Chohan v Commonwealth of Australia as represented by Department of Home Affairs [2025] FCA 437

The Five Country Conference (FCC) Data-Sharing Protocol agreed in 2009 between the UK, Australia, Canada, New Zealand and United States, secured arrangements to share the fingerprints of up to 3,000 individuals between each participating country per year. Where there is a match under these arrangements, partner countries exchange information which may assist with decision-making on visa applications, among other things. In July 2015, the Department received information from the United Kingdom regarding Mr CHOHAN through the FCC data exchange.

1. Secondly, the Department released to the applicant a "case note" created on 9 February 2016, and stored on the Department's computer systems, in relation to the applicant. That case note appears on its face to include text copied from an email or other communication received by the Department from the United Kingdom Government. It does not identify the person within the United Kingdom Government who sent the communication. (Other evidence showed that despite comprehensive searches being made, the Department has been unable to locate the original communication, or the identity of the person who sent it.) The case note included the following:

Arrested by UK Immigration on 23/02/2008 in Manchester as a suspected illegal entrant.

(notes below)

He claimed he was in the UK as a student and had arrived 8-9 months ago.

He provided the name and number of his brother Atta-Ul-Mustafa CHOHAN but when OIC Ratcliffe spoke to him he denied knowing the subject stating that his brother by that name was in Pakistan.

I attended Longsight Police Station to interview subject with the assistance of Urdu interpreter Interview under caution commenced at 1610 hrs. He stated that he had entered the UK on 04/07/07 as a visitor. His visa was valid for 2 years and that his brother had obtained it for him in Islamabad. He was adamant that he wasn't working despite the fact that he was encountered wearing a white butchers coat and stood behind the butchers counter wielding a meat cleaver and serving a customer. He states that he sent his passport back to Pakistan on the advice of his brother but he couldn't give a reason for this.

1. The FCC agreement to which the Department's statement above refers was not in evidence. In the decision of the Administrative Appeals Tribunal concerning the applicant's freedom of information request, however, reference was made to a Memorandum of Understanding, signed on 21 August 2009, between the then Australian Department of Immigration and Citizenship, and the United Kingdom Secretary of State for the Home Department acting through the United Kingdom Border Agency. That agreement would appear to represent the terms of the FCC agreement, at least as between Australia and the United Kingdom. The decision of the Administrative Appeals Tribunal quotes various of its provisions, and I am prepared to proceed, for the purposes of this application, on the basis that an agreement in those terms could be proved.
2. The quoted provisions set out a process by which the participating governments may request information from one another. In broad terms, a requesting government (which here would have been Australia) supplies fingerprints of the person in respect of whom information is sought to another government (here, the United Kingdom). The United Kingdom would then search its own records, to see if a match to the supplied fingerprints is obtained. If a match is obtained, then the United Kingdom would notify Australia of that fact, along with various other identifying information (such as name, date of birth, photographs, passport number, etc).
3. Other provisions stipulate that information provided and received under the agreement should be as accurate, complete, and up to date as possible. It is also stated that, if any government becomes aware that information provided or received is inaccurate, then it should notify the other government and provide corrected information. It is said to be expected that each government will act in a timely manner in relation to any request for access to, or corrections of, information.
4. The applicant also relied on the terms of "Privacy Impact Assessments" prepared by both the United Kingdom and United States Governments in relation to the FCC agreement.
5. Clause 1.5 of the United States Privacy Impact Assessment states:

How will the information be checked for accuracy?

US-VISIT information is checked for accuracy through multiple quality reviews to ensure a minimum level of completeness and quality. Initial quality reviews are conducted by comparing against the submitted documentation, such as an identification card, passport, or other corroborating documentation; and if necessary by conducting an in-person interview. An individual is also provided the opportunity to correct or amend information if he or she believes the information is not accurate. ... Additionally, FCC partners are authorized to request subsequent corrections, changes, and deletions when necessary and appropriate. Finally, robust multilateral administrative policies ensure that inaccurate information is detected and corrected in a timely manner. Each FCC country is responsible for its own information; and to ensure that no one is harmed by inaccurate information held by another FCC country, each FCC country must provide individuals with access and redress.

1. The United Kingdom Privacy Impact Assessment included the following:

4.7 How will we know the information is accurate?

...

There are some risks around the accuracy of the biographic information exchange on the cases where biometric matches are identified:

· data may be inaccurate because of errors in the source database;

· data may be inaccurate because it has been incorrectly transcribed; or

· data may be incorrectly interpreted by the country receiving it.

In trials, we have sought the best ways to mitigate these risks, and reflected these in the Protocol arrangements:

...

· the arrangements provide for co-operation between the different countries' central teams to liaise and correct any data that is found to be inaccurate.

4.7.1 Can I see and if necessary correct any information held about me?

It is important for the fair processing of people's information and for public trust that there is transparency in the arrangements. Whilst we have taken a range of steps to ensure that the data shared is accurate and is correctly understood, there always remains some level of accuracy risk. However, we have confirmed in our assessment of the other countries' data protection arrangements ... that each provides individuals with adequate rights to access information which is held on them, to correct any erroneous information, and for the opportunity to seek redress against breaches of the law. We have also specifically set out that no data may be exchanged under the Protocol which may not be disclosed to the individual to whom it relates.

...

