisting of the matter.

1 Both parties to the decision of the Tribunal in FM v Vice-Chancellor, Macquarie University [2003] NSWADT 78 have appealed against the decision. The decision related to an application for review of the conduct of a public sector agency brought by the applicant (‘FM’) under the provisions of the Privacy and Personal Information Protection Act 1998 (Privacy Act). FM was a former student of the respondent University (‘Macquarie’). His complaint related to the disclosure by it of information relating to his period of enrolment as a student in 1999. The information was disclosed to the University of New South Wales (UNSW) after he had obtained enrolment (and been granted a scholarship) in 2001. The enrolment was cancelled.

2 The Tribunal found that two academic staff members of Macquarie had unlawfully disclosed information relating to the FM in contravention of the information protection principle set out in s 18 of the Privacy Act (IPP s 18, the Disclosure Limitation Principle) which provides:

18 Limits on disclosure of personal

(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:

(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or

(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or

(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.’

3 Also relevant to this case is s 26(2) of the Privacy Act which provides:

‘A public sector agency is not required to comply with section 10, 18 or 19 if the individual to whom the information relates has expressly consented to the agency not complying with the principle concerned.’

4 The Use Limitation Principle (IPP s 17) has also been raised as relevant by Macquarie, and for convenience is set out:

17. Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.’

5 Under s 55 of the Privacy Act the Tribunal has wide powers to make orders:

55. Review of conduct by Tribunal

(1) If a person who has made an application for internal review under section 53 is not satisfied with:

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.

(2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders:

(a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct,

(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice,

(c) an order requiring the performance of an information protection principle or a privacy code of practice,

(d) an order requiring personal information that has been disclosed to be corrected by the public sector agency,

(e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant,

(f) an order requiring the public sector agency not to disclose personal information contained in a public register,

(g) such ancillary orders as the Tribunal thinks appropriate.

(3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 5 of the Administrative Decisions Tribunal Act 1997.

(4) The Tribunal may make an order under subsection (2) (a) only if:

(a) the application relates to conduct that occurs after the end of the 12 month period following the date on which Division 1 of Part 2 commences, and

(b) the Tribunal is satisfied that the applicant has suffered financial loss, or psychological or physical harm, because of the conduct of the public sector agency.

(4A) The Tribunal may not make an order under subsection (2) (a) if:

(a) the applicant is a convicted inmate or former convicted inmate or a spouse, partner, relative, friend or an associate of a convicted inmate or former convicted inmate, and

(b) the application relates to conduct of a public sector agency in relation to the convicted inmate or former convicted inmate, and

(c) the conduct occurred while the convicted inmate or former convicted inmate was a convicted inmate, or relates to any period during which the convicted inmate or former convicted inmate was a convicted inmate.

(5) If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency.

(6) The Privacy Commissioner is to be notified by the Tribunal of any application made to it under this section.

(7) The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section.’

6 In this case the Tribunal made a conduct order against Macquarie, but declined to award FM monetary compensation. The order made was:

Privacy and Personal Information Protection Act 1998

7 Macquarie has appealed against the finding of contravention and the consequent order. FM has appealed over the failure to award him monetary compensation.

Circumstances

8 The circumstances out of which the contravention of s 18 arose were as follows.

(2) On 5 March 2002 FM was accepted as a postgraduate student at the University of New South Wales (UNSW), following an application for admission made in February 2002. UNSW were not made aware by FM that FM had previously been a student at Macquarie University.

(3) Subsequent to admission the University of New South Wales became aware that FM had been a student at Macquarie and sought information about his academic history there from Macquarie.

(4) It is at this point that the question of compliance with the Privacy Act as relevant to this case arises.

(5) On 20 March 2002 a person ("A") of UNSW, spoke on the phone to a person ("B") from Macquarie, then on 22 March 2002, A spoke to another person ("C"), also from Macquarie University.

(6) B and C told A about alleged incidents in which FM had been involved at Macquarie and which resulted in his candidature as a postgraduate student being terminated there.

(7) On 11 April 2002 a person in the Academic Program Section of Macquarie faxed FM's academic transcript to the UNSW.

(8) The UNSW had also made enquiries of other Universities that FM had previously attended.

(9) On 16 April 2002, the UNSW advised FM that it proposed to review his enrolment status in the light of his failure to provide certain information on his application for admission. In particular, the Registrar wrote that:

‘It has been drawn to my attention that you did not declare on your application for admission to the PhD program your previously [sic] enrolments at the University of Adelaide (1997), the University of Queensland (1998) Macquarie University (1999) and the University of Tasmania (2000 and 2001).’

9 Macquarie has acknowledged that it did not hold any direct consent from FM permitting it or its staff to make the disclosures referred to at steps (6) and (7) above. It did however claim that an express consent had been given to it by virtue of a clause in the UNSW application form completed and signed by FM in February 2002 and set out later in these reasons.

10 Case against Enrolling University: FM has also complained over the conduct of UNSW in making the enquiries that it did following his admission into the postgraduate program. That complaint has also given rise to an application for review that has been considered by the Tribunal and the Appeal Panel, and dismissed. The Tribunal found that the UNSW had not infringed the Privacy Act in that the various requirements attaching to the collection and disclosure of personal information had been satisfied by it (see IPPs ss 8, 9, 10, 11 and 18), with the clause referred to being critical in that it constituted an authorisation for collection of personal information from a third party (thereby satisfying cl 9(a)) and being relevant to the requirement that any disclosure was of a kind that the individual could be said to have been reasonably aware might occur or had been the subject of a specific notice to him (see s 10 and s 18(1)(b)). See DO v University of New South Wales [2002] NSWADT 211; DO v University of New South Wales (GD) [2003] NSWADTAP 9 (appeal dismissed).

Macquarie’s Submissions to Primary Tribunal

11 Before the Tribunal Macquarie contended that it had not contravened s 18 for the following reasons:

· not all the information in issue was "personal information" within the definition of that phrase in s 4(3) of the Privacy Act;

· not all the information in issue was "held" by Macquarie within the definition of that phrase in s 4(4) of the Privacy Act;

· B and C believed on reasonable grounds that the disclosure was necessary to prevent or lessen a serious and imminent threat to the life or health of another person, within s 18(1)(c) of the Privacy Act;

· FM gave his express consent to Macquarie not complying with s 17 [the Use Limitation Principle] placing limits on the use of personal information] and therefore the disclosure is exempt pursuant to s 26(2) of the Privacy Act [the same argument is relevant to compliance with s 18]; and

· the disclosure was made in accordance with the Privacy Commissioner's Direction on Processing of Personal Information by Public Sector Agencies in Relation to their Investigative Functions and is therefore exempt under s 41 of the Privacy Act.

12 The Tribunal rejected all of these contentions.

13 In rejecting FM’s application for a monetary order, the Tribunal primarily relied on the consideration that FM could not be said to have suffered any personal damage in circumstances where the information that came to light about his academic history (from several prior Universities, including Macquarie) was clearly relevant to the UNSW’s decision to enrol him and afforded a proper justification for terminating his enrolment. The Tribunal was satisfied that had FM revealed his full academic history he would never have been admitted in the first place.

Appeals

14 Section 56 provides:

56. Appeals to Appeal Panel against decisions and orders of Tribunal

An order or other decision made by the Tribunal under this Part may be appealed to an Appeal Panel of the Tribunal under Part 1 of Chapter 7 of the Administrative Decisions Tribunal Act 1997 [the Tribunal Act] by a party to the proceedings in which the order or decision is made.’

15 Section 112 of the Tribunal Act provides materially:

112. Appealable decisions of the Tribunal

(1) For the purposes of this Part, an "appealable decision" of the Tribunal is a decision of the Tribunal (or a decision that is taken to be a decision of the Tribunal) made in proceedings for:

(a) an original decision where the enactment under which the Tribunal has jurisdiction to make the decision expressly provides that the decision may be appealed to an Appeal Panel under this Part, or

(b) a review of a reviewable decision.’

