Commissioner of Police v Ritson

Court of Appeal (NSW)|2023-11-23|Before: Bell CJ, Stern JA, Dhanji J

Solicitors: Karen Smith, Crown Solicitor NSW (Applicant) R Wilkins, Information and Privacy Commission NSW (Second Respondent) File Number(s): 2023/00261025 Publication restriction: N/A Decision under appeal Court or tribunal: Supreme Court Jurisdiction: Common Law Citation: [2023] NSWSC 854 Date of Decision: 21 July 2023 Before: Dhanji J File Number(s): 2022/237160

[Note: The Uniform Civil Procedure Rules 2005 provide (Rule 36.11) that unless the Court otherwise orders, a judgment or order is taken to be entered when it is recorded in the Court's computerised court record system. Setting aside and variation of judgments or orders is dealt with by Rules 36.15, 36.16, 36.17 and 36.18. Parties should in particular note the time limit of fourteen days in Rule 36.16.]

HEADNOTE [This headnote is not to be read as part of the judgment] In 2017 and 2018 Brendon Ritson, a former police officer, sent six emails to the NSW Police Force (a public sector agency) requesting access to information about him held on its databases. In 2019, after there has been no production of documents in response to his requests, Mr Ritson sought internal review of two separate tranches of requests, pursuant to s 53 of the Privacy and Personal Information Protection Act 1998 (NSW) (Privacy Act). He contended that the NSW Police Force, as an agency subject to the information protection principles in the Privacy Act, had failed to comply with its obligation under s 14 to provide access to his personal information "without excessive delay or expense". The first review concluded that three requests sought material covered by a deed of release executed by Mr Ritson in 2011; two further requests had been sent to the wrong address, but searches had located no relevant material. The second review (relating to email 6) found that the request had been sent to a moribund address, but searches responding to the request located a very large amount of information, which led the reviewer to conclude that further searches would be an unreasonable and substantial diversion of agency resources. In April and July 2019 Mr Ritson lodged two applications for external review with the Civil and Administrative Tribunal. The Tribunal found that the Commissioner of Police had failed to provide the Mr Ritson with access to the information without excessive delay, and ordered that the Commissioner perform the obligation by providing Mr Ritson with his requested personal information within 30 days. The Commissioner appealed the Tribunal decision to the Appeal Panel, which dismissed the appeal. The Commissioner then appealed to the Supreme Court. Dhanji J (the primary judge) dismissed the appeal and the Commissioner then sought leave to appeal to the Court of Appeal. Mr Ritson did not appear before the primary judge or in the Court of Appeal, but the Privacy Commissioner was joined and acted as contradictor. The main issues on appeal were whether: (i) the Commissioner of Police should have leave to appeal; (ii) the Tribunal had power to order the provision of documents which might be exempt from access; and (iii) the agency was entitled to refuse to provide access because locating the information would entail an unreasonable and substantial diversion agency resources. The Court (Basten AJA, Bell CJ and Stern JA agreeing), granting leave to appeal and allowing the appeal, held: As to issue (i) - leave to appeal (1) Although there was doubt that Mr Ritson maintained an interest in defending the order made by the Tribunal, and the issue as to the power of the Tribunal to make the impugned order had been the subject of two appeals, there was material before the Court supporting the Commissioner's contention that the order for production ignored the existence of arguable grounds for refusing access. Although the Commissioner may have made poor forensic choices in opposing and appealing the orders, the case raised matters of public importance and there was no prejudice to Mr Ritson in granting leave to appeal. Leave should be granted: [32]. As to issue (ii) - power to order access to exempt documents (2) To read s 14 of the Privacy Act in isolation would remove any basis for resistance to production of documents under the specific and general exemptions provided in ss 24, 25 and 27: [35]-[36]. (3) Section 20(2)(b) of the Privacy Act precludes reading s 14 in isolation from sections containing conditions or limitations on access or on the process of considering a request. Therefore, the Tribunal cannot provide relief involving an order for the production of documents for a breach of s 14 without having found (in the absence of a concession) that no condition or limitation on access was engaged. The Tribunal exceeded its available powers: [38]-[39]. As to issue (iii) - reliance on unreasonable and substantial diversion of resources (4) The Government Information (Public Access) Act 2009 (NSW) (GIPA Act), s 60(1)(a), permits an access application to be refused if dealing with the application would require an unreasonable and substantial diversion agency resources. The question is whether that power of refusal operates to limit the access obligation imposed by s 14 of the Privacy Act. The Privacy Act and GIPA Act were intended to operate harmoniously as part of the legislative scheme dealing with information held by the government: [52]. The effect of s 20(5) of the Privacy Act is to import "conditions and limitations" imposed by the GIPA Act so as to qualify the right conferred by s 14 of the Privacy Act: [66]-[68].

JUDGMENT

BELL CJ: I agree with Basten AJA.
STERN JA: I agree with Basten AJA.
BASTEN AJA: The subject matter of the application for leave to appeal to this Court is, ultimately, an order made by the Civil and Administrative Tribunal (the Tribunal) that the Commissioner of Police, having breached a statutory obligation to provide personal information to Brendon Ritson, as requested by him, "without excessive delay" was obliged to provide the information forthwith, whether or not Mr Ritson was otherwise entitled to the information under the statute. The Commissioner appealed from the Tribunal to the Appeal Panel, and from the Appeal Panel to a judge in the Common Law Division: however, that order remains in place.
The judgment from which the present appeal is sought to be brought is a detailed and careful analysis provided by Dhanji J (primary judge) on 21 July 2023: Commissioner of Police v Ritson ("DVT") (No 2). [1] The Commissioner had appealed from a decision of the Appeal Panel of the Tribunal, pursuant to s 83(1) of the Civil and Administrative Tribunal Act 2013 (NSW) ("the Tribunal Act"). The appeal was limited to an appeal "on a question of law" and required leave of the Court. Although the appeal was dismissed, Dhanji J had granted leave, on the basis that the matter raised "issues of general importance".
An appeal to this Court requires leave pursuant to s 101(2)(r) of the Supreme Court Act 1970 (NSW), as it does not involve a matter exceeding the monetary threshold in that provision. As senior counsel for the Commissioner of Police accepted in the course of the hearing, there was a live issue as to whether there should be a grant of leave. It is convenient to provide some background to the proceedings, in order to explain why, in the circumstances, a grant of leave to appeal should be made.

