Commissioner of Police (NSW Police Force) v DVT

NCAT Appeal Panel|2022-03-18

Introduction

The Appellant (the Commissioner) appeals a decision published on 30 April 2021 (referred to as the Breach Decision) and a decision published on 8 October, 2021 (referred to as the Remedies Decision). Although the proceedings at first instance bear different file numbers, they are in fact the same set of proceedings. In the proceedings the Tribunal was exercising its jurisdiction under the Privacy & Personal Information Protection Act 1998 (NSW) (the PPIP Act). By s 55(6) of the PPIP Act, the Privacy Commissioner has a right to appear and be heard in any proceedings before the Tribunal in relation to an administrative review under that Act. The Privacy Commissioner did not exercise her right of participation in the proceedings at first instance but has exercised that right in relation to these appeal proceedings.
The effect of the Breach Decision was to find that the Appellant had breached s 14 of the PPIP Act in respect of the Respondent's access requests in emails identified as emails 1 to 5 to provide access to personal information held by the Appellant in respect of the Respondent. In relation to another email (identified as email 6) the effect of the Breach Decision was to make a finding that the Appellant had not breached s 14. The Tribunal also made directions for the parties to file submissions "as to remedy". Subsequently, a decision was made to determine the remedy without a hearing by determination on the papers.
The effect of the Remedies Decision was to order that the Appellant was to refrain from repeating any of the conduct of concern detailed in the Breach Decision and conduct similar to it "in contravention of IPP7 in relation to any IPP7 access requests" made by the Respondent. There was a further order that within 30 days of 8 October 2021 the Appellant is to "perform IPP7 by providing the [Respondent] with access to all of the [Respondent's] personal information requested in emails 1-6".
On 5 November 2021 the Appellant lodged a Notice of Appeal with respect to both the Breach Decision and the Remedies Decision. On 3 December 2021, the Appeal Panel made an order by consent, staying the operation of orders 1 and 2 made in the Remedies Decision until finalisation of the appeal on the condition that the Appellant provides the Respondent access to certain personal information. Neither in the written submissions, nor at the hearing of the appeal, were we provided with evidence or submissions as to whether the Respondent had obtained access to the personal information identified in the orders made on 3 December 2021.

Summary of the directions hearing held 10 December 2019

The discussion concerned a deed dated 22 November 2011 (described as a Deed of Release) between the Appellant and the Respondent. By the deed the Respondent received a sum of money in full and final settlement of certain proceedings, complaints, requests and other matters identified in the deed. The deed provided for the Respondent to release the Appellant with respect to those proceedings, complaints and requests and other matters identified in the deed.
At the directions hearing a solicitor representing the Appellant gave an undertaking to the Respondent to "not run the deed argument at the breach stage" (see page 491 of the appeal book). Subsequently, the Appellant sought to rely upon the deed in respect of the Respondent's application considered and determined in the Breach Decision, and therefore a question arose as to whether the deed could be relied upon in view of what had occurred at the directions hearing.
A summary of the two decisions under appeal is set out in the following paragraphs.