16 In light of the terms of s 56 of the Privacy Act, this appeal falls, it would seem, under s 112(1)(a) even though the underlying proceedings take the form of an application for review. (As to the confusion surrounding the conceptual classification to be given to Privacy Act proceedings, see Sharp N ‘The chameleon tribunal: The Administrative Decisions Tribunal of New South Wales’ (2003) 10 AJAL 181 at 188.)

17 The scope of an appeal is governed by s 113:

113. Right to appeal against appealable decisions of the Tribunal

(1) A party to proceedings in which an appealable decision of the Tribunal is made may appeal to the Tribunal constituted by an Appeal Panel.

(2) An appeal under this Part:

(a) may be made on any question of law, and

(b) with the leave of the Appeal Panel, may extend to a review of the merits of the appealable decision.’

18 The Appeal Panel has generally adopted the position that an error of law must be shown before considering whether to extend an appeal to the merits: Brandusoiu v Commissioner of Police [1999] NSWADTAP 8.

19 The Privacy Commissioner had (as has been customary in applications for review heard by the Tribunal) exercised the right given to that office by s 55(7) of the Privacy Act ‘to appear and be heard in any proceedings before the Tribunal’. Macquarie has contended before the Appeal Panel that the Privacy Commissioner has no right to be heard, and that the right given by s 55(7) is only available in respect of proceedings at first instance, before the General Division of the Tribunal.

Procedural Issues

(1) Scope of Notice of Appeal Lodged by FM

20 In Ground 1 of his notice of appeal, FM challenged the decision of the Tribunal as it related to the refusal to award financial compensation. There was no objection to that Ground. However Macquarie objected to the remaining paragraphs of the notice of appeal, namely paragraphs 2 to 6, essentially on the basis of relevance to the Tribunal’s decision. The Appeal Panel considered FM’s submissions, and ruled that paragraph 2 be left stand, and the first sentence of paragraph 3, and that the remainder of paragraphs 3 to 6 be struck out and not considered. The Panel noted that it saw the first sentence of paragraph 3 as essentially a repetition of the ground found in paragraph 1. Paragraph 2 was left stand in case it might be said to allege some error in the reasoning of the Tribunal.

21 Thus the following elements of FM’s notice of appeal were permitted to stand:

2. The Tribunal erred in not studying carefully the applicant’s academic transcripts in which clearly stated [sic] that the applicant ‘withdraw’ from his course at Macquarie [sic].

3.1. The Tribunal erred in forming an opinion based on the respondent’s misleading and false allegations and submissions.’

(2) The Role of the Privacy Commissioner at Appeal

22 This issue is raised by Ground (5) of Macquarie’s notice of appeal. Before the Tribunal below Ms Allars for Macquarie had submitted that the Privacy Commissioner should be treated as a ‘party’ to the proceedings. The Privacy Commissioner had submitted that the office was not a ‘party’ to the proceedings.

23 As noted above, s 55(7) deals with the role of the Privacy Commissioner in proceedings before the Tribunal and states:

‘The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section.’

24 Section 55(1) confers on a person who is dissatisfied with the outcome of an internal review of conduct by the agency the right to apply to the Tribunal for an external review of that conduct by the Tribunal. Nothing is said about the role or relationship of the public sector agency in relation to that application. But the practice of the Tribunal has been to treat the public sector agency as the respondent to the application. This is particularly important given the orders that may be made pursuant to s 55(2) against the agency.

25 The Tribunal concluded that the Privacy Commissioner was entitled to appear in the proceedings without being treated as a party to the proceedings. The Tribunal said:

11 Firstly, the Privacy Commissioner has no legal interest in the proceedings, nor is he personally affected or bound by the Tribunal's decisions. (See Levy v State of Victoria (1997) 189 CLR 579 at 600 to 605.) In this case, the Privacy Commissioner is not bound by the decision in the sense that his presence is not required to enable the decision maker to effectively and completely adjudicate on all matters in dispute.

12 Secondly, the Commissioner's role in proceedings before the Tribunal is merely advisory, in accordance with his statutory functions. The functions of the Privacy Commissioner are set out in Part 4 Division 2 of the Privacy Act. In particular, the Privacy Commissioner is "to promote the adoption of, and monitor compliance with, the information protection principles" (s 36(2)(a)) and "to provide advice on matters relating to the protection of personal information and the privacy of individuals" (s 36(2)(g)). Because the Tribunal is a creature of statute, any role akin to amicus curiae must be derived from statute.

13 Thirdly, if the legislature intended that the Privacy Commissioner have the status of a party, it could have made that intention clear, as it has done in other legislation. Section 65(2) of the Retail Leases Act 1994 confers on the Registrar of Retail Tenancy Disputes a power to "intervene" in proceedings before the Retail Leases Division of the Tribunal. Once the Registrar has intervened, he or she "becomes a party to the proceedings". (See Registrar of Retail Tenancy Disputes v Lyndhurst Developments Pty Ltd & Davies (RLD) [2001] NSWADTAP 25 where the Appeal Panel concluded that the Registrar was a party with a limited role.) Section 65(2) of the Retail Leases Act 1994 contrasts with s 55(7) of the Privacy Act which merely gives the Privacy Commissioner the right to appear and be heard. If the legislature had intended the Privacy Commissioner to be a party to the proceedings, it could have said so expressly.

14 Taking into account all of these factors, the words of s 55(7) of the Privacy Act do not confer the burdens and benefits of party status on the Privacy Commissioner. The Privacy Commissioner has a right to intervene in proceedings and be heard.’

26 It will be seen that had Ms Allars’ contention succeeded before the Tribunal the Privacy Commissioner would have been declared to be a party, and would therefore have had the rights conferred upon a party to appeal to the Appeal Panel by s 56 of the Privacy Act.

27 At the appeal hearing, Ms Allars continued to pursue the question of the nature of the Privacy Commissioner’s involvement in the present proceedings, and objected to the participation of the Privacy Commissioner in the appeal hearing.

28 Ms Allars referred to s 56 of the Privacy Act which provides that an order or decision by the Tribunal ‘may be appealed … by a party to the proceedings in which the order or decision is made’. Ms Allars noted, and we agree, that this provision was consistent with s 113 of the ADT Act - s 113(1), which provides that: ‘A party to proceedings, in which an appealable decision of the Tribunal is made, may appeal to the Tribunal, constituted by an Appeal Panel.’

29 In our view, it is clear that the Privacy Commissioner is not to be treated as a party in any proceedings in the Tribunal, whether at the first instance stage or before the Appeal Panel. As we understand Macquarie’s position, the contention is that s 55(7) is a provision that only gives the Privacy Commissioner a right of participation of any kind at the first instance stage. This is said to be the effect of the words in s 55(7) ‘any proceedings before the Tribunal in relation to a review under this section’.

30 Section 55 is the provision which confers the right on the applicant to lodge and, correspondingly, jurisdiction on the Tribunal to hear, applications for review of the conduct of public sector agencies.

31 The appeal rights conferred by s 56 can not, we consider, be compartmentalised in the way suggested by Macquarie. The proceedings are commenced in the Tribunal sitting at first instance, and are dealt with by the General Division. The Appeal Panel forms part of the Tribunal. It is not a statutory entity standing apart from the Tribunal as is, for example, the Supreme Court. The expression ‘proceedings before the Tribunal’ embraces both proceedings at first instance and at the Appeal Panel level. It is true, as Ms Allars submitted, that there is in s 56 a separate provision dealing with appeals to the Appeal Panel. The presence of this provision does not affect the breadth of the term ‘Tribunal’ as used in s 55. Section 56 has a limited subject matter, the conferral of a right of appeal and a statement as to who has the right of appeal. It is clear that were the office of Privacy Commissioner disappointed by the outcome of a first instance decision in which the office had participated, the office could not initiate an appeal to an Appeal Panel.

