Lawful collection IPP and HPP

NSW privacy law: does it prohibit, or require, the collection of personal and health information by public agencies? Is privacy law’s purpose a mandatory consideration when construing it? What should ‘lawful purpose’ mean? Is the prohibition against collection by ‘any unlawful means’ inclusive of a means of collection that contravenes privacy law?

These are some of the issues that arose in ALZ v SafeWork NSW [2017] NSWCATAP 51 (9 March 2017).

Background
Construction of HPP 1 and s 8
Mandatory to consider purpose
Authorised versus not forbidden fiasco
By any unlawful means

Background

When WorkCover (who later became SafeWork) received my privacy complaint about how its OH & S Division had handled my health information it had clear evidence that the conduct had occurred but it made an erroneous finding that it had not.^[1] It purported instead to understand that I was concerned about the management of my workers compensation claim and it collected not-reasonably-necessary personal and health information from my employers’ workers compensation insurer^[2] in contravention of several privacy principles.

WorkCover used the information from the insurer in its findings (to imply that I was a serial complainer whose complaints had no merit) which caused the information’s disclosure to the Privacy Commissioner and Civil and Administrative Tribunal (the Tribunal).

Tribunal’s decision

The Tribunal decided that the Information Protection Principles (IPPs) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) and Health Privacy Principles (HPPs) of the Health Records and Information Privacy Act 2002 (NSW) (HRIP Act) permitted WorkCover to use (without my consent, for a purpose I didn’t know about, in a way that was prejudicial to me) the health and personal information that WorkCover had been prohibited from collecting from the insurer;^[3] which I thought wrong.

I offered an Appeal Panel an alternate construction of privacy legislation; a construction that protected my health and personal information as I expected laws that were developed to protect privacy should but the Appeal Panel said my alternate construction had no merit^[4] and my assumption that the legislation should be interpreted in a way which protects my privacy to the greatest extent possible is not correct.^[5]

I admit, unashamedly, that I did construe privacy legislation so it protected my and other people’s privacy to such a degree that public agencies could not collect health and personal information in breach of a prohibition then keep it and use it behind the person’s back to harm them, which is surely the protection that Parliament intended to provide when it developed the HRIP and PPIP Acts.

Agencies need telling

Parliament was, after all, fully alive to the fact that its agencies had a propensity to act improperly and illegally or why else would it have needed to tell its agencies repeatedly that they must not break the law? Agencies must not collect personal and health information unless they have a lawful purpose, Parliament said, they must not collect information by any unlawful means, and they must not do any thing or engage in any practice that contravenes a privacy principle.^[6] You’d think that went without saying wouldn’t you; it’s amazing really, that public agencies needed to be told.

Construction of s 8 and HPP 1

1)  A public sector agency/organisation must not collect personal /health information unless:

(a)  the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and

(b)  the collection of the information is reasonably necessary for that purpose.

(2)  A public sector agency must not collect personal information by any unlawful means.

My construction

My construction of the privacy principles was based on the literal meaning of the text. It had public agencies securely bound. Consider the purpose of the Acts, I said, read the principles in context, these are prohibitions (that wasn’t original – the Court of Appeal had already said it^[7]), the conditions are essential, ‘lawful purpose’ means ‘authorised purpose’, and collecting by a means that breaches the Acts is prohibited.

If the conditions aren’t satisfied, I said (in less colloquial language), then bam, the collection is prohibited. If the collection’s prohibited then bam, the information can’t be kept or used because, der, why on earth would Parliament prohibit the collection of information that it intended the agency to use?

The Appeal Panel’s construction

My construction didn’t go down very well with the Appeal Panel.  Rubbish, it impliedly said. It’s not mandatory to consider the purpose,^[8] privacy legislation doesn’t pursue its objects at all costs—values compete and you have to balance privacy rights with a public agency’s need to perform its functions effectively and efficiently. Collections are required, not prohibited, a ‘lawful purpose’ is a ‘not forbidden,’ purpose, and certainly it’s okay to use a means of collection that breaches the Acts; not everything that advances the purpose of the Acts is the law you know.^[9]

(I suspect that the Appeal Panel had indulged in some catastrophising, ‘if ALZ is correct then public agencies won’t be able to collect an individual’s information and keep it and use it if they want too.’ Damn straight I say. Not unless they have a purpose that is authorised, and the collection is reasonably necessary, and not unless they collect the information by a lawful means, and not unless they follow the prescribed collection process that obliges the agency to obtain the individual’s consent.)