Leave to appeal: procedural background

A brief chronology of the matter provides a troubling picture as to the time and resources which have already been devoted to determining Mr Ritson's entitlement to his own personal information held by the NSW Police Force. Indeed, it is not at all clear that Mr Ritson still maintains an interest in the proceedings, although that may be because he presently has an entitlement to the documents and information sought, pursuant to the order made by the Tribunal on 8 October 2021. However, he did not appear at the proceedings in the Common Law Division, nor has he appeared in (or indeed responded to communications about) the proceeding in this Court.
On the other hand, the Privacy Commissioner, appointed under Pt 4 of the Privacy and Personal Information Protection Act 1998 (NSW) ("Privacy Act") intervened in the proceedings in the Appeal Panel, [2] and was joined in the proceedings in the Common Law Division. Both before Dhanji J and in this Court, the Privacy Commissioner briefed counsel who played a valuable role in contesting the submissions of the Commissioner of Police. Given the doubt about the continuing interest of Mr Ritson in pursuing his claims for documents (originally made in 2017), and given the unsatisfactory history of the matter, there is a real issue as to whether this is an appropriate vehicle to agitate the issues which both Commissioners treat as significant and of general public importance. It is necessary to outline the unsatisfactory history, which was helpfully summarised by the primary judge.
For a period from late 2001 up to 10 March 2011, Mr Ritson was a police officer. Whether he resigned or was medically discharged is unclear. However, on 22 November 2011, he executed a deed of release in respect of various compensation claims, claims for damages and requests that had been made by him under the Privacy Act and the Government Information (Public Access) Act 2009 (NSW) ("GIPA Act"). Between 11 May 2017 and 20 December 2018 Mr Ritson sent six emails to three different NSW Police Force email addresses.
Three emails were sent in the period May-June 2017. On 11 May 2017, Mr Ritson sent by email a request under s 14 of the Privacy Act seeking access to "all information held about me" on two identified databases managed by the NSW Police Force (email 1). A further request on 21 May 2017 (email 2) sought "all documents constituting, evidencing, concerning or referring to the direction/s issued by or on behalf of the NSW Police Force pursuant to cl 9(b) of the Deed of Release executed by me on 22 November 2011". On 15 June 2017 (email 3), Mr Ritson sought "all documents arising out of or in any way connected with the assessment and/or determination of the Medal Assessment and Review Panel in relation to my eligibility for the awarding of a National Police Service Medal on or about 16 May 2014". Each email was sent to an address commencing "iau".
Three further requests were made in 2018. On 28 April 2018 (email 4), sought "documents concerning or referring to me" being "emails sent to or from Bernadette Keating" and "file notes created by Bernadette Keating", between April 2017 and April 2018. That email was sent to what appears to be Ms Keating's own account with the Police Force. On 29 June 2018 (email 5) sought "documents containing information about my entitlement to a refund of the advance deposit of $150.00 paid for application reference number … on or about 16 March 2015 pursuant to s 71(2) of the [GIPA Act]". That email was sent to a police address commencing "gipaapp". Finally, on 20 December 2018 (email 6) a second email to Ms Keating's address, titled "PRIVATE & CONFIDENTIAL", sought access to "copies of all emails, file notes and memorandums arising out of my application for ex gratia legal assistance".
It is clear from the content of the email requests that there had been ongoing communications between Mr Ritson and the NSW Police Force over some years up until May 2017, and between May 2017 and April 2018. [3] What is also apparent is that there had been no production of documents in response to the requests prior to 16 January 2019 when Mr Ritson sought an internal review pursuant to s 53 of the Privacy Act in relation to emails 1-5. The internal review was sought on the basis that the NSW Police Force, being a public sector agency for the purposes of the Privacy Act, had failed to comply with its obligation under s 14 of the Act "without excessive delay or expense [to] provide the individual with access to the information".
The first internal review was undertaken with respect to the requests in emails 1-5. As to emails 1, 2 and 3 the reviewer, Acting Inspector Andrew James, concluded that the November 2011 deed provided lawful authority for not complying with the principle stated in s 14, pursuant to s 25(a) of the Privacy Act. With respect to emails 4 and 5 the reviewer concluded that the requests for access were not addressed to the position identified in the NSW Police Force Privacy Management Plan, pursuant to which requests were to be made. Further, email 4 had been directed to a Ms Keating, a senior lawyer in the Office of General Counsel within the Police Force; the reviewer noted that an "out of office" response had been sent, Ms Keating being absent on leave, from which she had not returned. The reviewer stated that searches had been made, but apart from email 4 itself, no emails, nor file notes falling within the scope of the request had been located. The reviewer declined to take further action.
With respect to email 5, a number of communications were apparently exchanged between the NSW Police Force and Mr Ritson, copies of which were attached to the reviewer's report.
On 24 April 2019, Mr Ritson sought an internal review of the response to his request of 20 December 2018 (email 6), again directed to Ms Keating, seeking various documents. The reviewer refused to take further action on that request because (i) it had not been directed to the correct officer, (ii) Mr Ritson had previously been given an "out of office" response for that address, and (iii) the address was not monitored or used at the time email 6 was sent. Notwithstanding those reasons, and the resultant finding that there had been no breach of s 14, the reviewer stated that searches had been conducted for the information requested, and a very large amount of information located, from which the reviewer concluded that "further searches to identify information that is your personal information is an unreasonable and substantial diversion of NSWPF resources". That response reflected a basis for refusing to deal with an access application contained in s 60(1)(a) of the GIPA Act.
Exercising a right of external review, Mr Ritson lodged two applications with the Tribunal, the first on 24 April 2019 dealing with the first internal review decision and the second on 23 July 2019 dealing with the second internal review decision.
The two applications were dealt with together. In a decision handed down on 30 April 2021, [4] Senior Member A Christie noted that on 21 May 2020, orders had been made limiting the issue for determination to "whether there has been a breach of s 14" of the Privacy Act, and the proceedings were not to address remedies if any breach were found. [5] Accordingly, the first decision of the Tribunal was restricted to that topic.