Summary of Breach Decision

The Breach Decision identified the two applications brought by the Respondent (as the Applicant) pursuant to s 55 of the PPIP Act. The first was an application dated 24 April 2019 for administrative review of the conduct of the Appellant, which was the subject of an internal review decision under s 53 of the PPIP Act, which decision is dated 26 March 2019. The Respondent's request for internal review was dated 15 January 2019.
The second application was dated 23 July 2019 for administrative review of the Appellant's conduct which was the subject of an internal review decision under s 53 of the PPIP Act, which decision is dated 26 June 2019. The Respondent's request for internal review was dated 26 April 2019.
Both of the applications were, by consent of the parties, consolidated and heard together. On 21 May 2020 a directions hearing occurred, and by a consent order it was determined that the Tribunal would first hear and determine whether there has been breach of s 14 of the PPIP Act by the Appellant. If breach was found remedies were to be addressed later [4]. The Tribunal recorded that the Appellant had sought to "unilaterally withdraw from the undertaking given at the directions hearing on 10 December 2019 by a letter dated 30 April 2020 to the Respondent. The Tribunal found that it was required to determine the "validity of that withdrawal" [5].
The Respondent's first request for internal review referred to 5 email messages sent by the Respondent requesting access to personal information under s 14 of the PPIP Act and requested an internal review by the Appellant on the basis that the Appellant had failed to provide the Respondent with access to personal information as requested by those emails without excessive delay [7]. The Respondent alleged that the Appellant was in breach of s 14 of the PPIP Act.
The five emails are referred to in the Breach Decision at [7] including a brief description of the nature of the information requested at [8].
The second application for internal review referred to and attached an email (identified as email 6) sent to a Ms Keating requesting access to certain information arising out of the Respondent's application for ex gratia legal assistance.
With respect to all six emails the Respondent alleged that the Appellant had failed to provide access to his personal information without excessive delay.
At [10] the Breach Decision summarised the findings of the Appellant's internal reviewer in respect of the emails. The reviewer found, in part, that there was no breach of s 14 (ie. no excessive delay) because the request had not been directed or posted to the relevant personnel or, in the case of Ms Keating, that the Appellant had not received or was not aware of the access request because for a period Ms Keating had been on maternity leave and then resigned without returning to work.
In addition, the internal review noted (as recorded at [12]) that searches had been conducted for information falling within the scope of the request in email 6 which searches had located a large amount of information and, in the opinion of the internal reviewer, further searches would be necessary to identify the Respondent's information. It was contended that there would be an unreasonable and substantial diversion of the Respondent's resources were further searches to be undertaken.
At [13] the Tribunal identified three issues for determination. The first was whether the so-called withdrawal of the undertaking concerning the deed was valid. The second was the consequences of the decision in relation to the withdrawal of the undertaking on the scope of the Tribunal's enquiry in relation to the alleged breach by the Appellant of IPP7. That is to say, can the Appellant rely on certain terms of the deed to argue that IPP7 has not been breached. The third issue was to determine whether the Appellant's conduct breached IPP7 having regard to the determination of the second issue.
At [38] the Tribunal dealt with the so-called undertaking not to run the deed argument. The Tribunal referred to the fact that the undertaking was made during an application for the issue of a summons by the Respondent and at [39] the Tribunal found that the undertaking was made "in order to persuade the Applicant (ie. now the Respondent) to drop the request in their Summons Application in relation to a number of documents which had originally been requested by the Applicant to be included in that summons, which the Applicant did."
On 6 March 2020, the Appellant made written submissions concerning the deed and its provisions in relation to their impact on the s 14 PPIP Act breach issue [40]. Those submissions set out "legal excuses" for the Appellant not to comply with s 14. These included reliance upon s 25(a) and (b) of the PPIP Act for the purpose of arguing that non-compliance had been lawfully authorised or permitted by the terms of the deed. The submissions also relied upon s 24(1) of the PPIP Act by submitting that compliance with s 14 in respect of certain of emails would detrimentally affect the Appellant as an investigative agency or prevent the proper exercise of the Appellant's complaint-handling functions, in this case by undermining the Appellant's ability to resolve complaints via a private settlement (ie. by way of the deed) [40].
The Breach Decision refers to a letter dated 30 April 2020 by which the Appellant purported to withdraw the undertaking. At [41] the Tribunal recorded that the position of the Appellant was that the undertaking was not given to the Tribunal and therefore it was not necessary for the Appellant to seek to be released from it by the Tribunal. The Tribunal recorded that the Appellant's letter stated that the Appellant now "considers that that (ie. the deed and its effect) is an issue which properly and necessarily goes to the question of breach, rather than remedy". The Tribunal further recorded that the Appellant submitted that the Respondent to this appeal was allowed further time to provide evidence and submissions in connection with the summons or issue a new summons and, further, that two of the three documents sought in the proposed summons had since been provided by the Appellant to the Respondent.
At [44] the Tribunal found that the Appellant "cannot unilaterally withdraw from the Undertaking". The Tribunal found that, given that the Respondent (ie. the Applicant) has not released the Appellant's solicitor from the undertaking and wishes it enforced, the proposed withdrawal is not valid.
The Tribunal then stated that, because the undertaking "stands", the Tribunal has not considered the Appellant's submissions relating to or referring to the deed or its provisions.
At [47] the Tribunal stated that as the purported unilateral withdrawal of the undertaking is not valid, the Tribunal is satisfied that the issue should be brought to the attention of the New South Wales Legal Services Commissioner for consideration and such action as the Commissioner determines is appropriate.
From [48] the Tribunal dealt with the question of breach under s 14 of the PPIP Act. The Tribunal recorded that the Appellant accepted that emails 1 to 6 constituted requests by the Respondent for access to personal information and that other than in respect of email 5, the Respondent had received no response to the emails. The Tribunal further found that emails 1 to 5 were sent to email addresses of the Appellant and were received by the addressees.
After reciting the submissions of the parties, the Tribunal, from [55] onwards, recorded its findings. These are summarised as follows: 1. IPP7 does not include in its wording any qualifications, requirements or conditions to an individual's exercise of their right to access their personal information held by an agency. An applicant's history with the agency or experience otherwise with PPIP Act access requests do not generally limit the exercise of one's right under IPP7 to access personal information [55]. 2. No specified means of contacting an agency in respect of an IPP7 access request is binding on or otherwise restricts an individual in the exercise of their right under IPP7 [56]. 3. As long as the email address is a valid email address of the agency, an employee of the agency or "function or area" of the agency and the email was received by the addressee, then the agency has received the access request for the purposes of the PPIP Act. It is up to the agency to have in place appropriate measures to ensure that all such access requests are appropriately referred internally, and dealt with without excessive delay [57]. 4. In the Appellant's case where the request is made in person to a police officer in a police station in remote New South Wales, for example, additional time granted in which to comply with IPP7 may likely be a little longer than if the request was emailed to an employee, area or function in the main or the head office of the Respondent. Circumstances "may come into play" in determining whether there has been excessive delay in a specific case which may allow a longer period than in other circumstances in which to provide access [58]. 5. It was the Appellant's obligation to implement appropriate processes, escalation procedures and training of all its personnel to ensure that the Respondent receives a personal information access request under IPP7 and that all requests are directed to the appropriate person. Should a staff member whose out of office message indicates that they will return on a specified date not return to work, it is beholden on the agency at the time they know that the staff member will not be returning to work to check that staff member's email address/inbox to ensure that any access request received is being processed [59]. 6. It is not incumbent on an individual who has applied to an agency under IPP7 to follow-up or chase that agency in relation to their access request [60]. 7. Simply because a broad access request is made under IPP7 that may include some exempt information or information for which non-compliance by the Respondent is excused, it is not sufficient grounds to deny access to all personal information the subject of the access request. The access request must be fulfilled by withholding only that personal information exempted from access. It is not acceptable for the Respondent to claim that the Applicant's access request is too widely framed and therefore the Respondent is excused or exempt from disclosing any of the Applicant's personal information [61]. 8. Where access is denied based on any lawful excuse or exemption then "in the spirit of IPP7" that agency should notify the individual of this without excessive delay in order to enable the individual to pursue, if they wish, an internal review [63]. 9. The following are the periods within which the Respondent should have provided access to the personal information requested for each of emails 1 to 5: 1. email 1 - 60 days given the potential volume and requirement of the Respondent to sort through relevant personal information and determine which, if any, is exempt plus an additional seven days given the request was not made to the person specified in the Appellant's Privacy Management Plan (PMP) making a total of 67 days from receipt. 2. email 2 to 5 - 37 days each [65]
At [65] the Tribunal found the delay in the case of each email numbered 1 to 5 was excessive. In the case of emails 1 to 5 the delay ranged from approximately 200 days to over 600 days. There was no excessive delay in the case of email 6 because the Tribunal found that the Appellant did not receive the Respondent's access request until the date of the second application for administrative review. The Respondent did not breach IPP7 in respect of email 6 [66].
The Tribunal made seven orders. The first order was in the nature of a declaration or finding by which the Tribunal stated that the withdrawal of the undertaking made by the Appellant's solicitor was not valid and that the undertaking remained in place. Order 2 was a finding that the Appellant had breached IPP7 in respect of the Respondent's requests in emails 1 to 5. Order 3 was to the effect that the Appellant did not breach IPP7with respect to email 6. Orders 4 to 6 inclusive were directions for the parties to file and serve submissions as to the appropriate remedy and order 7 was a direction to the Registrar of the Tribunal to forward a copy of the Tribunal's reasons to the New South Wales Legal Services Commissioner.
The following is a summary of the Remedies Decision: 1. The Tribunal referred to s 55(1) of the PPIP Act which is in the following terms: 55 ADMINISTRATIVE REVIEW OF CONDUCT BY TRIBUNAL (1) If a person who has made an application for internal review under section 53 is not satisfied with-- (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. 1. The Tribunal identified the "conduct of concern" in two categories. It described "conduct of concern 1" as the conduct described in the first application for administrative review (made on 15 January 2019 and decided on 26 March 2019) by which the Respondent stated that the Appellant had failed to provide access to personal information in emails 1 to 5. The second aspect was described as "conduct of concern 2" and it related to the second application for administrative review (made on 26 April 2019 and decided on 26 June 2019). It concerned the Respondent's request concerning email 6.
The Tribunal repeated the fact that in the Breach Decision, the Tribunal had found that the Appellant had failed to provide access to the requested information and that in respect of emails 1 to 5 there was excessive delay in providing such access. The issue for the Tribunal to determine was the remedies to be awarded based upon the findings as to "liability" in the Breach Decision including enforcement of the Respondent's right to access their personal information under IPP7 [18]. The Tribunal then stated that if the Appellant wished to claim that it is exempt or excused from performance of IPP7, in whole or in part, it is incumbent on the Appellant to raise and, ultimately, establish such before the Tribunal and that the Appellant had not done so in this case [18]. At [19] the Tribunal stated that it was satisfied that an order under s 55(2)(c) of the PPIP Act requiring performance of IPP7 is appropriate. At [21] the Tribunal stated that it is appropriate to order the Appellant to refrain from repeating the conduct of concern or similar conduct in contravention of IPP7. The Tribunal stated it had power to make such an order under s 55(2)(b) of the PPIP Act.
At [24] the Tribunal made two orders. Order 1 was to the effect that from the date of the Remedies Decision, the Appellant is to refrain from repeating any of the conduct of concern and conduct similar to it in contravention of IPP7 in relation to any IPP7 access requests made by the Respondent. Order 2 was to the effect that within 30 days from the date of the publication of the Remedies Decision, the Appellant will perform IPP7 by providing the Respondent with access to all of the Respondent's personal information requested in emails 1‑6.