32 It is true, as Ms Allars observes, that s 56 is silent as to any role for the Privacy Commissioner in appeal proceedings. In our view this is because s 55(6) and s 55(7) were intended to deal with that question.

33 Section 55 (the conferral of a right to seek external review) forms part of a series of provisions comprising Part 5 (Review of certain conduct) of the Privacy Act. First of all s 52 provides for the kind of conduct that is the subject of the review provisions. Then s 53 gives a person who is aggrieved with any conduct covered by s 52 the right to apply for review of the conduct by the agency. The agency is obliged to notify the Privacy Commissioner of the receipt of the application for internal review: s 54(1). The Privacy Commissioner is entitled to make submissions to the agency: s 55(2). The individual in the agency dealing with the application must consider those submissions: s 53(5)(b). The agency may engage the Privacy Commissioner to undertake the review: s 55(3). The powers of the Privacy Commissioner in those circumstances are the same as the agency: s 54(5). If the person is dissatisfied with the outcome of the internal review process, an application for external review of the conduct may be made to the Tribunal: s 55. The Tribunal is, like the agency, obliged to notify the Privacy Commissioner of the application: s 55(6). Then the provision that has been focussed upon in these proceedings appears in s 55(7): ‘The Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to a review under this section.’ Finally there is s 56, which as noted earlier is headed ‘Appeals to Appeal Panels against decisions and orders of Tribunal’ and provides:

Administrative Decisions Tribunal Act 1997

34 While it is the case that ‘the Tribunal’ first referred to in s 56 must mean the Tribunal sitting at first instance (the meaning the Appeal Panel itself often uses in referring to the Divisional decision), it would in our view be inconsistent with the legislative scheme as it relates to the role of the Privacy Commissioner to apply the same interpretation to the use of the word ‘Tribunal’ in s 55(6) and s 55(7).

35 In the case of s 55(6) the reference to ‘Tribunal’ is, as we see it, a generalised reference to the Tribunal as an administrative organisation rather than the member or members forming the Tribunal for the purpose of hearing the case. As a practical matter, the Registrar of the Tribunal undertakes the task of notification well before the matter is listed before any member or members. Obviously once empanelled it may be found that such a notification has not occurred, in which the case the Tribunal in its empanelled form would have to see that the duty imposed by s 55(6) is carried out.

36 Section 55(7) uses the words ‘any proceedings before the Tribunal in relation to a review under this section’. As to this expression, the key words ‘proceedings’ and ‘Tribunal’ are on their face words of potentially wide import. There is nothing, we consider, that would justify reading either or both words down so as to confine them to proceedings at the first instance level of the Tribunal.

37 On the other hand it is clear that there are other provisions in s 55 which refer to the Tribunal sitting judicially, for example in reference to the power to make orders given by sub-s (2). Those order-making powers are also open to be exercised by an Appeal Panel, for example in circumstances where it choses to give leave to extend an appeal to the merits (Tribunal Act, s 113) or decides to make orders which finally dispose of the matter (see Tribunal Act, s 115(3)(c)).

38 It could not sensibly in our view be argued that the Appeal Panel was somehow precluded from doing that on the basis that the word ‘Tribunal’ in s 55(2) is only a reference to the Tribunal sitting at first instance and constituted as the General Division. This discussion demonstrates, we consider, that there is some elasticity in the way the word ‘Tribunal’ is used in this legislation. The term ‘Tribunal’ is used in different ways at different points of the Act.

39 The language of statutes must be interpreted in its context and with the purpose or objects of the statute in mind. In Repatriation Commission v Vietnam Veterans' Association [2000] NSWCA 65 at [107] - [108]; (2000) 48 NSWLR 548 at [107] - [108] Spigelman CJ said:

R v Wilson; Ex parte Kisch

Cooper Brooks (Wollongong) Pty Ltd v Commissioner of Taxation

K & S Lake City Freighters Pty Ltd v Gordon & Gotch

Ltd

CIC Insurance Ltd v Bankstown Football Club Ltd

Project Blue Sky Inc v Australian Broadcasting Authority

As Sir Anthony Mason put it in K & S Lake City Freighters Pty Ltd (at 315) (in dissent, but not with respect to the law of statutory interpretation);

"... Problems of legal interpretation are not solved satisfactory by ritual incantations which emphasize the clarity of meaning which words have when viewed in isolation, divorced from their context. The modern approach to interpretation insists that the context be considered in the first instance, especially in the case of general words, and not merely at some later stage when ambiguity might be thought to arise."’

40 This approach is reflected in the Interpretation Act 1987, s 33.

41 Section 55(7) should be given a construction which is consistent with the beneficial objects of this landmark piece of human rights legislation and the central role given to the Privacy Commissioner in the legislation to make it work. The Privacy Commissioner has an oversight role in relation to the way agencies handle complaints. There are many other powers and responsibilities given to the Privacy Commissioner by other parts of the Privacy Act of similar significance. It would make a mockery of these arrangements for the Privacy Commissioner to be cut out of the appeals environment of the Tribunal, where quite possibly some of the most significant questions touching on the scope and operation of the legislation might arise.

42 In its reasons the Tribunal below made an analogy between the role played by the Privacy Commissioner before the Tribunal and that of the amicus curiae in litigation before superior courts. Ms Allars made a number of criticisms of the Tribunal’s employment of this analogy. We do not consider it necessary here to examine those arguments. We agree with the Tribunal below that it is plain that the legislature gave the Privacy Commissioner a statutory right to ‘appear and be heard’ before the Tribunal. It could have, but did not, declare the Privacy Commissioner to be a ‘party’ to proceedings (cf the position of the Registrar, Retail Tenancy Disputes under the Retail Leases Act 1994, discussed by the Tribunal). That remains the nature of the Privacy Commissioner’s relationship to proceedings before the Appeal Panel.

43 Ms Allars also submitted that the Privacy Commissioner should only be involved in proceedings before the Appeal Panel on a submitting appearance basis. She submitted that the Privacy Commissioner’s position was affected by the ‘Hardiman’ Principle (Re Australian Broadcasting Tribunal; ex p Hardiman (1980) 54 ALJR 314). She also referred the Appeal Panel to a recent learned discussion of this principle as it might apply to statutory bodies with regulatory responsibilities in circumstances where their regulator’s actions or decisions are under challenge before a superior court (see TXU Electricity Ltd v Office of Regulator General, Victoria and ors [2001] VSC 4 (Sup Ct Vic, Ashley J)).

44 We did not find these references helpful. It is plain that the main sphere of operation of the Hardiman Principle is the situation where a tribunal or court is the subject of appeal or review in circumstances where there are two contestants. The normal rule is that tribunal or court makes a ‘submitting appearance’ to the appeal body, and takes no active part in the appeal. The basis for the principle is the concern that the affected court or tribunal not be seen to advocate a position before the appeal body and in this sense become a partisan against the appellant, especially in circumstances where there is a possibility that the matter may be remitted to that court or tribunal for its further consideration.

45 We do not see the Privacy Commissioner as being in such a position.

46 In this Tribunal it would be unthinkable that the presiding member of the Division under appeal would appear at the appeal hearing to make submissions. The Privacy Commissioner is not in the kind of relationship to the Appeal Panel. TXU dealt with the relationship of the energy price regulator in Victoria to judicial review proceedings in which an energy company was challenging a price determination made by that office. We do not see that situation as having relevant application to this case; a determination of the Privacy Commissioner is not being judicially reviewed.

47 We will now deal with the substantive appeals.

Substantive Issues

48 If the Macquarie appeal is wholly successful then it becomes unnecessary to consider FM’s appeal. So we will commence by examining the Macquarie appeal.