The Senior Member summarised the applicant's case as identifying "excessive delay" by noting the number of days between the dates of each email and the date on which the relevant internal review request was made. In dealing with the question of breach of s 14, also known as Information Protection Principle 7 (IPP 7), Senior Member Christie stated: "61 Of course, in complying with an IPP 7 access request the Respondent may apply any exemptions to access and thus limit the personal information to which the Applicant is provided access. However, simply because a broad access request is made under IPP 7 that may otherwise include some exempt information or information for which non-compliance by the Respondent (in this case) is excused, it is not sufficient grounds to deny access to all personal information the subject of the access request (i.e. to not provide the other personal information not exempted or excused from access). That is, the access request must be fulfilled by the Respondent by withholding only that personal information exempted from access. It is not acceptable for the Respondent to claim that the Applicant's access request (e.g. in Email 1) is too widely framed and therefore, because the Respondent would need to consider how to apply this request across its holdings of the Applicant's relevant personal information, it is excused/exempt from disclosing any of the Applicant's personal information the subject of the access request under IPP 7 in Email 1. 62 In conclusion, while subject to possible excuses or exemptions in other sections of the PPIP Act, the wording of s14 PPIP Act/IPP 7 is clear and unconditional. In this case access to personal information of the Applicant held by the Respondent must, at the request of the Applicant and without excessive delay or expense, be provided to the Applicant. In summary, unless non‑compliance is excused or compliance is otherwise exempted by other provisions of the PPIP Act (or other legislation) then providing access without excessive delay is a legislative obligation imposed on the Respondent which, apart from any such legislative exemptions or excuses, cannot be made subject to any qualifications imposed by the Respondent."
It will be necessary to address the proper construction of s 14 in due course; what is relevant for present purposes is the acknowledgement that the disclosure obligation did not extend to material which was exempt or excused from disclosure.
In dealing with the second stage of the hearing, relating to relief, the Senior Member identified aspects of the Commissioner's submissions in the following terms: [6] "13 In the Respondent Submissions the Respondent submits, in summary and most relevantly, that: (1) A consideration of what action, if any, would be appropriate for the Tribunal to take by way of remedy is confined by the scope of the Tribunal's jurisdiction in these proceedings. The Tribunal does not have jurisdiction to review conduct of the Respondent that was not the subject of the Applicant's application(s) for internal review. The conduct that was subject of the application(s) for internal review was that the Respondent had 'failed to provide [the Applicant] with access to my personal information [as requested in those five emails] without excessive delay'. (2) What is not within scope of the Tribunal's jurisdiction is the question of the Applicant's entitlement to the personal information sought. At the time the request for internal review was made the Applicant's entitlement to the information had not been assessed. (3) No evidence was adduced in the Decision proceedings going to the question of the Applicant's entitlement to their personal information as it would have been had entitlement been in issue. The evidence of the Respondent would have included, but not been limited to, the applicable public interest considerations against disclosure imported from the Government Information (Public Access) Act 2009 into the PPIP Act by way of s 20(5) (including matters of client legal privilege) and the diversion of resources required to answer the questions. Similarly, no submissions were made by the Applicant going to the issue of the Applicant's entitlement to their personal information."
In addressing those submissions, the Senior Member stated: "16 … (2) As regards the submissions referred to in paragraphs [12(2)] and [13(2)], [13(3)] and [14(1)] above, assuming the information requested is an applicant's personal information and, in the absence of the agency establishing a lawful basis for non-performance (ie refusing access), an IPP 7 access request does not require the applicant to prove their entitlement to access their requested personal information. Access to their personal information held by the agency is their right under IPP 7, unless and until the agency can establish an applicable lawful excuse or exemption as the basis for its refusal to provide access to that information (in whole or in part). … 18 The Tribunal must, based on the submissions and evidence before it, decide the real issue(s) in dispute in these remedy proceedings in line with the guiding principle and plain words of IPP 7. In this case, the real issue in dispute is the remedies to be awarded based on the findings as to liability in the Decision, including the enforcement of the Applicant's right to access their personal information under IPP 7. If the Respondent wished to claim that it is exempt or excused from performance of IPP 7, in whole or in part, it is incumbent on the Respondent to raise and, ultimately, establish such before the Tribunal and it has not done so in the case."
In the result, the Tribunal (relevantly) made the following order: "(2) Within 30 days of the date of these Reasons for Decision the Respondent will perform IPP 7 by providing the Applicant with access to all of the Applicant's personal information requested in Emails 1-6 (as defined in the decision)."
Since that decision, the Commissioner of Police has maintained three fundamental submissions: first, the conduct under review, said to be in breach of s 14 or IPP 7, was one of excessive delay; rightly or wrongly, that complaint was upheld. The matter under review was not any question as to whether Mr Ritson was entitled to specific documents. Secondly, the order made precluded the Commissioner from assessing individual documents, because that had not been done for the purpose of defending the claim of excessive delay. Thirdly, the Commissioner was not required to assess the documents if the task "would require an unreasonable and substantial diversion of the agency's resources", as provided in s 60(1)(a) of the GIPA Act.
Some variation or expansion of those points was at the heart of the appeal to the Appeal Panel and the further appeal to the primary judge. Other issues, such as procedural unfairness, were also agitated, but in terms they were different formulations of the same three issues, although there was a degree of confusion and obfuscation in the way they were presented. In this Court, the grounds of appeal were expressed in the following terms: "1 The primary judge erred in concluding that there was no obligation on the Tribunal to satisfy itself, before ordering a public sector agency to perform IPP 7 by providing a person with access to all of their personal information, that the conditions, limitations or exemptions that may apply by operation of ss 20(5) or 27 of the [Privacy Act] have been properly given effect. 2 The primary judge erred in holding that s 60(1)(a) of the [GIPA Act] was not picked up by s 20(5) of the [Privacy Act]."
