Disclosure
13 Sections 18 and 19 Act of the PIPPA Act provide -
18 Limits on disclosure of personal information
(1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or
(b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
(2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
19 Special restrictions on disclosure of personal information
(1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person.
(2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless:
(a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction or applies to that Commonwealth agency, or
(b) the disclosure is permitted under a privacy code of practice.
(3) For the purposes of subsection (2), a relevant privacy law means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned.
(4) The Privacy Commissioner is to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales and to Commonwealth agencies.
(5) Subsection (2) does not apply:
(a) until after the first anniversary of the commencement of this section, or
(b) until a code referred to in subsection (4) is made,
whichever is the later.
14There is no dispute that at the time of the alleged disclosure and use of Ms Bevege's personal information the Privacy Commissioner had not prepared a code authorised by s 119(4). As a consequence, the effect of the curiously worded ss (5) was that s 119(2) did not apply, because a code relating to extra-territorial disclosure had not yet been made. This absence of a code is a matter that the Privacy Commissioner has now taken steps to address.
15The same situation prevailed at the time the decision in GQ v NSW Department of Education and Training (No 2) [2008] NSWADT 319 was made. There the personal information concerned a debt owed by a teacher to a NSW School, the fact of which had been communicated in a telephone conversation between the principal of that school and the principal of a Victorian school, at which the teacher was then working. Handley DP identified the issue to be determined as whether, "the PPIP Act applies to trans-border disclosures of information." The only submissions before him were those advanced by the Privacy Commissioner, whose submissions, at that time, were substantially accepted by the Tribunal. Those submissions are at odds with those now made by the Privacy Commissioner.
16 The Tribunal first found that s 18(1) and s 19(2) of the PIPPA Act contained inconsistent provisions -
14 I am satisfied, in this instance, that section 18(1) is a general provision limiting the disclosure of personal information, whereas section 19(2) is a specific provision dealing with disclosure of personal information to a person or body outside NSW. The effect of the application of the generalia specialibus presumption, there being no indication that the presumption should not be applied, is that the specific provision - section 19(2) - prevails to the extent of any repugnancy with the general provision - section 18(1). Thus, section 18(1) does not apply in respect of the disclosure of personal information by a public sector agency in NSW, such as the Department, to any person or body in a jurisdiction outside NSW or to a Commonwealth agency.
15 The fact that pursuant to section 19(5), section 19(2) has not come into operation, as Ms Morris explained, does not, in my view, affect this reasoning. Ms Morris stated that it is open to the Privacy Commissioner to prepare a privacy code of practice regulating the disclosure of personal information by public sector agencies to persons or bodies outside NSW, and permitting disclosures, for example, in circumstances similar to those set out in paragraphs (a) to (c) of section 18(1). I note that section 29(4) specifically recognises that "[a] privacy code of practice may also provide for the disclosure of personal information to persons or bodies outside New South Wales". I also note that section 19(4) appears to impose an obligation on the Privacy Commissioner to prepare such a code. However, the fact that this has not yet happened, despite the passage of over nine years since section 19(1) took effect, does not mean that section 19(5) no longer applies.
16 In support of her submission that section 18(1) does not apply to disclosures of personal information outside NSW, Ms Morris also referred to the presumption that legislation is not intended to have extra-territorial effect. In Jumbunna Coal Mine No Liability v Victorian Coal Miners' Association (1908) 6 CLR 309, at 363, O'Connor J said:
"In the interpretation of general words in a Statute there is always a presumption that the legislature does not intend to exceed its jurisdiction. Most Statutes, if their general words were taken literally in their widest sense, would apply to the whole world, but they are always read as being prima facie restricted in their operation within territorial limits."
17 Ms Morris noted that the presumption against extra-territoriality is reflected in section 12(1)(b) Interpretation Act 1987, which states:
(1) In any Act or instrument:
(a) ...
(b) a reference to a locality, jurisdiction or other matter or thing is a reference to such a locality, jurisdiction or other matter or thing in and of New South Wales.
18 As Ms Morris noted, there is nothing to indicate that the NSW Parliament intended to displace the presumption and, indeed, extra-territorial disclosures are specifically addressed in section 19(2).
19 The above leads me to conclude that section 18(1) of the PPIP Act does not apply to disclosures of personal information to a person or body outside NSW. Thus, GQ is unable to pursue a remedy against the Department. Any remedy would have to lie under section 19(2), but that provision is not yet in operation as a result of the Privacy Commissioner not having made the relevant privacy code of practice necessary to bring section 19(2) into operation pursuant to section 19(5). ...
17In this case the Privacy Commissioner has submitted that that there is no inconsistency between the provisions of section 18(1) and 19(2) which prevents them being read consistently with the language and purpose of the PIPPA Act as a whole. In Project Blue Sky Inc v Australian Broadcasting Authority [1998] HCA 28 the majority )McHugh, Gummow, Kirby and Hayne JJ) explained that -
"The primary object of statutory construction is to construe the relevant provision so that it is consistent with the language and purpose of all the provisions of the statute. The meaning of the provision must be determined "by reference to the language of the instrument viewed as a whole". In Commissioner for Railways (NSW) v Agalianos. Dixon CJ pointed out that "the context, the general purpose and policy of a provision and its consistency and fairness are surer guides to its meaning than the logic with which it is constructed". Thus, the process of construction must always begin by examining the context of the provision that is being construed.
A legislative instrument must be construed on the prima facie basis that its provisions are intended to give effect to harmonious goals. Where conflict appears to arise from the language of particular provisions, the conflict must be alleviated, so far as possible, by adjusting the meaning of the competing provisions to achieve that result which will best give effect to the purpose and language of those provisions while maintaining the unity of all the statutory provisions. Reconciling conflicting provisions will often require the court "to determine which is the leading provision and which the subordinate provision, and which must give way to the other". Only by determining the hierarchy of the provisions will it be possible in many cases to give each provision the meaning which best gives effect to its purpose and language while maintaining the unity of the statutory scheme.