The Protocol further supports our duty under the fourth data protection principle in the Data Protection Act 1998 to ensure that data is kept accurate and up to date. Checks made under the Protocol will help us to correct and update our systems. For example, where they show that an immigration offender believed to be in the UK is now elsewhere, we will be able to update our records accordingly.

1. The applicant contends that the information provided by the United Kingdom about him was not provided in accordance with the fingerprint-matching process outlined in the FCC agreement. He said:

According to FCC Protocol data will be shared by fingerprint matching in first stage and then other data will be shared in second stage but, the [Commonwealth] Received these adverse information [from] UK Embassy Islamabad.

...

But it was duty of care of [Commonwealth] according to FCC data share framework that, [Commonwealth] should must get fingerprint match from both the countries rather than relying on information from Embassies of UK and USA.

...

... The Applicant came to know on 20 April 2021 through Email of OAIC that, information were [shared] through FCC data sharing protocol and under this protocol it was duty of care of defendant to match the fingerprint record from both countries to correct information.

...

In May 2022, the applicant became aware through the Administrative Appeals Tribunal's decision that [the Department] had relied on unverified information received from the UK and US Embassies instead of fingerprint matching as required under the FCC Protocol.

1. The submission seemed to me to be capable of two possible interpretations (or perhaps two submissions were being put).
2. The first possible submission was that the information about the applicant was provided by the United Kingdom other than in accordance with the proper processes of the FCC agreement. That is to say, whereas the FCC agreement first required the anonymous provision and matching of fingerprints, with the subsequent sharing of information relating to the individual thus identified, here the United Kingdom Government had come to provide information about the applicant through some other process, and without the safeguard of fingerprint matching.
3. That submission seemed to be based on a portion of an affidavit of a Commonwealth lawyer relied upon in the Administrative Appeal Tribunal proceedings. The relevant part of the affidavit was describing the documents about which there remained a dispute for the Tribunal's determination. In paragraph [8.2.3] the deponent identified:

Case note dated 9 February 2016 in relation to information provided to the Department's Post in Islamabad by its foreign counterpart from the United Kingdom (UK) claimed to be exempt under s 33(b).

1. The applicant submitted that this showed that the information about him had been provided by the "UK Embassy Islamabad". I infer that the applicant submits that the United Kingdom High Commission in Islamabad is the "foreign counterpart" to the "Department's Post in Islamabad". I am not sure that that is a fair reading of the affidavit. It more naturally reads as referring simply to the Department's foreign counterpart in the United Kingdom (i.e., the Home Office), wherever based. In any event, even if it does refer to the United Kingdom High Commission, it is not apparent to me why that fact would imply non-compliance with the FCC protocol provisions. Furthermore, it is not controversial that the records maintained by the United Kingdom Government in relation to the applicant did include the false information that the applicant had been arrested. Compliance with the FCC protocols thus would not have avoided that false information being provided to the Commonwealth.
2. The second possible submission is that the FCC protocols required that only information that could be verified through fingerprints should be shared or acted upon. To the extent that that is the submission, I infer it takes as its starting point the fact that the United Kingdom Home Office, in its email to the applicant of 10 June 2016, said that the records "show that no fingerprints were taken for the arrested person who claimed your identity". But it seems to me to misunderstand the way that the FCC protocols operate. The fact that no fingerprints were taken of the man who was arrested may explain why the information in question came to be recorded against the applicant's name. But the fingerprint matching provisions of the FCC protocol do not operate so that only information verified by fingerprints can be recorded against a person's name. Rather, those provisions operate so that, whatever information is recorded against a person's name, will be provided to another country when a fingerprint match in relation to that person is obtained.
3. For now, I will simply observe that the applicant appears to have strong prospects of proving that:

(a) the information provided by the United Kingdom Government about the applicant being arrested was false;

(b) the Commonwealth did not itself interrogate or seek to verify that information before putting it to the applicant for his comment (or, indeed, after the applicant denied it);

(c) the Commonwealth's letter came to the attention of the applicant's employer, albeit without the Commonwealth being aware, or having any reason to suspect, that that would occur; and

(d) as a result, the applicant's employer terminated his employment, causing the applicant to suffer financial loss.

1. I do not consider, however, that the applicant has reasonable prospects of proving that the information was provided other than in accordance with the FCC agreement.

1. Before turning to consider the prospects of the claim advanced by the applicant, it is necessary to address two preliminary matters:

(a) The first is the question of the Court's jurisdiction. The Commonwealth's submissions, at least for the purposes of this application, proceeded on the basis that the Court had jurisdiction pursuant to s 39B(1A)(c) of the Judiciary Act 1903 (Cth) (i.e., that the proceedings involve a matter "arising under any laws made by the Parliament"). I am satisfied that that is an appropriate assumption to make for purposes of determining this application. That is, while the applicant brings a common law claim in negligence, he contends, as will be seen, for a duty of care arising in relation to the exercise of powers under the Migration Act 1958 (Cth), and his case on breach relies on certain norms of conduct prescribed in Commonwealth legislation (i.e., the Privacy Act 1988 (Cth)). In those circumstances, the Commonwealth submitted, and I accept, that the "subject matter of the controversy owes its existence to Commonwealth legislation": see Rana v Google Inc (2017) 254 FCR 1; [2017] FCAFC 156 at [18], per Allsop CJ, Besanko and White JJ.