The three issues raised by the Commissioner of Police might appear, on their face, to have merit, given the statements made by the Senior Member set out above. The question thus arises as to why the order of the Tribunal was not corrected, either by an application to reopen the relief decision, or on appeal to the Appeal Panel. The notice of appeal to the Appeal Panel was not available in this Court, except by way of a summary of the grounds provided by the Appeal Panel in its decision of 15 July 2022. [7] If the purported summary were accurately so described, the grounds must have been repetitive and verbose, perhaps giving the impression of a drafter struggling to identify a question of law. In fact that would not have been necessary, as the Appeal Panel could, with leave, have extended the nature of the appeal and even conducted a rehearing if it appeared there had been a miscarriage of justice. [8] However, it is clear that the issues now identified were raised before the Appeal Panel, for example, at par 38(1), (3) and (5). The last ground was addressed in the following terms: "136 Ground 5 concerning the Remedies Decision is also rejected. Having found unreasonable delay and there being no evidence to support the withholding of any personal information by virtue of one of the sections of the PPIP Act, such as ss 20(5), 24(5), 25(a) or (b) or 27, there was no basis for an order other than the orders in fact made by the Tribunal."
It may have been true that there was a lack of evidence before the Tribunal, but the Appeal Panel refused to allow the Commissioner to read an affidavit from Mr James, sworn on 14 January 2022, after the second decision of the Senior Member. Although it may have been arguable that the possible scope of the appeal to the Appeal Panel was misunderstood in the Court below, there was no challenge in this Court to the primary judge's dismissal of a ground challenging the Appeal Panel's refusal to admit the affidavit. Nevertheless, and somewhat opportunistically, senior counsel for the Commissioner in this Court relied on the affidavit on the leave application, in order to establish that there were indeed substantial arguments that some or all of the documents sought by Mr Ritson would, on analysis, have fallen within an exception, or within the exclusion from the requirement to search for and identify relevant documents in s 60(1)(a) of the GIPA Act. The affidavit was accepted for that purpose.
Mr James stated that on 3 December 2021, the Appeal Panel had imposed a conditional stay (by consent) on the orders made by the Tribunal on condition that the Commissioner provide Mr Ritson with access to "some of his personal information requested in emails 1, 3-6". A bundle of documents was said to have been provided. With respect to documents responsive to the request in email 2, a bundle of confidential documents was exhibited to the affidavit.
Mr James explained the searches that had been undertaken and the limited results which had been achieved. He stated that some of the information fell, in his opinion, "within the scope of the release and bar to [Mr Ritson] making such a request under s 14 of the [Privacy Act] in cl 7(c) of the Deed (relevantly, not to make requests under the [Privacy Act] in respect of his employment with the NSWPF)". [9] Mr James noted that some electronic records "may also not be in a text-searchable format, and may include photos, scans of documents in an image and a non-searchable PDF format". [10] It is not necessary to record the numerous technical difficulties deposed to by Mr James in relation to carrying out searches that would be required to comply with the email requests. It is sufficient to note that there was an arguable case for refusal to deal with the application under s 60(1)(a) of the GIPA Act, if that provision were engaged.
Further, Mr James identified numerous objections to the production of confidential information. These included records of investigations under Pt 8A of the Police Act 1990 (NSW), excluded from the definition of "personal information" in the Privacy Act. [11] The material was identified by reference to a table of public interest considerations listed in s 14 of the GIPA Act, and the public interest considerations raised in Sch 1 to the GIPA Act, which were conclusively presumed to provide an overriding public interest against disclosure: GIPA Act, s 14(1). The internal complaint handling processes of the NSW Police Force, including specific documents, were identified, disclosure of which could contravene those provisions. Other documents were identified for which client legal privilege would be claimed.
So far as reliance upon the deed was concerned, Mr James identified "complaints [Mr Ritson] made against the 29 former and serving police officers referred to in Sch 2 of the Deed" which he considered were "very likely to have been made under Pt 8A of the Police Act", disclosure of which "would prejudice the NSWPF's complaint handling and management action functions under Pt 8A and reveal the personal information of the police officers who had been the subject of those complaints". [12]
In fact, the basic information contained in the affidavit was set out in the two internal review decisions (Mr James having been the reviewer on each occasion) which were not in the papers before this Court until handed up by counsel for the Privacy Commissioner after lunch. What is more puzzling is that those decisions, being the subject matter of the review before the Tribunal, must have been available in the Tribunal, before the Appeal Panel and before the primary judge.
Had the Court not had information about the nature of the claims addressed in the deed, or the relationship over some two decades between the NSW Police Force and Mr Ritson, it would have been necessary to speculate as to whether there were real issues as to the production of the documents sought, or whether the case was an abstract exercise to determine the scope of certain statutory provisions. Both the content of the internal review decisions and Mr James' affidavit demonstrated with a degree of clarity that such issues did arise. That they were only made available half way through the hearing in this Court was unfortunate.
That procedural history gives rise to two further matters. First, even assuming, which is by no means clear, that the Commissioner of Police had made a forensic mistake in failing to proffer such material to the Senior Member at the first hearing, it is difficult to understand why the Appeal Panel refused to have regard to such information which, as has been noted was in its essence revealed in the record of the decisions under review. No doubt the possibility of prejudice to Mr Ritson was to be considered, but to turn a blind eye to the possibility of serious potential breaches of the laws protecting confidential information is difficult to comprehend.
Secondly, the material should be accepted in this Court as demonstrating that there were live issues of public importance which would not be addressed if leave were to be refused. There should be a grant of leave to appeal.