(1) Macquarie’s Appeal

49 The grounds of appeal are divided into five Grounds. We have already dealt with Ground (5) and rejected it. The other four Grounds comprise three with numerous sub-points and one which comprises a single point. Ground (1) alleges ten errors by the Tribunal in dealing with the ‘disclosures in the two telephone conversations’. Ground (2) alleges four errors by the Tribunal in dealing with ‘the disclosure of the applicant’s academic record’. Ground (3) alleges seven errors ‘in relation to relief’. Ground (4) alleges a denial of procedural fairness on the part of the Tribunal in not giving Macquarie ‘an opportunity to make submissions with respect to the form of the Tribunal’s order. It will be seen that the grounds divide into those that go to the liability issue and those that go to the nature of any remedy and the procedure adopted by the Tribunal in formulating its order.

Liability Issues: Grounds (1) and (2)

50 We now set out the Tribunal’s findings in relation to the conversations that lie at the heart of this case.

29 B said that A phoned again about a week later and asked about the incident in which B was involved with FM. B said in his statement that he told A that:

The second incident was when two policemen came to my office looking for him. I asked what it was about and they said that a person from the University had filed a complaint against FM and they wanted to interview him. He wasn't here and I passed the message on to him and he had to go to Eastwood Police Station which he did.

The third incident occurred when he started yelling at a student and I had to intervene.

31 B said that at the time he had the conversation with A he took the view that he had a duty to answer her enquires because the incidents he knew about involved intimidation, yelling and threatening behaviour by FM and he believed he was dangerous. B said he was concerned that similar incidents could happen again at the UNSW.

32 C gave evidence that he was the relevant Head of Department at Macquarie when FM enrolled in March 1999. On, or just prior to, 22 March 2002, he received a call from A requesting "some background information" on FM. C replied as follows:

Yes, I remember FM. He was enrolled in a PhD . . . His candidature was terminated at the end of 1999 by the Disciplinary Committee. The basis for the termination related to a number of reports of verbal abuse and physical intimidation of other students - particularly female - and some members of staff. I witnessed one incident myself. I was working in a lab next door to one where FM was working. I overheard raised voices and went to investigate. FM was arguing with his supervisor, . . . . (B). A female student was lying on the floor in a very distressed state. I was shocked by what I saw. . . . (B) told me that FM had sworn at the student and he had intervened to stop him. When I later spoke to the student she told me she was too frightened to make a formal complaint. At that point I felt I had no option but to initiate disciplinary proceedings. His candidature was subsequently terminated. I think he is likely to become a problem at UNSW.

51 The following analysis will not follow exactly the way the points are listed in the notice of appeal.

52 (a) Does the meaning of ‘personal information’ extend to information not held in recorded form by a public sector agency?

53 The Tribunal’s answer was yes. This conclusion is the basis for its use of the seemingly-odd phraseology in its decision and in parts of its reasons ‘held in their minds’ and variants on that. The Tribunal, by this expression, is, as we see it, seeking to convey the point that the information which the Privacy Act regulates includes both documentarily-held information and mentally-held information (that can be said to be in the possession or control of the agency).

54 Macquarie contends that the Privacy Act, properly construed, refers to information held in a material documentary form, for example in paper records, in diagrams or as photographs; or in electronic storage, as in computer records. It is not typical of information privacy statutes to define ‘personal information’ in this narrow way. Section 4 defines ‘personal information’ and s 4(1) is cast broadly to encompass information or opinion, whether or not recorded in a material form. Section 4 provides:

4. Definition of "personal information"

(1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

(2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics.

(3) Personal information does not include any of the following:

(a) information about an individual who has been dead for more than 30 years,

(b) information about an individual that is contained in a publicly available publication,

(c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act,

(d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth,

(e) information about an individual that is contained in a protected disclosure within the meaning of the Protected Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a protected disclosure,

(f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997,

(g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry,

(h) information about an individual arising out of a complaint made under Part 8A of the Police Service Act 1990,

(i) information about an individual that is contained in a document of a kind referred to in clause 1 or 2 of Schedule 1 (restricted documents) to the Freedom of Information Act 1989 (ie Cabinet documents or Executive Council documents),

(j) information or an opinion about an individual's suitability for appointment or employment as a public sector official,

(ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000,

(k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection.

(4) For the purposes of this Act, personal information is "held" by a public sector agency if:

(a) the agency is in possession or control of the information, or

(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.

(5) For the purposes of this Act, personal information is not "collected" by a public sector agency if the receipt of the information by the agency is unsolicited.’

55 Similarly the founding Australian legislation the Commonwealth Privacy Act 1988 defines ‘personal information’ broadly as:

‘"personal information"

whether recorded in a material form or not

56 While the Commonwealth Act has an apparently wide definition of ‘personal information’ it limits the operation of its Information Privacy Principles, and consequently the type of conduct which can expose an agency to liability, to conduct which relates to recorded personal information. The Commonwealth Information Privacy Principles (CIPPs) are set out in s 14. The Collection Limitation CIPPs 1-3 apply to the handling of personal information ‘for inclusion in a record or in a generally available publication’. There is no further reference to material held in a generally available publication with the remaining CIPPs 4-11 (those concerning security, access, correction, data quality, use and disclosure) being applied to ‘record keeper who has possession or control of a record’. A ‘record’ is defined as:

"record"

(a) a document; or

(b) a database (however kept); or

(c) a photograph or other pictorial representation of a person;

but does not include:

(d) a generally available publication; or

(e) anything kept in a library, art gallery or museum for the purposes of reference, study or exhibition; or

(f) Commonwealth records as defined by subsection 3(1) of the Archives Act 1983 that are in the open access period for the purposes of that Act; or

(fa) records (as defined in the Archives Act 1983) in the custody of the Archives (as defined in that Act) in relation to which the Archives has entered into arrangements with a person other than a Commonwealth institution (as defined in that Act) providing for the extent to which the Archives or other persons are to have access to the records; or

(g) documents placed by or on behalf of a person (other than an agency) in the memorial collection within the meaning of the Australian War Memorial Act 1980; or

(h) letters or other articles in the course of transmission by post.’

57 A wide primary definition of ‘personal information’ is found in the New Zealand Privacy Act 1993, s 2:

‘“Personal information”' means information about an identifiable individual; and includes information contained in any register of deaths kept under the Births and Deaths Registration Act 1951’

58 The New Zealand Information Privacy Principles do not contain any claw-back, as it might be called, of the kind found in the Commonwealth law. The New Zealand Information Privacy Principles (NZIPPs) apply in the case of storage, data quality and use and disclosure limitation to an ‘agency that holds personal information’ (see for example NZIPPs 5, 8-11), the collection NZIPPs 1-4 apply to the ‘collection’ of ‘personal information’. Nothing is said along the lines of ‘for inclusion in a record’. The only NZIPPs which, arguably at least, restrict themselves to personal information held in a material form are the access and correction NZIPPs 6 and 7. NZIPP 6 (access) applies where ‘an agency holds personal information in such a way that it can readily be retrieved’. While NZIPP 7 (correction) does not have such a limitation it, we consider, would need to be read subject to NZIPP 6.

59 It is clear from the publications of the Office of the New Zealand Privacy Commissioner and the New Zealand Complaints Review Tribunal that no restriction is applied to the operation of the NZIPPs that confines them to personal information held in material form. Oral communications of information are regularly the subject of consideration. See for example, the volume Complaints Review Tribunal Cases 1998-2001 (October 2001, NZ Privacy Commissioner). See especially Casenote 37930 2002 NZPrivCmr 10; Re Application by L (1997) 3 HRNZ 716.

60 The same position was clearly established in 1988 in respect of that country’s freedom of information legislation, the Official Information Act 1982 (the OI Act). It is administered by the Chief Ombudsman.