(b) The second is the choice of the substantive law that governs the applicant's claim. The Commonwealth submitted that the law of the Australian Capital Territory would apply. That was said to be on the basis that the alleged negligence "involved decision-making processes based in Canberra", with the ACT thus being the lex loci delicti. It was further submitted, however, that it was only the common law of negligence, and not the provisions of the Civil Law (Wrongs) Act 2002 (ACT), that applied (by reason of operation of the Australian Capital Territory (Self-Government) Act 1988 (Cth), s 27). This issue seemed to me to raise questions of some complexity. For one thing, it is not obvious that the applicant does in fact allege negligence in the performance of "decision-making processes based in Canberra". The visa application was lodged and processed in the Australian High Commission in Islamabad. The conduct about which the applicant complains thus took place in an Australian diplomatic mission in Pakistan. There is authority that is inconsistent with any general proposition that the law of the sending state applies in a foreign diplomatic mission (see, e.g., R v Turnbull; Ex parte Petroff (1971) 17 FLR 438 at 441-444, per Fox J; Minister for Foreign Affairs and Trade v Magno [1992] FCA 566; (1992) 37 FCR 298 at 321, per French J; Brannigan v Commonwealth (2000) 110 FCR 566; [2000] FCA 1591 at [27], per O'Loughlin J). To the extent that ACT law does apply, it is also not obvious that the Civil Law (Wrongs) Act does not (see Glavinic v Commonwealth [2023] ACTSC 361 at [289]- [290], per Mossop J). Ultimately, I do not consider it necessary to resolve these questions. I will assume in the applicant's favour that Australian law rather than Pakistani law applies to his claim (for that is what the applicant submitted). Even if Pakistani law applied, there being no evidence as to its content, I would assume that it is the same as the law of Australia: Neilson v Overseas Projects Corporation of Victoria Ltd (2005) 223 CLR 331; [2005] HCA 54 at [125], per Gummow and Hayne JJ, [248]-[249], per Callinan J, [267] per Heydon J. As to precisely which Australian jurisdiction, or law area's, law applies, (and if it is the ACT, whether the Civil Law (Wrongs) Act applies) I do not think it matters. I would have reached the same conclusion whichever Australian law applied, and whether or not the Civil Law (Wrongs) Act applied. The relatively subtle differences between potentially applicable laws could not make any difference to the viability of the applicant's case.

1. I also pause to note that the applicant, by his statement of claim and in his submissions, identified or advanced a variety of statutes, authorities, and arguments which could on no view be relevant, much less of assistance, to the formulation and assessment of his claim in negligence. I have not addressed such matters in these reasons, but have sought to articulate and deal with the applicant's case at its highest.

1. The applicant's statement of claim does not plead the existence of a duty of care. The Commonwealth said that it assumed that "the applicant contends that the Commonwealth owed a duty of care relating to the delegate's decision to refuse to grant the applicant a visa". That assumption explained the focus of the Commonwealth's submissions on the demonstration of an asserted incoherence in a decision to refuse a visa simultaneously being a valid exercise of power under the Migration Act, and also giving rise to a liability in tort.
2. During the course of oral argument, I explored with counsel for the Commonwealth the possibility that that assumption may not have been correct. The applicant's case did not seem to me to depend upon, much less seek to impugn, the decision to refuse his application for a visa. Rather, the applicant's complaint was concerned with the communication of untrue and damaging information about him during the decision-making process. Liability in tort for such conduct would not necessarily involve any incoherence with statutory provisions authorising the decision that was ultimately made. None of that is to deny that there may not still be an incoherence incompatible with the recognition of a duty of care in tort; but if there is, it will be found principally in aspects of the statutory scheme other than those requiring and authorising the decision itself.
3. As a non-lawyer, it was both understandable and unsurprising that the applicant did not address in his submissions the duty of care for which he contends. He focussed on what he said the Commonwealth did wrong. At its core, as I understood it, he submitted that the Commonwealth had an obligation to, but did not, take reasonable care to verify the accuracy of information it received from foreign governments so that visa applicants did not suffer harm. The precise content of the duty was, however, expressed in different ways at different times in the applicant's submissions. The principal difference between the various formulations concerned the use of the information in connection with which the obligation to verify was said to arise:

(a) Sometimes, the applicant spoke in terms of a duty arising "when the [Commonwealth] received contradiction response from the applicant". In other words, the duty did not impose any obligation to take reasonable care in relation to the content of a communication providing procedural fairness communication to a visa applicant; rather, it applied to the steps taken by the Commonwealth after it was put on notice that the information was disputed. In that way, I understood the applicant to be contending for a duty owed to visa applicants in respect of whom the Commonwealth had received false information, and who had informed the government of that fact, to take reasonable care to correct and disavow the records in question (additionally to, or independently of, the making of a decision in reliance on the information).

(b) On other occasions, the duty was expressed to apply to the communication of information to the applicant in the first place. In other words, it was a duty to take reasonable care that communications providing procedural fairness to visa applicants did not contain false information. That is to say, I understood the applicant to contend that it is only after information has been properly verified that it can even be put to the applicant for comment.