Issues on appeal: construction of s 14 of the Privacy Act

Section 14 of the Privacy Act reads as follows: 14 Access to personal information held by agencies A public sector agency that holds personal information must, at the request of the individual to whom the information relates and without excessive delay or expense, provide the individual with access to the information.
Section 14 is curious in two respects. First, it is the only one of the information protection principles set out in Pt 2, Div 1 of the Act (ss 8-19) which requires disclosure of information. In that respect, it is a provision which might have been expected to be found in the GIPA Act which, although generally dealing with public access rather than individual access, covers a number of important considerations relevant to access under s 14 of the Privacy Act. (However, that general proposition does not resolve the specific issue as to whether s 60(1)(a) qualifies the operation of s 14.) What is clear, however, is that within the Privacy Act, s 14 cannot be read in isolation. If it were so read, it would remove any basis for resistance to production under (i) the specific exemptions in s 23A(1), (revealing ASIO requests), (ii) the general exemptions, which apply to a number of sections including s 14, being s 24 (relating to investigative agencies), s 25 (where non-compliance is lawfully authorised or required) and s 27 (exemptions for certain law enforcement agencies, including the NSW Police Force), set out below.
Nor is it possible to read s 14 as providing a default requirement for disclosure despite the possible operation of an exemption, in circumstances where the agency has delayed excessively in resolving the application of an exemption. Yet that is the effect of the order made in the present case by the Tribunal.
All that follows from the statutory structure. The terms "information protection principle" and "principle" are defined in s 3(1), to mean a provision set out in Pt 2, Div 1, which includes s 14. Part 2, Div 2, titled "General provisions relating to principles", contains the following two provisions: 20 General application of information protection principles to public sector agencies (1) The information protection principles apply to public sector agencies. (2) The application of the principles to public sector agencies - (a) may be modified by privacy codes of practice, and (b) is otherwise subject to this Act. … (5) Without limiting the generality of section 5, the provisions of the Government Information (Public Access) Act 2009 that impose conditions or limitations (however expressed) with respect to any matter referred to in section 13, 14 or 15 are not affected by this Act, and those provisions continue to apply in relation to any such matter as if those provisions were part of this Act. 21 Agencies to comply with principles (1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency. (2) The contravention by a public sector agency of an information protection principle that applies to the agency is conduct to which Part 5 applies.
Critical for present purposes is s 20(2)(b), which precludes reading s 14 in isolation from other sections in the Privacy Act containing conditions or limitations on access or on the process of considering a request. Part 5 (referred to in s 21(2)) contains the provisions for internal and external review (ss 53 and 55) availed of by Mr Ritson.
That alone supplies a justification for the Commissioner's view that the relief available for a breach of s 14 could not involve an order for production of documents, absent a finding (or concession) that no condition or limitation on access was engaged. Accordingly, the Tribunal exceeded the powers available to it in making an order requiring the breach of s 14 to be remedied "by providing" the documents requested within 30 days. As a matter of principle, the appeal should be allowed and the operative order of the Tribunal set aside.
Before turning to the interrelationship of the Privacy Act and the GIPA Act, it is desirable to identify more particularly the conditions and limitations on access provided in the Privacy Act. To determine the scope of s 14 it is necessary first to refer to the definition of "personal information" in s 4 of the Privacy Act, which relevantly provides: 4 Definition of "personal information" (1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following - … (h) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990, … (4) Personal information is held by a public sector agency if - (a) the agency is in possession or control of the information, or (b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement… . The possible engagement of the exception in s 4(3)(h) was expressly referred to by Mr James.
Section 24 (1) exempts an "investigative agency" [13] from compliance with s 14 if compliance "might detrimentally affect … the agency's complaint handling functions or any of its investigative functions". Section 25 reads as follows: 25 Exemptions where non-compliance is lawfully authorised or required A public sector agency is not required to comply with section … 14 … if - (a) the agency is lawfully authorised or required not to comply with the principle concerned, or (b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law …. As will be noted shortly, the right to decline to carry out a search that would be unreasonably onerous may well be "necessarily implied or reasonably contemplated" by the Privacy Act itself, if not permitted by the GIPA Act.
The exemption in s 27, though described in the title as "specific" applies to much of the operational activity of the police: 27 Specific exemptions for certain law enforcement agencies (1) Despite any other provision of this Act, the following are not required to comply with the information privacy principles - … (h) the NSW Police Force. (2) However, the information protection principles do apply to a public sector agency mentioned in subsection (1) in connection with the exercise of the agency's administrative and educative functions.

