Commissioner of Police, NSW Police Force v FYH

Background

1. The respondent is a police officer with over 34 years of service. On 21 February 2023, the respondent had a conversation with a Senior Constable during which it was revealed that the Senior Constable (and others) had been provided with confidential information concerning, amongst other things, the respondent's "Taser history" and "complaint history". The respondent considered the information had been wrongly disclosed and reported the incident.
2. On 27 March 2023, he made a formal complaint of breach of privacy in an email to both the Office of General Counsel of the appellant and the Information and Privacy Commission. He included in these documents the text of the conversation with the Senior Constable, with some explanations.
3. Some excerpts from the email which included the text of the conversation (with pertinent explanations) are as follows: "He said, 'I met some people from PSC [Professional Standards Command]. You're famous there. Everyone knows your Taser history.' I said, 'Who were you talking to there?' He didn't respond but continued on saying 'They said you told a probationer [probationary constable]…' He said, 'They were saying that you can't be promoted because you wouldn't pass IAPro.' [IAPro is an internal complaints management system…] He mentioned IAPro a number of times during this conversation. He further said, 'They said you were decertified [from carrying a Taser] a number of times when you were at [a Police Area Command].' I said, 'Who were you speaking to?' He said, 'Just a group of people from there. One of them said he was an ex-weapons instructor. He said in one of your Taser incidents he recommended you be decertified and charged.' ... He said, 'One of them asked me what rank you were and when I told them, they said you wouldn't ever be promoted because of your history. They said you wouldn't be suitable to supervise at a higher rank because of your Taser history.' Eventually he walked away and went back to his desk in another part of the office. At 8.20am, I walked to his area and said, 'This happened at PSC?' He said, 'No, it was at a coffee cart.'"
4. The respondent also said of the conversation: "The details [the Senior Constable] disclosed are accurate enough for me to believe the information came from a person or persons with intimate knowledge of my police complaint history. I made contemporaneous notes about this conversation by sending myself an email to my work email address. I also contacted a Sergeant I know at PSC. That person advised me to report the matter to my Manager.... The officer who spoke to me does not work for PSC nor does his role entitle him having knowledge of my complaint history."
5. On 3 April 2023 the respondent filed an application for internal review and noted that the specific conduct he complained of was "Disclosure by PSC staff of my confidential complaint information to a colleague who is not entitled to know." The document used is a standard form, from the Information and Privacy Commission headed "Privacy Complaint: Internal Review Application Form". In the section which provides various boxes to tick, the respondent described his complaint by ticking the boxes for "security or storage of my personal or health information" and "disclosure of my personal or health information". In the section headed "When did you first become aware of this conduct (date)?", the respondent recounted the date and mentioned an email he had sent to himself which contained the text of the conversation.
6. On 13 April 2023, the appellant asked the respondent whether the internal review should include the 27 March email (which as recounted above, contained the text of the conversation). That day, the respondent replied in the affirmative.
7. The appellant treated the complaint dated 3 April 2023 as an application for internal review in respect of "Disclosure by PSC staff of my confidential complaint information".
8. On 20 July 2023, the appellant provided its decision in relation to the internal review to the respondent. The appellant found it had securely held the respondent's personal information and had not disclosed the respondent's personal information. The appellant also found that it had not used the respondent's personal information outside of the reasons for which it was collected. Accordingly, the appellant determined that no further action would be taken on the matter.
9. By application filed 11 August 2023, the respondent applied to the Tribunal for administrative review of conduct of the appellant, under s 55 of Privacy and Personal Information Protection Act 1998 (NSW) (Privacy Act or the PIPP Act). The appellant sought summary dismissal on the ground that the Tribunal was not seized of jurisdiction.
10. The Tribunal refused the summary dismissal application (the Decision).

Preliminary Question

1. A preliminary question arose as to whether the appellant may appeal as of right or must seek leave to appeal. Subsection 80(2) of the Civil and Administrative Tribunal Act 2013 (NSW) (NCAT Act) relevantly provides that appeals lie as of right on any question of law, unless the decision appealed is an interlocutory decision of the Tribunal.
2. "Ancillary decision" and "interlocutory decision" are defined by s 4(1) of the NCAT Act: ancillary decision of the Tribunal means a decision made by the Tribunal under legislation (other than an interlocutory decision of the Tribunal) that is preliminary to, or consequential on, a decision determining proceedings, including - (a) a decision concerning whether the Tribunal has jurisdiction to deal with a matter, and (b) a decision concerning the awarding of costs in proceedings. … interlocutory decision of the Tribunal means a decision made by the Tribunal under legislation concerning any of the following - (a) the granting of a stay or adjournment, (b) the prohibition or restriction of the disclosure, broadcast or publication of matters, (c) the issue of a summons, (d) the extension of time for any matter (including for the lodgment of an application or appeal), (e) an evidential matter, (f) the disqualification of any member, (g) the joinder or misjoinder of a party to proceedings, (h) the summary dismissal of proceedings, (h1) the granting of leave for a person to represent a party to proceedings, (i) any other interlocutory issue before the Tribunal.
3. The appellant submits that even though the Decision concerned a summary dismissal application, and a summary dismissal is expressly included at (h) in the definition of an interlocutory decision, the Decision was not an interlocutory decision. This is because, so it was submitted, it concerned the jurisdiction of the Tribunal and was, therefore, an ancillary decision as defined; and accordingly, leave is not required. However, at the hearing, the appellant applied for leave, in the event it was necessary.