61 In Commissioner of Police v Ombudsman [1985] 1NZLR 578 the High Court of New Zealand (Jeffries J) made a ‘test case’ ruling on several aspects of the interpretation of that Act. The decision was subsequently appealed to the Court of Appeal of the High Court (a five member bench presided over by Cooke P) and Jeffries J’s judgment was upheld: see Commissioner of Police v Ombudsman [1988] 1NZLR 385. In the OI Act there were some special provisions to do with access to ‘personal information’. ‘Personal information’ was defined as: ‘any official information held about an identifiable person’. In contrast to many freedom of information laws, the NZ OI Act’s sphere of operation is not confined to access to ‘documents’.

62 This point was noted by Jeffries J (at page 8 of the Lexis printout) in the following way:

‘Perhaps the most outstanding feature of the Act is that the word ‘information’ is used which dramatically broadens the scope of the whole Act. The stuff of what is held by Departments, Ministers, or organizations is not confined to the written word but embraces any knowledge, however gained or held, by the named bodies in their official capacities. The omission, undoubtedly deliberate, not to define the word ‘information’ serves to emphasise the intention of the legislature to place few limits on relevant knowledge. … In this Court’s view the astonishing breadth of the definition of official information affects the interpretation of personal information …’. which dramatically broadens the scope of the whole Act.

63 McMullin J said (at page 20 of the Lexis printout):

‘“Information” is not defined in the Act. From this it may be inferred that the draftsman was prepared to adopt the ordinary dictionary meaning of that word. Information in its ordinary dictionary meaning is that which informs, instructs, tells or makes aware.’

64 As it happens, the case before the High Court and the Court of Appeal concerned information held in documentary form (the contents of police briefs of evidence).

65 Macquarie contends that the NSW Act is confined in the way refected in Commonwealth law, and does not bear an interpretation of the kind found in New Zealand.

66 The NSW Act has 12 IPPs, set out as separate sections, 8 to 19 (thus the usage IPP s 8, etc). The text more closely resembles the NZIPPs than the CIPPs. There are no words of limitation such as ‘information held in records’ or ‘information held in generally available publications’. The IPPs have the same unrestricted quality that is found in the NZIPPs. The IPPs simply apply to ‘a public sector agency that holds personal information’ – for example, IPPs ss12-18 or an agency that ‘collects personal information’ (see IPPs ss 8-11).

67 Macquarie focussed on phraseology in the definition of ‘personal information’, also found elsewhere in the Privacy Act, such as ‘held’ and ‘in the possession or control’ of the agency to support the proposition that read as a whole the IPPs only applied to recorded personal information. Its submission is that though, in contrast to the Commonwealth Act the words "record" and "record-keeper" are not used, these other terms do indicate that something has to be possessed or held even if it not be tangible.

68 It is therefore contended that information which is nothing more than knowledge ‘in the mind’ of an officer, acquired in any way that one can think of, is not the kind of information which the Act is intended to apply to. Support, it was said, for this approach was to be found in a number of these components of the definition in section 4. Macquarie referred to s 4(2) of the Act:

‘(2)

69 It submitted that all of these items have a physical aspect to them.

70 Similarly it is contended that the exclusions from the meaning of ‘personal information’ in s 4(3) have the common characteristic of being information held in a material form, not simply what is in the minds of officers of the agency. To repeat, the exclusions in s 4(3) are expressed as follows:

(a) information about an individual who has been dead for more than 30 years,

(b) information about an individual that is contained in a publicly available publication,

(c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act,

(d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth,

(e) information about an individual that is contained in a protected disclosure within the meaning of the Protected Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a protected disclosure,

(f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997,

(g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry,

(h) information about an individual arising out of a complaint made under Part 8A of the Police Service Act 1990,

(i) information about an individual that is contained in a document of a kind referred to in clause 1 or 2 of Schedule 1 (restricted documents) to the Freedom of Information Act 1989 (ie Cabinet documents or Executive Council documents),

(j) information or an opinion about an individual's suitability for appointment or employment as a public sector official,

(ja) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000,

(k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection.’

71 Attractive as these submissions may be from an administrative point of view, there is nothing in our view in these exclusions which could be said to read down the meaning of ‘information’ to that held in an agency in recorded or material form. Clearly many of these species of information could be possessed by officers of an agency without being written down or stored in a computer database; others such as that mentioned in item (b) refers to information held in records. Dr Gaudin from the Privacy Commissioner’s office cogently referred to s 4(3)(f) as an example of information that would almost certainly be of an oral kind, i.e. the information picked up by police officers engaged in undercover work. This showed an intention on the part of the legislature to cover oral and other forms of personal information. The exclusion in item (b) is one that is not concerned with the substance of the information but where it is located.

72 Macquarie submitted that s 4 should not be interpreted as being intended to capture perceptions and knowledge which is obtained independently of university record-keeping or collection of data by the University.

73 Macquarie contended that it would be absurd to make subject to the Privacy Act information acquired by an officer about a student in a social setting, the example given was at a dance performance or a university drama club play. It was submitted that it would be absurd to subject a disclosure of information about such a matter to control by the IPPs when the acquisition of the very same information by reading a generally available publication such as a magazine would be immune. We do not accept the point. Variable application of the requirements of the Act to the one piece of information or the same information handling activity involving two agencies is possible.

74 This example could be multiplied across the entire Act which is replete with exclusions, qualifications and special exemptions. Take for example the Police Service. It is given various immunities that some other law enforcement agencies (for example the Director of Public Prosecutions) do not enjoy. So if those two bodies jointly collected the same information in a manner which contravened the Act one could be liable and not the other.

75 Macquarie referred to s 4(4) which provides:

(4)

"held"

(a) the agency is in possession or control of the information, or

(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.’

76 The word ‘held’ or one of its variants is found in many provisions of the Privacy Act, most importantly in terms of the present case, in IPP s 18, which commences with the following words: ‘(1) A public sector agency that holds personal information must not disclose the information’ etc.

77 There will, we consider, be cases which go to the question of whether the agency can be said to ‘hold’ the information in issue. Clearly that will be most easily established where there is an official record recording the information in issue. Equally there will be cases, as we see it, where the information can not properly be said to be ‘held’ by the agency in the sense that the agency has ‘possession’ or ‘control’ of the information. An officer may say something about an individual that is slanderous, mischievous and unfair. It may be, depending on the circumstances, that the agency is exposed to vicarious liability in say defamation for the publication of those comments and the damage caused. But it could possibly be the case that the agency might be found not to have itself ‘held’ that information. An officer may have private papers which could not reasonably be said to contain information held by the agency. These issues are familiar in Freedom of Information law: see, for example, Re Barkhorder and ACT Schools Authority (1987) 12 ALD 332.

78 On the other hand the information may be of a sort that was never committed to paper but was acquired in an official capacity by the officer, is being used for official purposes and clearly is relevant to the organisation. We see no reason in principle or in the terms of the words ‘possession’ or ‘control’ to remove that kind of information from the sphere of protection given by the Privacy Act to individuals in this State who are the subject of comment by public sector agencies.

79 Ms Allars then referred to the sequence of the IPPs and the administrative environment that they contemplated: one where information is ‘collected’ and then passes through other stages such as being ‘secured’, being subject to ‘access’ requests, and then being ‘used’ and ‘disclosed’. These sequence was seen as having a bearing on the meaning to be attached to ‘possess’ and ‘possession’. Ms Allars referred to the case of Re Sullivan v Department of Industry Science and Technology (1996) 23 AAR 59. In that case, the Commonwealth AAT considered the meaning of the expression, "document in the possession of an agency," as used in s 4(1) of the Freedom of Information Act 1982 (Commonwealth). We do not find that decision instructive as it plainly deals with the situation of possession of a ‘document’ not possession of ‘personal information’ as defined by the NSW Privacy Act. The learned member, Professor Peter Bayne, gives a number of cogent reasons at 67 as to why possession in this context has the meaning of physical possession. For similar reasons we do not find the United States authorities (Thomas v US Department of Energy (1983) 719 Fed Rep 2d 342; Kline v Dept of Health & Human Services (1991) 927 Fed Rep 2d 522; Krieger v Fadely (2001) 199 FRD 10) instructive. They deal with the meaning of ‘possession’ in the context of the US Privacy Act 1974 which clearly regulates personal information held in agency records and agency ‘systems of records’. These cases deal with the question of the distinction to be drawn between information merely in the possession of officers and that which is in the possession of the agency. In Thomas the Court held that the agency was not liable under the Privacy Act in circumstances where the personal information in issue was acquired by a supervisor by independent means and not from a record. The disclosure of the information was not affected by the Act even if identical information could be found in the agency records. This case in our view is merely illustrative of the kind of debate around the word ‘held’ that is likely to ensue over time under the NSW Act.