Notice of Appeal

A Notice of Appeal was lodged on 5 November 2021 with respect to both the Breach Decision and the Remedies Decision. The Notice of Appeal stated that an extension of time is required to appeal the orders made on 30 April 2021 (the Breach Decision orders).
In respect of the Breach Decision, the Notice of Appeal stated that the Appellant challenges the following "orders": 1. The purported unilateral withdrawal of the undertaking made by the [Appellant's] solicitor is not valid and the undertaking remains in place and is effective against the Appellant. 2. The [Appellant] has breached s 14 PPIP Act/IPP7 in respect of the Respondent's requests in emails 1-5 to access their personal information held by the [Appellant].
The grounds of appeal may be summarised as follows: 1. The Tribunal erred by identifying the wrong issue or asking the wrong question with respect to the undertaking when it posed as an issue for determination at the hearing the question of whether the purported withdrawal of the undertaking was valid. 2. The Tribunal erred in law by purporting to enforce the undertaking when it was beyond its power to do so. 3. The Tribunal erred at law by failing to give adequate reasons for its finding that the undertaking could not be withdrawn. 4. The Tribunal erred by failing to take into account the submissions made by the Appellant in support of its withdrawal of the undertaking. 5. The Tribunal erred by denying the Appellant procedural fairness in rejecting, and failing to have regard to, the Appellant's submissions insofar as they related to or referred to the Deed of Release executed by the Respondent and the NSW Police Force and the effect of the deed on the Appellant's obligations under s 14 of the PPIP Act. 6. The Tribunal constructively failed to exercise its jurisdiction in that it failed to resolve material issues presented for determination regarding the scope of its jurisdiction. Specifically, the Tribunal did not resolve: 1. the precise parameters of the conduct that was the subject of the Respondent's internal review applications; 2. whether the scope of the internal review application (that is the Appellant's conduct in response to the requests for access pursuant to s 14) was limited to whether the Appellant had failed to provide the Respondent with access to his personal information without excessive delay; or 3. whether the scope of the internal review applications extended beyond the question of excessive delay to the Appellant's failure to provide the personal information requested and the Respondent's entitlement to that personal information. 1. Additionally, or in the alternative to 6 above, to the extent that the Tribunal did resolve the question of the scope of its jurisdiction, it erred by identifying the wrong issue or asking the wrong question insofar as it sought to construe the scope of the Respondent's internal review requests solely by reference to part only of the Respondent's requests for internal review and without regard to either the entirety of each internal review request (which refers to the Appellant's failure to acknowledge the Respondent's applications) or the factual circumstances surrounding the conduct that was the subject of the internal review requests. 2. The Tribunal erred at law in finding that the Appellant breached IPP7 by refusing to provide or denying access to the Respondent's personal information sought by emails 1 to 6 on the basis that the Appellant was exempt from compliance with respect to some of the information requested in that: 1. at the time the Respondent made his internal review applications, the requests for access to personal information had not been assessed or determined by the Appellant; 2. the scope of the Respondent's internal review applications was therefore limited to the question of whether there had been excessive delay by the Appellant in responding to the Respondent's requests for access to personal information; 3. a finding regarding a refusal to provide or denial of access to the Respondent's personal information was outside the scope of his internal review applications as there had been no response, refusal or denial of his requests for access; and 4. as a consequence, the Tribunal's finding was beyond the scope of its review of the Appellant's conduct and was therefore in excess of its jurisdiction. 1. The Tribunal erred at law in finding that the Appellant breached IPP7 by failing to provide the Respondent with access to the information requested for the same four reasons described in 8(a) to (d). 2. In the alternative to 8 above, the Tribunal erred by denying the Appellant procedural fairness, in that it purported to determine the issue of the Respondent's entitlement to personal information he had requested without first giving the Appellant the opportunity to adduce evidence going to the question of any lawful excuse for exemption from compliance with s 14 that may apply to the information that was sought. 3. The Tribunal erred by failing to properly apply s 14 of the PPIP Act, insofar as it determined that there can be no fetter on the means of making or to whom or to which part of an agency a request under s 14 of the PPIP Act is made in that it failed to construe s 14 of the PPIP Act within the context of the PPIP Act as a whole, and in a manner that promotes the underlying purpose and objects of the PPIP Act. 4. The Tribunal erred in making the following findings of fact when there was no evidence to support such findings: (a) that an unidentified subset of the Respondent's personal information requested by email 1 was not exempt from access and should have been granted without excessive delay. (b)-(e) the Respondent submits the same with respect to emails 2 to 5 inclusive. 1. The Tribunal erred in finding that the undertaking was in the nature of a solicitor's undertaking provided to the Appellant's solicitors when the undertaking was given by the Appellant's solicitors on its behalf. 2. The Tribunal erred in finding that the Appellant had either refused or denied the Respondent access to his personal information as at the time the internal review applications were made, either on the basis that it was excused or exempt from disclosing any of the Respondent's personal information the subject of the access requests or at all.
The Notice of Appeal seeks orders from the Appeal Panel to the effect that the decision made on 30 April 2021 be set aside and that the decisions of the Appellant made on 28 March 2019 and 26 June 2019 be remitted to it for reconsideration under s 65 of the Administrative Decisions Review Act 1997.
The Appellant submits that it requires leave to appeal in relation to grounds 13 and 14. Leave is sought on the basis that the errors are readily apparent and give rise to an injustice that is reasonably clear, that the errors were fundamental to the Tribunal's ultimate determination and in the case of ground 13 gave rise to errors of law.
In respect of the application to extend time in which to appeal, the grounds of appeal state that it was not clear to the Appellant until the Remedies Decision was delivered that it would be necessary to appeal the Breach Decision. The Appellant elected to await the Tribunal's delivery of its reasons in the Remedies Decision before determining to bring an appeal of the Breach Decision. No prejudice will be suffered by the Respondent in relation to his opposition to the appeal as a result of an extension of time being granted.
With respect to the Remedies Decision the grounds of appeal may be summarised as follows: 1. The Tribunal erred by failing to properly apply s 14 of the PPIP Act, insofar as it determined that s 14 provides an individual with an unfettered right to access his or her personal information that is held by a public agency. 2. The Tribunal erred by identifying the wrong issue or asking the wrong question insofar as it sought to construe the scope of the Respondent's internal review requests solely by reference to part only of the Respondent's requests for internal review and without regard to the entirety of each internal review request which refers to the Appellant's "failure to acknowledge" the Respondent's applications for access to his personal information and the factual circumstances surrounding the conduct that was the subject of the internal review requests. 3. The Tribunal erred by identifying the wrong issue or asking the wrong question in asking whether or not the Appellant had established a "lawful basis for non-performance (ie. refusing access)" [16(2)] when there had been no refusal of access or denial of the request for access, but rather a delay in responding to those requests for access and the Appellant had not, at the time of the internal review requests, given consideration to whether or not there was a lawful basis for non-performance or refusal to provide access. 4. The Tribunal erred by applying a wrong principle of law in determining that its task was to determine the real issues in dispute in accordance with the guiding principle provided by s 36 of the Civil & Administrative Tribunal Act 2013 (NSW) (the NCAT Act) when its task was instead to determine the correct and preferable decision having regard to the relevant factual material before it and within the parameters of the scope of its jurisdiction based on the conduct that was the subject of the internal review requests. 5. The Tribunal erred at law, in ordering the Appellant to provide the Respondent with access to the information requested by emails 1-6 when that information, or a subset of it, is or may be: 1. subject to an overriding public interest against disclosure, such that, by operation of s 20(5) of the PPIP Act, the Appellant is not authorised to disclose it; 2. exempt from disclosure pursuant to ss 25(a) or (b); 3. exempt from disclosure pursuant to s 24(1); 4. exempt from disclosure pursuant to s 27; or 5. exempt from disclosure on the basis that providing the Respondent with access to all or some of that information would require an unreasonable and substantial diversion of the Appellant's resources, contrary to s 60(1)(a) of the Government Information (Public Access) Act 2009 (imported into the PPIP Act pursuant to s 20(5) of the PPIP Act); and the Appellant had not yet had an opportunity to undergo an assessment as to whether any of the above conditions on or exemptions from disclosure apply to the information requested.
The Notice of Appeal submits that the Appeal Panel should set aside the decision of the Tribunal made on 8 October 2021. The further submission is made that the decisions of the Appellant made on 28 March 2019 and 26 June 2019 be remitted to it for reconsideration under s 65 of the Administrative Decisions Review Act, 1997.

Reply to Appeal

The Respondent opposes the appeal and submits that leave to appeal should be refused.

Appellant's Submissions

The Appellant's submissions set out the basic background facts which are summarised in the following paragraphs: 1. Between 11 May 2017 and 20 December 2018, the Respondent made six separate requests by email to the Appellant for access to his personal information. Each email identified the categories of information requested. 2. On 15 January 2019 the Respondent made an application for internal review by the Appellant pursuant to s 53 of the PPIP Act in relation to the conduct of the Appellant concerning emails 1 to 5. On 24 November 2019 the Respondent made an application for internal review by the Appellant in relation to the Appellant's conduct in connection with email 6. 3. It appears that the Respondent received no responses to his email requests with the exception of email 5 to which the Respondent received a reply. 4. In relation to the first of the two applications for internal review, the Appellant concluded that there had been no contravention of s 14 of the PPIP Act. The Appellant relied on two separate bases for this finding. The first was that there had been no failure to comply with the requests without excessive delay because the requests had been directed to the incorrect persons or business unit within the Appellant and had been overlooked or incorrectly processed (which the Appellant has termed the "Misdirection Argument"). The second basis was that the Appellant was lawfully authorised not to comply with the requests made in emails 1, 2 and 3 owing to the effect of the Deed of Release between the parties dated 22 November 2011. The Appellant took the view that the release provided by clause 7 of the deed discharged the Appellant from having to deal with the access requests contained in emails 1, 2 and 3. The Appellant was relieved of its obligation to respond to requests by reason of the exemption to compliance, provided by s 25(a) of the PPIP Act. Before the proceedings in the Tribunal, the Appellant also relied upon ss 25(b) and 24(1). 5. With respect to the second application for internal review. The Appellant also concluded that there had been no contravention of s 14 of the PPIP Act relying on the Misdirection Argument. 6. On 24 April 2019 the Respondent commenced proceedings in the Tribunal in respect of the first application for internal review and on 23 July 2019 commenced an application in the Tribunal in respect of the second application for internal review. The proceedings were subsequently consolidated. 7. On 23 October 2019 the Respondent applied for a summons to be issued which summons was opposed by the Appellant. On 10 December 2019 a hearing was conducted in relation to the summons. A lawyer for the Appellant informed the Tribunal member conducting that hearing that the Appellant would not be relying upon the deed, except in connection with any remedies. The representative, in effect, gave an undertaking to the Respondent not to "run the deed argument at the breach stage". 8. However, the Appellant's submissions lodged with the Tribunal on or about 6 March 2020 included the "Deed Arguments". On 30 April 2022 the Appellant wrote to the Respondent advising him that the Appellant withdrew from the undertaking. The Respondent did not accept that the Appellant was permitted to rely on the Deed Arguments at the breach stage of the hearing and the issue was deferred to be determined by the Tribunal at the substantive hearing on breach. This is recorded at [5] Breach Decision. 9. A hearing occurred before the Tribunal on 2 November 2020 and with the consent of the parties, the hearing was limited to the question of whether there had been a breach by the Appellant of s 14 of the PPIP Act with the question of remedies to be addressed later if breach were found. 10. The Appellant's case before the Tribunal relied upon evidence concerning searches made by the Appellant's officers to locate the Respondent's email requests (ie. emails 1 to 5). Those searches did not locate email 6. The Appellant did not adduce evidence going to the question of the Respondent's entitlement to the personal information he sought. Nor did the Appellant make any submissions as to the issue of entitlement. The issue of entitlement to the information and whether any exemptions from compliance might apply to the Appellant under the PPIP Act was not addressed by either party. 11. The Appellant relied upon the Misdirection Argument, and the Deed Arguments to contend that there had been no contravention of s 14 of the PPIP Act. 12. In particular, the Appellant contended that the requests contained in emails 1, 2 and 3 were barred by the operation of the Deed. The Appellant was relieved of its obligations to respond to the requests contained in emails 1, 2 and 3, by operation of the Deed in concert with s 25(1) or (b) of the PPIP Act. The Appellant also relied upon s 24(1) in connection with emails 1, 2 and 3 on the basis that compliance would detrimentally affect the agency's complaint-handling functions or any of its investigative functions.
The Appellant's submissions summarised the findings of breach made by the Tribunal. The Tribunal found that the Appellant had breached s 14 in respect of the access requests concerning emails 1 to 5 because the Appellant had failed to provide the Respondent with access to personal information without excessive delay. The Tribunal rejected the Misdirection Arguments for the reasons earlier recorded above.
In the Remedies Decision, the Tribunal considered that in its Breach Decision it had determined that the scope of its jurisdiction included not only the question of excessive delay but also extended to a consideration of the Appellant's failure to provide access to the requested information.

