AIT18 v Australian Information Commissioner

Federal Court of Australia (Full Court)|2018-11-13|Before: Mr P, Farrell JJ

The applicant's submissions summarised 36 In his oral address, Mr Rivette (who appeared together with Mr Clarke for the applicant) identified what he described as the following four key issues in the appeal: (a) Whether the Privacy Act must be interpreted in a manner consistent with the principles of interpretation of remedial or beneficial legislation, the principles of contextual interpretation and recognising that the legislation is based on the Commonwealth's commitment to its international obligations under Art 17 of the ICCPR and the OECD Guidelines. (d) Whether on its proper construction IPP 11.1(d), which requires that a disclosure be required or authorised by or under law, includes both express and implied requirements or authorisation. (e) Whether it was correct for the AAT in relation to IPP 11.1(a) to categorise personal information into sub-categories, or kinds of information, not recognised by the Privacy Act or OECD Guidelines, and in doing so create a two-step test that has the effect of allowing the creation of different categories of personal information that attract different levels of protection. Under the AAT's approach, it looked at the nature of the information as the first step rather than first focusing on the knowledge of the individual. (f) Whether the AAT was correct to create different categories of individuals, who will have greater or lesser levels of protection under the Privacy Act based on their personal characteristics (such as education and employment status) in circumstances where the Privacy Act makes no such distinction, and treats all human individuals in the same manner. 37 The applicant's submissions on these matters, which were very lengthy, may be summarised as follows.

Contextual interpretation - Question 2, Grounds 3-4 41 The applicant submitted that the proper approach to statutory construction was to commence with a consideration of the text, while having regard to context and purpose, citing SZTAL v Minister for Immigration and Border Protection [2017] HCA 34; 91 ALJR 936 (SZTAL) per Kiefel CJ, Nettle and Gordon JJ and Project Blue Sky Inc v Australian Broadcasting Authority [1998] HCA 28; 194 CLR 355 (Project Blue Sky) at [69]-[71]. 42 The applicant acknowledged that the AAT correctly stated the relevant principles of construction but he submitted that it then failed to apply those principles to IPP 11.1(a) and (d) and, in particular, failed to apply a "contextual interpretation". He submitted that the AAT failed to give effect to the "paramount importance" placed on the protection of privacy in determining any ambiguity in the Privacy Act or the IPPs. The applicant submitted that the AAT "strained" to find purpose in other legislation, such as the OHS Act, without addressing whether the Disclosures were necessary for DVA to fulfil its functions.

Categorisation of information - Question 2, Grounds 5-6 43 The applicant submitted that, in deciding whether any of the three Disclosures was permitted under IPP 11.1(a), the question the AAT was required to determine was whether AIT18 was "reasonably likely to have been aware ... that information of that kind is usually passed to that person, body or agency". 44 The applicant submitted that, had the AAT applied the correct principles of interpretation, it would properly have placed emphasis on his knowledge or state of awareness. The issue of whether the applicant was "reasonably likely to have been aware" required DVA to "make a difficult judgment about what the person the information is about is reasonably likely to know." This judgment must be made from an objective analysis of what has occurred and the steps the record-keeper has taken, and to do this before making the Disclosures. Had the decision been made that the applicant may not be reasonably likely to be aware, then it was in the power of DVA to directly inform him of the actions it might take if, for example, his behaviour continued, and therefore act in a way that preserved his privacy. Importantly, this would arm him with the information he needed to determine his future conduct, so the applicant submitted. 45 The applicant contended that, to address the issue of whether he was "reasonably likely to have been aware", the AAT was also required to undertake an objective analysis of those matters that would have created an awareness in a reasonable person in the place of the applicant. The starting point for the AAT would properly have been a review of those actions of DVA as the collector and disseminator of the personal information which would indicate to a reasonable person in the applicant's place that: (a) information may be passed to that person, body or agency; and (b) the information may be of the kind that was passed or proposed to be passed. However, the AAT failed to do this, so contended the applicant. 46 The applicant submitted that the AAT's reasoning involves the creation of different categories of personal information, which attracts different levels of protection. Thus, protection could range from information that would attract the full protection offered by the Privacy Act and the IPPs in contrast with some lesser category of information, such as the information in Disclosures 1, 2 and 3, which would have no protection at all against disclosure. 47 The applicant submitted that the Privacy Act recognises no categorisation of personal information, other than a subset of personal information (that being sensitive information, which attracts greater protection for the individual and creates more stringent obligations and restrictions on its collection, use and dissemination). 48 The applicant submitted that the AAT erroneously relied upon cl 3(a) of the OECD Guidelines (Reasons [242]-[243]), even though it failed to identify any ambiguity in the language of IPP 11.1(a) (Reasons [237]) and had not exhausted the application of the ordinary rules of interpretation before erroneously looking at this extrinsic material, contrary to Saeed v Minister for Immigration and Citizenship [2010] HCA 23; 241 CLR 252 (Saeed) at [33] per French CJ, Gummow, Hayne, Crennan and Kiefel JJ. 49 The applicant submitted that the AAT erroneously found that "IPP 11.1(a) has been drafted in light of cl 3(a) in that it requires an additional categorisation of personal information that has been passed by reference to its "kind" and a determination of whether it would usually be passed on" (Reasons [243]). He submitted that this finding was unsupported by authority.

"Usually passed on" - Questions 3-9, Grounds 7-18 50 The applicant submitted that, in construing the phrase "usually passed on", the AAT correctly referred to guideline 22 of the Plain English Guidelines to Information Privacy Principles 8-11, which were published by the Information Commissioner (IPP Guidelines). He also agreed with the AAT's view that an agency "usually passes on personal information to another body if it is the agency's normal practice to disclose some or all of that type of information to that body" (Reasons [234]). The applicant contended that the AAT then failed to apply that approach and erroneously refused at Reasons [235] to look at the "regularity with which personal information is passed on to another body" in deciding what is "usually passed on". 51 The applicant criticised the AAT's use of an example of a search warrant in concluding at Reasons [235] that "what is customarily or ordinarily done if personal information is of a particular kind, can be what is customarily or ordinarily done with that kind of personal information even if personal information of that kind rarely comes into the custody of the record-keeper". The applicant contended that the AAT erred in failing to focus on the individual's state of knowledge, whether actual or implied, by using an objective analysis.

