DVT v Commissioner of Police

Submissions and Evidence before the Tribunal

1. The material before the Tribunal in these proceedings as to remedies is as follows:

Applicant's Submissions 1. "Submission of the Applicant as to Remedy" filed on 25 May 2021 (Applicant Submissions); and 2. "Further Submissions of the Applicant as to Remedy" dated 2 July 2021 (Applicant Further Submissions);

Respondent's Submissions 1. "Submission of Respondent as to Remedy" filed on 1 June 2021 (Respondent Submissions); and 2. "Further Written Submissions of Respondent as to Remedy" filed on 22 June 2021 (Respondent Further Submissions).

Applicant Submissions, Applicant Further Submissions and requested remedies/orders

1. The orders sought by the Applicant in the Applicant Submissions are, in summary and most relevantly, that: 1. The Commissioner of Police is to personally provide a written undertaking that the Conduct of Concern will not occur again and provide an unreserved formal apology to the Applicant addressing the breaches of IPP 7 noted in the Decision. 2. The Respondent is to perform IPP 7 by providing the Applicant with access to their personal information the subject of the Applicant's IPP 7 requests. Such personal information to include information held as at the date of these Reasons for Decision. 3. The Respondent is to implement such administrative measures necessary to ensure that the offending conduct of the type the subject of the Decision will not occur again. 4. The Respondent is to amend its Privacy Management Plan (PMP) to reflect the administrative measures implemented in accordance with (3) above. 5. In consultation with the Privacy Commissioner, the Respondent is to provide training to a named individual employee of the Respondent in relation to the obligations of the Respondent under the PPIP Act and their responsibilities managing staff within the relevant unit which performs duties or exercise functions under the PPIP Act. 6. The Respondent is to publish notices (not identifying the Applicant in accordance with the publication restriction) in the "News" section of the Respondent's website and via the Respondent's Instagram, Twitter and Facebook social media accounts noting that the Commissioner was ordered to address a personal information access breach and the Respondent was ordered to perform IPP 7 and complete the various matters noted in the Orders made by the Tribunal.
2. In the Applicant Submissions the Applicant submits, in summary and most relevantly, that the Tribunal: 1. may either exercise the functions conferred or imposed on the public sector agency pursuant s 53(7) PPIP Act or make any of the orders provided for in s 55(2) PPIP Act; 2. has the power to order the implementation of administrative measures to ensure that conduct similar to the offending conduct will not occur again under s 53(7)(e) and also has the power to order the performance of an IPP pursuant to s 55(2)(c) PPIP Act; and 3. may make such ancillary orders as it thinks appropriate pursuant to s 55(2)(g) PPIP Act. An ancillary order being an order that is incidental or supplemental to any order that the Tribunal is empowered to make and flowing directly from the finding of the contravention of the relevant IPP.
3. In the Applicant Further Submissions the Applicant submits, in summary and most relevantly, that: 1. The Respondent's submission that the question of the Applicant's "entitlement to the information" was not before the Tribunal for review and was not subject to the determination by the Tribunal is obviously incorrect and should be rejected. 2. The Applicant's entitlement to their personal information is, at the very least, implicit in the Tribunal's finding that the Respondent breached s 14 PPIP Act/IPP 7. If the Applicant had no entitlement to the information there could be no finding that the Respondent breached s 14 PPIP Act/IPP 7 (i.e. there could be no excessive delay). 3. The Respondent has been on notice from the very outset of this matter that the Applicant was alleging that they had suffered significant frustration and distress as a result of the Respondent's repeated breaches of their privacy. 4. For the purposes of ordering an apology from the Respondent, the Tribunal can properly be satisfied on the basis of the unchallenged evidence that the Applicant suffered significant frustration and distress as a result of the Respondent's repeated breaches of their privacy rights, including excessive delay. Relevantly, the requirement in s 55(4)(b) PPIP Act that "psychological harm" be established to the satisfaction of the Tribunal applies to an order for monetary compensation under s 55(2)(a) PPIP Act, not an apology. 5. The Respondent's submission that there is no statutory basis for the Tribunal to order the amendment of the Respondent's PMP in this case is misconceived and should be rejected as the statutory basis for the Tribunal to order the amendment of an agency's PMP was discussed in the decision of EIG.