Grounds 1-5 and 13: the Undertaking

The Tribunal erred in finding that the undertaking was in the nature of a solicitor's undertaking whereas it was in fact an undertaking given on behalf of the Appellant. This is apparent from the transcript of the hearing held on 10 December 2019 concerning the summons application and the hearing on 2 November 2020. In short, it was an inter-partes undertaking.
The Appellant seeks leave to raise ground 13 (relating to an error of fact) on the basis that the error is readily apparent and gives rise to an injustice that is reasonably clear (being the Tribunal's purported enforcement of the undertaking and corresponding refusal to take into account the Appellant's submissions addressing the Deed Arguments). This error of fact has given rise to errors of law raised in grounds 1 to 5.
Having determined that the undertaking was a solicitor's undertaking, the Tribunal proceeded to ask itself the wrong question when it posed for determination the question of whether or not the purported withdrawal of the undertaking was valid. Being an inter-partes undertaking, the undertaking having been given by the Appellant to the Respondent, the withdrawal was governed by the ordinary rules of contract: Cassar v New South Wales Crime Commission (2014) 87 NSWLR 684 at 693 [39]. In determining that the withdrawal was invalid, the Tribunal acted beyond the scope of its power.
The Appellant further contends that the Tribunal's reasoning with respect to the undertaking and its finding that it could not be withdrawn was deficient. Having regard to the guidance provided by s 62(3) of the NCAT Act, it is clear that the Tribunal failed to provide adequate reasons in relation to this issue. The Tribunal did not expressly make a finding as to the nature of the undertaking and failed to set out its understanding of the applicable law referring only to the decision in Council of the Law Society of NSW v Jiao [2020] NSWCATOD 63. That case is not authority relevant to the undertaking. The Tribunal erred in failing to take into account the submissions made by the Appellant in support of its withdrawal of the undertaking. Further, such failure amounted to a denial of procedural fairness. The Appellant had made extensive submissions as to why, as a matter of law, the Deed was relevant to the principal issue for determination, namely, whether the Appellant had contravened s 14 of the PPIP Act by failing to respond to the Respondent's requests for access to his personal information.

Grounds 6-10: scope of the Tribunal's jurisdiction

By ground 6 the Appellant contends that the Tribunal failed to exercise its jurisdiction in that it failed to determine the precise conduct that was the subject of the Respondent's applications for internal review and in turn the scope of its jurisdiction.
The Respondent lodged his applications for internal review before he had received any response to his requests for access and before the Appellant had considered those requests. As a result, when considering his applications for internal review, the Appellant drew a distinction between the alleged failure on the Appellant's part to provide the Respondent with information he requested without excessive delay and the question of his entitlement to that information. The Appellant argued before the Tribunal that the conduct under review was whether or not the failure to respond to the Respondent's requests constituted a breach of s 14 on the basis that this failure to respond to or acknowledge the requests amounted to a failure to provide him with access to his personal information without excessive delay. The Appellant's submissions conveyed that the proper scope of the proceedings was one of two principal issues for determination before the Tribunal. The Appellant identified the scope of the conduct to be examined and the distinction between the failure to respond without excessive delay and the one hand (being within scope) and the Respondent's entitlement to the information sought on the other (being outside of scope).
The Appellant submits that the Appellant made it clear in the proceedings at first instance that in contradistinction to the question of excessive delay, the question of the Respondent's entitlement to the information he sought was not within scope. This was a separate issue and not one that was before the Tribunal for determination because the Commissioner had not considered the requests before the Respondent made his application for internal review.
The material before the Tribunal supported the Appellant's position. Both of the Respondent's internal review requests refer to the conduct regarding which he sought review as a "failure to acknowledge all five of my requests". The Appellant in its first and second internal review decisions characterised the complaints made by the Respondent as a failure to provide the Respondent with access to his personal information without delay and "excessive delay in responding to your requested access".
In Ormond v NSW National Parks & Wildlife Service (No 2), the Tribunal stated at [14] that s 52 of the PPIP Act provides for the types of conduct that may be reviewed. It is confined to conduct that has occurred at the time an application for internal review is made under s 53. The conduct that had occurred at the time the Respondent made his internal review applications was a failure to respond to the requests without excessive delay. The conduct that had not occurred consisted of the other elements or obligations imposed on a public sector agency when a request for access under s 14 is made, namely, an assessment of the request, the carrying out of reasonable searches for the information across various information systems, a review of the information yielded by the searches, a determination of entitlement to the information sought and the provision of part, none or all of the personal information to the applicant.
The Appellant further submits that the scope of the applications made by the Respondent is one of fact but it affects jurisdiction. The Tribunal identified the conduct raised by the Respondent, in his internal review applications described in shorthand as "conduct of concern 1" and "conduct of concern 2". Conduct of concern 1 concerned the Respondent's first application for internal review and was the Appellant having failed to provide the Respondent with access to personal information without excessive delay. Conduct of concern 2 concerned the second application for internal review and was the Appellant failing to provide the Respondent with access to personal information as requested in email 6 without excessive delay.
The Tribunal failed to resolve a material issue that had been raised squarely for determination by the Appellant, namely what were the precise parameters of the conduct under review? Did the conduct of concern extend to a failure to provide access to material to which the Respondent was entitled or did it only extend, as the Appellant contended, to the question of delay?
The Tribunal failed to resolve the material issue described above. Prior to delivering the Remedies Decision the parties had provided written submissions. The Appellant's written submissions sought to emphasise the parameters of the scope of the Tribunal's jurisdiction submitting that a consideration of what action (if any) would be appropriate for the Tribunal to take by way of remedy was confined by the scope of its jurisdiction. The Appellant repeated the submission that the question of the Respondent's entitlement to the personal information he sought was not within scope because at the time the Respondent made his request for internal review his entitlement to the information had not been assessed. The Appellant contended that it followed that the Tribunal could not by way of remedy order the Appellant to perform IPP7 by providing access to the personal information the subject of his email access requests.
The Appellant's submissions refer to [17] of the Remedies Decision where the Tribunal states that it is satisfied that in the Breach Decision the Tribunal had found that the conduct of concern was the failure of the Appellant to provide access to the requested information and, in respect of emails 1 to 5, excessive delay in providing such access. The Appellant submits that the Tribunal did not in reaching a determination as to what it had found as to the scope of its jurisdiction, identify where that finding was made in the Breach Decision. The Appellant contends that no such finding was made and the failure to make such a determination amounted to a constructive failure on the Tribunal's power to exercise its jurisdiction.
The Appellant's submissions further contended in the alternative to ground 6 that, to the extent that the Tribunal did resolve the question of the scope of its jurisdiction, it erred by asking the wrong question or identifying the wrong issue insofar as it sought to construe the scope of the Respondent's internal review requests solely by reference to part only of those requests. The Tribunal did not have regard to the second part of each of the Respondent's applications for internal review which provided critical context to and informed the substance of the privacy complaint that was being made: "The failure to acknowledge all five of my requests is conduct amounting to oppressive disregard of my rights and [the Appellant's] own privacy duties". The same error was made in the Remedies Decision and the Appellant contends that, by ground 2, that this error infected the Remedies Decision.
Grounds, 8, 9 and 14 flow from the Appellant's contention that the scope of the Tribunal's jurisdiction was limited to the question of the Appellant's failure to respond to the Respondent's access request without excessive delay. At [61] of the Breach Decision, the Tribunal appeared to make a finding that the Appellant had breached IPP7 by refusing to provide or denying access to the Respondent's personal information sought by emails 1 to 6 on the basis that the Appellant was exempted from compliance with respect to some of the information requested. By ground 8, the Appellant asserts that this finding amounted to an error of law because at the time that the Respondent made his application for internal review his request for access had not been subject of any assessment or determination by the Appellant. There had been no refusal to provide or deny access and a finding to this effect was beyond the scope of the Tribunal's review of the Commissioner's conduct and in excess of the Tribunal's jurisdiction. By ground 14 the Appellant asserts that this finding also amounted to an error of fact.
By ground 9, the Appellant contends that the Tribunal's finding at [66] of the Breach Decision that the Appellant had breached IPP7 by failing to provide the Respondent with access to the personal information he had requested was beyond the scope of the Tribunal's review of the Appellant's conduct and in excess of its jurisdiction. This is because the failure to provide the Respondent with access to his personal information was not the conduct that was the subject of his internal review application. When the Appellant considered these applications there had not yet been a response of any kind: no decision had been made and there had not been any refusal or denial of access.
In the alternative to ground 8, the Appellant submits (by ground 10) that before determining the issues of the Respondent's entitlement to the personal information he had requested, the Tribunal ought to have first given the Appellant the opportunity to adduce evidence going to the question of any lawful excuse or exemption from compliance with s 14 that may apply to the information sought. The Tribunal's failure to do so amounted to a denial of procedural fairness, given that this opportunity could realistically have resulted in a different outcome.
With respect to the question of lawful excuse or exemption from compliance, the Appellant seeks the Appeal Panel's leave to adduce additional evidence in the form of an affidavit by Acting Inspector Andrew James dated 14 January 2022. That affidavit explains Mr James' position and that he had dealt with the Respondent's internal review applications. His affidavit gives evidence of the searches he conducted after the Appellant received the applications for internal review and the searches conducted during and after the conclusion of the proceedings at first instance. Arising from the "preliminary review" Mr James has identified documents which, in his view, the Respondent is barred from requesting by operation of clause 7 of the Deed. In respect of email 1, searches conducted revealed documents responsive to the request that fell within the scope of the release contained in clause 7(c) of the Deed. With respect to email 2, searches conducted revealed documents that fell within the scope of the bar in clause 7 of the Deed. With respect to email 6, searches conducted revealed in excess of 8,000 pages and further searches may need to be performed. Mr James' preliminary view of initial results indicated that some of the personal information would fall within the scope of the release contained in clause 7(c) of the Deed. Mr James' affidavit deposes as to the resources already expended in responding to the Respondent's request for information. The Appellant would rely on this evidence, leave permitting, in support of the argument that the Appellant was lawfully permitted to refuse access to some of the personal information requested on the basis that dealing with certain of the requests would require an unreasonable and substantial diversion of the agency's resources within the meaning of s 60(1)(a) of the Government Information Provision Act (the GIPA Act).