The appellant's jurisdictional argument

1. The appellant contended, at first instance, that the pre-conditions to enlivening the Tribunal's jurisdiction had not been met. The argument was that the Tribunal's administrative review jurisdiction stems from s 55 of the Privacy Act and this was not enlivened, for the following reasons: 1. Section 55 is in Part 5 of the Privacy Act. Section 55 mandates that the conduct the subject of the administrative review, first, must be the subject of an application for internal review, in accordance with s 53 of the Privacy Act. 2. Section 53, in turn, only applies to conduct as defined in s 52 of the Privacy Act. 3. Section 52 (relevantly to this matter) provides that Part 5 applies only to conduct in contravention by a public sector agency of an information protection principle. 4. It was not possible for there to have been conduct in contravention of one of the information protection principles relied on by the respondent, because they each concern "personal information" and here, there was no personal information. That argument proceeded as follows: 1. The application for internal review concerned conduct alleged to be in breach of the Information Protection Principle (IPP) 5 (Retention and security of personal information) and IPP 10 (Limits on use of personal information) in ss 12 and 17 of the Privacy Act respectively. 2. The respondent couched his application for internal review as concerning "complaint information" and complaint information must be read as meaning "information about an individual arising out of a complaint made under Part 8A of the Police Act 1990". 3. Complaint information is expressly excluded from being personal information under s 4(3)(h) of the Privacy Act. 4. Therefore, the conduct does not concern personal information. 1. The appellant contended that Part 5 of the Privacy Act was, consequently, never engaged. 2. As a result, there was no entitlement to internal review (under s 53). Hence, there could never be an application for internal review and the Tribunal's jurisdiction could never be enlivened; as the pre-condition to s 55 of the Privacy Act, there being a valid application under s 53, could never be met.
2. The appellant confirmed at the hearing that the argument, as put at first instance, was that the Tribunal had no jurisdiction. It was not merely an argument that the application was bound to fail; it was not merely an argument that the Tribunal had no power to make the orders sought. The appellant maintained that the Tribunal had no authority to decide the matter.
3. The difference between jurisdiction (authority to decide) and power to resolve "a justiciable controversy of a kind which falls within the court's limits" is an important one: M Leeming, Authority to Decide: The Law of Jurisdiction in Australia (2nd ed, 2020, The Federation Press) at 2. There is a difference between "the power of the court to make an order, as opposed to its authority to decide": M Leeming, Authority to Decide: The Law of Jurisdiction in Australia (2nd ed, 2020, The Federation Press) at 32; Lacey v Attorney-General (Qld) (2011) 242 CLR 573; [2011] HCA 10 at [48], Osland v Secretary to the Department of Justice (No 2) (2010) 241 CLR 320 at [19]. See too Minister for Immigration and Multicultural and Indigenous Affairs v B [2004] HCA 20 at [6]: "In a legal context the primary meaning of jurisdiction is "authority to decide". It is to be distinguished from the powers that a court may use in the exercise of its jurisdiction." (Footnotes omitted)
4. These principles apply to the Tribunal.
5. We pause to note that the appellant initially accepted that there had been a valid application for internal review and purported to determine it. Nonetheless, her position changed. Parties cannot consent to jurisdiction: Turner v Kostoglou [2004] SASC 174 at [31]; Commissioner of Taxes v Tangentyere Council Inc (1992) 2 NTLR 76 at 79; Thomson Australian Holdings Pty Ltd v Trade Practices Commission (1981) 148 CLR 150; 37 ALR 66 at 75; Ridley v Whipp (1916) 22 CLR 381 at 386; Yirrell v Yirrell [1939] HCA 33; (1939) 62 CLR 287 at 295. It is a Court's (and it follows a Tribunal's) first duty to ensure it is seized of jurisdiction: Gaynor v Attorney General of New South Wales [2020] NSWCA 48 at [130]-[132]; Citta Hobart Pty Ltd v Cawthorn [2022] HCA 16 at [24] and [63]; NEC Information Systems Aust Pty Ltd v Lockhart (1991) 22 NSWLR 518; 101 ALR 95 at 97-98; Dyldam Developments Pty Ltd v Owners - Strata Plan 85305 [2020] NSWCA 327 at [45]; Wilson v Chan & Naylor Parramatta Pty Ltd [2020] NSWCA 213 at [16]. Accordingly, if there is no jurisdiction, the appellant's initial acceptance of an internal review application does not affect the result.