OHS Act and DFD Act - Question 9, Grounds 7, 17-18. 52 The applicant submitted that, in relation to the OHS Act and the DFD Act, there was no evidence before the AAT that DVA relied upon or used requirements under that legislation to pass on, let alone "usually pass on", personal information to other parties or agencies. 53 The OHS obligations were internal to DVA and reasonably practicable steps could have been taken within DVA to discharge its duty without making the Disclosures (Reasons [297]). There was no evidence before the AAT which pointed to a process or usual practice whereby it was reasonably likely that a person would be aware that his or her personal information would be disclosed to other parties if there was a possible breach of the DFD Act. DVA's evidence was that when dealing with a difficult client, staff would seek an Apprehended Violence Order or go to the police. 54 The applicant submitted that the AAT erred in concluding that its interpretation was consistent with the policy of the Privacy Act, in that it balanced the legitimate needs of an agency in acquiring personal information and the use made of it against the need to sustain personal privacy. However, the policy referred to by the AAT was in relation to the collection of information and not the disclosure of personal information to a third party, and is therefore irrelevant to the issue of whether the individual would be aware that information of that kind is usually passed on to that third party. 55 Finally, the AAT was said to be in error in finding that statutory responsibility under the OHS Act can authorise disclosure under IPP11.1(a) (Reasons [263]). Consideration of IPP 11.1 in totality makes clear that disclosure required or authorised by or under law is confined to IPP 11.1(d), and the enforcement of criminal law is confined to IPP 11.1(e). The applicant submitted that the AAT therefore erred in finding that the personal information in Disclosures 1 and 2 would usually be passed to his medical practitioner and employer. 56 With reference to Reasons [262], the applicant submitted that the AAT made a finding that, because of the relationship between DVA and the Department of Defence and to his clinical health care, it would be an ordinary and reasonable thing for an agency in the position of DVA to pass on the information to the Department of Defence. However, there was no evidence to support this finding, which the applicant said was "mere speculation". In observing that "it would be the usual thing to do in the circumstances" the AAT revealed the nature of its own error, in applying its own standard of "concern for a fellow human being", rather than objectively analysing what was done in practice by DVA, which the applicant contended was the requisite task.

Normal practice to notify employer of offence - Question 4, Grounds 9-10 57 The applicant submitted that the AAT committed the same error in relation to the DFD Act. There was no evidence before the AAT to suggest that DVA had turned its mind to whether the applicant was committing offences that required Disclosure 3 to be made. Rather, the AAT at Reasons [275] again speculated in finding that as a general proposition "when one Commonwealth agency comes to a view that an employee of another may be committing offences, it is normal or usual practice to tell that employee's employing agency". The applicant submitted that it was wrong of the AAT to make this finding and apply it to Disclosure 3 in the absence of direct evidence to support that proposition and, specifically, DVA's usual practice. 58 The applicant submitted that the AAT relied upon a factual finding based upon the content and tone of his emails, noting that he was "quick to complain to a third party" (Reasons [253]) and "exhibited a tendency to return to problems" (Reasons [255]). Based upon this evidence, the AAT found that the response of DVA to be appropriate. Consideration of an individual's mental state is a subjective inquiry and an irrelevant consideration under IPP 11.1(a), which is concerned with an objective assessment, so he submitted. The applicant submitted that consideration of his behaviour to assess the appropriateness of disclosure involved error, citing Craig v South Australia [1995] HCA 58; 184 CLR 163 (Craig) at [15]. 59 The applicant submitted that the AAT consequently failed to make the appropriate inquiry into the kinds of practices and information that DVA would usually pass to the Chief of the Air Force, or any other agency. There was no evidence that such information was frequently passed on by DVA to the Department of Defence. Instead the AAT framed it in terms of the relationship between the agencies, which was contrary to evidence before both the Commissioner and the AAT (Reasons [262]).

Knowledge - Question 5, Grounds 11-12 60 In relation to the issue of knowledge, the AAT found at Reasons [277] that as the holder of an undergraduate degree, two Masters degrees and three graduate certificates, the applicant's education and rank in the RAAF made it more likely that a person in his shoes would understand that information of the kind would be passed on to others. This finding was said to go to two aspects of the test under IPP 11.1(a): (a) the imputed knowledge of the applicant; and (b) his knowledge of the type of information that was actually passed in the three Disclosures. 61 The applicant acknowledged that the IPP Guidelines suggest that relationship, occupation and life experience are relevant considerations in determining the state of knowledge, however, he submitted that the AAT's approach and the IPP Guidelines were erroneous, or alternatively, the manner in which this consideration was applied by the AAT was in error. He said that it was inconsistent with the objects of the Privacy Act and the general context of its provisions to create different categories of individuals. 62 The applicant submitted that the AAT erroneously applied subjective elements to what the term "reasonably" denotes as an objective test. The AAT's error was said by the applicant to be that it applied a subjective test, based upon the applicant's personal capacities, experience and education (Reasons [277]), as opposed to an objective standard, as required by IPP 11.1(a). 63 The applicant submitted that, in the absence of evidence of actions or conduct of the collector that would indicate to a learned individual that it could disseminate the information, the level of education of the individual must be irrelevant. That is to say education alone cannot be a determinative fact. The AAT's approach not only allows the creation of different categories of personal information (as described above), but also creates different categories of individuals, who, perhaps subject to their education, will either have greater or lesser levels of protection under the Privacy Act. The Privacy Act makes no such distinction, and this finding is contrary to concepts of human rights and privacy for all human individuals that underpin the Privacy Act, and the general concepts of human autonomy and dignity, so submitted the applicant.