Ground 11: Breach Decision, ground 1 Remedies Decision: misapplication of s 14)

By ground 11, raised with respect to the Breach Decision and ground 1 of the grounds with respect to the Remedies Decision, the Appellant argues that the Tribunal misapplied s 14 in determining that there can be no fetter on the means of making or to whom or to which part of an agency a request under s 14 is made and s 14 provides an individual with an unfettered right to access his or her personal information held by public sector agencies.
The Appellant submits that to construe s 14 in this way is to fail to read the provision within the context of the PPIP Act as a whole and in a manner that promotes the underlying purpose and objects of that Act.
The interpretation of s 14 advanced by the Tribunal whereby an individual can seek access to their personal information by any means and to any person or part of the agency notwithstanding any guidance, suggestion or request provided by the agency for how access requests are to be made is to provide absolute protection to an individual's privacy. In effect, it promotes a construction of s 14 that gives primacy to the beneficial purposes of the PPIP Act at all costs. This construction is unreasonable in that it imposes an untenable and unsustainable burden on government agencies. The construction favoured by the Tribunal fails to strike a balance between the protection of an individual's privacy on the one hand and the recognition of potentially competing objectives of other legislation on the other hand.

Ground 12: no evidence to support findings of fact

By ground 12, the Appellant contends that the Tribunal erred by making a series of findings of fact when there was no evidence to support such findings. The Appellant relies upon the findings of fact contained in [65] of the Breach Decision. These findings were: 1. A subset of the Respondent's personal information requests requested by email 1 was not exempt and should have been granted without excessive delay. 2. The Respondent's personal information requested by emails 2, 3, 4 and 5 was not exempt from access and should have been granted without delay. 3. The Appellant contends there was no evidence to support the findings described in the above paragraph because, as at the date that the Respondent made his applications for internal review, the Appellant had undertaken no assessment and made no determination with respect to his requests for access. The Appellant, having formed the view that the scope of the Tribunal's jurisdiction was limited to that conduct that was the subject of the applications for internal review did not adduce any evidence to establish that the Appellant was excused from compliance or compliance was exempted by the provisions of the PPIP Act.

Grounds of appeal: Remedies Decision

Grounds 1 and 2 concerning the Remedies Decision are addressed in the submissions concerning the Breach Decision. Ground 3 contended that the obligation to establish a lawful basis for non-performance had not been enlivened because there was at that stage no refusal of access or denial of the request for access but only a failure to respond to those requests.

Ground 4: the Tribunal applied a wrong principle of law

At [18] of the Remedies Decision, the Tribunal identified the task before it as being to determine the real issues in dispute in the remedy proceedings in line with the guiding principle provided by s 36 of the NCAT Act and the words of IPP7. The Appellant submits that that was not the task before the Tribunal. Rather, its task was to determine "the correct and preferable decision" having regard to the relevant factual material before it and within the parameters of the scope of its jurisdiction (s 63 ADR Act).
The Tribunal's application of s 36 of the NCAT Act was an error and amounted to an application of the wrong principle of law. In wrongly identifying the task before it and proceeding to require the Appellant to provide access to the information sought the Tribunal acted beyond its power.

Ground 5: Tribunal erred in making order 2

The Appellant contends that in circumstances where the Commissioner had not searched for and assessed the information requested by the Appellant, the Tribunal erred in making order 2 on the basis that the information to which the Respondent requested access through emails 1 to 6 is or may be: 1. subject to an overriding public interest against disclosure such that by s 20(5) of the PPIP Act the Appellant is not authorised to disclose it. 2. exempt from disclosure pursuant to ss 24(1), 25(a) or (b) or 27 of the PPI Act, or 3. exempt from disclosure on the basis that providing the Respondent with access to all or some of that information would require an unreasonable and substantial diversion of the Appellant's resources, contrary to s 60(1)(a) of the GIPA Act.
The evidence of Mr James on which the Appellant now seeks to rely establishes that at least a subset of the information that the Tribunal has ordered the Appellant to provide to the Respondent is the subject of an overriding public interest against disclosure. Further, a subset of that information is, on Mr James' evidence, subject to an exemption from disclosure by reason of ss 24 and/or 25 and the effect of the Deed or pursuant to s 27 because the information sought is not in connection with the Appellant's educative and administrative functions. The Tribunal was in error to order the Appellant to provide access to the information sought without first giving the Appellant an opportunity to determine whether any of the abovementioned conditions on or exemptions from, disclosure applied.
The Appellant contends that orders 1 and 2 of the Tribunal should be set aside and in substitution of the Breach and Remedies Decisions, orders made pursuant to s 65 of the ADR Act remitting the Appellant's Decisions made on 28 March 2019 and 26 June 2019 to the Appellant for reconsideration.
We interpose here to refer to the submissions above concerning the request for leave to introduce the new evidence. We record that during the hearing we decided to refuse such leave and, accordingly, Mr James' affidavit is rejected. Reasons were given orally.