Determination of preliminary question

1. In AQO v Minister for Finance and Services (2016) 93 NSWLR 46; [2016] NSWCA 248 (AQO) Basten JA, after reviewing the definitions of ancillary and interlocutory decision, said as follows at [127]: "It is true that there is a specific reference to a decision regarding the jurisdiction of the Tribunal in the definition of ancillary decision and it may be inferred that the Appeal Panel thought that the specific reference to jurisdiction determined the issue. However, it appears from the chapeau to the definition of ancillary decision that one must determine that the decision is "other than an interlocutory decision" before coming to specific paragraphs which identify, non-exhaustively, what is meant by the term. If jurisdiction were determined as part of the final determination of a matter by the Tribunal, it might constitute an ancillary decision; however the refusal of a summary dismissal application, albeit based on an alleged absence of jurisdiction, is almost certainly an interlocutory issue, falling within either par (h) or par (i) of the definition of interlocutory decision."
2. His Honour then set out a contrary argument. Ultimately, it was of no moment to that appeal, but it is clear that his Honour preferred the view that the matter was interlocutory. Subsequently, in Commissioner of Police, NSW Police Force v Holmes [2021] NSWCATAP 202, the Appeal Panel, after considering his Honour's analysis in AQO and another argument to the contrary, determined that an application on jurisdictional grounds was indeed ancillary. It was noted there that other Appeal Panels had come to the same view. These included: DHU v Commissioner of Police, NSW Police Service [2018] NSWCATAP 282 at [25]-[35] and Dubow v Mid-Western Regional Council [2019] NSWCATAP 242 at [11]. In the interests of facilitating consistency and promoting public confidence in tribunal decision-making, we would follow these decisions unless we consider they are wrong: Australian Postal Corporation v Williams [2024] NSWCATAP 168 at [30]-[31]. We do not consider they are wrong.
3. Despite the persuasive weight of the obiter of Basten JA in AQO, we agree with the reasoning in Commissioner of Police, NSW Police Force v Holmes and respectfully follow the recent Appeal Panel decisions. For the following reasons we consider the Decision was an ancillary decision: 1. It concerned whether the Tribunal has jurisdiction to deal with an application - a matter expressly referred to in the definition of "ancillary decision". 2. The Tribunal's first task is to determine whether it has jurisdiction: as referred to above. The Decision was, therefore, preliminary to determination of the application - a matter detailed in the chapeau to the definition of "ancillary decision". 3. The importance of determining jurisdiction is so critical to the Tribunal's function, that leave should not be required if there is an allegation of error on a question of law.
4. On the ground that the appellant's application for summary dismissal was based on the contention that the Tribunal lacked authority to decide the matter, the Decision is an ancillary decision.
5. This is not impacted by the fact that the appellant sought summary dismissal under s 55(1)(b) of the NCAT Act. Section 55(1)(b) provides: 55 Dismissal of proceedings (1) The Tribunal may dismiss at any stage any proceedings before it in any of the following circumstances - … (b) if the Tribunal considers that the proceedings are frivolous or vexatious or otherwise misconceived or lacking in substance
6. The mere fact that the appellant relied on s 55(1)(b) of the NCAT Act could not change the fundamental nature of any decision to dismiss on grounds of want of jurisdiction. In Cornish v Penrith City Council [2024] NSWCATAP 107 at [12] the Appeal Panel noted that the NCAT Act does not provide, specifically, for dismissal for want of jurisdiction. An order to dismiss for want of jurisdiction is often made under s 55(1)(b) of the NCAT Act on the basis that the proceedings are misconceived.
7. Here, there was no dismissal at all; but had there been, it would not have been necessary for the Tribunal to dismiss the application under a specific provision of the NCAT Act. The Tribunal could simply have dismissed for want of jurisdiction. It would have been clear in those circumstances that the decision was ancillary. It follows, that it also does not change the nature of a decision that the application for summary dismissal failed.
8. The appellant may appeal as of right on a question of law.
9. If we are wrong, then the principles for leave to appeal would be relevant. These were recently, broadly, summarised by the Appeal Panel in Imbree v Chief Commissioner of State Revenue [2024] NSWCATAP 158 at [83]-[84]: "Leave to Appeal [83] Several cases in the Tribunal have considered when the Appeal Panel might grant leave to extend to the merits. Some of these were collected in FVA v Commissioner of Police, NSW Police Force [2024] NSWCATAP 127 and included: Ros v Commissioner of Police [2020] NSWCATAP 70 at [20]-[23], Collins v Urban [2014] NSWCATAP 17 at [82]-[84], Nakad v Commissioner of Police, NSW Police Force [2014] NSWCATAP 10 at [45]. See too Abdul-Karim v Council of the New South Wales Bar Association [2005] NSWCA 93 at [33]-[34]. [84] In order to obtain leave, the appellant must identify some point of principle or question of public importance, or an unorthodox approach to the fact finding, a finding that was unreasonably arrived at, or a clear injustice."