Required or authorised by or under law - Questions 10-12, Grounds 19-20 64 The applicant submitted that the AAT was correct to find that s 16 of the OHS Act did not expressly require or authorise DVA to make the Disclosures (Reasons [295]). Having decided this, however, the applicant submitted that the AAT should then have found that, in the absence of an express provision, the Disclosures were "not required or authorised by or under law" and made a finding that the exemption under IPP 11.1(d) did not apply to them. 65 The applicant submitted that the AAT erred in finding that, although the Disclosures were not expressly required or authorised by the OHS Act, the requirement or authorisation "could be implied" (Reasons [296]). The applicant submitted that this is contrary to authority concerning the interpretation of such words in other legislation, contrary to the correct principles of interpretation applicable to remedial or beneficial legislation, and contrary to the context and objects of the Privacy Act. 66 As to the phrase "required by law", the applicant submitted that "required" meant "demands" or "necessitates" (citing Department of Premier and Cabinet v Hulls [1999] 3 VR 331 at [31]) and should not be construed as meaning "need". 67 The applicant submitted that the use or disclosure of personal information is required only where there are express statutory requirements to report matters to agencies or enforcement bodies, or where legislation specifically requires an organisation to carry out some action, which of necessity involves particular uses or disclosures of personal information. The applicant cited Rahman v Ashpole [2007] FCA 1067 (Rahman), where Graham J held that disclosure of personal information by a bank to Centrelink was required or authorised by or under the provisions of the Social Security (Administration) Act 1999 (Cth). It is an offence under s 197(1) of that Act for a person to refuse or fail to comply with a requirement to give information or produce a document as required by ss 192 and 196 of that Act. 68 As to the phrase "authorised by or under law", the applicant submitted that "authorised" permits a discretion as to whether the organisation will engage in an act or practice. He submitted that there must be a specific provision that allows a relevant discretion. A use or disclosure under 11.1(d) applies if the law requires or authorises a function or activity that clearly and directly entails the use or disclosure. He maintained that there is no reason to depart from the ordinary meaning of the term "authorised", which has been found to be "to give someone the power or right to do something" or "to give permission for something", and "sanction, approve, countenance and permit" or "authorise simply refers to the rule which permits the conduct which is otherwise not permitted." 69 The applicant submitted that the AAT was wrong to rely upon Minister for Aboriginal Affairs v Peko-Wallsend Ltd [1986] HCA 40; 162 CLR 24 in support of its construction and findings on authorisation, because that case involved a different statutory scheme. He said that the AAT should have adopted an approach which acknowledged that the Privacy Act was remedial or beneficial legislation, citing Coco at [10]. 70 The applicant submitted that by finding that a requirement or authorisation was to be implied, the AAT overrode his fundamental right and freedom which was protected by the Privacy Act. The AAT also erroneously relied upon the IPP Guidelines in Reasons [259].

Irrelevant considerations - Question 13, Ground 21 71 The applicant did not press question 13 and ground 21.

Application of IPP Guidelines - Question 14, Grounds 22-23 72 The applicant did not press these matters.

The submissions of dva and information commissioner summarised 73 Both DVA and the Information Commissioner provided detailed written outlines of their submissions. It is unnecessary to set them out in what already are lengthy reasons for judgment. The primary submissions are substantially reflected in the reasons given below for dismissing the appeal. We will also address below the role of the Information Commissioner in the appeal in determining the appropriate orders for costs.