A priori assumption

The Appeal Panel, it seems, assumed that the privacy principles interfered with an agency’s ability to be effective and efficient and it thought it a desirable policy that privacy rights be balanced with the agencies need for effective efficiency so it undertook the task of construing s 8 and HPP 1 with its assumption and desirable policy in mind, which I think wrong and a big no-no.

Wrong

It is wrong for two reasons. First, because the assumption that privacy rights interfere with efficiency is wrong. The Court of Appeal said about the PPIP Act that “it is also a purpose of the legislative scheme to ensure the effective conduct of the public agencies by establishing a mechanism to determine the relevance and accuracy of the information held by such agencies”.^[10]

So rather than interfere with effective conduct, the privacy principles ensure it.

(And, if the Appeal Panel needed any evidence that the Court of Appeal was correct it only had to look at how WorkCover failed epically to perform its internal review function at all, let alone with effective efficiency, because it kept and used the not-reasonably-necessary and irrelevant information that it collected in contravention of privacy principles.)

Second, the Appeal Panel was wrong to balance privacy rights with the need for agency efficiency because it’s clear from the myriad of exemptions and exceptions in the PPIP and HRIP Acts that Parliament did all the balancing it thought necessary when it developed the Acts.

Big no-no

The High Court said that the purpose of legislation must be derived from what the legislation says and not from any priori assumption about the desired operation of the relevant provisions,^[11] and, it is not legitimate to assume a purpose not apparent from the text of the relevant provisions then construe the provision with the assumed purpose in mind and say there is nothing positively inconsistent with the assumed purpose.^[12] Which is what, it seems to me, the Appeal Panel did.

Lessened the protection every time

The Appeal Panel’s mistakes caused it to choose (every time it construed HPP 1 and s 8) a construction that diminished the protection of privacy. For example, it:

• said ‘must not collect personal/health information unless …’ was ‘requiring agencies to collect information’, [13]
• euphemistically called the essential conditions a ‘permissible purpose’,^[14]
• chose the meaning of lawful purpose that permits agencies to collect information for improper purposes[15],
• said an earlier Appeal Panel that had adopted a meaning that restricted collections to authorised purposes had got it wrong,^[16] and
• failed to decide that the prohibition against collecting information by ‘any unlawful means’ was inclusive of a means that breached the PPIP or HRIP Acts.^[17]

(The Appeal Panel did say that an agency can’t use information it collected for an impermissible purpose^[18] but it’s not clear how collecting information that is not reasonably necessary for a not-forbidden–by-law purpose makes the not-forbidden purpose impermissible.)

Mandatory to consider purpose

Although the Appeal Panel rejected that “the purpose of the PPIP Act was a mandatory consideration when construing the meaning of ‘lawful purpose’” there’s lots of authority that supports that it is mandatory to consider the purpose (and/or objects) of an Act when you construe it, many of which refer to s 33 of the Interpretation Act 1987 (NSW) or its equivalent in other jurisdictions. Section 33 says:

In the interpretation of a provision of an Act or statutory rule, a construction that would promote the purpose or object underlying the Act or statutory rule (whether or not that purpose or object is expressly stated in the Act or statutory rule or, in the case of a statutory rule, in the Act under which the rule was made) shall be preferred to a construction that would not promote that purpose or object.