80 There are clear indications in the NSW Act that the legislature turned its mind to the distinction between ‘personal information’ simpliciter held by agencies and personal information recorded in a material form held by agencies.

81 Section 29 deals with the operation of privacy codes of practice, a mechanism open to be employed by agencies (after approval by the Privacy Commissioner) to vary and ‘customise’ the IPPs to the particular circumstances of the agency. The provision relevant to this point is sub-s (3). It appears in the following context. The whole of the provision follows:

29. Operation of privacy codes of practice

(1) Privacy codes of practice may be made for the purpose of protecting the privacy of individuals.

(2) A privacy code of practice may regulate the collection, use and disclosure of, and the procedures for dealing with, personal information held by public sector agencies.

(3) In particular, a privacy code of practice may provide for the protection of personal information contained in a record that is more than 30 years old, and any such provision has effect despite the provisions of any other Act that deals with the disclosure of, or access to, personal information of that kind. Any such code must, to the extent that it relates to personal information contained in a State record that is more than 30 years old, be consistent with any relevant guidelines issued under section 52 of the State Records Act 1998.’

82 In sub-s (3) a specific conjunction is made between personal information and records. This is rare in the Act.

83 We consider that the meaning of the term ‘personal information’ can not be read down in the way pressed by the University. We acknowledge in that regard that many privacy and data protection laws do start with a broad definition of ‘personal information’ and then limit the extent to which liability is imposed by the law by limiting the Data Protection Principles or the Information Privacy Principles that characterise these laws to activities relating to personal information held in material form in official agency record systems. While now a little dated, the survey of laws given by the NSW Privacy Committee in its report, Privacy and Data Protection, Submission to the Independent Commission Against Corruption (No 63, June 1991) reflects that point.

84 (b) Is the information in issue in this case ‘unsolicited’ and therefore not subject to the Privacy Act?

85 Section 4(5) provides:

‘Personal information is not collected by a public sector agency if the receipt of the information is unsolicited.’

86 The submission here was difficult to follow. As we conceive of the term ‘unsolicited’ it refers to information that an agency finds itself receiving (primary meaning, Macquarie Dictionary, ‘not asked for’). A public sector agency is not bound by the Collection principles in that situation as it had no opportunity to define or set the parameters under which it was received.

87 But the position here is that the information acquired by B (as to the conduct of FM), both by direct observation and from C, became the basis of a disciplinary inquiry. If there was any doubt about its status prior to that point, on any sensible view it then became information in the possession and control of the agency. Academic staff members see conduct and hear statements made by students constantly. Most of it never goes any further. It may be that that there can be some debate over whether those sorts of observation can be said to be in the possession or control of the agency. But this was a far more serious matter where the information formed the basis of an internal inquiry into FM’s conduct. In our view there can be no doubt that this information was in the possession or control of the University.

88 (c) Did the disclosure fall within the exception relating to Imminent Threat to Health or Safety?

89 The affidavit evidence of B provides a basis for this contention. To reiterate the summary given by the Tribunal below:

‘31 B said that at the time he had the conversation with A he took the view that he had a duty to answer her enquires because the incidents he knew about involved intimidation, yelling and threatening behaviour by FM and he believed he was dangerous. B said he was concerned that similar incidents could happen again at the UNSW.’

90 The relevant exception to IPP s 18 provides:

‘(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.’

91 This, in our view, involves an essentially factual inquiry. Accordingly to interfere with the assessment of the trier of fact (the Tribunal below) its finding must be shown to be manifestly unreasonable. The Tribunal assessed A’s evidence and formed the view that the circumstances did not constitute one giving rise to a ‘serious and imminent threat to health and safety’. Ultimately it was not satisfied that requirement of a ‘serious and imminent threat’ was shown. We see no reason to disturb the findings in this case.

92 (d) Did FM expressly consent to the disclosure or is it one that he has been made aware of in accordance with section, that information of that kind is usually disclosed to the other persons or body?

93 Section 26(2) provides that disclosure is permitted where there is express consent: ‘(2) A public sector agency is not required to comply with section 10, 18 or 19 if the individual to whom the information relates has expressly consented to the agency not complying with the principle concerned.’ (Emphasis added.) And within s 18(1)(b) there is provision for disclosure based on the subject’s ‘reasonable awareness’ of such a possibility. Section 18(1)(b) provides:

‘(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body’

94 Macquarie sought to rely on the UNSW authorisation clause to found the conclusion that it had ‘express consent’ to the disclosures made by B and C; or, alternatively, to found the conclusion that FM should have been ‘reasonably aware’ that such information might be disclosed.

95 In the companion case, DO v University of New South Wales (GD) [2003] NSWADTAP 9. the Appeal Panel upheld the Tribunal’s conclusion that the authorisation clause was sufficient to make lawful the UNSW’s collection of the personal information. The clause was as follows:

‘I authorise the University to obtain official records from any tertiary institution previously attended by me. If any information supplied by me may be considered to be untrue or misleading in any respect, I understand the University may take such action as it believes necessary including the disclosure of the information to any person or body the University considers has a legitimate interest in receiving it and I consent to such disclosure. I understand that the University reserves the right to vary or reverse any decision made on the basis of incorrect or incomplete information.’

96 In our decision on appeal, we held that this clause was sufficient to cover all official records that contained academic history and disciplinary information. We did not at that stage have before us the detail that has emerged in the present case. It may that there is an issue, which we did not consider in that case, as to the precise scope of this authorisation which spoke of ‘records’ and did not extend to orally-transmitted information not derived from records.

97 (i) Express Consent. The requirement of ‘express consent’ can not, we consider, be stretched in the way submitted. This legislation protects an aspect of an important human right, that of freedom from interference with privacy. The express consent provision should be strictly applied so as to underpin that right. In our view the requirement of express consent must be the subject of administrative action by the agency disclosing the information. It must have gone to the individual concerned and obtained an express consent that is precise as to the kind and, possibly, the exact contents of the information to which the consent relates. Macquarie did not do that in this case.

98 (ii) Reasonable Awareness. Macquarie repeated the submission considered by the Tribunal below that if a collecting agency obtains an authorisation to collect information from another public sector agency then the other public sector agency can take the benefit of that authorisation to make lawful its disclosure – provided it is within the scope of the authorisation.

99 This case involves an experienced university student who had studied at several universities. Any reasonable student in these circumstances would, we consider, understand that the university which he or she is entering has a need to have official knowledge of a prior university record including disciplinary information to the extent that it is available officially.

100 FM indicated at hearing before us that he accepted that academic transcripts might be passed from a previous University to the next. He indicated that his principal objection was to what he saw as the unfair portrayal provided by the oral disclosures.

101 In our view the Tribunal’s finding on this matter ought not be disturbed.

102 It was open to FM to complain that the oral disclosures went further than could be said to have been permitted by the authorisation, and that he could not have anticipated that the kind of information conveyed orally was covered. Nor could it be readily found that he ought be reasonably aware that the oral disclosures would occur. An official record will hopefully tend to give a fuller and more balanced account of a set of events than would an oral description from someone closely connected with the occurrence of the inquiry, and who is likely to be perceived (whether fairly or not) as having a partisan view and an interest in defending its outcome.