1. The second of those possibilities seems most naturally to fit with the applicant's overall case theory. That is, in circumstances where the loss that the applicant claims to have suffered was a reaction of his employer to information contained in the 3 February 2016 letter, and not to the Commonwealth's later acceptance of or reliance upon that information, the acts or omissions of the Commonwealth after sending the letter would seem to be causally irrelevant. I do not think that the former possibility can be excluded, however. That is because I understood the applicant also to contend that the Commonwealth, acting reasonably, ought to have established the falsity of the information quickly, and communicated its acceptance of that fact to him before he was fired by his employer.
2. Ultimately, I do not think it is necessary or appropriate for the purposes of resolving this application to hold the applicant to a precise formulation of the duty for which he would contend at trial. If nothing else, I do not see why the applicant could not advance alternative formulations of the relevant duty. In any event, the two broad duties articulated by the applicant are not inconsistent with one another, and could operate cumulatively, or as components of a single broader duty. But more than that, in order to reach the necessary "high degree of certainty" about the ultimate outcome of the proceeding, and in order to determine that any deficiency in the case as presently articulated is "incurable", I consider it to be both possible and appropriate to approach the question of duty at a certain level of generality.
3. Whichever way the duty of care is formulated, however, it seems to me to lack reasonable prospects of success. That is so for several reasons. (I will assume in the applicant's favour that the loss suffered by the applicant was reasonably foreseeable.)
4. At least on its core formulation, the postulated duty would seem to be a duty to take reasonable care to avoid purely economic loss. As is well known, "[o]rdinarily, a person does not owe a duty to take reasonable care to avoid causing reasonably foreseeable pure economic loss to another": Mallonland Pty Ltd v Advanta Seeds Pty Ltd [2024] HCA 25 at [30], per Gageler CJ, Gordon, Steward, Gleeson, Jagot and Beech-Jones JJ. More must be shown than that such loss was a reasonably foreseeable consequence of the conduct of the respondent. For example, a duty of care may be established if a respondent has assumed responsibility towards the applicant to take reasonable care to avoid economic loss. Absent an assumption of responsibility, a judicial evaluation of various factors tending for or against the imposition of a duty is required: see, e.g., Mallonland at [36]-[41], per Gageler CJ, Gordon, Steward, Gleeson, Jagot and Beech-Jones JJ. Those factors may include such considerations as actual or constructive knowledge of the risk to the applicant of the particular type of economic loss that eventuated, the magnitude of the economic loss that risk entails, and the vulnerability of the applicant to the particular type of economic loss suffered (in the sense of the inability of the applicant to protect him or herself from the loss).
5. In this case, it is difficult to identify any recognised factor that would support recognition of a duty of care:

(a) The circumstances are not capable of sustaining a finding that the Commonwealth assumed responsibility towards the applicant to take reasonable care to avoid him suffering economic loss. An assumption of responsibility is "best understood as an undertaking (whether express or implied) by a person to take on a task or job for another person or class of persons, from which it can be inferred that the first person accepted that he or she would take reasonable care when engaging in that task or job": Mallonland at [33]. There was certainly no express undertaking to that effect, and it is not possible to imply such an undertaking from the relationship between the parties established by the applicant making an application for a visa. I will consider the relevance of the statutory regime under which the application fell to be considered and determined, and the consistency of the postulated duty with that regime, in due course. For now, though, it is enough to observe that the Commonwealth cannot be regarded as, in any meaningful sense, performing a task "for" the applicant. In its consideration of the applicant's visa application, the Commonwealth was acting in protection of its own interests (and those of the Australian people), and can in no way be seen to have impliedly assumed any responsibility towards the applicant for any harm that he may suffer as a result of the investigation and scrutinization of his application (cf., in a related context, the observations of French J in WAIS v Minister for Immigration and Multicultural and Indigenous Affairs [2002] FCA 1625 at [56]).

(b) Nor is it possible to regard the Commonwealth as having had actual or constructive knowledge of the risk to the applicant of the particular type of economic loss that eventuated. In Mallonland, at [38], the plurality quoted with approval the observation of McHugh J in Perre v Apand Pty Ltd (1999) 198 CLR 180; [1999] HCA 36 at [131] that such knowledge is "virtually a prerequisite of a duty of care in cases of pure economic loss". It is not possible to infer that the Commonwealth should be taken to have known that the correspondence would come to the attention of the applicant's employer, much less that, if it did, there was a risk that they would terminate his employment, by reason of at least the following circumstances:

(i) The 3 February 2016 letter was private correspondence, addressed to the applicant, and sent by email to an email address that was not obviously a work email account. It was an address that the applicant had identified as his own, in his application form, in circumstances where he did not authorise the Commonwealth to communicate with any other person in relation to the application. In those circumstances, the Commonwealth would have had no reason to consider that the applicant would show the letter to anyone who would be likely to cause him harm as a result (or that it would be otherwise accessible to such a person).

(ii) The purpose of the letter was only to provide the applicant with natural justice, and did not constitute a determination of his application, or contain any concluded finding about the truth or reliability of the information contained within it. In those circumstances, to the extent that the Commonwealth should have appreciated the risk that the letter would come to the attention of the applicant's employer, it would not have appreciated that the employer would, by reason only of the contents of the letter, and contrary to the applicant's denial, terminate the applicant's employment.

(c) Finally, the applicant cannot be regarded as vulnerable to the particular type of economic loss suffered (in the sense of being unable to protect himself against it). He was presumably in a position to control access to his email account and thus to the 3 February 2016 letter. To the extent a person did read the letter, the applicant was in a position to deny the truth of the information, to make clear that he was taking steps to establish the true position, and in fact to take such steps.