Furthermore, a court construing a statutory provision must strive to give meaning to every word of the provision. In The Commonwealth v Baume Griffith CJ cited R v Berchet to support the proposition that it was "a known rule in the interpretation of Statutes that such a sense is to be made upon the whole as that no clause, sentence, or word shall prove superfluous, void, or insignificant, if by any other construction they may all be made useful and pertinent".
18The Privacy Commissioner argues that s 19 can be read as imposing restrictions, which are additional to those imposed by s 18(1), that apply in the special circumstances when s 19(1) and (2) apply. The Commissioner on the other hand argued that there are clear and recognised inconsistencies between the provisions in s 18(1) and s 19, citing the Appeal Panel decision in Director General, Department of Education and Training v MT [2005] NSWADTAP 77. There the Tribunal found that s 19 "overrides if one of the categories in s 18(1)(c) is in issue" and that different defences are available depending upon which of those sections applies. The Commissioner went on to embark on a detailed consideration of the operation of the two provisions in an effort to demonstrate inconsistency.
19The Commissioner and the Privacy Commissioner are in agreement that s 19(2) has the effect of displacing the application of s 12(1) of the Interpretation Act 1987 in respect of disclosure. The Privacy Commissioner however, suggests that s 12(1) does not confine disclosures to which section 18(1) and 19(1) to ones within NSW only. If it did so, she submits, a number of provisions in the Act would be made redundant, particularly s 23(5). This exempts public service agencies (including law enforcement agencies which s 4 defines to broadly include Federal and State Police Forces among others) from complying with s 18(1) in defined circumstances. Such as interpretation, she submits, would undermine the purposes of the PIPPA Act.
20In response the Commissioner pointed out that s 23(5) is capable of applying to the disclosure of personal information to Federal and State Police Forces in NSW. The definition of Law enforcement agency was said not to evince an intention that the Act generally apply extraterritorially.
21The Commissioner adopted as a primary argument that the Tribunal had previously decided that s 118(1) did not apply in circumstances involving a disclosure of personal information via telephone to an interstate person or agency, and that the Tribunal, at first instance level, should exercise judicial comity and follow the decision GQ. The Commissioner referred to BY v Director-General Attorney General's Department [2002] NSWADT 79 and Terzic v Registrar if Births Deaths and Marriages [2013] NSWADT 82. In the former President O'Connor said at [21- 23] -
21 The threshold question that arises before considering any further these contentions is whether the present Tribunal should revisit the prior considered rulings. Counsel for the Administering Minister acknowledged the importance of different panels of a Division of the Tribunal being seen to deal consistently with the same or like questions. He acknowledged that the view might be taken that it would not be appropriate to revisit the previous, considered rulings.
22 In my view, a later Tribunal should exercise caution in reopening prior, considered rulings of an earlier Tribunal. Ordinarily a later Tribunal should adopt the ruling of the earlier Tribunal; and leave these questions to be finally determined within the Tribunal at the Appeal Panel level. Notably in the earlier cases where the Administering Minister's submissions have been rejected, there was no appeal; but that may have been, as counsel for the Administering Minister suggested at hearing, because ultimately following full substantive consideration the determinations in issue were affirmed.
23 Normally a prior considered Tribunal ruling should only be reopened if a new, significant argument is raised before the later Tribunal. This is not such a case. Nonetheless, I consider that some discretion should be allowed to a Divisional Head sitting at first instance to revisit prior rulings, where the Divisional Head has doubts about the prior rulings or the questions involved are of great significance, such as ones raising important issues of power or jurisdiction. (Such a ruling may itself be appealed to the Appeal Panel. In that event, the Divisional Head, who would customarily preside, is ineligible. Where there is an appeal in relation to such a ruling, the Appeal Panel should, in my view, give consideration, if it regards the ruling as doubtful, to referring the controversial question to the Supreme Court for determination.)
22In the present case the arguments being agitated with respect to the extraterritorial application of the PIPPA Act are the same as those that that were the subject of a considered ruling in GQ, albeit there the Tribunal did not have the benefit of a clear contradictor as is the case here. No new argument is raised here, although the competing arguments with respect to the issue have been well enunciated.
23In those circumstances, and given the guidance in BY, I think it incumbent upon me to follow the decision Handley DP made in GQ v NSW Department of Education and Training (No 2) [2008] NSWADT 319 in order to ensure consistency in decision making by the Tribunal.
24I also think that Ms Bevege's argument that a disclosure made in NSW over the phone to an interstate person does not withstand the weight of analyses. I accept the Commissioner's submission that the "essence of disclosure is making known to a person information that the person to whom the disclosure is made did not previously know": see Nasr v State of NSW (2007) 170 A Crim R 78 at 106. Disclosure occurs when information is revealed to the recipient and is dependent on the recipient's knowledge. Were I to accept Ms Bevege's submission, given the decision in GQ, the provisions of a 19(2) - once a code is issued - could be easily avoided by the device of making a phone call. I do not consider such a result consistent with the purposes of the Act.
25Finally, I note that Ms Bevege's argument that there has been internal disclosures of her personal information between units of the New South Wales Police Force does not evidence a breach of s 18. This is so because it is well established that the internal use of information within an agency does not amount to disclosure.
26I appreciate that this result will be a severe disappointment to Ms Bevege who considers she has been a victim of a real injustice. The issue however is one of law, in which there is already a considered decision determinative of the issue. The appropriate forum to seek a reconsideration of that authority is at appeal level.