DQU v University of New England
Where s 10(b) of the PPIP Act should have been an issue but wasn’t.
Background
The University of New England (University) had a dual purpose for collecting information about DQU (who wanted to come to Australia with his wife and son to study at university[1]) and his brother DQV (an Australian citizen who was sponsoring him and who lived and worked in Sydney[2]).
The University’s purposes were 1) to assess the likelihood that the Commonwealth Department of Home Affairs would grant student visas to DQU and his wife and son,[3] and 2) to protect the highest and most favourable number one rating that the Department of Home Affairs had conferred on the University for recruiting overseas students who were Genuine Temporary Entrants.[4]
Worth protecting
Having a number one rating means that the Department of Home Affairs will streamline the visa applications of students that the University has made a formal offer of admission to. This allows the University to better manage the risk that courses will be undersubscribed should the Department not grant student visas to students that the University has made a formal offer of admission to. Streamlining “convert[s] offers of enrolment to actual enrolments in the shortest possible timeframe”.[5]
Also worth protecting
DQU and DQV, who were only aware of the first of the above-mentioned purposes, became aggrieved at the University’s demands for more and more personal information. Over a period of about 12 weeks the University collected from them or asked them to provide:
Copies of DQU’s and his wife’s and son’s passports, a Statement of Purpose form, a Genuine Student and Genuine Temporary Entrant form, a Genuine Temporary Entrant Financial Capacity Matrix form, a Financial Sponsorship Declaration form, a Details of Applicant’s Family Unit form, a Details of Applicant’s Financial Sponsor’s Family Unit form (which asked for details of DQV’s family including his parents and divorced wife), two of DQU’s bank statements, a completed UNE GTE Assessment form, “formal marriage ceremony photographs covering the actual marriage rituals and both bride and groom together with both set of parents and/or other family members”, handwritten letters describing DQH’s and his wife’s travel history details, DQU’s son’s birth certificate, a certified copy of DQU’s Certificate of Registration in his profession, a certified copy of DQU’s Year 10 and Year 12 equivalent education qualifications, verification of DQU’s work experience and proof of employment “such as [a] formal appointment letter, a reference letter from his seniors, salary slips and bank statements”, a copy of DQV’s passport, a copy of DQV’s current visa, evidence of DQV’s annual salary income such as bank statements, payslips and tax payment, and DQV’s residential address.[6]
Review applications
DQU and DQV applied to the University, and to the New South Wales Civil and Administrative Tribunal (Tribunal), for (respectively) an internal and an administrative review of the University’s conduct under s 53 and s 55 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act).[7]
Their applications raised each of the information protection principles (IPPs) in sections 8 – 11 of the PPIP Act[8] but not, specifically, s 10(b), which says:
If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following – (b) the purposes for which the information is being collected.
It’s not surprising that DQU and DQV did not raise s 10(b) in their applications. They didn’t know that they hadn’t been made aware of the dual purposes for which the University was collecting their personal information. They did not know, therefore, that s 10(b) was an issue.
The Tribunal, however, ought to have known. It knew, both, that the purposes of collection included to protect the University’s number one rating, and, that DQU and DQV did not know that protecting the rating was a purpose for which the University collected their information.
The Tribunal said DQU’s and DQV’s concerns arose “from a misunderstanding of the context in which the requests were made”[9]. And, “Regrettably, DQU and DQV do not appear to have fully understood” that “the aim was to have DQU’s student visa applicant [sic] streamlined by the Commonwealth Department of Home Affairs”.[10]
But instead of determining the s 10(b) issue, which arose on the material before the Tribunal, and which was a real issue in the proceedings, the Tribunal confined its determination to the issues the parties had raised. It found that the University had complied with its PPIP Act obligations and decided not to take any action in the matter,[11] which I think wrong.
Power to inquire
The Tribunal, in administrative review proceedings, has inquisitorial powers. The presidents of the NSW Civil and Administrative Tribunal and its predecessor, the Administrative Decisions Tribunal, have said so:
Administrative review proceedings in NCAT are administrative and inquisitorial in nature: Justice Armstrong, Youssef v NSW Legal Services Commissioner [2020] NSWCATOD 85 (30 July 2020), [30].