The High Court said that Victoria’s equivalent of s 33 was a “statutory injunction” that “requires a court to construe an Act … in the light of its purposes.”^[19]

Another High Court said the “cardinal rule of statutory interpretation … requires the words of a statute to be read in their context.”^[20] And according to South Australia’s Supreme Court, “consideration of the context of a provision requires that regard be had to surrounding provisions and the purpose of the Act generally …”^[21]

Yet another High Court said “… the principle that requires that the particular provisions of the Act must be read in light of the statutory objects is of particular significance in the case of legislation which protects or enforces human rights. In construing such legislation, the courts have a special responsibility to take account of and give effect to the statutory purpose”.^[22]

The Full Court of the Federal Court accepted as uncontroversial a submission that the general law and the Commonwealth equivalent of s 33 required the object of the Act to be considered when properly construing a provision and when exercising a discretion.^[23]  (Interestingly, the Full Court cited among its authorities Minister for Aboriginal Affairs v Peko-Wallsend Ltd [1986] HCA 40; (1986) 162 CLR 24, which was the same authority that the Appeal Panel relied on when it rejected that it was mandatory to consider the purpose.[24])

Finally, the NSW Court of Appeal cited s 33 after saying it was “required to undertake the exercise of statutory construction with a view to promoting the purpose or object underlying the PPIP Act and the HRIP Act rather than construing the Acts in a manner which would not promote that purpose or object.”^[25]

All of which supports that it is indeed mandatory to consider the purpose(s) of the PPIP and HRIP Acts when construing them.

Authorised versus not forbidden fiasco

The way that the Tribunal and its Appeal Panels have dealt with this issue has, in my opinion, denied them any credibility as the deciders of what is correct and preferable when it comes to the conduct of other public agencies.

The issue concerns the meaning of the term ‘lawful purpose’ in s 8 and HPP 1, which principles prohibit the collection of personal and health information unless the “information is collected for a lawful purpose that is directly related to a function or activity of the agency”.

The Tribunal has gone backwards and forwards between ‘lawful purpose’ means a ‘purpose that is authorised’ and ‘lawful purpose’ means a ‘purpose that is not forbidden’ while citing the same case, NX v Office of the Director of Public Prosecutions,^[26]  as the authority for both of the opposing meanings.

When I appealed the Tribunal’s decision that ‘lawful purpose’ meant ‘not forbidden’ my grounds included caprice and unreasonableness because the Tribunal’s previous decision said ‘lawful purpose’ meant ‘authorised’^[27]. But the Appeal Panel said:

• the Appeal Panel (O’Connor J, Fitzgerald K and Bolt M) in PN v Department of Education and Training (GD) [2010] NSWADTAP 59 (31 August 2010) “held that “lawful purpose” is to be interpreted to mean a purpose that is not forbidden, rather than positively authorised by law”, and
• the Appeal Panel (O’Connor J, Higgins S and Bolt M) in WL v Randwick City Council (GD) [2007] NSWADTAP 58 (5 October 2007) incorrectly characterised the Tribunal’s decision in NX^[28].

Which is odd because the terms ‘not forbidden’ and ‘authorised by law’ are absent from the PN Appeal Panel’s reasons, and six weeks after the PN decision the Tribunal (constituted by the member who had decided NX) cited NX and the WL Appeal Panel and said ‘lawful purpose’ “refers to “a purpose that is authorised, as opposed to not forbidden, by law …””^[29]

Tribunal in NX

In 2005 in NX v Office of the Director of Public Prosecutions^[30] (NX) the Tribunal (Montgomery S) was called on to decide whether  the DPP had a lawful purpose for collecting personal information about a spent conviction. The Tribunal considered the meaning of ‘lawful purpose’, and referred to the High Court’s decision in Taikato v The Queen ^[31].  The Tribunal cited the Court as saying:

“”[L]awful purpose” … should be read as a purpose that is authorised, as opposed to not forbidden, by law because that meaning best gives effect to the object of the section. The meaning of “lawful” depends on its context … As a general rule, interpreting “lawful purpose” in a legislative provision to mean a purpose that is not forbidden, rather than positively authorised, by law is the interpretation that best gives effect to the legislative purpose of the enactment. This is because statutes are interpreted in accordance with the presumption that Parliament does not take away existing rights unless it does so expressly or by necessary implication …Nevertheless, the purpose, context or subject matter of a legislative provision may indicate that Parliament has used the term “lawful purpose” to mean a purpose that is positively authorised by law. That seems to be the best interpretation of the term in the present case.”