Interrelationship of GIPA Act and Privacy Act

There remains the outstanding issue as to the relationship between the GIPA Act and the Privacy Act and, in particular, the possible engagement of s 60(1)(a) of the GIPA Act in dealing with a request for documents under the Privacy Act.
The appropriate place to commence the enquiry is the Privacy Act. As has been noted, that Act contains no process for an individual to obtain access to "personal information" about that individual. Rather, as occurs with some statutory provisions conferring jurisdiction on a court, s 14 has a double function, [14] namely of imposing an obligation on a public sector agency and, by implication, conferring a right on an individual to request access to personal information held by the agency.
It is clear from the breadth of the definition in s 4 that personal information may be, but need not be, contained on a database. Older databases are not necessarily readily searchable. While personal information does not include information about an individual who has been dead for more than 30 years, [15] it may be inferred that it does cover persons who have been dead for less than that period, and information about an employee who may have worked for the agency for decades and may have left the agency decades ago. A request under s 14 no doubt assumes that the agency holds personal information about the person requesting access, but there may be circumstances where the agency cannot readily determine whether it holds such information.
In analogous circumstances, rules of court impose controls on discovery and notices to produce. The party subject to such an order or notice may obtain relief from the court in control of the proceedings if the request is unreasonable, burdensome or too general. There is no such control available within the express provisions of the Privacy Act. That raises a question as to whether there are controls which may be implied from the terminology used and the context in which it appears or, alternatively, such controls or limitations which arise under the GIPA Act are imported so as to qualify the obligations under the Privacy Act.
Turning first to the question of implication, it is necessary to return to the provisions imposing obligations on the public sector agency and, in particular s 25(b) set out above. Further, as the Privacy Commissioner noted in submissions, there is an important qualification to the operation of the Privacy Act contained in s 69: 69 Legal rights not affected (1) Nothing in Part 2 or 3 gives rise to, or can be taken into account in, any civil cause of action, and without limiting the generality of the foregoing, nothing in Part 2 or 3 - (a) operates to create in any person any legal rights not in existence before the enactment of this Act, or (b) affects the validity, or provides grounds for review, of any judicial or administrative act or omission. (2) Subsection (1) is subject to sections 21 and 32.
As counsel submitted, the effect is that nothing in Pt 2 gives rise to a civil cause of action or creates any legal rights, but merely imposes the obligation under s 21, [16] contravention of which may lead to an internal review under Pt 5 (s 53) and a further review by the Tribunal. Apart from the possible enforcement of a monetary order under s 55(2)(a), it was common ground that there was no mechanism for enforcing any order made by the Tribunal. The agency is required to notify the Privacy Commissioner of the application for review and the findings of the review: s 54(1). The Privacy Commissioner has a right to appear before and be heard in any proceedings before the Tribunal in relation to the review: s 55(6). The Privacy Commissioner has the power, no doubt only exercised in the case of serious or repeated breach, to provide a special report to Parliament: s 61C(1).
The absence of enforceable legal rights in an individual arising from a contravention of the information protection principle may suggest that no particular regulation of any dealing with a request was intended; rather, the matters were to be left to the administrative remedies provided. Alternatively, it may be inferred that reasonable limitations are contemplated as governing the requirement to respond to any request, however broad or unreasonable, through the language of s 14.
For the reasons already noted, the obligation in s 14 is subject to other provisions of the Act: s 20(2). That necessarily implies that the obligation is limited to providing access to the information to which the person is entitled, which in turn recognises that the public sector agency must first identify the relevant information and then assess the entitlement of the person requesting it. The test of "excessive delay" must take account of the need to engage in those steps. Further, "delay" arguably assumes knowledge of the request and imports a reasonableness test into the assessment of the response. That is, only an unreasonably slow response will constitute delay, and something more is required for the delay to be "excessive". The lapse of a particular period of time does not, without further enquiry, constitute delay. Nor is there delay in providing access to documents in circumstances where the agency has decided that either it holds no documents containing personal information about the person making the request, or the person is not entitled to the documents. Whether that decision is right or wrong, does not engage the test of "excessive delay" merely because documents are not provided and the person considers that they should have been.
That leaves open the question as to whether s 14 imposes an obligation to make enquiries and searches regardless of the resources which may be required to undertake that exercise, and the likelihood of success. It seems unlikely that the legislature intended to impose an obligation on a public sector agency in such circumstances. Indeed, except as an ancillary step to the principle contained in s 15 (requiring an agency to amend information at the request of the individual to whom it relates to ensure that it is accurate), the principle governing access to personal information is distinct from the other principles which seek to protect the privacy of personal information from inappropriate disclosure. Nevertheless, its function as a basis for correction of inaccurate information is an important function of the legislative scheme.