103 There is, and we acknowledge Ms Allars’ submission, some possible confusion in the Tribunal’s approach to this point. It does when it addresses the relief point state that FM should receive no damages because the decision to revoke his enrolment was inevitable once his history came to light. But we see that observation as confined to that part of the information disclosed which was in the form of official records and upon which UNSW relied in its reasons for its decision.

104 (e) Does the Disclosure fall within the Scope of the Lawful Investigation Exemption of the Privacy Commissioner’s Direction

105 Section 41 of the Privacy Act provides:

41. Exempting agencies from complying with principles and codes

(1) The Privacy Commissioner, with the approval of the Minister, may make a written direction that:

(a) a public sector agency is not required to comply with an information protection principle or a privacy code of practice, or

(b) the application of a principle or a code to a public sector agency is to be modified as specified in the direction.

(2) Any such direction has effect despite any other provision of this Act.

(3) The Privacy Commissioner is not to make a direction under this section unless the Privacy Commissioner is satisfied that the public interest in requiring the public sector agency to comply with the principle or code is outweighed by the public interest in the Privacy Commissioner making the direction.’

106 On 28 December 2001 the Privacy Commissioner issued a Direction on Processing of Personal Information by Public Sector Agencies in relation to their Investigative Functions (the Direction). The principal disclosure in issue occurred on 22 March 2002. Macquarie and UNSW were among the numerous agencies covered by the Direction (see Schedule).

107 Clause 4 provided:

‘A relevant agency need not comply with sections 9, 10, 13, 14, 15, 17, 18 or 19(1) if compliance might detrimentally affect (or prevent the proper exercise of) any of the agency’s investigative functions or its conduct of any lawful investigations.’ ‘Investigation’ is defined as is ‘investigative functions’ and ‘lawful investigation’.

108 The above terms are defined as follows:

investigation

"investigative functions" of an agency refer to those functions that are directly related to a lawful investigation and that are necessary for the conduct of that lawful investigation;

"lawful investigation" means an investigation carried out by an agency under specific legislative authority or where the power to conduct the investigation is necessarily implied or reasonably contemplated under an Act or other law. It covers only those investigations which may lead to the agency taking or instituting formal action in relation to the behaviour under investigation. Such formal action may include, but is not limited to, prosecution, cautioning, the administration of a penalty or the removal of a benefit or approval;’

109 Macquarie referred to the definition of a ‘lawful investigation’ being ‘an investigation carried out by an agency under specific legislative authority and which may lead to the agency taking formal action, including the administration of a penalty or the removal of a benefit or approval.’ It argued that UNSW was involved in a lawful investigation in that sense. ‘Investigative functions’ was defined as referring to ‘those functions that are directly related to a lawful investigation and that are necessary for the conduct of that lawful investigation’.

110 Macquarie contended that it was involved in the carrying out of an ‘investigative function’ for the UNSW.

111 The Tribunal dealt with this submission as follows:

68 Macquarie submitted that the reference in paragraph 4 of the Direction to "any of the agency's investigative functions" makes it clear that there is no requirement that these be investigative functions of the agency which seeks the benefit of paragraph 4. Macquarie said that it is carrying out an investigative function when it exercises functions directly related to and necessary for, the conduct of a lawful investigation by another relevant agency, such as UNSW. Finally, Macquarie submitted that because the disclosure occurred pursuant to the Direction, it was not necessary to obtain FM's consent to the disclosure.

69 I accept Macquarie's submission that its "investigative functions" do not necessarily have to relate to the conduct of an investigation that Macquarie itself is conducting or has conducted. The remainder of Macquarie's submission relies on three propositions, namely: that UNSW was carrying out a lawful investigation as defined, that Macquarie's investigative functions are directly related to that lawful investigation and are necessary for the conduct of that investigation, and that non-disclosure of the information or opinions in the phone conversations might detrimentally affect (or prevent the proper exercise of) any of Macquarie's investigative functions.

70 To be a "lawful investigation", an investigation must be carried out under specific legislative authority or necessarily implied or reasonably contemplated under an Act or other law. Macquarie did not indicate the "specific legislative authority" or the Act or law under which UNSW conducted the investigation. I could find no reference to investigations of the kind contemplated by Macquarie in the University of NSW Act 1989, the University of New South Wales By-law 1996 or the University of New South Wales Rules 1999.

71 In the absence of any legal basis for UNSW's "investigation", I find that it does not constitute a "lawful investigation" as defined in the Direction. Having come to that conclusion, there is no need to consider the other elements of the Direction.’

112 Ms Allars submitted:

6.7 The Tribunal determined that there was no legal basis for UNSW's investigation and therefore there was no "lawful investigation" for the purposes of the Direction.

6.8 Plainly UNSW has power both in the performance of its general functions under s 6 of the University of New South Wales Act 1989 (NSW), and at common law, to undertake enquiries to ensure that students are enrolled in accordance with its by-laws, and that their admission and enrolment comply with any state or federal laws. It is not necessary to identify coercive powers or a statutory duty of inquiry in order to establish that an investigation is a lawful one. In 1904 the High Court expressed the view that the power of inquiry is a common law power of any natural person, and also of government, rather than a power peculiar to the Crown:

the power of inquiry, of asking questions, is a power which every individual citizen possesses

Clough v Leahy

6.10 The investigation was not unlawful. Accordingly UNSW conducted a "lawful investigation" for the purposes of the Direction. Since the telephone conversations and transmission of academic transcript occurred pursuant to the Direction, it was not necessary for the appellant to obtain the applicant's consent to those disclosures.’

113 Macquarie, it will be seen, has sought through these submissions, to meet the criticism of the Tribunal below as to the legal foundation for the investigative actions taken by UNSW and Macquarie’s co-operation with them. There were no submissions going to this point from the Privacy Commissioner or FM either below or on appeal.

114 We agree that the permissibility of disclosure is not to be conclusively determined by whether there is a ‘specific legislative authority’. We do not understand the Tribunal to have stopped at that point. It did seek to look generally at the UNSW and Macquarie legislation.

115 Here the submission is that (at least) the investigation was one that is ‘necessarily implied or reasonably contemplated’ under the University legislation (see “lawful investigation”, extract from definition). Enrolment status is a fundamental concern for a University and the wider community. We consider that this case falls into that category. The UNSW was at liberty, we consider, to take reasonable steps to inquire into and investigate the enrolment status of a student by contacting prior Universities that he had attended. It adopted the course of going to senior academics in the relevant Faculty. This, as we see it, is not unreasonable. It may have received partial and coloured information. That can happen during an investigation. It is for the investigator to stand back from the information, and consider what duties it may owe to the individual affected to obtain that individual’s version of the matter, and then consider, if it wishes to take detrimental action, what the basis for that should be. In our view there can be no doubt that a University has the power to institute formal action in relation to enrolment. Such a power must logically carry with it the power to investigate compliance with enrolment criteria.

116 In our view, the Tribunal erred at this point of its reasons, though the submissions that it had before it on this point were, we recognise, less developed than those received by the Appeal Panel.

117 In our view the references in cl 4 to ‘the agency’s investigative functions’ covered what occurred here. We are satisfied that Macquarie was engaged in carrying out an investigative function in connection with the UNSW investigation.

118 There has been no finding, however, as to whether compliance with IPP 18 ‘might detrimentally affect’ the exercise of those functions. This matter still needs to be addressed.

Question of Detriment

119 Where an agency does not hold a clear authority or consent from the subject of information, it plainly faces risks in terms of Privacy Act liability when it orally discloses information or hands over the information in documentary form. We are not in a position to make a finding on that point at this stage. The transaction may be saved (as may be the case here) because to do otherwise would ‘detrimentally affect’ a lawful investigation or was in the category of information that the subject should have been reasonably aware would have been disclosed. These will be hard standards to satisfy when sensitive and highly adverse information is communicated.