10. As the appeal concerns pure questions of law, this may have been an appropriate case for the grant of leave. However, had leave been necessary, we would not have granted leave. The reason against leave is that the appeal grounds are of no utility, as we do not consider that, even if they were made out, they could affect the result at first instance. The reasons for this are set out below.

Principles regarding questions of law

1. The Court of Appeal has recently focussed on the requirement that an appeal (under various statutes) be on a question of law. These include: Ferella v Chief Commissioner of State Revenue [2014] NSWCA 378, Thomas and Naaz Pty Ltd v Chief Commissioner of State Revenue [2023] NSWCA 40, Medical Council of New South Wales v Mooney [2024] NSWCA 180, Schwartz Family Co Pty Ltd v Capitol Carpets Pty Ltd [2017] NSWCA 223.
2. The principles were recently summarised in Imbree v Chief Commissioner of State Revenue [2024] NSWCATAP 158 at [24]-[26]: "[24] An appeal may be brought, under s 80 of the Civil and Administrative Tribunal Act 2013 (NSW), on a question of law, or with leave of the Appeal Panel, on any other grounds. The question of law must be a pure question of law and must be articulated with precision, as it is the subject matter of the appeal: Ferella v Chief Commissioner of State Revenue [2014] NSWCA 378 at [22]. It should be possible to discern the question of law from the notice of appeal: Thomas and Naaz Pty Ltd v Chief Commissioner of State Revenue [2023] NSWCA 40 at [71]. These authorities were recently applied by the Appeal Panel in Gennacker Pty Ltd t/as Homestead Holiday Park v Hohnberg [2024] NSWCATAP 96 at [11]. The Court of Appeal of NSW in Medical Council of New South Wales v Mooney [2024] NSWCA 180 at [96]-[97] recently reiterated the importance of identifying the question of law. [25] The Criminal Court of Appeal in Orr v Cobar Management Pty Limited (2020) 103 NSWLR 36; [2020] NSWCCA 220 at [48] and [109], identified that the pure question of law must be discernible on the face of the ground and not depend upon disputed facts: '[48] As was noted in Bass v Permanent Trustee Company Ltd (1999) 198 CLR 334; [1999] HCA 9 at [52], some questions of law can be decided without any reference to the facts, or may proceed by reference to assumed facts. These are sometimes described as 'pure questions of law'. This was the terminology used, for example, by Leeming and White JJA in strictly confining a grant of leave to appeal in Wilson v Chan & Naylor Parramatta Pty Ltd as trustee for Chan & Naylor Parramatta Trust [2020] NSWCA 62 at [11]; see also Medical Council of New South Wales v Lee [2017] NSWCA 282 at [77]; and Violi v Commonwealth Bank of Australia [2015] NSWCA 152 at [66] and [125]. … [109] Those questions of law should be, in our opinion, what are sometimes described as 'pure questions of law'. They should not draw the Court of Criminal Appeal into questions of fact. Moreover, they must be questions whose character as a question of law can be recognised on the face of the question, and not depend upon the answer given to the question.' [26] The relevant principles were recently stated by Chen J in Liu v Director of Public Prosecutions (NSW) [2024] NSWSC 382 at [87]-[90]. Of particular relevance to this case is what his Honour said at [89]-[90]: '[89] As to this last matter, what amounts to a question of law alone is as stated by Gibbs CJ in Williams v R (1986) 161 CLR 278, 287: … there is 'a question of law alone' if the question of law can be stated and considered separately from the facts with which it may be connected in a given case. [90] The question of law alone is not, however, an abstract or hypothetical question. Rather, the appeal is against the conviction 'on a ground that involves a question of law alone'. That requires that the answer to the question of law, and the consequential questions that follow from its resolution, be material to the outcome 'in the sense that it could have affected the outcome': Bimson, Roads & Maritime Services v Damorange Pty Ltd [2014] NSWSC 734 at [41] ; Styles v Rowley [2023] NSWSC 1053 at [50]-[51]; R v GAT [2024] NSWCCA 32 at [90]. In that way, the appeal against the conviction 'involves' the question of law alone.'"
3. Briefly put, it is critical that the question of law: 1. be a pure question of law; 2. not require the Appeal Panel to delve into the facts in dispute (noting that some pure questions of law concern facts, such as the 'no evidence ground' or as identified in Rogers v Vinoly [2016] NSWCATAP 2 at [11] - [14]; and 3. be capable of being identified as a question of law irrespective of the answer to the question.
4. Further, as an appeal is "on" any question of law, the question of law is the subject matter of the appeal. The question must not be hypothetical or arid. It must be capable of affecting the orders under appeal.
5. The last-mentioned point is particularly important to this appeal. It must be possible to identify that, if the grounds of appeal succeed, there is at least some possibility that the orders at first instance will be affected.