(a) The proper approach to construction of the Privacy Act : Grounds 1-2 74 In view of the centrality to the applicant's appeal of whether or not the AAT erred in its approach to the construction of remedial legislation such as the Privacy Act, it is desirable to address that issue immediately. For the reasons that follow, we are not satisfied that the applicant has established that the AAT adopted an erroneous approach. 75 As noted above, the applicant relied heavily on Coco in support of his challenge to the AAT's reasoning and findings concerning both IPP 11.1(a) and (d). In particular, he contended that the following passage from Coco at [10] is critical and describes the approach which the AAT should have taken in construing those IPPs (footnote omitted): 10. The insistence on express authorization of an abrogation or curtailment of a fundamental right, freedom or immunity must be understood as a requirement for some manifestation or indication that the legislature has not only directed its attention to the question of the abrogation or curtailment of such basic rights, freedoms or immunities but has also determined upon abrogation or curtailment of them. The courts should not impute to the legislature an intention to interfere with fundamental rights. Such an intention must be clearly manifested by unmistakable and unambiguous language. General words will rarely be sufficient for that purpose if they do not specifically deal with the question because, in the context in which they appear, they will often be ambiguous on the aspect of interference with fundamental rights (See Chu Kheng Lim v. Minister for Immigration (1992) 176 CLR 1 at 12 per Mason CJ). 76 It is well established that remedial or beneficial legislation should be accorded a "fair, large and liberal interpretation", as opposed to one which is literal or technical (see, for example, IW v City of Perth [1997] HCA 30; 191 CLR 1 at 12). But the matter is more nuanced than is suggested by either that general proposition or the applicant. 77 Subsequent caselaw has properly emphasised the need for caution in applying this canon of construction. For example, in New South Wales Aboriginal Land Council v Minister Administering The Crown Lands Act [2016] HCA 50; 260 CLR 232 the High Court emphasised the importance of understanding the particular issue to which the task of statutory construction relates in any individual case. Their Honours drew a distinction between a situation where a Court is asked to construe a statute where there are choices available in the statute's construction, in which case the choice can be guided by taking a broader approach on the basis of the beneficial purpose of the statute, as opposed to a case where the exercise of statutory construction is focused on the meaning of specific words. Importantly, the High Court said at [32] and [33] (footnotes omitted): 32. It has been said that remedial or beneficial legislation should be accorded a "fair, large and liberal interpretation", rather than one which is literal or technical. At issue in R v Kearney; Ex parte Jurlama was whether a claim could be made under the Aboriginal Land Rights (Northern Territory) Act 1976 (Cth) with respect to land which could only acquire the necessary character of being "traditionally owned" by reference to land which lay outside that which was available to be claimed. Gibbs CJ (with whom Brennan, Deane and Dawson JJ agreed) said: If the section is ambiguous it should in my opinion be given a broad construction, so as to effectuate the beneficial purpose which it is intended to serve. The statute in that case left the question open and provided the Court with choices in its approach to the statute's construction. In such a circumstance the Court was clearly justified in adopting a broader approach on the basis of the beneficial purpose of the statute. 33. That is not the situation which arises with respect to s 36(1) of the ALR Act, where it is the meaning of particular words which is in question. In Victims Compensation Fund Corporation v Brown it was pointed out that to commence the process of construction by posing the type of construction to be afforded - liberal, broad or narrow - may obscure the essential question regarding the meaning of the words used. It is one thing to say that no restricted construction should be given to legislation which confers benefits; but if the focus is on the meaning of specific words, the circumstance for a liberal application may not arise. 78 Observations to similar effect had previously been made by Hayne, Heydon, Crennan and Kiefel JJ in Minister Administering The Crown Lands Act v NSW Aboriginal Land Council [2008] HCA 48; 237 CLR 285 at [47]-[48]. These observations are directly applicable in the circumstances here where the Court is required to construe the meaning of specific words in IPP 11.1(a) and (d). 79 There are additional reasons for caution in applying the statements of principle in Coco at [10] to the different circumstances here. At the heart of that case was a statutory provision which provided, in effect, an immunity from the offence of using a listening device to record or listen to a private conversation (s 43(1) of the Invasion of Privacy Act 1971 (Qld)). The immunity was given to a member of the police force acting in the performance of his or her duty if the member "has been authorised in writing to use a listening device" by various specified persons and subject to an overriding approval by a Judge of the Supreme Court (s 43(2)(c)). 80 The issue was whether s 43(2)(c) of that Act conferred authority on a Supreme Court Judge to authorise entry onto premises to install and maintain a listening device in circumstances where that entry would otherwise constitute an unlawful trespass. At [8], the High Court plurality (Mason CJ, Brennan, Gaudron and McHugh JJ) described the right of a person in possession of premises to exclude others from the premises as "a fundamental common law right". Their Honours then added, with reference to caselaw, that statutory authority to engage in what otherwise would be tortious conduct "must be clearly expressed in unmistakable and unambiguous language". 81 It is in that context that the plurality in Coco then stated the general principles at [10] which are set out at [75] above. 82 It may be accepted that the Privacy Act is remedial or beneficial legislation and should, in general, be construed liberally but with close attention to the relevant statutory terms which require interpretation. We reject the applicant's submission, however, that the statutory context and relevant circumstances here are similar to those in Coco. That is for the following reasons. 83 First, as the applicant's counsel acknowledged in oral address, there is no common law right to privacy in Australia. 84 Secondly, the personal information which is the subject of these proceedings was not obtained or collected by DVA in circumstances which otherwise would have constituted a trespass or given rise to some other cause of action in tort. 85 Thirdly, the Privacy Act itself reflects the Parliament's concern to recognise and protect individual privacy within the framework of a complex statutory regime. It does so by a series of statutory provisions which protect the privacy of individuals from unlawful or arbitrary interference but also by specifying circumstances (or "exceptions") which reflect the Parliament's concern to strike an appropriate balance between competing community interests. We accept the Information Commissioner's submission that, in those circumstances, the exceptions should be interpreted carefully so as to preserve the balance which the legislation strikes between the competing community interests, noting also the relevance of the fact that Art 17(1) ICCPR is not expressed in unqualified terms. It does not confer an absolute "right to privacy", but rather creates a right not to be subjected to arbitrary or unlawful interference with one's privacy. The exceptions in the Privacy Act reflect the Parliament's identification of circumstances in which interference with a person's privacy is not arbitrary or unlawful. 86 In our respectful view, further helpful guidance as to the correct approach in construing IPP 11.1(a) and (d) is reflected in the following observations of Burchett J in Commonwealth of Australia v Human Rights and Equal Opportunity Commission [1998] FCA 3; 76 FCR 513 (HREOC Case) at 520 to 521 in respect of the proper construction of disability discrimination legislation (emphasis in original): The Commissioner and the judge at first instance sought support for narrow readings of the exemption contained in s 15(4) in the rule that remedial legislation should be liberally construed, a rule which does apply to human rights legislation and reinforces the statutory objects "to eliminate, as far as possible, discrimination" in the respects mentioned in s 3 of the Disability Discrimination Act: IW v City of Perth (1997) 71 ALJR 943; 146 ALR 696 at 948; 702; Waters v Public Transport Corporation (1991) 173 CLR 349 at 359, 394; and see s 15AA(1) of the Acts Interpretation Act 1901 (Cth). But such a rule, as Cardozo J pointed out in Burnet, Commissioner of Internal Revenue v Guggenheim (1933) 288 US 280 at 286, must be applied with a watchful eye. Sometimes the construction which is liberal to one person may be illiberal to others. Where remedial legislation contains exemptions designed to strike a careful and practical balance between competing community interests, a Court which distorts that balance in the name of furthering the remedy risks usurping a political role, and in doing so, frustrating the will of Parliament. The Disability Discrimination Act was intended to relieve the deprivation and humiliation that too often accompany misfortune, but not at the cost of creating further misfortune. A line was drawn at s 15(4) to protect, at least, employers and fellow employees who might be affected by a disabled person's inability to carry out the inherent requirements of an employment. The legislative choice as regards where that line was to be drawn must be respected: cf Arnold v Queensland (1987) 6 AAR 463; 73 ALR 607 at 464; 608, 481-483; 626-627. 87 A similar approach was adopted by Sackville J in Taciak v Commissioner of Australian Federal Police [1995] FCA 650; 59 FCR 285 (Taciak) at 299 when his Honour made the following obiter remarks concerning the proper construction of Telecommunications (Interception) Act 1979 (Cth) which established statutory safeguards which were designed to ensure that intercept information could be used only for specified permitted purposes: The recognition and protection of privacy in the Interception Act, in my view, justifies a restrictive approach to the construction of the statutory exceptions to the prohibitions on the interception of telecommunications and on the use of lawfully obtained intercept information. There is room for argument as to whether the principle of construction articulated in Coco v The Queen should be applied, with all its rigour, to the definition of "permitted purpose" in the Interception Act. But where there is genuine doubt as to whether the statutory language authorises the use of intercept information for a particular purpose, that doubt should be resolved in favour of a narrow, rather than a broad construction of the statutory authorisation. It is perhaps unnecessary to add that, should a policy judgment be made that the ability to use intercept information for appointments or reappointments to the AFP outweigh the value of privacy, it is open to Parliament to amend the legislation to give effect to that judgment. 88 It may be accepted that, as a statement of general principle, legislation such as the Privacy Act should, as far as the statutory language permits, be construed so as to give effect to Australia's international obligations (see, for example, NBGM v Minister for Immigration and Multicultural Affairs [2006] HCA 54; 231 CLR 52 at [61] per Callinan, Heydon and Crennan JJ and Minister for Immigration and Multicultural and Indigenous Affairs v QAAH of 2004 [2006] HCA 53; 231 CLR 1 at [34] per Gummow ACJ, Callinan, Heydon and Crennan JJ). But the words of qualification which are set out immediately above are critical. 89 As will shortly emerge with reference to each of the remaining grounds of appeal which are pressed by the applicant, we do not consider that the AAT erred in its construction of any of the relevant provisions of the Privacy Act. For the reasons given above, we reject grounds 1 and 2, which relate specifically to the correctness of the AAT's approach to statutory construction. In particular, the AAT did not err when it stated in the Reasons at [287] that the exceptions in the IPPs "should be given their ordinary meaning and neither read restrictively nor expansively". The legislation itself reflects the Parliament's balancing of competing interests. The AAT also correctly noted that the legislation did not confer a right to privacy as such. 90 It is true that the AAT did not descend into a more detailed analysis of caselaw of the kind set out above concerning the construction of remedial or beneficial legislation. The applicant has not demonstrated, however, that the AAT erred by not applying the approach in Coco. Incidentally, it is notable that the AAT made no express reference to Coco in its reasons for decision. It is unclear whether or not the AAT's attention was drawn to that case. In any event, for the reasons given above, Coco is distinguishable. 91 We turn now to consider each of the more specific grounds of appeal while noting that some of them overlap with grounds 1 and 2. It is convenient to group some of the grounds more broadly than in the section of the reasons for judgment above in which the applicant's submissions are summarised. It is also convenient to deal separately with the grounds of appeal relating to IPP 11.1(a) from those relating to IPP 11.1(d).