As a general rule, interpreting “lawful purpose” in a legislative provision to mean a purpose that is not forbidden, rather than positively authorised, by law is the interpretation that best gives effect to the legislative purpose of the enactment. This is because statutes are interpreted in accordance with the presumption that Parliament does not take away existing rights unless it does so expressly or by necessary implication Potter v Minahan (1908) 7 CLR 277 at 304; Corporate Affairs Commission (NSW) v Yuill (1991) 172 CLR 319 at 322, 338; Coco v The Queen (1994) 179 CLR 427 at 436-437.

Nevertheless, the purpose, context or subject matter of a legislative provision may indicate that Parliament has used the term “lawful purpose” to mean a purpose that is positively authorised by law. That seems to be the best interpretation of the term in the present case.”

The Tribunal said, in the context of s 8 of the PPIP Act, “lawful purpose” should be given the first of the two meanings discussed by the High Court above.^[32]

Tribunal in SW

In 2006 the Tribunal (Handley R) in SW v Forests NSW^[33] said Forest’s conduct “was not for an ‘authorised’ purpose …” citing NX.^[34]

WL Appeal Panel

In 2007 the Appeal Panel (O’Connor J, Higgins S, and Bolt M) in WL v Randwick City Council^[35] said, “The words ‘lawful purpose’ within s 8 mean ‘a purpose that is authorised, as opposed to not forbidden, by law’: NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 at [21]-[22].”^[36]

Tribunal in PN

The WL Appeal Panel was followed in April 2010 by the Tribunal (Higgins S) in WL v Randwick City Council^[37] but in the meantime in 2009 the Tribunal (Montgomery S) in PN v Department of Education and Training said, ““Lawful purpose” as has been stated to generally mean, a purpose that is not forbidden, rather than positively authorised, by law: NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 at paragraph [22].”^[38]

PN Appeal Panel

When PN appealed the Appeal Panel said, “The Tribunal considered the issue of whether s 8(a) was infringed. In our view, it reached the only available conclusion on the evidence, that the information was collected for a lawful purpose directly related to a function or activity of the agency (s 8(a)). There was no error in its approach”^[39].

(As noted earlier, the terms ‘not forbidden and ‘positively authorised’ are absent from the PN Appeal Panel’s reasons.)

Tribunal in SB

Six weeks after the PN Appeal Panel said the Tribunal in PN had not erred in its approach, the  Tribunal (Montgomery S) said in SB v Roads and Traffic Authority,^[40] (SB) ““Lawful purpose” in HPP 1 refers to “a purpose that is authorised, as opposed to not forbidden, by law”: NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 at [21]-[22]; WL v Randwick City Council [2007] NSWADTAP 58 at [45] and [47].”^[41]

And Mr Montgomery ought to know what NX stood for because he decided it.

Tribunal in ALZ

In June 2016 the Tribunal (Montgomery S) in ALZ v SafeWork NSW^[42] cited NX, and the WL and PN Appeal Panels and said it adopted “the approach taken by the Appeal Panel in PN v Department of Education and Training [2010] NSWADTAP 59, “lawful purpose” is to be interpreted to mean a purpose that is not forbidden, rather than positively authorised, by law.”^[43]

‘Not forbidden’ prevails

The [ALZ] Appeal Panel said it was “not persuaded that the Tribunal’s interpretation of one of those elements (that the purpose must be lawful) is inconsistent with the overall purpose of the Privacy legislation.”^[44] And it did not correct what I thought was a serious error.

I guess the Appeal Panel meant it was not inconsistent with the purpose it had constructed (privacy rights are not promoted at the expense of an agency’s need for expediency effective efficiency) because ‘not forbidden’ by law legitimates, as the Appeal Panel did, collections for improper purposes such as discrediting a complainant, or undertaking an unauthorised review of a third party that was not involved in the conduct that the agency had a statutory obligation to review but didn’t because it made a wrong finding that the conduct did not occur despite having clear evidence that it did.