Respondent's Submissions

In respect of grounds 1 to 5 and 13, the Respondent submits that the Tribunal did not err in construing the undertaking as a solicitor's undertaking. However, the Respondent further submits that it was open to the Tribunal to reach the same conclusion about the undertaking for the following reasons: the Respondent had conducted his case in reliance upon the undertaking, the Respondent had not released the Appellant from the undertaking and wishes to have it enforced, the Appellant's change of position in relation to the undertaking is unconscionable and unbecoming of a model litigant and the undertaking gives rise to an estoppel with respect to reliance upon the Deed defence.
The Respondent further submitted that the Appellant's attempt to run the deed argument at the breach stage of the proceedings was an abuse of process.
With respect to grounds 6 to 10 the Respondent submits that the Appellant relies upon an absurd and artificial distinction between the failure on the Appellant's part to provide the Respondent with the information requested without excessive delay and the question of the Respondent's entitlement to that information. The question of entitlement is fundamental and inextricably linked to the request. The Appellant received the Respondent's requests and decided not to provide the Respondent with the information requested, such conduct implied that the Respondent was not entitled to the information requested.
The question of the Respondent's entitlement was squarely put in issue by the following statement in the application for internal review: "NSWPF has failed to provide me with access to my personal information without excessive delay and has contravened s 14 of the PPIPA".
As the Appellant acknowledges in her submissions, the Appellant did not adduce any evidence going to the question of the Respondent's entitlement to the information sought and did not make any submissions as to the issue of entitlement. After the Tribunal published the Breach Decision on 30 April 2021, the Appellant did not then assert, by lodgement of an appeal, that there had been a denial of procedural fairness. Rather, the Appellant filed submissions regarding the question of remedies. In the circumstances, the Appellant has waived its right to complain of procedural fairness.
With respect to the other grounds of the appeal, the Respondent submits that the grounds have no tenable basis.

Submissions of the Privacy Commissioner

The following paragraphs summarise the submissions of the Privacy Commissioner.
An administrative review of conduct by the Tribunal pursuant to s 55(1) of the PPIP Act is not at large. It is confined in its scope by the initial request for internal review, reasonably construed: Department of Education & Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [16]-[19]. This is so because s 55(1) of the PPIP Act allows an Applicant to seek review of the "conduct that was the subject of the application (for internal review) under s 53", not other conduct.
Here the requests for internal review were in the terms as summarised below.
By email dated 15 January 2019, the Respondent made a request, which included the assertion that the Appellant had failed to provide the Respondent with access to the Respondent's personal information without excessive delay and has contravened s 14. The application further stated that the Respondent sought immediate access to his personal information and monetary compensation. The Respondent's email dated 24 April 2019 was in similar terms.
It would be open to the Appeal Panel to conclude that, reasonably construed, the Respondent's complaint was that the Appellant had failed to acknowledge his request within a reasonable time and also that the Appellant had failed to provide him with access to his personal information. The redress which the Respondent sought from the internal review was immediate access to his personal information. This suggests that the Respondent's request for internal review is not limited to the question of delay but was also directed at the substantive failure to provide him access to his personal information.
The Tribunal can only consider the question of a breach of the PPIP Act and the Appellant's conduct up until the internal review application: see for example AFU v Sydney Local Health District [2012] NSWADT 197 at [15]. The Appellant submits that because the Appellant had not commenced any substantive steps of responding to the request for personal information, the "conduct" which had occurred at the time of the application for internal review was limited to the Appellant's failure to respond to the initial request. However, viewed substantively, the relevant "conduct" was that the Appellant had not provided the Respondent with access to the personal information which he had requested in alleged contravention of s 14. Whatever internal reasons the Appellant had for not providing the information requested, the Respondent was entitled to request that an internal review be conducted to permit him to access that information on the basis of an alleged failure to comply with s 14 of the PPIP Act. If these submissions are accepted, they also address grounds 3 to 5 which the Appellant raised in connection with the Remedies Decision.
With respect to ground 11 by which the Appellant contends that the Tribunal misapplied s 14 in determining that there can be no fetter on the means of making or to whom or to which part of an agency request is made and that s 14 provides an individual with an unfettered right to access personal information. The particular question which the Tribunal was considering in the passages cited by the Appellant was the question of how a person can exercise their right to access their personal information. The Tribunal was not purporting to hold that s 14 provides absolute protection to an individual's privacy. The Tribunal expressly noted at [62] of the Breach Decision that there are other provisions of the PPIP Act which provide for excuses or exemptions to the right to access personal information conferred by s 14 and noted at [58] of the Breach Decision that the manner in which the request is made may affect the question of whether there is an excessive delay in responding to the request.
The Tribunal was correct to conclude at [55] is of the Breach Decision that s 14 does not include in, its wording, any qualifications, requirements or conditions to (or contemplate the ability to impose such on) an individual's exercise of their right to access the personal information held by an agency. This is consistent with the decision of the Appeal Panel in LN v Sydney Local Health District (GD) [2012] NSWADTAP 9 to which the Tribunal referred at [55] of the Breach Decision.
The words of s 14 speak for themselves, and the Appellant's concern that the Tribunal's construction of s 14 "imposes an untenable and unsustainable burden on government agencies" is at least in part addressed by the fact that s 14 employs the contextual phrase "excessive delay". As the Tribunal recognised at [58] of the Breach Decision, the manner in which the request is made may well affect the assessment of what an "excessive delay" is in the particular circumstances.
The Privacy Commissioner's submissions then turned to the Appellant's contention that she was denying procedural fairness by not being afforded the opportunity to adduce evidence going to the question of any lawful excuse or exemption from compliance with s 14 that may apply to the information sought (ground 8). The Privacy Commissioner does not make any submissions concerning this issue save to note that the normal consequence of such a ground succeeding would be that the proceedings would be remitted to the Tribunal for redetermination.
The Privacy Commissioner referred to the Appellant's contention that the Tribunal erred in making findings without evidence, namely that the personal information requested by certain emails sent by the Respondent was not exempt from access and should have been granted without excessive delay (ground 12). Whether the information was exempt from access was a matter about which the Appellant would appear to have borne the evidentiary onus. The Appellant concedes that she did not lead any evidence about these topics (on the basis of her position concerning the scope of the Tribunal's jurisdiction). In those circumstances, the Tribunal can hardly have erred in making the findings at [65] of the Breach Decision.