(i) Contextual interpretation (Grounds 3-4) 92 The applicant's contention that the AAT erred in failing properly to consider "the paramount importance placed on the protection of the individual's privacy by the provisions of the Act" must be rejected. While accepting the remedial character of the Privacy Act, it is wrong to suggest that the legislation gives "paramount importance" to protecting the individual's privacy. Rather, as emphasised above, the legislation strikes a balance, as drawn by the Parliament, between protecting privacy and authorising conduct in the broader community interest as exceptions to protection of individual interests. 93 Insofar as the applicant's complaint that the AAT failed to apply a contextual approach relates to the AAT's construction of the phrases in IPP 11.1(a) concerning whether information is "usually passed on" and the individual's awareness of that matter, this is addressed under sub-headings (iii) and (iv) respectively below.

(ii) Characterisation of the "kind" of information disclosed (Grounds 5-6) 94 Contrary to the applicant's submission, we do not consider that the AAT erred in first characterising the "kind" of information that was disclosed by DVA and then considering whether information of that kind was usually passed on to the entities to which it was passed. This approach is supported by the text of IPP 11.1(a), which directs attention to the question whether the complainant (i.e. "the individual concerned") is reasonably likely to have been aware, or has been made aware under IPP 2, that "information of that kind" (being information of the kind that was actually disclosed), is usually passed on to that other entity. 95 The chapeau to IPP 11.1 makes express reference to "personal information" which is in the possession or control of a record-keeper and prohibits the record-keeper from disclosing that information to anyone other than the individual to whom the personal information relates unless one of the exceptions applies. One of those exceptions is that which is contained in IPP 11.1(a). That exception operates by reference to whether the individual concerned is reasonably likely to have been aware, or made aware under IPP 2, that information of the kind is usually passed to that other person or entity. It makes obvious sense to first identify and determine whether the relevant information is information of the "kind", before focusing upon the individual's state of awareness. That is the approach which was taken by the AAT and the applicant has failed to demonstrate that it was wrong. The applicant's submission that it is impermissible to categorise personal information other than into existing categories recognised by the Privacy Act (that being personal information and the subcategory of sensitive information) is at odds with the clear words of IPP 11.1(a), which requires a determination of whether information is of the "kind" which is usually passed to those to whom the disclosure was made. 96 The AAT did not err when it gave the ordinary meaning to the word "usually" in IPP 11.1(a) as meaning the kind of personal information that would customarily or ordinarily be passed on and that this test may be satisfied even if personal information of that kind only rarely comes into the custody of the record-keeper. 97 It is difficult to understand the applicant's criticism of the AAT for referring to cl 3(a) of the OECD Guidelines in its construction of IPP 11.1(a). As the AAT stated in Reasons [237], both the ICCPR and the OECD Guidelines are referred to in the Preamble to the Privacy Act. Accordingly, those materials form part of the context within which the legislation is to be construed. That is the case even if there is no ambiguity in the legislation. As Brennan CJ, Dawson, Toohey and Gummow JJ stated in CIC Insurance Ltd v Bankstown Football Club Ltd [1997] HCA 2; 187 CLR 384 at 408, the modern approach to statutory interpretation "insists that the context be considered in the first instance, not merely at some later stage when ambiguity might be thought to arise". The applicant's reliance on Saeed at [33] is misconceived. That passage addresses a different issue and, in any event, their Honours made clear in [34] that extrinsic materials may be relied upon to ascertain the context within which a particular provision was enacted. 98 The applicant seizes upon the fact that in Reasons [237] the AAT stated that it was at liberty to have regard to those materials "to resolve any ambiguity I find", citing Yager v The Queen [1977] HCA 10; 139 CLR 28 at 43-44 per Mason J (with whom Stephen J agreed). 99 Despite the AAT's express reference to the term "ambiguity" in Reasons [237], it is evident from surrounding paragraphs in the Reasons that the AAT was addressing the tension which it found between the legitimate use which could be made of personal information and the objective of protecting personal privacy. That is made clear in Reasons [238]. 100 It is in the context of resolving that identified tension that the AAT referred inter alia to cl 3 of the OECD Guidelines. That particular provision is set out in Reasons [242]. In defining the scope of the OECD Guidelines, cl 3(a) provides that the Guidelines should not be interpreted as preventing "the application, to different categories of personal data, of different protective measures depending upon their nature and the context in which they are collected, stored, processed or disseminated". 101 The AAT described cl 3(a) of the OECD Guidelines as being consistent with a construction of IPP 11.1(a) which requires "an initial categorisation" of personal information that has been passed by reference to its "kind" and a determination as to whether it "would usually be passed on". In particular, the AAT found that there is nothing in cl 3(a) (and the OECD Guidelines more generally) which suggests that categorisation of personal information is limited to that which is "regularly passed on", as opposed to what is "customarily or ordinarily passed on", whether that event occurs frequently or infrequently. The AAT did not fall into appealable error in referring to the OECD Guidelines in this way. The OECD Guidelines formed part of the relevant historical context, as is made explicitly clear in the Preamble to the Privacy Act.