Questions of law and the appellant's grounds of appeal

1. The appellant's grounds of appeal are as follows: "1. Did the Tribunal constructively fail to exercise its jurisdiction under s 55(1)(b) of the Civil and Administrative Tribunal Act 2013 (the CAT Act) by failing to determine the appellant's properly articulated claim on s 4(3)(h) of the Privacy and Personal Information Protection Act 1998 (the PPIP Act)? … 2. Did the Tribunal err at law by asking itself the wrong question in the application of the exclusion to the definition of "personal information" contained in s 4(3)(h) of the PPIP Act? … 3. Did the Tribunal constructively fail to exercise its jurisdiction under s 55(1)(b) of the CAT Act and s 55 of the PPIP Act by failing to determine the appellant's properly articulated claim as the scope of the internal review application?"
2. The first and third grounds assert that the Tribunal constructively failed to exercise its jurisdiction. As identified by Basten JA in Alexandria Landfill Pty Ltd v Transport for NSW [2020] NSWCA 165 (Alexandria Landfill) at [6] and [22], this is a reference to a situation where there has been an "apparent" exercise of jurisdiction, but the exercise has failed in some relevant way and may raise a question of law. A constructive failure to exercise jurisdiction has been treated as raising a question of law: FLK v Transport for NSW [2023] NSWCATAP 140 at [22]-[27] and cases there cited. See too Day v SAS Trustee Corporation [2021] NSWCA 71, although that decision was concerned with appeals on a "point of law" for the purposes of s 142N(1) of the District Court Act 1973 (NSW) at [15].
3. The expression "constructive failure to exercise jurisdiction" is used in different contexts. It has been applied to a case where the contention is that there was a failure to deal with a substantial, clearly articulated argument, which may also constitute a breach of natural justice or procedural fairness: Alexandria Landfill at [9], citing Dranichnikov v Minister for Immigration and Multicultural Affairs [2003] HCA 26 at [24]-[25]. Notably, s 38(2) of the NCAT Act preserves the rules of natural justice. Breach of procedural fairness has also been treated as, potentially, raising a pure question of law: Kudrynski v Orange City Council [2024] NSWCA 33 at [52].
4. This is the sense in which the appellant uses the expression "constructively fail to exercise its jurisdiction".
5. Here, the grounds have been particularised (as set out below) and the Appeal Panel was provided with the evidence and submissions filed below. The foundation for the first and third grounds is part of the record below. There is no contest regarding the materials that were filed; and this is apparent from the Decision itself.
6. The first and third grounds may be determined without descending into a contest about facts. The errors, if made, are ones that will appear (or not appear) on the face of the Decision, by reference to the submissions and evidence before the Tribunal.
7. Accordingly, the first and third grounds of appeal raise pure questions of law.
8. The second ground of appeal raises the question of whether the Tribunal misconstrued the statute or asked itself the wrong question. This question goes to whether or not there has been jurisdictional error: Craig v South Australia (1995) 184 CLR 163 at 177-178; [1995] HCA 58 at [12]; Kirk v Industrial Relations Commission of New South Wales (2010) 239 CLR 531; [2010] HCA 1 at [71]-[74]. The second ground of appeal raises a question of construction, which raises a pure question of law.
9. Despite raising questions of law, for the reasons set out below, the Appeal Panel has determined that the appeal has no utility. As framed, we do not consider the appellant's argument goes to the Tribunal's jurisdiction.