1. Another relevant feature of the postulated duty is that, while the applicant's articulation was focussed on the obligations of the Commonwealth in relation to the verification of information, it is in fact most directly concerned with the exercise of reasonable care in the making of statements which may come to the attention of third parties (or the correction of such statements as had already been made). That fact has several relevant consequences.
2. Even if the duty was not a duty to take reasonable care to avoid purely economic loss, and could be seen as a duty to take reasonable care to avoid the infliction of emotional distress, or damage to a visa applicant's reputation, that would not strengthen the applicant's case. In relation to emotional distress, the applicant does not contend that he has suffered a recognised psychiatric injury, and in those circumstances, no duty of care is owed: see Part 3.2 of the Civil Law (Wrongs) Act 2002 and, at common law, Tame v New South Wales (2002) 211 CLR 317; [2002] HCA 35 at [7], per Gleeson CJ, at [44], per Gaudron J; Frost v Chief Constable of South Yorkshire Police [1998] UKHL 45; [1999] 2 AC 455 at 469, per Lord Goff of Chieveley. Insofar as damage to reputation is concerned, the observation of the High Court in Sullivan v Moody (2001) 207 CLR 562; [2001] HCA 59 at [54], per Gleeson CJ, Gaudron, McHugh, Hayne and Callinan JJ is of particular relevance:

The present cases can be seen as focusing as much upon the communication of information by the respondents to the appellants and to third parties as upon the competence with which examinations or other procedures were conducted. The core of the complaint by each appellant is that he was injured as a result of what he, and others, were told. At once, then, it can be seen that there is an intersection with the law of defamation which resolves the competing interests of the parties through well-developed principles about privilege and the like. To apply the law of negligence in the present case would resolve that competition on an altogether different basis. It would allow recovery of damages for publishing statements to the discredit of a person where the law of defamation would not.

1. See also Tame at [28], per Gleeson CJ, [58], per Gaudron J, [122]-[126], per McHugh J, [323], [325], per Callinan J.
2. More generally, as a "duty of care in utterance by way of information" (Tepko Pty Ltd v Water Board (2001) 206 CLR 1; [2001] HCA 19 at [47], per Gleeson CJ, Gummow and Hayne JJ), the considerations underlying the rule in the more conventional presentation of such a case, stated by Barwick CJ in Mutual Life & Citizens' Assurance Co Ltd v Evatt (1968) 122 CLR 556; [1968] HCA 74 at 571, quoted with approval in Tepko at [47], remain relevant:

the speaker must realize or the circumstances be such that he ought to have realized that the recipient intends to act upon the information or advice in respect of his property or of himself in connexion with some matter of business or serious consequence.

1. Here, of course, the relevant "recipient" (i.e., the person said to have acted in reliance on the communication) is not the person to whom the communication was sent, and the relevant risk is not that that recipient will act upon the information to his or her own detriment, but rather to the detriment of the applicant (in that regard, it bears some, but far from complete, similarity to the case of Tame v New South Wales (2002) 211 CLR 317; [2002] HCA 35). Other cases of that general fact pattern demonstrate the importance of the particular circumstances in the resolution of the question of the existence of a duty. For reasons I have already given, the relevant "recipient" in this case was not a person that the Commonwealth ought reasonably to have appreciated would have become aware of the communication at all. It follows that it is impossible to conclude that, in the circumstances, the Commonwealth ought to have realized that the content of the 3 February 2016 letter would be relied upon by anyone, including the applicant's employer, to the detriment of the applicant.
2. Perhaps the most fundamental objection to the recognition of the postulated duty, however, is its incompatibility with the statutory scheme pursuant to which visa applications are considered. A duty of care will only be recognised to exist in relation to the performance of statutory powers, if the statutory regime in question can be seen to erect or facilitate a relationship between the person exercising the power and a class of persons that, in all the circumstances, displays sufficient characteristics answering the criteria for intervention by the tort of negligence: Graham Barclay Oysters Pty Ltd v Ryan (2002) 211 CLR 540; [2002] HCA 54 at [146], per Gummow and Hayne JJ. A critical consideration in answering that question is "the consistency or otherwise of the asserted duty with the terms, scope and purpose of the relevant statute": Graham Barclay at [149], per Gummow and Hayne JJ.
3. If a person makes a valid application for a visa, the Minister has a duty to consider it pursuant to s 47 of the Migration Act (and, ultimately, to decide whether to grant, or whether to refuse to grant, the visa pursuant to s 65 of that Act). The Minister must perform those obligations within a reasonable time, having regard to the circumstances of the individual case and the decision-making framework established by the Migration Act: see Plaintiff S297/2013 v Minister for Immigration and Border Protection [2014] HCA 24; (2014) 255 CLR 179 at [37], per Crennan, Bell, Gageler and Keane JJ. At the relevant time, Part 2, Division 3, Subdivision AB, of the Migration Act was entitled "Code of procedure for dealing fairly, efficiently and quickly with visa application". (That heading, of course, is part of the Act (see s 13, Acts Interpretation Act 1901 (Cth), and assists in identifying the purpose and object of the sub-division.) Its provisions included:

(a) Section 51A: which provided that the subdivision constitutes an "exhaustive statement of the requirements of the natural justice hearing rule in relation to the matters it deals with".

(b) Section 57: which provides that the Minister must disclose to an applicant, and invite him or her to comment upon, any information about an applicant that would be the reason, or part of the reason, for refusing to grant a visa.

(c) Section 58: which provides that a person invited under s 57 to comment on information, if asked to comment in writing, must do so within a prescribed period (if applicable) or a specified reasonable period.