(iii) Whether information of that kind is "usually" passed on (Grounds 7-10, 13-14, 16) 102 The applicant challenges the AAT's conclusion that the term "usually" means "ordinarily" or "normally", and not "frequently". 103 As noted above, no error has been established in the AAT's view that the term "usually" should be given its ordinary meaning and that this means "customarily" or "ordinarily". This conclusion was supported by dictionary definitions which are set out in Reasons [233], the provisions as a whole, and the purpose of the Privacy Act as informed by relevant extrinsic materials which are referred to in the Preamble. We accept the submission by DVA that the AAT's preferred construction better accords with the objects of the legislation and strikes an appropriate balance between protecting individual privacy while allowing the business of government to continue by creating exceptions which reflect broader community interests. 104 As is made clear in Reasons [236], the AAT plainly appreciated that even if this preferred construction was given to the phrase "usually passed to", this would not have the effect of giving an unduly wide construction to IPP 11.1(a), because its operation also turned on a second step, namely that the individual concerned is reasonably likely to have been aware that information of that kind is usually passed on. 105 The AAT added that relevant evidence bearing upon this matter may relate to considerations such as the ways in which an individual could have become aware that information of that kind is usually passed on or might relate to the particular knowledge possessed by the relevant individual. It was not incorrect of the AAT to note at the end of Reasons [236] that it may be more difficult to satisfy this second step if the case involved personal information of a kind that is passed to another person or entity only occasionally. 106 We read the relevant parts of the AAT's reasons for decision, including its references to and reliance upon extrinsic materials in Reasons [237], as justifying a construction of IPP 11.1(a) which permits some flexibility in categorising personal information so as to give effect to the balance which is struck between protecting individual privacy and not preventing disclosure as authorised by the exceptions. 107 The AAT's construction is supported not only by considerations of text, context and purpose, but also by common sense. That includes the fact that some kinds of information will be regularly or routinely collected by agencies and frequently passed on. But there will be other kinds of personal information which only comes into an agency's possession occasionally or rarely but that information may still customarily or ordinarily be passed on. 108 We reject the applicant's submission that there was no evidence to support the AAT's finding that disclosure of the information in Disclosures 1, 2 and 3 was customary or ordinary practice. As the AAT stated at Reasons [262], after noting the relationship between DVA and the Department of Defence and the ADF's role in the applicant's clinical healthcare, it would be "a normal or ordinary thing for a Commonwealth agency in the position of DVA to pass information to those engaged in, or responsible for, [the applicant's] medical care and treatment". This finding was reasonably open to be made by reference to that relationship and the ADF's role. 109 No further evidence was required to support the AAT's finding that the first two Disclosures were of information of a kind that is usually passed on to a person such as the ADF Senior Medical Officer and the Head of Joint Health Command in the Department of Defence. 110 Nor did the AAT err in finding at Reasons [263] that these disclosures were a necessary part of a process that enabled DVA to fulfil its statutory responsibilities under s 16 of the OHS Act and that, accordingly, the Disclosures involved information of a kind that is usually passed on to the persons who received that information here. There was ample evidence to support the AAT's findings with regard to s 16 of the OHS Act, not the least being the multiple communications emanating from the applicant which gave rise to concerns about the health and safety of DVA employees (as well as the applicant himself). 111 No appealable error has been demonstrated in the AAT's reasoning to the effect that, putting s 16 of the OHS Act to one side, and focusing upon the information which was the subject of Disclosures 1 and 2 by reference to a concern regarding the applicant's own healthcare, it was usual for an agency such as DVA who had such concerns to convey them to the Department of Defence as the body with responsibility for the applicant's wellbeing and healthcare. The AAT's finding was sufficiently supported by the materials to which it referred, namely: (a) the relationship between DVA and the Department of Defence; (b) the uncontested fact that the ADF was providing the applicant's clinical healthcare; and (c) the ordinary concern for another fellow human being by relevant personnel within DVA which suggested that, in the circumstances of this case, it was usual to pass on information of the relevant kind as an aspect of ordinary common sense and experience. 112 As to Disclosure 3, we consider that it was also reasonably open to the AAT to find that it was usual for an entity, such as DVA, which had good reason to believe that a member of the ADF was behaving irresponsibly, and possibly criminally, to draw the attention of the Chief of Air Force to that conduct. The applicant's multiple emails and other communications provided ample justification for a concern that he may have contravened s 60 of the DFD Act. Having regard to the content of the applicant's communications, a sample of which is summarised in [20]-[26] above, it was well open to the AAT to conclude at Reasons [265] and [266] that it was reasonable for DVA to consider that the applicant was bringing discredit on the ADF within the meaning of s 60 of the DFD Act and so possibly committing an offence. The AAT made express reference to some of those communications in Reasons [273]. No further evidence was required to support the AAT's finding that Disclosure 3 related to information of a kind that is usually passed on to a person such as the Chief of Air Force. 113 At Reasons [275], the AAT stated that it was appropriate for a Commonwealth agency to tell another agency that an employee of the latter agency may be committing an offence as long as there were sound reasons for coming to the view that the person may have engaged in criminal conduct. No appealable error has been established in respect of the AAT's reasoning in relation to this aspect of Disclosure 3. 114 The applicant was critical of the fact that the AAT took into account his own evidence on these matters in circumstances where there was, for example, no evidence before DVA concerning his level of education. This criticism fundamentally misconceives the nature of the AAT's review under s 96(1)(c) of the Privacy Act. In determining what was the correct or preferable decision, the AAT was not confined to the material which was before DVA. The AAT was entitled to take into account the material which was before it in discharging its statutory review function. The applicant's misconception is evident, for example, in [48] and [49] of his written reply submissions.