Utility of the Appeal

1. As mentioned above, as the appeal is "on" a question of law, the questions of law (or consequent questions) must be capable of affecting the order the subject of the appeal. Further, for a breach of procedural fairness to rise to a jurisdictional error which raises a question of law, the breach must be material, in the sense that it could affect the result: Stead v State Government Insurance Commission (1986) 161 CLR 141 at 145-147; LPDT v Minister for Immigration, Citizenship, Migrant Services and Multicultural Affairs (2024) 98 ALJR 610; [2024] HCA 12 at [7], [14]-[16], [35]-[36].
2. On this appeal, the appellant seeks an order that the appeal be allowed and order 1 at first instance be set aside and the application be dismissed under s 55(1)(b) of the NCAT Act, for want of jurisdiction.
3. At first instance, the appellant did not submit that the information was not personal information such that the application was bound to fail; and the application should be summarily dismissed for that reason. The appellant brought the application, at first instance, on the basis that the Tribunal simply had no jurisdiction. This position is maintained on appeal.
4. In the circumstances, the utility of this appeal depends on the Appeal Panel being satisfied that if the appellant succeeds on her grounds, that the underlying application could be dismissed for want of jurisdiction. On the other hand, if the Appeal Panel is satisfied that the Tribunal has jurisdiction to hear and determine the application, even if the grounds of appeal are made out, there would be no utility in the appeal and the errors would not be material in the requisite sense.

Legislation and submissions in relation to jurisdiction of the Tribunal

1. Subsection 7(1) of the Administrative Decisions Review Act 1997 (NSW) (ADR Act) defines an administratively reviewable decision to be a decision of an administrator over which the Tribunal has administrative review jurisdiction. Subsection 9(1) of the ADR Act identifies that the Tribunal has administrative review jurisdiction over a decision, if enabling legislation provides that applications may be made to the Tribunal.
2. Before identifying the enabling legislation, we pause to note that s 6 of the ADR Act defines a decision to include "doing or refusing to do any other act or thing" and s 7(2) makes plain that conduct of an administrator can be the administratively reviewable decision. The note to s 7 of the ADR Act gives s 55 of the Privacy Act as an example of administrative review over conduct. Accordingly, the "decision" we are concerned with is conduct. As mentioned above, the conduct the respondent seeks to have reviewed is conduct he contends was in breach of an information protection principle.
3. Here, the enabling legislation is the Privacy Act: Privacy Act, s 55.
4. Significant to the appellant's argument is that where the enabling legislation makes provision for applications to be made to the Tribunal in respect of an administratively reviewable decision subject to conditions, then the jurisdiction of the Tribunal is only enlivened if the conditions are satisfied (s 9(2) of the ADR Act).
5. Relevantly, the conditions enlivening the Tribunal's jurisdiction are found in Part 5 of the Privacy Act: ss 52, 53 and 55. 1. Section 52(1) provides that the relevant Part, applies to certain conduct, including (at (a)) "the contravention by a public sector agency of an information protection principle that applies to the agency." 2. Section 53 provides that a person "who is aggrieved" by the conduct of a public sector agency is entitled to a review (internal review) of that conduct. 3. Under s 55, a person may apply to NCAT for "administrative review" under the ADR Act, of the conduct that was the subject of the application under s 53 of the Privacy Act (the internal review application).
6. For the reasons identified above, the appellant submits that it is impossible for there to be a contravention of an information protection principle because the conduct complained of does not (and cannot) concern personal information. It follows, so the appellant submits, that the respondent fails at the first hurdle and the conditions to enliven the Tribunal's jurisdiction are incapable of being satisfied.
7. Two further matters must be considered.
8. The first is easily disposed of. It relates to s 55(4)(b) of the ADR Act. That, in effect provides for the Tribunal to waive the requirement for there to be an internal review where it is in the interests of justice to do so. However, this provision has been held not to apply in relation to matters under the Privacy Act. Deputy President Hennessy said in CWS v NSW Department of Education [2017] NSWCATAD 287 at [15]: "While I accept that s 55 of the ADR is not expressly excluded by s 52(4) of the PPIP Act, s 55(4) does not arise for consideration in the context of an application under the PPIP Act. Applications under that legislation are different from applications under legislation where an administrator makes an administratively reviewable decision which is then subject to internal review. Under the PPIP Act, an application for internal review under s 53 of the PPIP Act is a pre-condition to an administrative review by the Tribunal under s 55 of that Act. The Tribunal has no power to deal with the additional conduct in this case because the applicants have not applied for an internal review in respect of that conduct. Section 55(4) does not give the Tribunal jurisdiction to do so."
9. With respect, the Appeal Panel finds her Honour's reasoning compelling and agrees, for the reasons there stated, that s 55(4) of the ADR Act does not apply in relation to the Privacy Act.
10. This decision has been followed numerous times: DMI v Commissioner of Police, NSW Police Force; DMJ v Commissioner of Police, NSW Police Force [2018] NSWCATAD 284, EJE v Nepean Blue Mountains Local Area Health District [2021] NSWCATAD 289, FHI v Dental Council of New South Wales [2022] NSWCATAD 347.
11. This position is consonant with the well accepted proposition that administrative review under the Privacy Act is limited to the conduct the subject of the internal review application. This position has been confirmed since, at least, Department of Education and Training v GA (No. 3) [2004] NSWADTAP 50 (GA (No.3)). There, the Appeal Panel was considering whether the Administrative Decisions Tribunal was exercising original or administrative review jurisdiction. The Appeal Panel concluded that it was indeed administrative review at [6], applying Fitzpatrick v Chief Executive Officer, Ambulance Service of NSW [2003] NSWADT 132.
12. At [7] the Appeal Panel in GA (No. 3) said: "The Tribunal has jurisdiction to review "the conduct that was the subject of the application" under s 53. Consequently, the Tribunal cannot review any conduct that was not the subject of the application to the agency. That conduct may be more accurately or specifically identified in subsequent correspondence or discussions between the applicant and the agency."
13. This passage has been cited and followed multiple times, including: for example, Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [17], [19]; Office of Finance and Services v APV and APW [2014] NSWCATAP 88 at [33]; and DMR v Lane Cove Council [2024] NSWCATAD 193 at [153].
14. The second matter that requires consideration is s 52(2) of the Privacy Act.
15. Section 52(2) provides as follows: "A reference in this Part to conduct includes a reference to alleged conduct."
16. The appellant accepted in written submissions that Part 5 of the Privacy Act "applies to conduct constituting the actual or alleged contravention by a public sector agency of an IPP that applies to the agency: ss 52(1)(a) and 52(2)". However, the appellant further submits that the alleged contravention must concern information that is (or at least, might be) "personal information". The appellant submitted that if the alleged contravention does not concern personal information, "the IPPs will not apply and there will be no 'conduct' of the relevant public sector agency that is properly the subject of internal review."
17. The appellant's submission is to the effect that, unless the contravention or alleged contravention concerns personal information, the information protection principle cannot apply to the agency and Part 5 is not engaged. If the conduct complained of could never answer the description of conduct covered by Part 5, there could be no contravention of an information protection principle and the appellant submits that the Tribunal has no jurisdiction at all. The conduct or alleged conduct is not conduct which entitled the respondent to seek internal review and therefore, he is not entitled to seek administrative review in the Tribunal. The jurisdiction, so it is submitted, is determined by reference to the specifics of the conduct complained of.
18. The appellant also submits that we already know that there is no possible contravention of an information protection principle. We already know that the information protection principles cannot apply to the respondent. This is because the respondent, himself, limited the application to information that was excluded from being personal information: "complaint information".
19. To the contrary, the respondent submits that the Tribunal had and has jurisdiction and cavils with the appellant's limited characterisation of the underlying application and complaint.