Abhorrent consequence

Worse still, when the ‘not forbidden’ meaning of lawful purpose is applied with the Appeal Panel’s crappy made up rule, that an agency with a lawful purpose can use the information for that purpose even in circumstances where it contravened the privacy principles that obliged it to obtain the persons consent,^[45] what you have is a construction of the privacy principles that defeats utterly the purpose and objects of the Acts as Parliament wrote them (though it (the construction) is not inconsistent with Appeal Panel’s made up purpose).

 Authorised or not forbidden?

The words ‘lawful purpose’ ought, I think, to be construed as meaning ‘a purpose that is authorised by law’. “The authorisation might have been express or implied and may have flowed through a long chain of orders from a person who was given a general power … But whatever form an authorisation took, it must have been sourced in a positive rule of law …”^[46]

By any unlawful means

 A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle [or health privacy principle] applying to the agency.^[47]

I made a straight forward argument in the Tribunal and in the Appeal Panel that WorkCover contravened HPP 1 (2) and s 8 (2) of the PPIP Act because there was a positive legal prohibition against the means that WorkCover used to collect my information from the insurer.

I argued that s 11 of the HRIP Act and s 21 of the PPIP Act prohibit any thing or any practice that contravenes a privacy principle. Therefore, collecting information by a means that contravenes HPP’s 3 and 4, and s 9 of the PPIP Act is unlawful and WorkCover, who had employed that means, had contravened HPP 1 (2) and s 8 (2).

The Tribunal acknowledged my argument in its July 2014 reasons but didn’t decide the issue.^[48] In its 2016 reasons the Tribunal quoted what WorkCover said I said, and said it was my submission.^[49] The Tribunal said, ““Unlawful means” refers to the collection of information by means that are prohibited by the law”^[50], but it didn’t decide the issue.

When I appealed, the Appeal Panel said that the Tribunal agreed with WorkCover that it had not contravened s 8(2) of the PPIP Act and HPP 1(2).^[51]

Then the Appeal Panel said it can be implied that the Tribunal found no breach but just in case the Tribunal didn’t exercise its jurisdiction and decide the issue it would.^[52]

The Appeal Panel said the word ‘means’ means ‘method’. It said an example of collecting by an unlawful means would be collecting by an illegal listening device, and it cited ALZ v WorkCover NSW [2015] NSWCATAP 138 as its authority.^[53]

The Appeal Panel impliedly said that WorkCover did not use an illegal listening device to collect the documents that contained my personal and health information from the insurer so it had “not contravened s 8 (2) or HPP 1(2) and these grounds of appeal are dismissed”.^[54]

I (a person whose privacy was violated and who was harmed by the violation and who has a liking for justice and fairness) can’t understand the Tribunal’s and Appeal Panel’s reluctance to deal with the issue in a straightforward manner. Neither can I understand the Tribunal’s and Appeal Panel’s unwillingness to find that “any unlawful means” is inclusive of a means that contravenes the PPIP or HRIP Acts.

Why did two Appeal Panels construe the words ‘any unlawful means’ so narrowly? Did the Appeal Panels really think that Parliament only intended s 8(2) and HPP 1(2) to prohibit its public agencies from collecting, by means of a listening device or film, personal and health information contained in documents?

Unlimited application

The prohibition against the collection of personal and health information by ‘any unlawful means’ must surely include a means of collection that contravenes a privacy principle.  “The word “any” does not lend itself to a restrictive interpretation.”^[55] “It imports a universal and unlimited application to the subject described.”^[56]

 

---

 

[1] ALZ v WorkCover NSW [2014] NSWCATAD 93 (8 July 2014); [128], [145(ii)].

[2] Ibid. [145(v)].

[3] ALZ v SafeWork NSW (No 2) [2016] NSWCATAD 121 (16 June 2016).

[4] ALZ v SafeWork NSW [2017] NSWCATAP 51 (9 March 2017), [47].