(iv) What the individual concerned is "reasonably likely to have been aware" of (Grounds 11-12, 14-18) 115 We reject the applicant's contention that the AAT erred, in applying IPP 11.1(a) with reference to the applicant's subjective knowledge, education and other personal characteristics. As noted above, the applicant's contention was that the AAT was required to apply an objective standard. 116 The applicant's position is inconsistent with the plain text of IPP 11.1(a), which explicitly focuses upon what "the individual concerned" is reasonably likely to be aware of. In the circumstances of this particular case, this can only be a reference to the applicant himself. This exception turns on what the applicant was reasonably likely to be aware of and not what a hypothetical reasonable person was likely to be aware of. The relevant circumstances include the particular characteristics of the individual concerned insofar as they were known to DVA. 117 As to the meaning of the phrase "reasonably likely" in the context of this exception, the AAT correctly appreciated that this required a judgment "as to whether it is reasonable, as distinct from something that is irrational, absurd or ridiculous" to expect that the applicant would probably have been aware that the relevant information is usually passed on. The applicant did not contend that the AAT fell into error in the meaning it gave to the phrase "reasonably likely". Rather, he challenged the matters which the AAT took into account in concluding at Reasons [277] that it was reasonably likely that a person in the applicant's circumstances would have been aware that DVA would pass on the information in the Disclosures and to the persons to whom that information was passed. 118 In our view, the AAT did not err in taking into account the applicant's education, background, experience and own behaviour in concluding that a person in his position would be reasonably likely to be aware that it was usual (in the relevant sense) for information of the kind contained in the Disclosures here to be passed on to the people to whom the Disclosures were made in the particular circumstances here. Not only were those findings consistent with common sense, they were amply supported by the evidence before the AAT. This included material in the affidavit dated 23 April 2015 of Ms Jennifer Collins, as well as other evidence before the AAT concerning the applicant's personal qualifications and characteristics, including the applicant's own evidence on these matters. It was open to the AAT to draw reasonable inferences from these matters, which it did. 119 We further reject the applicant's claim that OHS Act and DFD Act are only relevant if the applicant was reasonably likely to have been aware that provisions in those Acts might require DVA to make the Disclosures. As stated at [110] and [112] and above, the AAT did not err in finding that the OHS Act and DFD Act were relevant to determining whether information of the kind was "usually" disclosed to the relevant recipient. On the proper construction of IPP 11.1(a), that exception is satisfied if the applicant is reasonably likely to have been aware that, in the ordinary course of events, information of that kind is usually disclosed to the relevant recipient. There is no additional requirement that the applicant be reasonably likely to have been aware of specific statutory provisions. 120 We accept DVA's submission that the AAT's approach was correct. In substance, this involved taking into account the relevant personal characteristics of the individual concerned which were known to the decision-maker and then asking what that individual, as a matter of reason and awareness, was reasonably likely to have been aware of or had been made aware of by operation of IPP 2. 121 For these reasons, as well as those stated at [108]-[109] and [112] above, we reject the applicant's submission that the AAT should have found that there was no evidence that information contained in the Disclosures were usually passed to the relevant recipients of the information here.