Engagement of GIPA Act

A number of provisions in the Privacy Act expressly refer to the GIPA Act. There is no doubt that the interrelationship between the two was understood by Parliamentary counsel and attempts were made to ensure the harmonious operation of the overall legislative scheme with respect to information held by the Government. Indeed, provision was also made to accommodate the operation of the Health Records and Information Privacy Act 2002 (NSW). [17] The GIPA Act post-dated the Privacy Act by more than a decade, but replaced the Freedom of Information Act 1989 (NSW) and, when enacted, the Privacy Act included identical provisions referring to the Freedom of Information Act.
The first and broadest provision in the Privacy Act is s 5, which states: 5 Government Information (Public Access) Act 2009 not affected (1) Nothing in this Act affects the operation of the Government Information (Public Access) Act 2009. (2) In particular, this Act does not operate to lessen any obligations under the Government Information (Public Access) Act 2009 in respect of a public sector agency.
Secondly, s 20(5) set out above at [37], expressly preserves the effect of provisions in the GIPA Act that "impose conditions or limitations" with respect to "any matter referred to in", amongst others, s 14. What then is the "matter" which is the subject of s 14? The Privacy Commissioner submitted that the matter was "the duty of a public sector agency, at the request of the individual to whom personal information relates, to provide access to that information". [18] It may be accepted that the focus of s 14 is the provision of access to information. However, counsel then continued: "The notion within the [Privacy Act] within s 14 that access be provided on request and without excessive delay is important because one would not import from the GIPA Act conditions or limitations that, with respect, are something other than an entitlement to information on request or without excessive delay."
It may be accepted that the two Acts should be given a harmonious operation. To that end, the foundation for that submission was that the GIPA Act had a different mechanism for obtaining access to information (by application) and that mechanism was not to be imported into the Privacy Act, so as to displace the simple unregulated "request".
That submission should not be accepted to the extent that it continues the misconception that s 14 should be read in isolation as imposing an unqualified duty with a correlative unqualified right of the person making the request. As explained above, the principle expressed in s 14 cannot be so viewed, if only because s 20(2) subjects it to other provisions of the Privacy Act which impose limitations and require the undertaking of an assessment, both of the scope of the personal information requested and the application of exemptions for the purpose of determining the documents (if any) to which the person requesting is entitled.
With that approach in mind, it is convenient to turn to the GIPA Act. The relevant provisions commence with two general statements of principle: 5 Presumption in favour of disclosure of government information There is a presumption in favour of the disclosure of government information unless there is an overriding public interest against disclosure. 6 Mandatory proactive release of certain government information (1) An agency must make the government information that is its open access information publicly available unless there is an overriding public interest against disclosure of the information. Note - Part 3 lists the information that is open access information.
Section 12(1) identifies "a general public interest in favour of the disclosure of government information"; s 13 provides that there is "an overriding public interest against disclosure of government information" where there are public interest considerations against disclosure which outweigh those in favour of disclosure. The section then provides that there is a conclusive presumption of an overriding public interest against disclosure in relation to matters described in Sch 1 to the GIPA Act and, further, that the only other public interest considerations to be taken into account are those listed in a table to s 14 of the GIPA Act itself.
As a general proposition, it may be accepted that those provisions should be understood as "conditions or limitations" which might be imported into the Privacy Act pursuant to s 20(5). On the other hand, the subject matter of the GIPA Act is public access, and one public interest against disclosure to members of the public is that the information may "reveal an individual's personal information". [19] That would not be a relevant public interest against a disclosure under legislation which is expressly designed to provide access to an applicant's own personal information.
The focus of the present case is on Pt 4 of the GIPA Act, titled "Access applications". Section 41 identifies certain formal requirements for an access application. The Privacy Commissioner's submission precluded the importing of those requirements into s 14 so as to qualify the simplicity of the "request" mechanism.
For present purposes, that submission may be accepted. However, if it carries with it the implication that a public sector agency cannot itself, with appropriately promulgated material, create a procedural mechanism for making such requests, as appears to have been accepted by the Tribunal, that implication should not be accepted.
Part 4, Div 2 of the GIPA Act provides for the transfer, amendment or withdrawal of an access application and that too may be put aside. The focus of consideration is Pt 4, Div 3, titled "Process for dealing with access applications". Section 51 addresses the problem consequential upon the imposition of formal requirements, namely dealing with questions of validity of an application. Again, it may be accepted that those provisions do not apply. The one provision in Div 3 which is relied upon, is s 53 which, so far as relevant, provides: 53 Searches for information held by agency (1) The obligation of an agency to provide access to government information in response to an access application is limited to information held by the agency when the application is received. (2) An agency must undertake such reasonable searches as may be necessary to find any of the government information applied for that was held by the agency when the application was received. The agency's searches must be conducted using the most efficient means reasonably available to the agency.
Part 4, Div 4 is titled "Deciding access applications". It provides that an agency must decide an access application within 20 working days after the application is received: s 57(1). The specification of a reasonably short period for processing an application carries an implication as to the nature of what may be considered reasonable searches. Arguably the requirement under s 14 of the Privacy Act, conditioning the obligation to provide access by the imprecise standard of "excessive delay" might be understood to be flexible and permit broader enquiries than contemplated under the GIPA Act.
Section 58 of the GIPA Act is instructive because it reflects the fact that an application (or a request) can be decided both favourably and unfavourably to the applicant, and for different reasons: 58 How applications are decided (1) An agency decides an access application for government information by - (a) deciding to provide access to the information, or (b) deciding that the information is not held by the agency, or (c) deciding that the information is already available to the applicant (see section 59), or (d) deciding to refuse to provide access to the information because there is an overriding public interest against disclosure of the information, or (e) deciding to refuse to deal with the application (see section 60), or (f) deciding to refuse to confirm or deny that information is held by the agency because there is an overriding public interest against disclosure of information confirming or denying that fact. Note - These decisions are reviewable under Part 5.
Section 58(1)(e) is then expanded by s 60 which relevantly provides: 60 Decision to refuse to deal with application (1) An agency may refuse to deal with an access application (in whole or in part) for any of the following reasons (and for no other reason) - (a) dealing with the application would require an unreasonable and substantial diversion of the agency's resources, (b) the agency has already decided a previous application for the information concerned (or information that is substantially the same as that information) made by the applicant and there are no reasonable grounds for believing that the agency would make a different decision on the application, (b1) the applicant has previously been provided with access to the information concerned under this Act or the Freedom of Information Act 1989, … (2) In deciding whether dealing with an application would require an unreasonable and substantial diversion of an agency's resources, the agency is not required to have regard to any extension by agreement between the applicant and the agency of the period within which the application is required to be decided. … (4) Before refusing to deal with an access application because dealing with it would require an unreasonable and substantial diversion of an agency's resources, the agency must give the applicant a reasonable opportunity to amend the application. The period within which the application is required to be decided stops running while the applicant is being given an opportunity to amend the application. (5) Notice of an agency's decision to refuse to deal with an access application must state the agency's reasons for the refusal.
If the matter referred to in s 20(5) of the Privacy Act, arising under s 14, is "provision of access to information" then the ability of an agency to refuse to deal with an application for access to information for specified reasons should, in the ordinary meaning of the terms, constitute a "condition or limitation" on that matter.
Contrary to the Privacy Commissioner's submission, the fact that s 60 deals with an application under the GIPA Act does not preclude that construction. All provisions of the GIPA Act apply to disclosure of government information under that Act. For example, the public interest considerations referred to in s 13 of the GIPA Act are identified "for the purposes of this Act"; similarly, the public interest considerations listed in the table to s 14 are those that may be taken into account "under this Act". By analogy with provisions in federal laws picking up State laws and applying them to federal jurisdiction, to pick up a provision from one state Act and apply it in another State Act must involve some adaption of the original language in which it was expressed. [20]
As the earlier discussion reveals, the absence of any procedural provisions governing the provision of access under the Privacy Act in circumstances where some procedural constraints must apply suggests that the drafter was content to allow such necessary procedures to be adopted from the GIPA Act. The language of s 20(5) of the Privacy Act is apt to achieve that result.
Doubt might be cast upon that conclusion if, at the time of the enactment of the Privacy Act, the Freedom of Information Act did not contain a provision similar to s 60. However, the Freedom of Information Act in fact imposed a right to refuse access in such circumstances: 25 Refusal of access (1) An agency may refuse access to a document: (a) if it is an exempt document, or (a1) if the work involved in dealing with the application for access to the document would, if carried out, substantially and unreasonably divert the agency's resources away from their use by the agency in the exercise of its functions, or … (5) Subsection (1) (a1) does not permit an agency to refuse access to a document without first endeavouring to assist the applicant to amend the application so that the work involved in dealing with it would, if carried out, no longer substantially and unreasonably divert the agency's resources away from their use by the agency in the exercise of its functions.
Thus, under the Freedom of Information Act the limitation on the obligation to process the application was dealt with as a reason for refusing access to the document, in the same way that the agency was empowered to refuse access to an exempt document. It is unlikely that s 20(5), as enacted, was intended to distinguish between two subparagraphs of s 25(1) of the Freedom of Information Act having a common operation. When that Act was repealed and replaced by the GIPA Act, the consequential amendment to s 20(5) of the Privacy Act simply replaced the name of the repealed Act with the name of the new Act.
For these reasons, the provision of access to documents pursuant to a request under s 14 of the Privacy Act should be read down so as to exclude the need to process an application in circumstances where s 60(1)(a), subject to subs (4), is engaged. A similar result may be reached by a process of implication from the terms of the Privacy Act, by application of s 25(b).

