Justice inaction
The NSW Department of Justice, represented by its Office of General Counsel, appeared before the Civil and Administrative Tribunal (Tribunal), which it administers, because one of its divisions (Corrective Services) contravened privacy legislation. It undertook a half-arsed review of the conduct, made recommendations that weren’t implemented, then continued to engage in the contravening conduct.
Another of its agencies, the Information and Privacy Commission, interestingly, had nothing to say.[1]
The Tribunal, when it determined the matter, looked for its powers in case law principles that should have gone out the window when the High Court handed down its judgement in Shi v Migration Agents Registration Authority [2008] HCA 31 (30 July 2008), then, satisfied it was impotent, the Tribunal ordered the Department of Justice to take steps to protect the applicant’s personal information (at its leisure) and apologise (when it gets around to it).[2]
Background
The review applicant in the case, DSN v NSW Department of Justice [2019] NSWCATAD 174 (23 August 2019), is an inmate of the High Risk Management Correctional Centre at Goulburn in NSW.[3] He and an inmate of the adjoining Goulburn Correctional Centre have the same first and last names.[4]
From time to time over a couple of years Corrective Services gave the two inmates each other’s mail. (DSN said he gave the mail straight back to officers.) Mail from DSN’s partner and friends and legal letters, which were marked with DSN’s identification number, were given to the other inmate.[5]
As well as that Corrective Services gave Wesley Mission, when it asked for DSN’s identification and unit numbers, the other inmate’s identification and unit numbers. Consequently Wesley Mission sent a CD to the other inmate instead of DSN.[6]
When DSN tried to find out what happened to the CD after the other inmate received it he was given three different stories, which made him suspect a cover-up.[7]
Perhaps, perhaps, perhaps
The nature of the information on the CD is not disclosed in the Tribunal’s reasons but perhaps the information was personal. Perhaps the information was sensitive. Perhaps that’s why DSN was keen to find out what happened to the CD after the other inmate received it.
Perhaps the information on the CD (18 documents[8]) was viewed, downloaded, saved, copied, cut and pasted, emailed, printed, handed around or otherwise shared and misused by inmates or visitors or Corrective Services’ officers (or even the media).
Perhaps DSN never found out.
Review applications
Internal review
DSN applied for an internal review under s 53 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).[9] The internal review took seven months to complete[10] (instead of 60 days) and it didn’t deal with all the issues. It didn’t deal with the disclosure of the names and addresses of DSN’s partner and friends to the other inmate or the disclosure of the other inmate’s mail to DSN. The other inmate wasn’t interviewed. The cover up of what happened to the CD after the other inmate received it wasn’t investigated. No-one was held accountable. And DSN and the other inmate were still getting each other’s mail.[11]
Administrative review
DSN applied to the Tribunal under s 55 of the PPIP Act for an administrative review of the conduct under the Administrative Decisions Review Act 1997 (NSW) (ADR Act).[12] The Tribunal agreed with the Department of Justice that s 12(c) and s 18 were contravened then it consulted its case law and said it could take no action in relation to any of DSN’s reasons for being dissatisfied because:
- DSN didn’t have standing to complain about or seek a review of conduct that did not concern his own personal information;
- the internal review processes were not reviewable;
- DSN had a right that he did not exercise to apply to the Tribunal when the internal review was delayed;
- the Tribunal did not have the jurisdiction to make individuals accountable; and,
- the Tribunal did not have the jurisdiction to take into account conduct that occurred after DSN applied for an internal review.[13]
The Tribunal was wrong. It had a plethora of powers that extended its authority but they were in the PPIP, ADR and Civil and Administrative Tribunal Act 2013 (NSW) (CAT Act) Acts – not in the Tribunal’s case law.
Powers and jurisdiction
ADR Act powers
Section 63 of the ADR says:
- In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following:
(a) any relevant factual material,
(b) any applicable written or unwritten law
(c) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.
2. In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide:
(a) to affirm the administratively reviewable decision, or
(b) to vary the administratively reviewable decision, or
(c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or
(d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal.
In Shi v Migration Agents Registration Authority[14] (Shi) the High Court construed an equivalent provision of the Administrative Appeals Tribunal Act 1975 (Cth) (AAT Act). The Court said the issue of how to define the jurisdiction and powers of the Tribunal in conducting a review of a decision depends on understanding all the relevant features of the inter-related statutes.[15]
Accordingly, the Tribunal’s jurisdiction and powers are defined by the interrelated PPIP Act and ADR Acts, and not by the case law.
Review jurisdiction
The ADR Act says, “The Tribunal has administrative review jurisdiction over a decision … if enabling legislation provides that applications may be made to the Tribunal for an administrative review under this Act of any such decision … in the exercise of functions conferred or imposed by or under the legislation, or … in the exercise of any other functions of the administrator identified by the legislation.”[16]
The PPIP Act provides that applications may be made to the Tribunal for an administrative review of the internal review findings, and actions proposed to be taken, and conduct.[17] The Tribunal has, therefore, administrative review jurisdiction over findings, proposed actions and conduct.