Reply Submissions of the Appellant

The following paragraphs summarise the submissions in reply made by the Appellant.
The Appellant accepts that the scope of the internal review application made under s 53 of the PPIP Act defines the scope of the administrative review proceedings in the Tribunal. However, the Appellant contends that an internal review application complaining of a breach of s 14 because an individual has not been provided with access to their personal information without excessive delay in response to a request could be a complaint about three separate acts of an agency. These are: 1. the agency did not respond to or acknowledge the request for access to personal information without excessive delay; 2. the agency incorrectly decided not to provide the individual with access to their personal information; or 3. the agency provided the individual with access to their personal information but did so after excessive delay.
The Appellant contends that the Respondent's two applications for internal review were complaints about the conduct described in (a) above. The Respondent's request for "immediate access to my personal information" in the internal review applications may support a construction that the conduct complained about is that set out in (b) above, that would not be the correct or preferable construction when regard is had to the underlying circumstances surrounding the requests made in emails 1 to 6.
There is a distinction between (a) and (b) above. To treat them as one in the same would produce the anomalous result of requiring an agency to internally review the correctness of conduct that it knows has not occurred and there is nothing in the PPIP Act that requires an agency to proceed on the basis that there has been a deemed or implied refusal after a period of time has elapsed. The scope of the Tribunal's jurisdiction had been understood to be only the conduct set out above at (a). The suggestion that maintaining the distinction limits the redress that an individual could seek in an internal review, and upon external review, should be rejected as it is not a permanent limitation that is imposed. An individual is not ultimately provided with any more access to personal information held by the agency than is permitted by the PPIP Act if the conduct complained of in the internal review application is a failure to deal with the request or a refusal of the request. The only difference in redress is that an individual may receive access to their personal information later than they would have if a decision not to provide access had been made prior to the internal review application being made. In circumstances where the PPIP Act does not prescribe a time limit, there is no compelling reason why the distinction between the two types of conduct resulting in an individual not being provided with access to the information should be recognised.
If the Appeal Panel finds that the conduct complained of in the Respondent's internal review applications is that set out at (b) above, as the Respondent now contends, the Appellant submits that it must follow that the Tribunal has constructively failed to exercise its jurisdiction as to the determination of the scope of the administrative review proceedings.
The Appellant's submissions in reply then proceed to deal with the question of entitlement to be given access to personal information. The Appellant contends that if the scope of the administrative review proceedings had included the Respondent's entitlement to access the personal information sought the Appellant would have relied upon six bases to say that the Respondent was not entitled to be provided access to some of the personal information sought by the requests made in emails 1 to 6.
The arguments the Appellant would have made in relation to ss 24, 25 and 27 were touched upon in the proceedings below, as arguments as to why the requests made in emails 1 to 3 may not have been requests that the Appellant was required to deal with, and can be repeated as arguments as to why the Respondent is not in not entitled to access his personal information sought in emails 1 to 6. The Appellant's arguments in relation to the provisions of the GIPA Act that are picked up by s 20 (5) of the GIPA Act were not made before the Tribunal below due to her position on the scope of the proceedings. These arguments are set out below.
The Tribunal has recognised in several decisions that an individual's personal information that is subject to an overriding public interest against disclosure within the meaning of the GIPA Act does not need to be provided for access under s 14 of the PPIP Act in response to a request by operation of s 20(5). There is an overriding public interest against disclosure if the public interest considerations against disclosure, on balance, outweigh the public interest considerations in favour of disclosure or when information falls within a class of information conclusively presumed to be.
On the sample of information that has been responsive to the Respondent's requests in emails 1 to 6 and reviewed to comply with the conditional stay, the Appellant submits that some of the Respondent's personal information responsive to his request may be subject to a conclusive presumption (because it is privileged from production on the ground of client legal privilege) or excluded information of an agency or because it is subject to the application of several public interest considerations against disclosure in the table to s 14 of the GIPA Act. Determining where the balance of public interest considerations in favour of disclosure and against disclosure lies is a question of fact and degree and requires a broad value judgment to be made.
The Privacy Commissioner appears to submit that the words "imposes a condition or limitation (however expressed)" in s 20(5) of the PPIP Act only pick up provisions in the GIPA Act that "deal with the substantive question of access to information" and therefore does not pick up s 60(1)(a) of the GIPA Act. The Appellant respectfully disagrees with the Privacy Commissioner's characterisation of s 60(1)(a) of the GIPA Act as not dealing with a substantive question that is picked up by s 20(5) of the PPIP Act and submits that the Appeal Panel should find that it does.
The Appellant contends that s 60(1)(a) of the GIPA Act confers a discretion on an agency to refuse to deal with an access application if dealing with the application would require an unreasonable and substantial diversion of the agency's resources. It is not a procedural requirement. Rather it provides that the legally enforceable right to access information does not have to apply if the work involved requires an unreasonable and substantial diversion of resources. Section 60(1)(a) is a "limitation" with respect to the entitlement to have access to government information and therefore a limitation to access personal information held by an agency that that is picked up by s 20(5) of the PPIP Act.
The Appellant contends that the difficulty with the Tribunal's construction of s 14 that it provides an individual with an unfettered right to access arises from its subsequent application of s 14 to the circumstances of the requests made in emails 1 to 5 and the erroneous approach it took to identifying and assigning weight to the facts and circumstances surrounding the request to determine whether there had been excessive delay. The Tribunal did not take into account and did not put any weight on the failure of the Respondent to follow-up or chase the agency in circumstances where he was on notice via an "out of office" email that was automatically generated that the email address inbox would be unattended for more than two months. The failure to follow-up would suggest that there was no real urgency behind the request and that is a relevant circumstance that should have been considered in determining whether there had been any excessive delay.
The Tribunal also only permitted an additional small amount of time for granting access where the request is made to the agency other than in accordance with the Privacy Management Plan. The Tribunal did not have regard to the limited resources of an agency to deal with access requests.
The Tribunal did not have regard to the Privacy Commissioner's Facts Sheet dated July 2014 as to the process for making a request under s 14, namely that individuals should make the request to an agency's privacy contact officer. The Appellant submits that the Facts Sheet should be considered to be a policy that that is applied by the Appellant in dealing with requests and therefore should be considered in determining whether there had been excessive delay.
With respect to the undertaking, the Appellant submits that the Respondent's submissions should be rejected. The Respondent has suffered no prejudice arising from the Appellant's withdrawal of the undertaking as he ultimately received the documents that were caught by the paragraph of the summons that had not been pressed following provision of the undertaking. He had more than six months' notice that the Appellant had withdrawn the undertaking prior to filing his submissions. His reliance on the undertaking could not have been reasonable, such as to give rise to any estoppel, nor could there be said to be a denial of procedural fairness to the Respondent. The Appellant contends that the Deed Arguments are highly relevant to reviewing the conduct that is the subject of the administrative review proceedings and whether the Appellant made the correct and preferable decision in relation to the internal reviews it conducted. There was nothing inappropriate to prevent the Appellant relying upon the Deed Arguments given that the Respondent had not articulated his case at the time that the Appellant was required to provide her submissions.
The Appellant would have been able to provide evidence to support her contention that the personal information responsive to emails 1 to 6 are subject to an overriding public interest against disclosure, where claimed or subject to some other legal exemption, if the Tribunal had determined the Respondent's entitlement to access that personal information to be in issue in the proceedings notwithstanding the Respondent's acceptance that it was not in issue in his submissions in response. The Appellant's evidence in chief before the Tribunal was consistent with her understanding of the scope of the conduct being reviewed by the Tribunal. The Respondent's evidence was also consistent with this understanding of the scope as it did not provide any insight to his motivations for seeking access to his personal information or otherwise assist in the identification of, or attribution of weight to, any public interest considerations in favour of disclosure that may apply to his personal information, which would have been relevant to the determination of whether the information was subject to an overriding public interest against disclosure.
The Appellant's and Respondent's actions in not filing such evidence in the circumstances cannot excuse the Tribunal from the error of making findings without evidence in relation to issues which the Tribunal in the Remedies Decision said should have been the subject of evidence during the breach stage of the proceedings. Nor, contrary to the Respondent's submissions, did the Tribunal not have the obligation to ask the Appellant as to whether there was any evidence demonstrating that the Respondent may not be entitled to access all of his personal information that had been sought in emails 1 to 6. This is because s 38(6)(a) of the NCAT Act imposes an obligation on the Tribunal to ensure all relevant material is disclosed to the Tribunal so as to enable it to determine all of the relevant facts in issue in any proceedings. The Tribunal had a duty to investigate in the proceedings below because it had a sound reason to conclude that all relevant material had not been disclosed (namely, that the Appellant's articulation of the scope of the administrative review proceedings expressly excluded the question of entitlement and the Appellant had also indicated that entitlement to access personal information will be in issue if it had been in scope and had not adduced any evidence in relation to the personal information that had been responsive to the requests, other than email 4). The Tribunal ought to have taken steps to investigate or otherwise inform itself as to whether there was any evidence relating to the Respondent's entitlement to access information before finding that the Respondent was so entitled.