Determination in relation to jurisdiction

1. The Appeal Panel is satisfied that the Tribunal has and had jurisdiction in relation to the underlying application. The reasons are set out below.

Is the information capable of amounting to personal information?

1. Personal information is defined under in the Privacy Act by sub-s 4(1) as follows: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
2. However, the Privacy Act excludes certain information from the definition.
3. Section 4(3) relevantly provides that personal information does not include (at (h)): "information about an individual arising out of a complaint made under Part 8A of the Police Act 1990."
4. The appellant submits, at [33] of the Appellant's Chief Submissions (ACS): "Here, the objectively ascertained intention of the legislature in carving out of information 'arising out of' a pt 8A complaint was to exclude the dealings of such information from being subject to the IPPs, and the conduct to which the information pertains from the conduct reviewable under [s] 52(1)(a) of the PPIP Act and, therefore, under Pt 5 of the PPIP Act."
5. The appellant submits that the appropriate review avenue is instead to complain under pt 8A of the Police Act that complaint information was later misused: at [32] of the ACS.
6. The appellant submits that the underlying application for internal review was narrow. In the ACS at [47]-[49], [52], it is asserted that: "In these proceedings, the application for internal review was the complaint form sent by the respondent on 3 April 2023, which described the conduct the subject of the application as "Disclosure by PSC staff of my confidential complaint information to a colleague who is not entitled to know". … [T]he scope of the internal review application depends upon a fair reading of the application. The respondent submits the following in support of its articulation of the scope. … First, the application refers to the PSC. The PSC is the Command within the NSWPF responsible for investigating complaints under pt 8A of the Police Act. … Additionally, as an experienced police officer, the respondent can be assumed to be aware that the terms "complaint" and "complaint history" when referring to PSC personnel have a particular meaning in the NSWPF; namely complaints under pt 8A of the Police Act."
7. The appellant maintains that the conduct the subject of the internal review and the administrative review applications was disclosure of information "arising out of a complaint made under Part 8A of the Police Act 1990": "complaint information".
8. The appellant submits at [30] of the ACS: "First, the respondent did not and still does not dispute that the subject information of his internal review application concerned his 'confidential complaint information', that is, 'information … discovered through an 8A complaint'."
9. However, the respondent does not accept that his application was limited in the way characterised by the appellant. He maintains that he does not know the source of the information. The respondent does not confine the conduct in the same fashion as the appellant and submits that the conduct that he complains of and seeks review of, is disclosure of his personal information, which the conversation he recounted revealed had been wrongly disclosed by the appellant. He acknowledges that he described it as "complaint information" but maintains that this should not be a limiting factor. The respondent submits that he could not be expected to know the source and should not be taken to be limiting the application for internal review to a breach of a privacy principle concerning information "arising out of a complaint made under Part 8A of the Police Act 1990". The respondent relies on the text of the conversation that he submits, on its face, is not limited to information arising from "complaint information".
10. The appellant candidly accepted that the source of the information disclosed in the conversation has not been determined; but submitted nonetheless, that the respondent had deliberately limited the conduct complained of to the disclosure of the complaint information. As an experienced police officer, it was submitted that he should be taken to have understood what the expression meant and deliberately chose to use it.
11. For the following reasons, the Appeal Panel rejects the limited characterisation put on the application for internal review submitted the appellant.
12. Ultimately, the application for internal review must be read with the full text of the conversation. Fairly read, it complains of conduct which is alleged to be the wrongful disclosure of the respondent's personal information. Whilst the application specifies it to be "complaint information", the disclosure is evidenced by the conversation and the source of that information is, as yet, unknown.
13. The text of the conversation refers to: taser history, a probationer, and an ex-weapons instructor. The appellant accepted, at least, that information from a weapons instructor may fall outside the Part 8A complaint process.
14. The mere fact that the application refers to "complaint information" is not sufficient to limit it in the way sought by the appellant.
15. Nevertheless, even if the Appeal Panel was, ultimately, satisfied that the conduct the subject of the administrative review did not concern personal information, this would not deprive the Tribunal of jurisdiction (though it would mean the application at first instance was doomed to fail). Whether the information is personal information requires the determination of facts and the application of the statute to those facts. Determination of this requires the Tribunal to exercise its jurisdiction.
16. This is consistent with AF v RTA [2009] NSWADT 274 where the Administrative Decisions Tribunal said at [7] that whether the information is not personal information within the meaning of the legislation is a substantive issue rather than a jurisdictional issue and such a determination did not deprive the Tribunal of jurisdiction to deal with the application. It was there said: "A good example of this side of the application is the argument that, in relation to some of the complaints, the information about the applicant that was collected, disclosed or used, was in fact information about the applicant's suitability for employment in the public sector and therefore section 4(3)(j) of the Privacy Act (or s.5(3)(m) of the heath records legislation) has application. Should this section apply, then the legislation itself has no application and consequently, the respondent argues, the Tribunal is without jurisdiction to entertain any application based on the use of such information. Whilst the conclusion is correct, the reasoning that the Tribunal is without jurisdiction where the information involved falls within s.4(3)(j) is suspect. Where s.4(3)(j) applies to the information in question the consequence is that a respondent, when dealing with the information, is not required to observe the privacy requirements of the legislation. As the Act has no application, then it follows that there can be no breach of the Act by collecting, disclosing or using such information. This is a substantive issue, rather than a question of jurisdiction. Should the Tribunal determine that the information in question falls within the section, this is a determination within jurisdiction. It is the type of determination that the Tribunal must make in all cases that come before it and it involves simply determining whether, on the facts as found by the Tribunal, a provision of the Act is, or is not, satisfied. In the example under consideration, a finding that the information used is not personal information as defined has the consequence that any user of that information cannot amount to a breach of the legislation. A jurisdictional issue, on the other hand, involves determining whether a condition precedent to entertaining the application has or has not been fulfilled. Determining such an issue does not determine whether or not the legislation has been breached, as it is procedural rather than substantial in nature. A good example of a jurisdictional point is the question whether or not there has been internal review before the Tribunal is approached. If this requirement is not satisfied then the Tribunal is in fact without jurisdiction, even if the respondent has acted in breach of the legislation: in such a case the Tribunal cannot entertain the application, save for determining the question whether it has jurisdiction. A determination that a proceeding involves information that is not personal information as defined means that the legislation does not apply to the information in question so that any user of the information cannot constitute a breach of the Act: such a determination does not have the consequence that the Tribunal has no jurisdiction with respect to the application before it."
17. On a textual analysis, s 52(1) read with s 52(2) is not as limited as the appellant submits. Even assuming that the information is, ultimately, on a proper consideration, not personal information, there is nonetheless conduct, or more correctly, an allegation of conduct, that has breached an information protection principle that applies to the agency. The determination of whether or not the information is personal information is part of the ambit of the Tribunal's jurisdiction.
18. In due course, if the Tribunal determines that the information is not personal information, the application for administrative review will fail; there will have been no conduct in contravention of an information protection principle that applies to the agency. This result would arise from the exercise of the Tribunal's jurisdiction and not because of a want of jurisdiction.
19. Taking s 52(2) of the Privacy Act into account, s 52(1)(a) states, in effect, that the relevant Part of the Privacy Act applies to alleged conduct, including an alleged contravention by a public sector agency of an information protection principle that applies to the agency. Read with s 52(2) in mind, s 53 provides that a person "who is aggrieved" by the alleged contravention, is entitled to an internal review. It would then follow that where the alleged conduct or the alleged contravention was the subject of the internal review application, the Tribunal would have jurisdiction to hear and determine an administrative review application, pursuant to s 55 of the Privacy Act, limited to the alleged conduct.
20. This is consistent with several cases in the Tribunal where the expression alleged conduct was, variously, described as follows: 1. Infringing conduct that has "possibly occurred": EM v Department of Education and Training (No 2) [2010] NSWADT 141 at [11], which was set aside by the Appeal Panel but on different grounds. 2. Conduct which "might amount to a possible contravention of an information privacy principle": BVV v Commissioner of Police [2020] NSWCATAD 182 at [46]. 3. Conduct which "may have comprised a breach of her privacy": DYS v Hunter New England Local Health District [2020] NSWCATAD 68 at [48].
21. The respondent's application for internal review pointed to conduct which may have comprised a breach of his privacy and the Tribunal has jurisdiction to determine if there was such a breach in relation to the identified conduct - being the disclosure of his personal information, as evidenced by the conversation with the Senior Constable, where the source of the information is unknown. For the reasons set out above, the Appeal Panel rejects the submission that we are in a position to know that the information is not personal information simply from the way the complaint and application for internal review were framed. In any event the Appeal Panel is satisfied that this is not a matter that goes to jurisdiction.
22. Even if, on the appellant's construction, there can be no possible breach of the respondent's privacy, because the information is not or cannot be personal information, that is a matter for the Tribunal to determine within its jurisdiction. At least, the Tribunal must construe the application for internal review.
23. This is sufficient to dismiss the appeal.

Determination of Grounds

1. It is important for an intermediate appellate court (or similarly, the Appeal Panel) to consider whether to determine all grounds of appeal to dispose of the matter without remitting below: Kuru v State of New South Wales [2008] HCA 26 at [12], Imbree v Chief Commissioner of State Revenue [2024] NSWCATAP 158 at [46].