In an administrative review under the ADR Act, the Tribunal is to determine what the correct and preferable decision is in the exercise of the functions of the administrator who made the decision under review, on the material before the Tribunal. The functions of the administrator and the nature of the particular decision in question will determine what the relevant factual issues are … the Tribunal can, with due regard to the rules of natural justice and practicality, conduct administrative review proceedings, in whole or in part, inquisitorially in appropriate cases: Justice Robertson Wright, ‘Administrative Review Proceedings in NCAT’, March 2017.[12]
[I]n review proceedings … [t]he duty of the Tribunal is to reach the ‘correct and preferable’ decision in the circumstances (ADT Act, s 63) by a process of inquiry. When undertaking the review of administrative conduct, as here, the Tribunal is not engaged in the resolution of an adversarial contest of the kind typical of civil litigation: Justice O’Connor, University of New South Wales v PC (GD) [2008] NSWADTAP 26 (24 April 2008), [50].
The Federal Court Full Court said, when a “review process is inquisitorial rather than adversarial” a Tribunal “is required to deal with the case raised by the material or evidence before it … the Tribunal is not to limit its determination to the ‘case’ articulated by an applicant if evidence and material which it accepts raise a case not articulated”. A “claim not expressly advanced will attract the review obligation of the Tribunal when it is apparent on the face of the material before the Tribunal”.[13]
Prime case
DQU’s and DQV’s matter is an example of a case where the Tribunal should have determined an issue that arose on the material before the Tribunal even though the issue was not articulated by a party.
The material before the Tribunal showed that despite the University making DQU a conditional offer of admission and providing him with information (via email or its website) about: the conditions he had to meet; studying at the University; fees, payment and refunds; living costs; compulsory health cover; consumer law; privacy law; the Education Services for Overseas Student Framework; and the University’s University International Student Offer Guide’[14], DQU (and DQV) did not become aware of the dual purposes for which the University was collecting their personal information.[15]
If and may have
If the Tribunal had raised and determined the s 10(b) issue it may have concluded that the step of providing the above information to an overseas student, whose primary language was not English, with the expectation that the student would become aware of the purposes by reading between the lines of some of the information, was not “such steps as are reasonable in the circumstances to ensure that” the student was “made aware of … the purposes for which the information is being collected”.
(“[W]hat is reasonable depends on all the circumstances”[16]; ‘reasonably’ and the reference to ‘all the circumstances’ import[s] an objective test”[17] “The ordinary grammatical meaning of the word “ensure” is to guarantee or make certain … The word “ensure” … is given emphasis by the preceding word “must””.[18])
The Tribunal may also have concluded that the University should provide individuals, especially those whose primary language is not English, with a collection notice that states straightforwardly, specifically and prominently what its dual purposes for collecting their personal information are (as well, of course, as the other factors set out in s 10(a-f)).
Conclusion
The lack of such a notice makes the University’s lawful purpose look like an ulterior motive.
[1] DQU v University of New England [2020] NSWCATAD 226 (11 September 2020), [2].
[2] Ibid. [6].
[3] Ibid. [7-9].
[4] Ibid. inference drawn from [112-116].
[5] Ibid. [113].
[6] Ibid. [48-70].
[7] Ibid. [11-12].
[8] Ibid. [17-18].
[9] Ibid. [26].
[10] Ibid, [157].
[11] Ibid. [169(4)].
[12] <https://www.ncat.nsw.gov.au/documents/speeches/20170321_paper_wright_nsw_bar_association.pdf>
[13] NABE v Minister for Immigration & Multicultural & Indigenous Affairs (No 2) [2004] FCAFC 263 (16 September 2004), [58].
[14] DQU v University of New England [2020] NSWCATAD 226 (11 September 2020), [48-70] and [155].
[15] The Tribunal did not refer to any evidence that showed that the University did make DQU and DQV aware that it was collecting their information to protect its Department of Home Affairs’ rating.
[16] Electronic Industries Ltd v David Jones Ltd [1954] HCA 69 (26 November 1954), [8].
[17] Bropho v Human Rights & Equal Opportunity Commission [2004] FCAFC 16 (6 February 2004), [66].
[18] Cahill v State of New South Wales (Department of Community Services) (No 3) [2008] NSWIRComm 123 (27 June 2008), [210].
