Principle of illegality

The New South Wales Civil and Administrative Tribunal (Tribunal) has case law that needs wiping out because it stands in the way of persons (whose privacy was interfered with by public agencies in NSW) having their matters decided according to law.

The Tribunal’s case law from the Appeal Panel’s decision in PN v Department of Education and Training (GD) [2010] NSWADTAP 59 (31 August 2010), which concerns s 25(b) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act) is an example of such case law.

Based on the wrong test and contrary to the principle of legality the ‘principles’ from PN have been followed numerous times including by the Tribunal in DQN v The University of Sydney [2019] NSWCATAD 266 (19 December 2019).

Section 25(b)

Section 25(b) of the PPIP Act says:

“A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if: (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998).”

Genesis of ‘principles’ from PN

The Department of Education and Training was before the Tribunal because PN did not agree that the authorisation she’d signed when she made a workers compensation claim covered all the Department’s handling of her personal information.^[1]

The Department said that workers compensation legislation “necessarily implied or reasonably contemplated” the exchange of personal information and as such its conduct was “not in breach of sections 9, 30 [sic], 13, 14, 15, 17, or 18 of the PPIP Act by reason of section 25(b)^.^[2]

Wrong test

The Department applied the wrong test. S 25(b) says an agency is not required to comply “if: (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act …” S 25(b)’s test was, therefore, whether non-compliance was otherwise permitted/necessarily implied/reasonably contemplated under workers compensation legislation, and not whether workers compensation legislation “necessarily implied or reasonably contemplated” the exchange of personal information.

Wrong test’s answer adopted

Although non-compliance was not otherwise permitted, necessarily implied or reasonably contemplated under workers compensation legislation, the Tribunal did not reject the Department’s argument but adopted it word for word typo and all as its conclusion. It said the Department was “not in breach of sections 9, 30 [sic], 13, 14, 15, 17, or 18 of the PPIP Act by reason of section 25(b).^[3]

Answer to wrong test elaborated on

PN appealed to the Tribunal’s Appeal Panel. She relied on guidelines made under workers compensation legislation (that the Department had not complied with) as evidence that non-compliance was not contemplated under workers compensation legislation.^[4]

The Appeal Panel said the “Tribunal did not err in its approach”.^[5] It said the guidelines did not lay down strict rules^[6] and:

It did “not think that the task required of the Tribunal in deciding whether or not s 25 is applicable requires it to go so far as to make a microscopic comparison of an alternative law to which an agency refers in justification. Section 25 is expressed in broad language. It is enough that ‘non-compliance is reasonably contemplated’ by the other law.^[7]

“In our view, it is enough for s 25(b) to apply that the transactions in issue … are of a type that is contemplated by the regime”.^[8]

“The Tribunal’s task is simply to make a broad judgement as to whether s 25 applies. The protection given to an agency by s 25 is not lost simply because the agency has failed to comply, in some aspect of the detail, with a requirement of the other law”.^[9]

Source of peculiar ideas unknown

It’s not clear where the Appeal Panel’s ideas came from.

Ideas about s 25’s protection

The Appeal Panel’s idea that s 25 uses broad language and protects agencies can’t have come from s 25 because s 25, in highly specific language, protects personal information by specifying (in obverse) that agencies must comply with the specified sections of the PPIP Act unless “(a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998)”.

Ideas about Tribunal’s task

The Appeal Panel’s idea that the Tribunal is not required to examine an Act relied on in justification because its task is to make a broad judgement as to whether s 25 applies can’t have come from the PPIP Act because it conferred on the Tribunal the jurisdiction to review the Department’s conduct;^[10] and it can’t have from come from the Administrative Decisions Tribunal Act 1997 (NSW), because it imposed on the Tribunal the duty to decide what the correct and preferable conduct is;^[11] and it can’t have come from the principle of legality because it pretty much says the opposite.

Principle of legality

The principle of legality governs the courts and Parliament. It comes into play when legislation is interpreted. It expresses the legal value that, “Courts do not impute to the legislature an intention to abrogate or curtail certain human rights or freedoms … unless such an intention is clearly manifested by unambiguous language, which indicates that the legislature has directed its attention to the rights or freedoms in question, and has consciously decided upon abrogation or curtailment”.^[12]

Directed attention and conscious curtailment

The Crimes (Domestic and Personal Violence) Act 2007 (NSW) is an example of an Act that reasonably contemplates non-compliance with the PPIP Act. The intention to curtail privacy rights is manifested by unambiguous language, which indicates that the legislature has directed its attention to privacy rights and has consciously decided upon curtailment.

S 98A says:

[P]rivacy legislation means the Privacy and Personal Information Protection Act 1998 or the Health Records and Information Privacy Act 2002 and any regulation or code of practice made under either of those Acts (s 98A).

S 98M says:

(1) In this section: dealing with information means the collection, use or disclosure of the information.

(2) An agency may, despite the privacy legislation, deal with information about a person without the consent of the person if the agency believes on reasonable grounds that:

(a) the particular dealing is necessary to prevent or lessen a domestic violence threat to the person or any other person, and

(b) the threat is a serious threat, and

No conscious curtailment

The Civil and Administrative Tribunal Act 2009 (NSW) (NCAT Act), the Administrative Decisions Review Act 1997 (NSW) (ADR Act) and the Government Information (Public Access) Act 2009 (NSW) (GIPA Act)^[13] are example of Acts that do not manifest clearly (or at all) an intention of the legislature to curtail privacy rights.

They do not contain unambiguous language which indicates that the legislature directed its attention to non-compliance with the PPIP Act and consciously decided to curtail privacy rights.

Yet the Tribunal in DQN v The University of Sydney [2019] NSWCATAD 266 (19 December 2019) cited the ‘principles’ from the Appeal Panel in PN and decided that “non-compliance with the use and disclosure information protection principles were [sic] permitted, necessarily implied and/or reasonably contemplated by the NCAT Act, the ADR Act and/or GIPA Act.”^[14]

Enough is enough

The Tribunal in DQN did what numerous other Tribunals have done. Instead of being governed by the principle of legality it let itself be governed by the PN Appeal Panel’s principles of illegality.

That needs to stop.

[1] PN v Department of Education and Training [2009] NSWADT 287 (23 November 2009), [72].

[2] [124].

[3] [212].

[4] PN v Department of Education and Training (GD) [2010] NSWADTAP 59 (31 August 2010), [50-51].

[5] [61].

[6] [53].

[7] [54].

[8] [57].

[9] [59].

[10] PPIP Act, s 55.

[11] ADR Act, s (63).

[12] Al-Kateb v Godwin [2004] HCA 37 (6 August 2004), [19-20].

[13] [34].

[14] [48].