Conduct
Section 53(6) says, A person who is aggrieved by conduct “is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned” “if the [internal] review is not completed within 60 days from the day on which the application was received” by the agency.
Section 55(1) says, A person who has made an application for internal review under section 53 may apply to the Tribunal for an administrative review under the ADR Act of the conduct that was the subject of the application under section 53 if they are not satisfied with the findings of the review or the action taken by the agency in relation to the application.
Findings and actions
Section 53(8)(c) says, A person has the right to have the internal review findings and the agency’s proposed action administratively reviewed by the Tribunal, which necessarily implies that applications may be made for an administrative review of the findings and proposed actions.
(Statutes contain “not merely what its words actually express, but also what they necessarily imply. Necessary implication is as much part of the contents of a document as its express statements”.[18])
Minister’s contravention of s 15
Section 55(1A) says: A person who is aggrieved by the conduct of a Minister (or a Minister’s personal staff) constituting a contravention of section 15 may apply to Tribunal for an administrative review of the conduct.
Power not limited
Contrary to the Tribunal’s case law the above-mentioned conferrals of jurisdiction to review conduct, findings and proposed actions do not limit the Tribunal’s s powers under s 63 of the ADR Act; nothing in s 55 does.
Section 55(3) says, “Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997” (in which Division- Part-Chapter s 63 resides).
Authority extended
In Shi the High Court agreed with other courts who’d said the power to “exercise all the powers and discretions that are conferred by any relevant enactment on the person who made the decision …” confers upon the Tribunal “an amplitude of powers that the Tribunal may exercise if it is convenient and useful to do so … [The power] extends the authority of the Tribunal so that it may more adequately exercise its function of reviewing on the merits the subject decision.” [19]
The High Court further said, “Given the broad powers afforded to the Tribunal for the purpose of bringing disputes over relevant administrative decisions to finality “on the merits”, no ground is shown for narrowing the decision-making powers of the Tribunal …”[20]
Wrong end of the stick
For decades the Tribunal’s been citing its case law and claiming that it lacks the jurisdiction or power that Parliament gave it to get stuck in and review conduct and decide what’s correct and preferable on the material before it when all the time it had an amplitude of powers that extended its authority.
In DSN’s case the Tribunal thought it was not authorised to have regard to the highly relevant evidence – that the Department of Justice were knowingly engaging in conduct that contravened the PPIP Act – because the contraventions occurred after DSN applied for an internal review.
Most up to date material
Taking account of events that occurred subsequent to the decision under review and making the correct or preferable decision on the up to date material before it were issues in Shi. The High Court (still construing s 63 of the ADR Act’s AAT Act equivalent) said the Administrative Appeals Tribunal “is an instrument of government administration and designed to act where decisions have been made in the course of government administration but which are in the view of the Tribunal not acceptable when tested against the requirements of good government.”[21] The High Court continued:
“[I]t was for the Tribunal to reach its own decision upon the relevant material including any new, fresh, additional or different material that had been received by the Tribunal as relevant to its decision. In effect, this was no more than a consequence of the Tribunal’s obligation to conduct a true merits review.”[22]
The obligation to have regard to the best and most current information available is no more than a feature of good public administration[23] that reflects the fact that nearly every statute that confers a power to make an administrative decision contains an implication that the decision is to be made on the basis of the most current material available to the decision-maker”. [24]
“This conclusion is all the more compelling when the decision in question is one which may adversely affect a party’s interests or legitimate expectations by exposing him to new hazard or new jeopardy.”[25]
“This object of protecting members of the public … is best achieved by the Tribunal making its decision upon the most up to date material available to it at the time of its own decision. It would be impeded if the Tribunal were confined to the facts and circumstances subsisting at the time of the Authority’s original decision weeks, months or even years in the past.”[26]
(“The particular nature of the “decision” in question may sometimes, exceptionally, confine the Tribunal’s attention to the state of the evidence as at a particular time.”[27] “If there is any such statutory limitation, it would be found in the legislation which empowered the primary decision‑maker to act…”[28] For example, a decision to grant or refuse a pension “may necessarily be limited to the facts at the particular time of the decision”.[29])
Actions the Tribunal could have taken
The PPIP and ADR Acts authorised the Tribunal to “stand in the shoes of the original decision-maker, for the purpose of its review …” and perform the function of the administrator in accordance with the law as it applied to that person; to perform the function over again.[30]
The Tribunal had the internal reviewer’s power (and obligation) to see what issues the eight page letter DSN attached to the internal review application raised.
It had the power to determine whether DSN was aggrieved for the purpose of s 53(1); the power to review the disclosures of DSN’s partner’s and friend’s personal information to the other inmate, and the power to review the disclosure of the other inmate’s personal information to DSN.