Ground 1

1. The Tribunal ultimately found, that whatsoever the scope of the exception in the paragraph (h) definition of personal information, it could not be engaged here, as the conduct complained of was disclosure which occurred before the Part 8A complaint. Accordingly, the conduct could not be conduct "arising out" of the complaint, no matter the scope of paragraph (h): Decision, at [70].
2. The appellant particularised Ground 1 in Annexure A to the Notice of Appeal as follows: "(a) the appellant's evidence was that three historical complaints were made regarding incidents of the respondent's taser usage in November 2013, April 2014 and August 2014 and that those complaints were investigated under pt 8A of the Police Act 1990 in 2013 and 2014 (Affidavit of Marc Holgate sworn 8 December 2023 at [21]-[23]); (b) the appellant's properly articulated submission was that the information, being 'disclosure by PSC staff of [the respondent's] confidential complaint information to a colleague who is not entitled to know' was information arising out of the 2013 and/or 2014 pt 8A complaints and was therefore excluded from the definition of 'personal information' in s 4(1) of the PPIP Act by s 4(3)(h) of the PPIP Act (Appellant's Submissions filed 13 December 2023 at [40]-[48], [60]-[61], [64]); (c) the Tribunal misunderstood and/or failed to consider the appellant's properly articulated claim (Reasons at [69]-[71]); and (d) contrary to the Tribunal's decision (Reasons at [69]-[71]), it was never contended by the appellant (or the respondent) that the 'information' the subject of the application arose out of the recent complaint made on behalf of the respondent under pt 8A of the Police Act in or around early 2023, being a complaint of misconduct of NSW Police Force officers regarding the improper use or disclosure of the respondent's confidential information as identified in the respondent's account of the conversation with [the Senior Constable] on 21 February 2023."
3. The Appeal Panel is satisfied that the submissions and evidence filed at first instance, accord with the particulars of this ground. There was no dispute about this.
4. Accordingly, it is apparent that the Tribunal, at first instance, erred in failing to determine a critical submission of the appellant. The Tribunal focussed on the complaint commenced in 2023 and not on complaints that were commenced in 2013 and 2014.
5. That is not to say, however, that the Appeal Panel accepts the appellant's submissions that the application concerns information which is not personal information. That question was considered above.
6. The Appeal Panel accepts that the Tribunal erred in failing to consider a critical submission of the appellant.

Ground 2

1. The appellant particularised ground 2 in Annexure A to the Notice of Appeal as follows: "(a) 'personal information' is defined in s 4(1) of the PPIP Act and is subject to the exclusions in s 4(3), including, per s 4(3)(h) 'information about an individual arising out of a complaint made under Part 8A of the Police Act 1990', (b) it is 'information' and not 'conduct' which is excluded by s 4(3)(h), with the consequence of that exclusion being that there is no 'conduct' that is properly the subject of an application for internal review to the agency per s 53 of the PPIP Act or, consequently, administrative review by the Tribunal pursuant to s 55 of the PPIP Act; (c) the Tribunal erroneously considered that the 'conduct' of the appellant, being the alleged conduct described in the respondent's account of his conversation with [the Senior Constable] on 21 February 2023, was not conduct arising out of the subsequent complaint by the respondent in or around early 2023 under pt 8A of the Police Act (Reasons at [70]-[71]), and (d) The Tribunal ought to have considered whether the 'information', being 'disclosure by PSC staff of [the respondent's] confidential complaint information to a colleague who is not entitled to know' was information arising out of the historical pt 8A complaints in 2013 and/or 2014 identified at paragraph 1(a) above and thereby excluded from the definition of personal information by s 4(3)(h) of the PPIP Act."
2. At [70]-[71] of the Decision, the Tribunal said: "[70] But, even giving the words "arising out of" their widest possible meaning, I fail to see how conduct occurring on 21 February 2023, and which therefore preceded the Pt 8A complaint, was conduct: • "arising out" of the subsequent Pt 8A complaint; or • "resulted" from the Pt 8A complaint; or • "proceeded" from the Pt 8A complaint; or • "originated" from the Pt 8A complaint. [71] As I say, the conduct preceded the Pt 8 investigation, and in fact was the cause of it of that investigation." (Emphasis in original)
3. The statutory task of the Tribunal was to determine whether the conduct, disclosure of information, was in contravention of a privacy principle. This would have required a finding that there was disclosure of personal information. The appellant's contention was that there could not be a contravention, as the information was not personal information. The task of the Tribunal, in that circumstance, was to determine whether the information was information arising out of a complaint under Part 8A of the Police Act 1990. The appellant contends that the Tribunal erred in not approaching the statutory task by asking this question.
4. The Tribunal misapprehended the statutory task. This was no doubt impacted by the misapprehension as to the appellant's underlying submissions concerning the historical complaints, which was considered in relation to Ground 1.

Ground 3

1. The appellant particularised ground 3 in Annexure A to the Notice of Appeal as follows: "(a) the appellant's properly articulated submission was that the scope of the application for internal review was limited to information arising out of the historical pt 8A complaints identified at paragraph 1(a) above (Appellant's Submissions filed 13 December 2023 at [39]-[51]); and (b) the Tribunal did not determine the appellant's submission as to the scope of the internal review application; and (c) had the Tribunal: (i) considered the appellant's properly articulated claim on s 4(3)(h) and/or (ii) asked itself the correct question in the application of s 4(3)(h), it ought to have considered and accepted the appellant's submission as to the scope of the internal review application."
2. The Appeal Panel accepts that the Tribunal erred in failing to determine the scope of the internal review application. Once again, this appears to have been impacted by the misapprehension as to the appellant's submissions, the subject of Ground 1.
3. Nevertheless, for the reasons expressed above, even if the scope of the application turns out to be as limited as the appellant contends, this would not have deprived the Tribunal of jurisdiction.

Non-publication order

1. A non-publication order was made, in relation to the name of the (now) respondent, during the course of the first instance proceedings. No issue was raised that a similar order should not be made for the purposes of these proceedings and so the Appeal Panel makes such an order.

Conclusion

1. Despite making out the grounds of appeal, the Appeal Panel dismisses the appeal. The appeal was brought on the very narrow point that the Tribunal, in effect, erred in failing to dismiss the underlying appeal for want of jurisdiction. For the reasons outlined above, the Tribunal was indeed seized of jurisdiction and so the appeal has no utility and the errors were not material.
2. The underlying application is to proceed in the Tribunal in the usual course.

Orders

1. The Appeal Panel orders: 1. The appeal is dismissed. 2. The originating application is listed for directions on 24 September 2024 with a view to the matter being progressed to hearing, in the ordinary course. 3. Pursuant to s 64(1)(a) of the Civil and Administrative Tribunal Act 2013, the name of the respondent is not to be published. The respondent is to be known by the pseudonym FYH.

---

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 09 September 2024