Before the assessor
13 On 12 March 2014, the then Secretary of the Department wrote to the appellant (along with other persons affected) advising of the Data Breach, as referred to above.
14 On 17 March 2014, the appellant applied to the Federal Circuit Court of Australia for an order that the Minister, the Tribunal and the assessor show cause why a constitutional writ should not issue based on the Data Breach. At that time, an injunction was also sought preventing her removal from Australia.
15 On 25 June 2014, an officer of the Department wrote to the appellant, referring to the Secretary's Data Breach notification letter of 12 March 2014 and also to the application for judicial review filed in the Federal Circuit Court. The letter invited the appellant, if she had any particular concerns about the impact of the Data Breach on her ability to return to her home country or country of usual residence, to provide specific reasons for, and details of, those concerns within 14 days. The appellant responded in writing, referring to the Data Breach and the impossibility of knowing who had accessed her information, and therefore who she could face a real risk of harm from, as it "may go well below the authorities, insurgents and paramilitaries in my home country, including foreign security and intelligence agencies". The appellant's letter further stated that the 14-day period in which to respond was unreasonable, given the lack of assistance she said was available to her to prepare a response, and seeking that such assistance be made available through a migration agent or lawyer.
16 On 30 June 2014, the appellant's solicitor wrote to the Department, again responding to the 25 June 2014 letter, and asserted a right to receive more details as to who had been able to access the appellant's personal information, as well as asserting a conflict of interest in having an officer of the Department conduct the ITOA. The letter enclosed the appellant's certificate of marriage to her fiancé, who was also said to be a victim of the Data Breach. A follow-up letter from the appellant's solicitor dated 8 July 2014 advised that she also sought to rely upon claims that she made in her original protection visa application to the Department, as well as in her application for review to the Tribunal.
17 On 14 January 2015, an officer of the Department wrote to the appellant advising that the Department had that day commenced an ITOA. The letter sought any further information in relation to the ITOA process within 14 days.
18 On 19 January 2015, the appellant's solicitor responded in writing to the Department's 14 January 2015 letter regarding the ITOA. That letter sought more detailed information about the Data Breach and again asserted that an impartial ITOA process could not be carried out by an officer of the Department, by reason of a conflict of interest arising from the Department being responsible for that breach occurring in the first place.
19 On 16 February 2015, the assessor sent a further letter to the appellant, as well as a copy to her solicitors, which enclosed information said to be relevant to the ITOA and inviting comment. The attachment outlined the objections that were contained in the letters sent by the appellant's solicitors on 30 June 2014 and 19 January 2015. The attachment addressed the issues of procedural fairness, conflict of interest, prior protection visa claims, the Data Breach "incident" and country information relating to departures from China and the treatment of failed asylum seekers upon returning to China. The attachment to the assessor's letter gave notice of the "adverse inferences" which could be drawn on the available information. This included a prediction to the effect that other than being briefly detained for questioning regarding her absence from China and her reasons for remaining in Australia, there was no real chance that she would be subjected to serious harm amounting to persecution, nor a real risk of significant harm.
20 On 17 February 2015, the appellant's solicitor responded to the Department's 16 February 2015 letter and attachment, pointing out that reference had not been made to the fact that the appellant was "now married to a Sri Lankan national who has an adverse ASIO finding and how this would affect [her] and may even expand her own protection claims against Sri Lanka and the foreign agencies that have an adverse interest in her husband". The solicitor's letter substantially repeated the complaints about the ITOA process, asserting that assumptions made about what access had been obtained was "speculation only", that the Department could not effectively and fairly assess whether non-refoulement obligations are engaged and that to do so was still a denial of procedural fairness. The solicitor's letter quoted from a single judge decision of this Court about the perceived inadequacies of the ITOA process, which has now been superseded by the High Court's decision in SZSSJ, and again sought further details about the Data Breach.
21 The ITOA conducted by the assessor was concluded on 9 April 2015, with a finding that non-refoulement obligations were not engaged in the appellant's case. Detailed reasons were supplied for that conclusion, sent under cover of a letter advising of the decision that had been made. Those reasons included a summary of the adverse information put to the appellant and the response provided on her behalf. The summary of the response was as follows, including footnotes:
On 17 February 2015, the claimant's representative responded to the concerns raised in the departmental letter.
The claimant's representative states that:
• Without access to the information held by the department, 'all assumptions and claims made are speculation only. To assume that only the home country has accessed the information is casting too narrow field in speculation as to who has accessed, saved, copied and sent on and received the information and as to who could harm the applicant' and 'the assumption that case officers are to accept that the home country has had access to the information then assess the applicant's claims against the country information is a flawed assumption to make, particularly as the country information does not deal with the scenario of a foreign government placing the names and details of asylum seekers held in its immigration detention facilities on the world wide web, breaching the migration Act, asylum seekers' confidentiality and international human rights obligations … the department cannot effectively assess the real chance of serious or significant harm that it has placed the applicant in and should find the applicant is now a refugee sur place'.
• An employee of the department which has 'breached the confidentiality of the applicant, who has not been granted access to the information held by the department, cannot effectively and fairly assess whether disclosing of the applicant's name and details on the world wide web the non refoulement obligations are engaged … it is still a denial of procedural fairness…".
• In relation to the KPMG Report, '… no-one knows how many times the information was copied, saved, stored and sent on. This information has now been stored by unknown persons/organisations and can be accessed for eternity and the harm caused to the applicant is not only immediate but for the rest of the applicant's life …'.
• Due to Australia's privacy laws, the 'only remedy open to the OAIC18 is to award compensation'. DIBP cannot 'investigate and decide whether the crime…committed has caused harm to the victims, or not'.
• By the department not disclosing 'the information to the applicant then the only assumption that can be made is that the department is hiding something adverse to its own interests'.
• The non-refoulement obligations are engaged by the data breach incident and 'the only task is to assess whether the country information indicates that the home country has a record of human rights violations and if so, the applicant is a refugee sur place'.19
It was also submitted that the departmental letter of 16 February 2015 did not refer to the fact that the claimant is married to a Sri Lankan national who has an adverse ASIO finding and that she is pregnant. When asked whether she had any concerns relevant to Australia's non-refoulement obligations assessed in this ITAO [sic],20 the claimant's representative submitted that if returned to China Ms LAI would be alone as her husband and their child would not be allowed to reside in China according to Chinese laws.21 It is submitted that according to ICCPR and the Convention of the Rights of the Child 'the family is the most important unit in society and should be protected and children should be with their parents'.
18 Office of the Australian Information Commissioner
19 Departmental file CLD2015/3456303
20 Departmental file CLD2015/3650842
21 Departmental file CLD2015/3650884
22 The last passage quoted above was taken from an email sent on behalf of the appellant on 20 February 2015, being part of the material referenced at footnote 21. That email was not before the primary judge but should have been. It was added to the appeal papers as an exhibit by consent. There was no problem with this as the substance of the email had already been referred to.
23 More generally, the last paragraph reproduced above at [21] refers to the passage in the 17 February 2015 letter, also quoted at [20] above, advising that the appellant was "now married to a Sri Lankan national who has an adverse ASIO finding and how this would affect [her] and may even expand her own protection claims against Sri Lanka and the foreign agencies that have an adverse interest in her husband".