(d) Section 63: which provides, relevantly, that the Minister may not make a decision in relation to a visa application until after any requested comments have been given, or the time limited for the provision of any comment has expired.

1. Of particular significance is the obligation imposed on the Minister by s 57 to disclose material to a visa applicant that would be a reason, or part of the reason, for refusing to grant a visa. Two matters may be observed:

(a) First, the section obliges the Minister to provide information of a particular character to a visa applicant. A duty of care that created the potential for liability for the communication of information required to be disclosed by s 57, would plainly be directly inconsistent or incompatible with the statutory obligation: see Electricity Networks Corporation v Herridge Parties (2022) 276 CLR 271; [2022] HCA 37 at [27], per Kiefel CJ, Gageler, Gordon, Edelman and Steward JJ.

(b) Secondly, the information obliged to be disclosed is, critically, information "that the Minister considers would be the reason, or part of the reason, for refusing to grant a visa". The duty of care for which the applicant contends would, therefore, operate to limit the information that the Minister was entitled to take into account (or the conclusions that he or she was entitled to draw from information) at the relevant stage of the decision-making process. Expressed differently, breach of the duty of care would give rise to a liability in relation to the Minister's use of the information in question at a point prior to the making of a final decision. Viewed from yet another perspective, the duty would operate to impose a precondition of "reasonable further inquiries" on the Minister's ability to take into account the information. By intruding into the evaluation of visa applications in that way, and by imposing a liability in respect of that evaluation, a further inconsistency or incompatibility is revealed. Administrative law remedies are available in relation to decisions that are vitiated by jurisdictional error. To overlay a duty of care on the statutory scheme for the consideration and determination of visa applications, would create the inevitable potential for tortious liability to arise in relation to lawful decision-making process leading to valid decisions. It would create an avenue to challenge what are, in effect, preliminary, conditional, or tentative conclusions reached during the decision-making process. The mere existence of the duty of care would have the tendency to induce a cautious and defensive approach to the performance of statutory powers and duties. All of this is a powerful factor arguing against the recognition of the duty of care for which the applicant contends: see, e.g., Fernando v Commonwealth (No 1) (2010) 188 FCR 188; [2010] FCA 753 at [150], per Siopis J; Hassan v Minister for Home Affairs [2024] FCA 527 at [93]- [98], per Perry J (noting Hassan v Minister for Home Affairs [2025] FCAFC 57 at [24]).

1. Overall, for all of the reasons I have set out above, I am persuaded that the applicant does not have reasonable prospects of establishing the existence of a duty of care. It follows that the Commonwealth's application for summary judgment should be granted on this basis alone.

1. Even if the applicant had reasonable prospects of establishing the existence of a duty of care, I am not satisfied that he could prove it was breached.
2. Whatever duty might be found to exist, it is axiomatic that it could only impose a duty to exercise reasonable care, and not to prevent the suffering of harm. Moreover, the existence of breach must be assessed prospectively and without the benefit of hindsight. See generally Roads and Traffic Authority of NSW v Dederer (2007) 234 CLR 330; [2007] HCA 42 at [18], per Gummow J. For the applicant to succeed, therefore, he would need to prove more than that the information provided to the Commonwealth by the United Kingdom Government was false and that, as events transpired, its falsity was capable of being discovered.
3. The applicant's case on breach reduced, as I understood it, to the following contentions:

(a) The Commonwealth unreasonably failed to verify the information received from the United Kingdom Government before providing it to him for comment. It should have verified the information through "fingerprint matching". In addition, there were various features of the information which should have suggested its unreliability, and which made the use of it unreasonable.

(b) The Commonwealth unreasonably failed to verify the information received from the United Kingdom Government after the applicant informed them that it was false. Once again, "fingerprint matching" should have been used, and the features suggesting unreliability should have been explored.

(c) The Commonwealth provided him with an unreasonably short period of time within which to respond to the adverse information. A period of seven days was not long enough for him to obtain a "true record" from the United Kingdom Government.

(d) The Commonwealth did not respond to his denial of the accuracy of the information, confirming its falsity, within a reasonable period of time. The Commonwealth should have responded disavowing the truth of the information provided by the United Kingdom Government before his employment was terminated.

1. A general theme underlying the first two aspects of applicant's case on breach (i.e., those relating to a failure to verify the information, either before or after sending the 3 February 2016 letter) was that the Commonwealth breached obligations it had under both the FCC agreement, and Australian Privacy Principles, to verify information and then delete or correct inaccurate information.
2. In relation to the FCC agreement, there is no doubt that it emphasises the importance of information provided pursuant to its terms being "accurate and as complete and up to date as is reasonably necessary for the purposes of" the agreement (cl. 6.11). It imposes obligations on parties who become aware of inaccurate information to correct it in a timely manner. But, as the United States Privacy Impact Assessment observes: "[e]ach FCC country is responsible for its own information" (cl. 1.5). That is to say, each country is responsible for the accuracy of its own records. Indeed, it is difficult to see how one country could sensibly be regarded as having the capacity, much less an obligation, to ensure the accuracy of another country's records. That is not to deny that the FCC agreement provides for one country to request corrections or deletions to another country's records. But the ability to make such requests where it comes to the attention of the first country that the second country's records contain an error does not imply any broader obligation on countries to interrogate or verify each other's records. Moreover, it is clear that the primary means by which the FCC agreement contemplates that records will be corrected is by giving individuals adequate rights to access and challenge information stored in relation to them. Once again, that is inconsistent with any general obligation on a country to verify or correct the records of other countries.
3. I am not persuaded that there is any reasonably arguable case that the Commonwealth breached any obligation it owed under the FCC agreement. It was entitled to rely on the accuracy of information provided to it pursuant to that agreement, and there was nothing in the particular circumstances in which this information was provided that made it unreasonable to do so. As I understood the applicant's case, the three circumstances that might be argued to have made it unreasonable to rely on the information provided by the United Kingdom Government were:

(a) Embedded within the information provided by the United Kingdom Government was information which suggested that the applicant had not in fact been arrested. That is to say, the notes themselves recorded that the applicant's brother had said that the applicant was not in the United Kingdom. So much may be accepted. But equally, it is plain that the United Kingdom Government had not accepted the truthfulness of the brother's statement. It is now apparent that the brother was telling the truth. But the question for present purposes is whether the fact that the record contained such a statement made it unreasonable for the Commonwealth to use that information for the purpose it did relevant to these proceedings. That purpose, of course, was to put the information to the applicant for comment in order to provide him with procedural fairness. I do not consider the fact that the information included within it contradicting information could be said to make that use unreasonable. The Commonwealth was not, at that point, relying in a final or concluded way on the truth of the information. It was simply seeking from the applicant any explanation he may be able to give. The contradicting information was not of such a character that it necessarily rendered the balance of the information so unreliable, that the Commonwealth would have been acting unreasonably in putting it to the applicant at all. The inclusion of contradicting information in the record in fact made it more important that the Commonwealth seek the applicant's submissions. The only other practical means by which the information could have been checked or verified would have been to ask the United Kingdom Government to reassess its own records. Obtaining the applicant's comment, at least as an initial matter, was an entirely reasonable course to adopt.

(b) The information was not provided pursuant to the FCC agreement, in that it was provided by the United Kingdom High Commission in Islamabad, rather than the United Kingdom Home Office. I have already referred to this submission above, in my discussion of the factual background. As I said there, it seems to me that the applicant has misinterpreted an affidavit filed in the Administrative Appeals Tribunal. The statement provided by the Department to the Office of the Australian Information Commissioner certainly records that the information was provided pursuant to the FCC agreement. But even if it was not, it was plainly provided through official channels by the United Kingdom Government, and there is no reason why the Commonwealth would not be acting reasonably in treating information provided by the United Kingdom High Commission as equivalently reliable to information provided through by Home Office. I am thus not persuaded that there is any arguable case that the information was not provided in accordance with the FCC agreement, or, if it was, that using that information in the way that it involved the breach of any duty owed by the Commonwealth.

(c) The sender of the information was not identified, thus suggesting its unreliability. I do not think that the premise of this submission has been established. The basis upon which it was put that the sender was not identified, was the fact that the Commonwealth has been unable to locate in its records the original communication used to create the case note. The fact that the Commonwealth could not later locate the original communication, however, does not give rise to an inference that the original communication was from an unidentified source. In circumstances where the case note plainly accurately reflected the United Kingdom Government's records (a matter capable of being inferred from the subsequent dealings between the applicant and that government), there is an irresistible inference that the case note accurately records an official communication from the United Kingdom Government (there being no other plausible means by which the information could have come to the knowledge of the Commonwealth). In those circumstances, it would also necessarily be inferred that the sender of the information would have been identified (if not the particular individual responsible, then at least enough to identify the communication as an official communication of the relevant branch of the United Kingdom Government). I do not consider there to be any reasonable prospect of establishing that it was unreasonable for the Commonwealth to put the information to the use it did on account of the source (or lack of identified source) of the original communication.

1. The applicant also criticised the Commonwealth for using information that was not verified by fingerprints. As I stated when discussing the factual background above, this submission is not well-founded. The role of fingerprint matching under the FCC protocols is simply to match those records held by one country with the person in respect of whom another country has sought information. There is no requirement that a country can only keep records in relation to a person where it has verified through fingerprints that the record is accurately attributed to that individual. Even if there was such a requirement, it would have been breached by the United Kingdom, not Australia. And there was no reason why the Commonwealth ought to have appreciated that fingerprints were not taken from the man who was arrested in the United Kingdom. Ultimately, the fact that no fingerprints were taken at the time of the arrest was a fact that only became known to the Commonwealth much later; and so it is important not to engage in any impermissible hindsight reasoning in relation to it.
2. Overall, therefore, I am not persuaded that the applicant has any reasonably arguable case in relation to breach, arising out of any failure to comply with the terms of the FCC agreement.
3. Insofar as the Australian Privacy Principles are concerned, the applicant referred to APP 10, which provides (in effect) that reasonable steps must be taken to ensure that personal information collected, used, or disclosed is accurate. In the context of consideration of breach, where I have assumed the existence of a duty of care, it does not seem to me that APP 10 can add much to the applicant's case. The real question is whether the Commonwealth failed to take such reasonable steps.
4. For the same reasons I have given in relation to the breach of the FCC agreement, I am not satisfied that there is any arguable case that the Commonwealth acted unreasonably in any respect in its use of the information provided by the United Kingdom Government.
5. Insofar as the submission that the Commonwealth provided the applicant with an unreasonably short period of time within which to respond to the adverse information is concerned, I am not persuaded that it constitutes a reasonably arguable case of breach. The applicant does not deny that it was a sufficient period of time for him to put his case to the Commonwealth as to why the information was incorrect. The 3 February 2016 letter, in any event, informed the applicant that if he was "unable to provide [the requested] information within this time" he should alert the Department. He did not do so. His real complaint is that it was not long enough for him to obtain a "true record" from the United Kingdom Government. The insufficiency of the period of time given to him to obtain that information could have been pointed out to the Department. Depending on the circumstances, proceeding to make a decision without waiting for a response from the United Kingdom Government may have had consequences for the validity of the decision. But there was nothing unreasonable about the period of time given to the applicant within which to make his response.
6. Finally, the submission that the Commonwealth did not respond to the applicant's denial of the accuracy of the information, confirming its falsity, within a reasonable period of time, is also without merit. The applicant responded to the request for information on 6 February 2016. It does not seem to me to be reasonably arguable that it was unreasonable for the Commonwealth to fail to identify the error in the United Kingdom Government records, and notify the applicant of that fact, before 12 February 2016 (when his employment was terminated). The only response provided by the applicant in relation to the information that he had been arrested in the United Kingdom was for him to say: "I never ever arrested nor involved in any work legally or illegally in UK. (it is a shocking and painful information for me) Not at all." He did not provide any objective information that might have enabled the Commonwealth to interrogate the United Kingdom Government, or assess the credibility of his denial (for example, he did not provide a copy of the passport that the United Kingdom Government ultimately accepted proved he was not in the United Kingdom at the relevant time). Even if the Commonwealth had undertaken steps to check the accuracy of the information with the United Kingdom Government, I do not regard it as reasonably arguable that it was unreasonable to have completed those inquiries by 12 February 2016.
7. It follows that I do not consider the applicant to have reasonable prospects of establishing a breach of any duty of care by the Commonwealth.