[5] Ibid. [82].

[6] PPIP Act, s 21(2); HRIP Act, s 11(3).

[7] In Director General, Department of Education and Training v MT [2006] NSWCA 270, the Court referred to the privacy principles as “prohibitions or restrictions upon the conduct of each public sector agency to which the Act applies” [29].

[8]  ALZ v SafeWork NSW [2017] NSWCATAP 51 (9 March 2017), [75-76].

[9] Ibid. [81].

[10] Director General, Department of Education and Training v MT [2006] NSWCA 270 (29 September 2006), [26].

[11] Certain Lloyd’s Underwriters Subscribing to Contract No IH00AAQS v Cross [2012] HCA 56, [26].

[12] Ibid. [41].

[13] ALZ v SafeWork NSW [2017] NSWCATAP 51 (9 March 2017), [82].

[14] Ibid.

[15] Ibid. [82-85].

[16] Ibid. [83-84].

[17] Ibid. [91-95].

[18] Ibid. [98].

[19] Mills v. Meeking [1990] HCA 6 (27 February 1990), [19].

[20] K & S Lake City Freighters Pty Ltd v Gordon & Gotch Ltd [1985] HCA 48 (1 August 1985), [4].

[21] Murphy v Police [2005] SASC 321 (25 August 2005), [23].

[22] Waters v Public Transport Corporation [1991] HCA 49, [21].

[23] CSL Australia Pty Limited v Minister for Infrastructure and Transport [2014] FCAFC 10 (26 February 2014), [147-148].

[24] ALZ v SafeWork NSW [2017] NSWCATAP 51(9 March 2017), [75].

[25] AQO v Minister for Finance and Services [2016] NSWCA 248 (05 September 2016), [74].

[26] [2005] NSWADT 74 (4 April 2005).

[27] SB v Roads and Traffic Authority [2010] NSWADT 255 (October 2010), [28].

[28] ALZ v SafeWork NSW [2017] NSWCATAP 51 (9 March 2017), [83-84].

[29] SB v Roads and Traffic Authority [2010] NSWADT 255 (October 2010), [28].

[30] [2005] NSWADT 74 (4 April 2005).

[31] [1996] HCA 28; 16 October (1985).

[32]NX v Office of the Director of Public Prosecutions [2005] NSWADT 74 (4 April 2005), [22].

[33] [2006] NSWADT 74 (13 March 2006).

[34]Ibid. [36].

[35] (GD) [2007] NSWADTAP 58 (5 October 2007).

[36] Ibid. [45].

[37] (No 2) [2010] NSWADT 84 (6 April 2010) [41].

[38][2009] NSWADT 287 (23 November 2009), [153].

[39] (GD) [2010] NSWADTAP 59 (31 August 2010), [65].

[40] [2010] NSWADT 255 (27 October 2010).

[41] Ibid. [28].

[42] (No 2) [2016] NSWCATAD 121 (16 June 2016).

[43] [42].

[44] ALZ v SafeWork NSW [2017] NSWCATAP 51 (9 March 2017), [82].

[45] Cited in ALZ v SafeWork NSW [2017] NSWCATAP 51 (9 March 2017), [34] and [98].

[46] Taikato v The Queen [1996] HCA 28.

[47] S 11 of the HRIP Act and s 21 of the PPIP Act.

[48]ALZ v WorkCover NSW [2014] NSWCATAD 93 (8 July 2014), [54].

[49] ALZ v SafeWork NSW (No 2) [2016] NSWCATAD 121 (16 June 2016), [29].

[50] Ibid. [42].

[51] ALZ v SafeWork NSW [2017] NSWCATAP 51 (9 March 2017), [20(a)].

[52] Ibid. [93].

[53] Ibid. [95].

[54] Ibid. [96].

[55] Truth About Motorways Pty Limited v Macquarie Infrastructure Investment Management Limited [2000] HCA 11(9 March 2000), [15].

[56] Cornwell v The Queen [2007] HCA 12 (22 March 2007), [193].