Reasoning in the Tribunal, Appeal Panel and Common Law Division

In the circumstances set out above, the appeal should be allowed, the judgment below set aside, the decision in the Appeal Panel set aside and the operative order made by the Tribunal set aside. Normally, it would be desirable, in taking that course, to identify the manner in which the primary judge, the Appeal Panel and the Tribunal fell into error. In part, the answer lies in the manner in which the Commissioner of Police presented her case below. In other circumstances, that might have consequences for costs orders. However, as neither the Commissioner nor the Privacy Commissioner seek costs on this appeal, no order for costs will be made. Nor was there any costs order in the proceedings in the Common Law Division. The orders of the Appeal Panel of 15 July 2022 did not extend to costs. Neither did the orders made by the Senior Member on 30 April 2021, nor the subsequent orders made on 8 October 2021. No issue as to the reason why error arose needs to be addressed.
To extend this judgment unnecessarily should be avoided in circumstances where years have elapsed since the first requests were made, and the reasons given by judicial officers and tribunal members now exceed 500 paragraphs, and the matters remain unresolved.
The judgment in the Common Law Division from which the present appeal is brought may be addressed briefly. The Commissioner of Police pursued three grounds. The first was that the Tribunal had erred in failing to afford her procedural fairness in determining that Mr Ritson was entitled to the information he had requested, the Commissioner not having been provided with an opportunity to demonstrate a lawful excuse or exemption from compliance, that may have been engaged. In this Court, as the Privacy Commissioner correctly noted, the question of procedural unfairness was not pursued, but the issue was recast as a lack of power to make the order sought. Understandably, the matter was not addressed in those terms by the primary judge.
Ground 2 stated that the Appeal Panel erred in upholding the Tribunal's decision in circumstances where "the Tribunal could not have been satisfied that [the Commissioner] had considered and given effect to the conditions, limitations or exemptions that may apply to that provision by operation of ss 20(5) or 27 of the [Privacy Act]". Ground 3 challenged the refusal of the Appeal Panel to allow the Commissioner to read Mr James' affidavit, which would have provided evidentiary support as to the basis for refusal to process the application under s 60 of the GIPA Act, and as to the engagement of various exemptions under the Privacy Act.
The primary judge was persuaded that s 60(1) of the GIPA Act was not picked up by s 20(5) of the Privacy Act. The reasoning in support of that conclusion commenced by noting that no reliance had been placed on s 60(1)(a) before the Tribunal. [21] The following discussion treated the contents of Pt 4 of the GIPA Act as a coherent code for applications under that Act. As some parts of the code were clearly not engaged with respect to s 14 of the Privacy Act, the primary judge rejected the proposition that s 60(1)(a) had application to a request for personal information under the Privacy Act. Although the conclusion should be rejected, there is no purpose in adding to the reasons set out above for rejecting that conclusion.
With respect to ground 3 as articulated before the primary judge, there was no challenge in this Court to the refusal of the primary judge to overturn the refusal of the Appeal Panel to admit the affidavit. Accordingly, it is not necessary to say anymore on that topic, apart from noting that (i) the analysis of the operation of s 14, read in its statutory context, provides some basis for the correctness of the approach taken by the Commissioner of Police before the Tribunal, and (ii) the essence of the affidavit was encapsulated in the records of the internal review decisions.

Orders

In these circumstances, the Court should make the following orders: 1. Grant the Commissioner of Police leave to appeal from order (2) made in the Common Law Division on 21 July 2023 dismissing the appeal to that Court. 2. Allow the appeal and set aside order (2) in the Common Law Division. 3. In place of that order: 1. allow the appeal from the decision of the Appeal Panel of 15 July 2022; 2. set aside order (3) dismissing the appeal from the Senior Member, and in place thereof: 1. set aside order (2) made by the Tribunal on 30 April 2021; 2. set aside the orders made on 8 October 2021. 1. The effect of these orders being that Mr Ritson's applications before the Tribunal remain undetermined. 2. (5) Direct that the Tribunal take such steps as it deems appropriate for the determination of those applications in accordance with the reasons of this Court, if the applications are pursued.

Endnotes

[2023] NSWSC 854.
Privacy Act, s 55(6).
See email 4, seeking notes created by an officer in the NSW Police Force in that period.
DVT v Commissioner of Police [2021] NSWCATAD 108 (30 April 2021) ("Liability decision").
Liability decision, par 4.
DVT v Commissioner of Police (No 3) [2021] NSWCATAD 290 (8 October 2021) ("Relief decision").
Commissioner of Police (NSW Police Force) v DVT [2022] NSWCATAP 231 (S Westgarth, Deputy President, R Dubler SC, Senior Member).
Tribunal Act, s 80(2) and (3).
Affidavit, par 25.
Affidavit, par 27.
See below, at [37].
Affidavit, par 64.
The term "investigative agency" is defined in s 3, but without express reference to NSW Police Force.
See, by analogy, The King v The Commonwealth Court of Conciliation and Arbitration; Ex parte Barrett (1945) 70 CLR 141, 165-166 (Dixon J); [1945] HCA 50.
Privacy Act, s 4(3)(a).
The additional reference to s 32 engages an obligation to comply with a privacy code of practice, as referred to in s 20(2).
Privacy Act s 4A (for example).
CA Tcpt, 23/11/23, p 48(8).
GIPA Act, s 14, table, par 3(a).
See, for example, John Robertson & Co Ltd (in liq) v Ferguson Transformers Pty Ltd (1973) 129 CLR 65 at 88 (Gibbs J); [1973] HCA 21.
Primary judgment at [139]. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 13 December 2023

Freedom of Information Act 1989(NSW)

At a glance

Court

Decision date

Before

Catchwords

Source

Catchwords

Judgment (11 paragraphs)

Parties

Legislation Cited (7)

Cases Cited (8)

Cited By (2)