120 Macquarie had in place a Draft Code of Practice as from August 2000. We agree with the views expressed by the Tribunal below that little significance can be given to this document for present purposes. Codes that have been approved by the Privacy Commissioner and have been gazetted have, of course, considerable status: see ss 30 and ff of the Privacy Act.

121 As the matter is some general significance, though not essential in light of our conclusion as to the lawfulness of disclosure, we will go on to deal with the relief issues.

The Relief Issues

Order Making Power of the Tribunal

122 The provision under which the Order was made was s 55(2)(b) which refers to:

‘(b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice.’

123 To reiterate, the order in this case was as follows:

Privacy and Personal Information Protection Act 1998

124 The expression ‘in our minds’ was merely reinforcing the conclusion, with which we agree, that information held mentally and disclosed orally is covered by the Disclosure Limitation Principle (IPP s 18).

125 But the order is expressed as a systemic, agency-wide order. This is problematic. In our view, unless there are good reasons to make a wider systemic order, orders should be confined to the parties to the proceedings. In our view no case was advanced by FM that went beyond what happened to him and its lawfulness. Orders should, as we see it, be inter partes unless there has been considered attention given in the proceedings to the possibility of a wider-operating order. Obviously in well-administered organisations the order will be adopted as a precedent and a basis for policy that will govern all practice of a like kind.

126 The Tribunal’s almost invariable practice is to issue reasons for decision that make findings and have attached final orders. This course of action is generally unproblematic. However situations can arise where the formulation of the order should be separated from the findings as to liability. Cases involving complex administrative environments where orders with administrative impact are being considered involve this kind of situation. Here a pervasive administrative order was issued in relation to the conduct of a major and complex public sector agency. It should, we consider, have been given the opportunity to make submissions as to the scope of any proposed order before it was settled. The possibility was not one canvassed in the course of the proceedings.

127 It will be seen that, therefore, we agree with Macquarie’s objections to the scope of the order and it follows that the procedural fairness objection is also made out.

128 In our view the appeal is made out on the following matters:

(b) The order-making process and the form of order.

129 So, in conclusion, one issue remains alive – whether compliance with the Disclosure Limitation Principle (IPP s 18) ought not be required because ‘compliance might detrimentally affect (or prevent the proper exercise of)’ the investigative activities involving UNSW and Macquarie over FM’s academic history (including disciplinary history).

130 It is desirable, as we see it, to bring this case to an end. The Macquarie notice of appeal does not expressly address the question of extending the appeal to the merits. In our view that would be the appropriate course. But as the presiding member of the Appeal Panel will not be available for some time, the further consideration of that question and the ‘detriment’ issue will have to be deferred until February 2004, at which time the matter will be relisted for further directions.

(2) FM’s Appeal

131 In light of our conclusions it is not necessary to deal with FM’s appeal.

132 However to assist in the finalisation of the case we make the following observations.

133 In our view, the Tribunal’s reasons were cogent that the UNSW would have moved to remove FM from the course and the scholarship ($23,000 pa) that he had been given, regardless of the oral information received from Macquarie.

134 FM told the Appeal Panel that the money received during the 6 weeks that he was in the course was not claimed. In these circumstances there is no financial loss to which FM can point. There was no evidence of any probative value before the Tribunal on the other points. In these circumstances we do not consider that the Tribunal erred in the conclusion it reached. In our view this matter should not be reopened. There is no basis for disturbing the Tribunal’s conclusions in that regard. FM’s appeal is dismissed.

Orders

(1) Appeal by FM dismissed.

(2) Appeal by Macquarie University allowed in part.

(3) Order of the Tribunal set aside.

(4) The application for review is to be further considered by the Appeal Panel on the question of whether to have required compliance with section 18 of the Privacy and Personal Information Protection Act 1998 would have detrimentally affected (or prevented the proper exercise of) the University’s investigative functions; and if there is a contravention the making of any Order.

(5) To be relisted for directions in February 2004.

(6) Liberty to either party to apply on 7 days’ notice in relation to the relisting of the matter.

Actions

Download as PDF Download as Word Document

Citations

Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43

Most Recent Citation

KJ v Wentworth Area Health Service [2004] NSWADT 84

Cases Citing This Decision

24

Vice-Chancellor Macquarie University v FM [2005] NSWCA 192

Freelancer International Pty Ltd and Australian Information Commissioner [2017] AATA 2426

FRN v Cumberland City Council [2025] NSWCATAD 74

Cases Cited

11

Statutory Material Cited

8

FM v Vice Chancellor, Macquarie University [2003] NSWADT 78

DO v University of New South Wales [2002] NSWADT 211

Do v University of New South Wales (GD) [2003] NSWADTAP 9

CITATION:	Vice-Chancellor, Macquarie University v FM (GD) [2003] NSWADTAP 43
PARTIES:	FIRST APPELLANT Vice-Chancellor, Macquarie University FIRST RESPONDENT FM SECOND APPELLANT FM SECOND RESPONDENT Vice-Chancellor, Macquarie University
FILE NUMBER:	039021, 039025
HEARING DATES:	30/06/2003
SUBMISSIONS CLOSED:	06/30/2003
DATE OF DECISION:	09/23/2003
DECISION UNDER APPEAL:	FM v Vice-Chancellor, Macquarie University [2002] NSWADT 78
BEFORE:	O'Connor K - DCJ (President); Goode P - Judicial Member; Antonios Z - Member
CATCHWORDS:	finding contrary to evidence - opportunity to be heard - role of Privacy Commissioner - scope of Tribunal Order - statutory interpretation
MATTER FOR DECISION:	Principal matter
FILE NUMBER UNDER APPEAL:	023156
DATE OF DECISION UNDER APPEAL:	04/16/2003
LEGISLATION CITED:	Freedom of Information Act 1989 Interpretation Act 1987 Official Information Act 1982 (NZ) Privacy Act 1974 (US) Privacy Act 1988 (Cth) Privacy Act 1993 (NZ) Privacy and Personal Information Protection Act 1998 Retail Leases Act 1994
CASES CITED:	Brandusoiu v Commissioner of Police [1999] NSWADTAP 8 Commissioner of Police v Ombudsman [1985] 1NZLR 578 Commissioner of Police v Ombudsman [1988] 1NZLR 385 DO v University of New South Wales [2002] NSWADT 211 DO v University of New South Wales (GD) [2003] NSWADTAP 9 FM v Vice-Chancellor, Macquarie University [2002] NSWADT 78 Kline v Dept of Health & Human Services (1991) 927 Fed Rep 2d 522 Krieger v Fadely (2001) 199 FRD 10 Re Application by L (1997) 3 HRNZ 716 Re Australian Broadcasting Tribunal; ex p Hardiman (1980) 54 ALJR 314 Re Barkhorder and ACT Schools Authority (1987) 12 ALD 332 Repatriation Commission v Vietnam Veterans' Association [2000] NSWCA 65 Re Sullivan v Department of Industry Science and Technology (1996) 23 AAR 59 Thomas v US Department of Energy (1983) 719 Fed Rep 2d 342 TXU Electricity Ltd v Office of Regulator General, Victoria and ors [2001] VSC 4
REPRESENTATION:	FIRST APPELLANT & SECOND RESPONDENT M Allars, barrister FIRST RESPONDENT & SECOND APPELLANT In person
ORDERS:	(1) Appeal by FM dismissed.; (2) Appeal by Macquarie University allowed in part. ; (3) Order of the Tribunal set aside.; (4) The application for review is to be further considered by the Appeal Panel on the question of whether to have required compliance with section 18 of the Privacy and Personal Information Protection Act 1998 would have detrimentally affected (or prevented the proper exercise of) the University’s investigative functions; and if there is a contravention the making of any Order.; (5) To be relisted for directions in February 2004.; (6) Liberty to either party to apply on 7 days’ notice in relation to the relisting of the matter.