(c) IPP 11.1(d): Grounds 19-20 122 The applicant's challenges to the AAT's approach and findings in respect of IPP 11.1(d) should also be rejected. 123 In particular, we reject his submission that this exception should be read narrowly so as to apply only to disclosures which are explicitly required or authorised by law. This construction is inconsistent with the text of the provision, which includes the phrase "by or under". Such language indicates that there is scope for disclosures to be directly provided for by a law, as well as those which are done under a law. 124 Furthermore, the applicant's preferred construction is not supported by his reliance on Coco or the principle of legality. That is because the exception contained in IPP 11.1(d) is an express carve-out from the general protection created by IPP 11.1. In addition, the exception in IPP 11.1(d) does not encroach upon an established common law right so as to attract the principle of legality. Rather, as emphasised above, it constitutes a statutory exception to a statutory right created by the Privacy Act itself. 125 It is also important not to lose sight of the fact that the Privacy Act has a breadth of operation which potentially covers a wide spectrum of laws. They include laws which, in their terms, require or authorise the production of records or the provision of information, such as compliance with a subpoena or other statutory requirements to provide information in response to a statutory notice, such as in ss 192 and 196 of the Social Security (Administration) Act 1999 (Cth), as considered in Rahman. But a requirement or authorisation to divulge personal information may also arise by necessary implication from a law that is directed to a purpose other than the disclosure of records or information. 126 The AAT found that s 16 of the OHS Act implicitly required or authorised disclosure. Its reasoning in Reasons [300], [301] and [308] is to the effect that it was necessary to draw such an implication in order to give effect to the statutory scheme of that legislation or, to put it another way, where the inability to disclose personal information would frustrate the operation of that scheme. An employer's obligation under that provision involves a mandatory command that the employer take all reasonably practicable steps to protect the health and safety at work of the employer's employees. As DVA pointed out, it is easy to imagine circumstances where such "reasonably practicable steps" would include the disclosure of personal information, including disclosing an employee's allergies or food intolerances to the convenor of a course which the employee will attend as part of his or her work duties. Similarly, here, disclosure of the relevant information was a "reasonably practicable step" in protecting the health and safety of DVA's employees as part of a process which involved advice being sought which would inform an appropriate assessment of the risk to those employees. 127 We reject the applicant's submission that reliance on s 16 must take into account the availability of other measures which were available to DVA. That submission is inconsistent with the text of s 16, which imposes a statutory obligation on an employer to take all reasonably practicable steps. 128 We also reject the applicant's submission that the AAT erred in its view that s 16 of the OHS Act authorised Disclosures 1 and 2 where there was a perceived risk of harm to DVA's employees in circumstances where there is an express exception in IPP 11.1(c) which deals with disclosure being necessary "to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person" (see [17] above). The applicant's contention appeared to assume that the five exceptions in IPP 11.1 were mutually exclusive. We reject that submission. The exceptions could overlap. In any event, the circumstances which might require an employer to make a disclosure under s 16 of the OHS Act may go beyond the more limited circumstances which underpin the exception in IPP 11.1(c). For example, the obligation under s 16 may be enlivened even if there is a threat to the health of an employee notwithstanding that the employer may not believe on reasonable grounds that the disclosure is necessary to prevent or lessen "a serious and imminent threat" to the life or health of one of its employees. 129 We accept the submission of the Information Commissioner that the exception in IPP 11.1(d) does not extend to authorise any disclosure that is merely incidental, convenient or conducive to the fulfilment of some other statutory obligation. Such an approach would give rise to an unduly wide exception. The critical factor is the necessity of drawing the relevant implication in order to give effect to the statutory scheme or, alternatively, to avoid frustrating the statutory scheme.

Costs 130 The applicant has failed to establish any of the grounds of appeal. Of course, costs ordinarily follow the event but we do not consider that it is appropriate that the applicant has to pay the costs of both DVA and the Information Commissioner. DVA is the proper contradictor. The Information Commissioner determined that it was appropriate to make submissions, both in writing and orally, concerning inter alia the proper construction of relevant provisions of the Privacy Act and IPP 11.1(a) and (d). They included lengthy submissions concerning the proper construction of remedial or beneficial legislation, which was also addressed by DVA. We do not accept the Information Commissioner's submission that his participation did not add significantly to the applicant's costs. The Information Commissioner's outline of written submissions totalled 15 pages and his oral address took up more time than that of DVA. 131 We acknowledge that the Information Commissioner was joined as a party in the AAT proceeding, as well as in the appeal. It was a matter for the Information Commissioner to decide what role he would play in the appeal, having regard to the well-known relevant observations in R v Australian Broadcasting Tribunal; Ex parte Hardiman [1980] HCA 13; 144 CLR 13. That does not mean, however, that the applicant should bear the costs of both respondents in the particular circumstances here. At a case management hearing on 26 April 2018, the Information Commissioner's then counsel said that, while the Commissioner intended to make submissions which "may be generally more directed at matters for policy and procedure", he did not "expect to take a more active role than the department…". In fact, as noted above, the Information Commissioner took up as much, if not more, time in his submissions than did DVA. Furthermore, the Information Commissioner went beyond making submissions on "policy and procedure". For example, he made detailed submissions on the proper construction of s 16 of the OHS Act. 132 In our respectful view, the Information Commissioner should bear his own costs, however, the applicant should pay DVA's costs, as agreed or assessed.

Conclusion 133 For these reasons the appeal should be dismissed. The applicant must pay the second respondent's costs, as agreed or assessed. I certify that the preceding one hundred and thirty-three (133) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justices Logan, Griffiths and Farrell.

Privacy Amendment (Enhancing Privacy Protection) Act 2012(Cth)

ion) Act 2012 (Cth) Social Security (Administration) Act 1999 (Cth), ss 192, 196, 197(1)) Telecommunications (Interception) Act 1979(Cth)

Telecommunications (Interception) Act 1979(Cth)

and Secretary, Department of Veterans' Affairs (Party Joined) [2015] AATA 112 Saeed v Minister for Immigration and Citizenship [2010] HCA 23; 241 CLR 252 SZTAL v Minister for Immigration and Border Protection [2017] HCA 34; 91 ALJR 936 Taciak v Commissioner of Australian Federal Police [1995] FCA 650; 59 FCR 285

1 This appeal is from a decision of the Administrative Appeals Tribunal (AAT) which is reported as TYGJ and Information Commissioner [2017] AATA 1560. The appeal is brought under s 44 of the Administrative Appeals Tribunal Act 1975 (Cth) (the AAT Act). 2 The appeal raises issues concerning the proper construction of the Privacy Act 1988 (Cth) (Privacy Act) and several Information Privacy Principles (IPPs). The appeal involves the Court's original jurisdiction.

At a glance

Court

Decision date

Before

Source

Judgment (20 paragraphs)

Parties

Legislation Cited (12)

Cases Cited (22)

Cited By (4)