1. The primary submission made by the Commonwealth in relation to causation is that the applicant still would have lost his job, just a few days later, if there had been no breach of duty. That is because, on the Commonwealth's submission, one of the reasons for the refusal of the applicant's visa application was the (false) information about the applicant being arrested in the United Kingdom. It was thus said to follow that, whatever the problems with the 3 February 2016 letter, when the 17 February 2016 notification of the decision was sent to the applicant, precisely the same result would have obtained.
2. I do not accept the Commonwealth's submissions in this respect, for the following reasons:

(a) Even if it is right that the applicant would have lost his job a few days later, it presumably remains possible, if not likely, that the applicant could establish some loss (if nothing else, in the form of lost wages for the short period in question).

(b) More than that, however, the question of causation on this application is, obviously enough, to be approached on the basis that the applicant might establish the existence, and breach, of the duty of care for which he contends. If the applicant's case were assumed to have succeeded to that extent, then, on most variations, the consequence would be that the false information about the arrest in the United Kingdom would not have been included in the 3 February 2016 letter (either because the Commonwealth would have discovered its inaccuracy, or because it would not have included unverified information in the letter). Alternatively, the falsity of the information would have been established before a decision was made. Either way, a likely corollary of the success of the applicant's case to that point is thus that the reasons given for refusing his visa application would not have included the information about the arrest. Absent that information, then it seems unlikely that the applicant would have lost his job (that is, the mere fact of refusal of the visa would not have been inconsistent with the employment affidavit, and it was that inconsistency that seems to have motivated the employer's decision).

1. For those reasons, I do not think it can be said that the applicant's case on causation lacks reasonable prospects of success.

1. Finally, the Commonwealth submitted that the applicant's case lacked reasonable prospects on the basis that the applicant's claim was brought out of time. The applicant's employer wrote to him on 12 February 2016, informing him that his employment was terminated, effective 15 February 2016. The applicant did not commence these proceedings until 7 May 2024, more than eight years after the date he suffered loss as a result of the negligence he alleges.
2. The Commonwealth has not filed a defence. Assuming the applicable law to be that of the Australian Capital Territory, s 45 of the Limitation Act 1985 (ACT) provides that a party shall not have the benefit of any extinction of a right by reason of the expiry of a limitation period unless it has been "pleaded or otherwise appropriately claimed". There are authorities that both support and deny the availability of summary judgment on the basis of a limitation defence before it is pleaded.
3. There are also many authorities that emphasise the undesirability of determining a limitation defence on an application for summary judgment in all but the clearest of cases: see, e.g., Wardley Australia Ltd v Western Australia (1992) 175 CLR 514; [1992] HCA 55 at 533, per Mason CJ, Dawson, Gaudron and McHugh JJ, at 558-550, per Toohey J; Reilly v Australia and New Zealand Banking group Ltd (No 2) [2020] FCA 1502 at [19]- [21], per O'Bryan J; Dunstan v Orr (No 2) [2023] FCA 1536 at [195]- [196], per Wigney J; Testart v Testart (No 2) [2023] FCA 209 at [122]- [126], per O'Callaghan J.
4. It is at least possible, depending precisely on how the applicant were to put his case, that the applicant may establish a basis upon which an applicable limitation period could be extended. In light of the conclusions I have already reached, it is not necessary for me to resolve this issue in order to determine the application. I would not, however, have been disposed to grant the application for summary judgment on this basis alone.

1. For the reasons I have given, I am satisfied that the applicant "has no reasonable prospect of successfully prosecuting the proceeding". In those circumstances, I am satisfied that it is appropriate to give judgment, pursuant to s 31A(2) of the Federal Court Act, in favour of the Commonwealth.

I certify that the preceding seventy-five (75) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Owens.