Consideration

We will firstly consider the Appellant's application for time to be extended with respect to the late lodgement of the appeal against the Breach Decision.
In our view, an extension should be granted for the reasons set out below.
Section 80 of the NCAT Act provides that an appeal may be made against a decision. The definition of decision is in s 5 and includes the making of a determination or a declaration. The time for lodgment of an appeal is 28 days from the date the Appellant was notified of the decision (rule 25 of the Civil & Administrative Tribunal Rules 2014 (NSW)). The appeal was lodged approximately six months out of time. The orders made were in the nature of declarations (order 1) and findings (orders 2 and 3) that had no immediate effect because the proceedings were to continue for the purposes of making determinations as to what remedy ought to follow. That is evident from the directions for submissions to be made by the Applicant first followed by the Respondent.
The reason for the delay was the Appellant's decision to await the outcome of the next stage of the proceedings. In our view that decision was understandable in the circumstances and having regard to the orders and directions made in the Breach Decision. No evidence of prejudice to the Respondent has been provided. A consideration of the Appellant's appeal in respect of the Remedies Decision involves a consideration of the Breach Decision and the facts leading to that decision.
It is in the interests of justice that the appeal against the orders made in the Remedies Decision be considered in conjunction with the reasoning contained in the Breach Decision. For the above reasons, we extend time for lodgment of the appeal against the orders made in the Breach Decision.
We now turn to the question of whether the Tribunal erred at first instance in determining that the Appellant was not entitled to rely upon the deed as a reason for not complying with the Respondent's access requests without excessive delay. At first instance the Tribunal held that the deed could not be relied upon by reason of the undertaking that was given by a solicitor representing the Appellant at an earlier directions hearing. The undertaking was to the effect that the deed would not be relied upon at the breach stage of the proceedings. The undertaking did not preclude the possibility of the deed being raised at the remedies stage of the proceeding. We were informed at the hearing of the appeal that it was not then raised because of the Appellant's view concerning the scope of the Tribunal's jurisdiction. That is to say, the Appellant took the view that the remedies stage of the proceedings remained limited to a consideration of whether the Appellant should be the subject of an order, having not provided the Respondent with personal information, but that the scope of the proceedings at the remedies stage did not include consideration of the Respondent's entitlement (or lack thereof) to his personal information
In the submissions made in March 2020 at first instance the Appellant included submissions concerning the effect of the deed and the entitlement of the Respondent to access personal information.
In our view, the Tribunal was in error to hold that the conduct of the Appellant in withdrawing the undertaking was "invalid". The undertaking was not necessarily given irrevocably. Rather it was given in the interests of procedural fairness, namely to enable both parties to understand that at the breach stage the effect of the deed would not be in issue. The Tribunal did not find that the Appellant's conduct in making submissions concerning the deed gave rise to procedural unfairness to the Respondent. The relevant timetable seems to us to reveal that the Respondent had ample time to respond to the Appellant's submissions concerning the deed and re-issue an application for a summons if he wished.
However, following the publication of the Breach Decision the Appellant had an opportunity to then raise the effect of the deed upon any appropriate remedies which the Tribunal might consider. The Appellants did not do so because they had a view of the scope of the proceedings which they understood limited the Tribunal's jurisdiction to a consideration of whether there had been unreasonable delay in providing access to the information requested by the Respondent.
In the Breach Decision the Tribunal recommended that the issue of the withdrawal of the undertaking should be brought to the attention of the Legal Services Commissioner. What we have stated in the above paragraphs should not be taken to be in disagreement with that recommendation, or to excuse the solicitor who acted otherwise than in accordance with the undertaking. If the Appellant wished to be released from the undertaking an appropriate course would have been to seek to obtain the consent of the Respondent and to relist the proceedings to inform and obtain the consent of the Tribunal.
Ground 1 of the appeal is rejected because, although the Tribunal may have erred at the breach stage of the proceedings, the reason the Tribunal did not later consider the deed was because of the failure of the Appellant to raise the provisions of the deed at the remedies stage. That in turn occurred because the Appellant erred in its understanding of the scope of the Tribunal's jurisdiction (an issue which we will address later).
For the above reasons, grounds 2 to 5 inclusive of the appeal are also rejected.
However, it follows from the conclusions we have set out above that in our view the order or declaration described as order 1 made on 30 April 2021 was made in error. Accordingly order 1 will be set aside.
We now turn to the question of the scope of the Tribunal's jurisdiction. This issue is raised by grounds 6 to 10 of the grounds of appeal.
We are in agreement with the submissions lodged by the Privacy Commissioner. In particular, we agree with the Privacy Commissioner that the Respondent's complaint, reasonably construed, was that the Appellant failed to acknowledge his request within a reasonable time and also that the Appellant had failed to provide him with access to his personal information. The redress which the Respondent sought from the internal review was immediate access to his personal information. The Respondent's request for internal review was not limited to the question of delay but was also directed at the substantive failure to provide him with access to his personal information.
In the Respondent's email dated 15 July 2019, being his first application for internal review, the Respondent specifically asserted that the Appellant had failed to provide him with access to his personal information and had contravened s 14 of the PPIP Act. The application expressly states that the Respondent seeks immediate access to his personal information. The Respondent's email of 24 April 2019, being the second request for internal review, was in similar terms.
We refer to the Appellant's submissions that it had made it clear in the proceedings at first instance that the question of the Respondent's entitlement to the information he sought was not within scope. We do not agree for the reasons set out above that the Tribunal erred in determining that the scope included the issue of entitlement but, in addition, note that the Appellant's attempt to rely upon the deed would appear to us to have been inconsistent with the submission that the Tribunal had before it only the limited issue of whether the Appellant had failed to provide access to personal information without excessive delay. In other words, the Appellant's attempt to rely upon the deed went to the issue of the Respondent's entitlement to the information which the Appellant submits was outside the scope of the Tribunal's jurisdiction.
As the Privacy Commissioner submits, viewed substantively, the relevant conduct for review by the Tribunal was that the Appellant had not provided the Respondent with access to personal information which he had requested in alleged contravention of s 14. The Breach Decision adopts the same approach. At [66] of the Breach Decision the Tribunal held that the Appellant had breached s 14 in respect of emails 1-5 "in that the Respondent (ie. now the Appellant) held the Applicant's relevant personal information, received the Applicant's email access requests when they were emailed to and received at legitimate email addresses of the Respondent and the Respondent failed to provide the Applicant with access to that information without excessive delay." At [61] of the Breach Decision the Tribunal noted that the Appellant may, in the course of complying with an access request, apply any exemptions to access and thus limit the personal information to which the Applicant is provided access. The Tribunal stated that where a "broad access request" is made that may include some exempt information or information for which non-compliance by the Respondent is excused it is not sufficient grounds to deny access to all personal information, the subject of the access request [61].
It is clear to us that the Tribunal considered the scope of its jurisdiction to include whether the Respondent was entitled to access information held by the Appellant (or to put it another way, whether the Appellant was entitled to withhold certain information) and because there was no evidence supporting the withholding of information the Tribunal found, correctly in our view, that the Appellant had breached s 14. Accordingly, for the above reasons, grounds 6 to 10 are rejected and likewise grounds 3 to 5 of the appeal against the Remedies Decision are also rejected.
Ground 11 concerns the submission that the Tribunal erred by failing to properly apply s 14 insofar as it determined that there can be no fetter on the means of making or to whom or to which part of an agency a request under s 14 is made.
Again, we are in agreement with the submissions of the Privacy Commissioner. The Tribunal was not purporting to hold that s 14 provides absolute protection to an individual's privacy as submitted by the Appellant. The Tribunal noted that there were provisions of the PPIP Act which provide for excuses or exemptions to the right to access personal information conferred by s 14. The Tribunal was correct to conclude at [55] of the Breach Decision that s 14 does not include in its wording any qualifications, requirements or conditions in respect of an individual's exercise of their right to access their personal information held by an agency. In LN v Sydney Local Health District (GD) [2012] NSWADTAP 9 the Tribunal considered an internal policy requiring that the director be contacted before scans could be supplied to patients. The Tribunal noted that there may have been sound reasons for the policy but that the policy cannot override the entitlement provided to patients under the relevant legislation.
Here, the Tribunal found that the Respondent's emails were received at email addresses attached to the Respondent and that it was up to the Respondent to ensure that those email addresses were given attention so that incoming emails were read and addressed. We see no error in the Tribunal's determination of that issue and reject the submission of the Appellant that that interpretation places the Appellant in an untenable and burdensome position. As the Privacy Commissioner submits the question of unreasonable delay incorporates consideration of whether the addressee was charged with the responsibility of dealing with access requests. The Tribunal gave additional time having regard to that consideration in its assessment of unreasonable delay.
Ground 11 is rejected.
Ground 12 concerns the contention that the Tribunal erred by making a series of findings of fact for which there was no evidence to support those findings.
With the exception of some evidence concerning the volume of information responsive to email 1 the Tribunal had before it no evidence to the effect that the information requested was exempt information. In those circumstances, the Tribunal was entitled to order access in the manner in which it did. It was up to the Appellant to demonstrate an entitlement to exemption. Ground 12 is rejected.
Ground 13 has already been covered in our consideration of grounds 1 to 5.
Ground 1 concerning the Remedies Decision is also rejected for the same reasons concerning Ground 11 above and in particular our view that the Tribunal did not find that an individual has unfettered access to personal information.
Grounds 2 and 3 concerning the Remedies Decision concern the argument that no lawful basis for a finding of non-performance by the Appellant has been enlivened because at no stage has there been a refusal of access or a denial of the request for access. Given the view we have earlier expressed that substantively the Appellant's conduct constituted a refusal or denial to provide access, the Tribunal had a lawful basis for the orders it made in the Remedies Decision. Grounds 2 and 3 are rejected.
Ground 4 concerning the Remedies Decision is to the effect that the Tribunal by virtue of s 36 of the NCAT Act, erred in identifying the task before it as being one to determine the real issues in dispute when in fact the Tribunal's task was to determine the correct and preferable decision. In our view this is, in the context of these proceedings, a distinction without a difference in that the Tribunal's reasoning does not in our view display anything other than the correct and preferable decision.
Ground 5 concerning the Remedies Decision is also rejected. Having found unreasonable delay and there being no evidence to support the withholding of any personal information by virtue of one of the sections of the PPIP Act, such as ss 20(5), 24(5), 25(a) or (b) or 27, there was no basis for an order other than the orders in fact made by the Tribunal.
The Appellant contended that s38(a) of the NCAT Act operated to impose upon the Tribunal the obligation to ensure that all relevant material was disclosed to the Tribunal including evidence relating to the Respondent's entitlement to access information. In our view the Tribunal's obligation in the context of this matter was to give the Appellant an opportunity to put relevant information before the Tribunal. The Appellant had an opportunity but did not act on it.
For the above reasons, the appeal must be dismissed.
The Appeal Panel makes the following orders: 1. Order 1 made on 30 April 2021 in 2020/1900127295 and 2019/00230579 is set aside. 2. The order staying the operation of orders 1 and 2 made on 8th October 2021 is lifted and the period of 30 days stated in order 2 commences from the date of publication of these orders. 3. The appeal is otherwise dismissed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 15 July 2022

Personal Information Protection Act 1998(NSW)

Administrative Tribunal Act 2013(NSW)

Administrative Tribunal Rules 2014(NSW)

At a glance

Court

Decision date

Source

Judgment (18 paragraphs)

Parties

Legislation Cited (4)

Cases Cited (2)

Cited By (1)