The Tribunal had the internal reviewer’s power to speak to the other inmate;[31] the power to take account of the fact that the Department of Justice took three times as long to complete the review and continued to contravene the Act after the completion of the review; and the power to decide what the correct and preferable decision is on that up to date material.
Aggrieved
Section 53(1) of the PPIP Act says, “A person (the applicant) who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct”[32]
The High Court (citing the Federal Court) said: “[Person aggrieved] does not mean that any member of the public can seek an order of review. I am satisfied, however, that it at least covers a person who can show a grievance which will be suffered as a result of the decision complained of beyond that which he or she has as an ordinary member of the public. In many cases that grievance will be shown because the decision directly affects his or her existing or future legal rights. In some cases, however, the effect may be less direct”.[33]
DSN’s reason for being aggrieved at the disclosure of his partner’s and friends information to the other inmate is not stated in the reasons. Perhaps he thought the disclosure may have compromised their safety. In any event his interest in not having their information disclosed to the other inmate (and the other inmate’s information disclosed to him) was beyond that of an ordinary member of the public and DSN, therefore, had standing.
If DSN was concerned for his partner’s safety he was in good company because the complainant in ‘DK’ and Telstra Corporation Limited [2014] AICmr 118 (30 October 2014), a Federal Circuit Court judge, complained that he feared for the safety of his partner after their address and phone number were unlawfully disclosed.
Correct and preferable decision
“In considering what is the right decision, the Tribunal must address the same question as the original decision-maker was required to address”.[34]
If the Tribunal had looked in the PPIP, ADR and CAT Acts for its powers and followed the High Court instead of itself it may have decided that the Department of Justice:
- in contravention of s 12(c) did not ensure that DSN’s personal information and that of his partner, friends and the other inmate was protected by reasonable security safeguards against unauthorised access and disclosure in circumstances where he and another inmate had the same first and last name;
- in contravention of s 18 disclosed DSN’s personal information, and the personal information of his partner, friends, and the other inmate, to a person other than themselves;
- In contravention of s 16 used the information, that DSN is an inmate and these are his identification and unit numbers, without taking reasonable steps, in circumstances where it was aware of the ongoing mail mix up, to ensure the information was accurate and not misleading.
- In contravention of s 18 disclosed to the other inmate the information that DSN was corresponding with Wesley Mission (plus any contraventions the Tribunal found after it called and heard the evidence of the other inmate and the Corrective Services officers on what happened to the CD after the other inmate received it).
Orders
The Tribunal may have concluded on the up to date material before it that DSN’s privacy rights were not a high priority for the Department of Justice and made orders under s 55(2) of the PPIP Act that required the Department of Justice:
- to place a warning on its database immediately and verify before the proceedings were concluded that it had been done; and
- to make DSN’s partner and friends aware of the disclosure so they could exercise their rights; and
- to apologise to DSN, in terms that were acceptable to him, before the proceedings were concluded.
It certainly had the power.
[1] DSN v NSW Department of Justice [2019] NSWCATAD 174 (23 August 2019), [17].
[2] Ibid. [65].
[3] Ibid. [5].
[4] Ibid. [6].
[5] Ibid. [8].
[6] Ibid. [9].
[7] Ibid. [12].
[8] Ibid. [26].
[9] Ibid.
[10] Ibid. [12]-[18].
[11] DSN v NSW Department of Justice [2019] NSWCATAD 174 (23 August 2019), [26].
[12] Ibid. [25].
[13] Ibid. [53]-[55], [58]-[64].
[14] [2008] HCA 31 (30 July 2008)
[15] Shi v Migration Agents Registration Authority [2008] HCA 31 (30 July 2008), [25].
[16] ADR Act, s 9(1).
[17] ‘Conduct’ is an administratively reviewable decision, see s 7 of the ADR Act.
[18] Hirsch v Zinc Corporation Ltd [1917] HCA 55 (12 October 1917).
[19] Shi v Migration Agents Registration Authority [2008] HCA 31 (30 July 2008), [35]-[38].
[20] Ibid. [68].
[21] Ibid. [35].
[22] Ibid. [36].
[23] Ibid. [41].
[24] Ibid. [42].
[25] Ibid. [42].
[26] Ibid. [50].
[27] Ibid. [46].
[28] Ibid. [99].
[29] Ibid. [44].
[30] Ibid. [134].
[31] Section 6 of the Civil and Administrative Tribunal Act 2013 (NSW) provides the power to call and examine witnesses (such as the other inmate and the Corrections Services officers).
[32] PPIP Act, s 53(1).
[33] Argos Pty Ltd v Corbell, Minister for the Environment and Sustainable Development [2014] HCA 50 (10 December 2014), [28], citing Tooheys Ltd v Minister for Business and Consumer Affairs [1981] FCA 121; (1981) 36 ALR 64, [79].
[34] Shi v Migration Agents Registration Authority [2008] HCA 31 (30 July 2008), [142].