Respondent Submissions and Respondent Further Submissions

1. In the Respondent Submissions the Respondent submits, in summary and most relevantly, that: 1. A consideration of what action, if any, would be appropriate for the Tribunal to take by way of remedy is confined by the scope of the Tribunal's jurisdiction in these proceedings. The Tribunal does not have jurisdiction to review conduct of the Respondent that was not the subject of the Applicant's application(s) for internal review. The conduct that was subject of the application(s) for internal review was that the Respondent had "failed to provide [the Applicant] with access to my personal information [as requested in those five emails] without excessive delay". 2. What is not within scope of the Tribunal's jurisdiction is the question of the Applicant's entitlement to the personal information sought. At the time the request for internal review was made the Applicant's entitlement to the information had not been assessed. 3. No evidence was adduced in the Decision proceedings going to the question of the Applicant's entitlement to their personal information as it would have been had entitlement been in issue. The evidence of the Respondent would have included, but not been limited to, the applicable public interest considerations against disclosure imported from the Government Information (Public Access) Act 2009 into the PPIP Act by way of s 20(5) (including matters of client legal privilege) and the diversion of resources required to answer the questions. Similarly, no submissions were made by the Applicant going to the issue of the Applicant's entitlement to their personal information. 4. The apology sought by the Applicant is inappropriate and improper. Any apology that the Respondent is ordered to make must relate only to the conduct the subject of the proceedings. The Tribunal is not at liberty to take into account the alleged inconvenience, annoyance, frustration or distress said to be suffered by the Applicant as result of the Respondent's breach of IPP 7 as there is no evidence of this before the Tribunal. 5. The Applicant has not sought monetary compensation and has not placed any material before the Tribunal that will enable the Tribunal to find that the Applicant had suffered loss or psychological or physical harm that was because of or caused by the Respondent's breach. Accordingly, there is "no basis for the Tribunal to make an award of damages of any magnitude". 6. The Applicant's request for a written personal undertaking from the Commissioner of Police that "the conduct of concern the subject of this proceeding will not occur again" has no statutory basis, nor is it clear that such an undertaking could be the subject of orders by the Tribunal. Further, if it were accepted that it is within the Tribunal's power to make such an order, the breadth of the undertaking requested by the Applicant is unacceptably broad, it is ambiguous in its terms and the Applicant has not identified why such an order would be appropriate. 7. The Applicant seeks an order that the Respondent "implement such administrative measures necessary to ensure that the conduct of concern the subject of this proceeding will not occur again". This order is open to two interpretations. On the one reading, the order refers specifically to the actual conduct the subject of the Decision and seeks the implementation of such administrative measures to ensure that that historic conduct will not occur again. Self‑evidently that historic conduct of concern the subject of the Decision has already happened and therefore such an order (to stop it happening again) would be otiose. An alternative reading is that the requested order requires the Respondent to implement administrative measures to ensure the Respondent does not, in the future, respond to requests for access to personal information with excessive delay. This latter reading of the Applicant's requested order would also suggest that the order is otiose, as it is indistinct from the Respondent's existing legal obligation under s 14 PPIP Act/IPP 7. As has been recognised by the Tribunal on numerous occasions, whether there has been compliance with s 14 PPIP Act/IPP 7 will always be informed by the specific facts and circumstances of a particular request. The remedy sought by the Applicant is therefore at once unacceptably broad and ambiguous and compliance would be impossible. 8. There is no evidence of any systemic issues with the Respondent's systems for responding to s 14 PPIP Act/IPP 7 requests and there are "special circumstances arising from the litigation between the Applicant and the Respondent which goes some way to explaining how these particular breaches occurred". 9. It is submitted that the Tribunal is not empowered to order the Respondent to amend its PMP. "Administrative measures" ordered under s 63(2) of the Administrative Decisions Review Act 1997 (ADR Act) and s 53(7) PPIP Act do not include the implementation or amendment of a PMP. Nor would an order requiring the amendment of a PMP come within the meaning of the "ancillary orders" referred to s 55(2) PPIP Act. 10. As regards the request for an order that the Respondent provide training to a named individual employee of the Respondent, the Applicant has not identified any basis for singling out that individual for training and there is no evidence before the Tribunal that would satisfy the Tribunal that such an order is required. 11. Finally, the Applicant seeks that the Respondent be required to publish notices in relation to the Tribunal's findings and remedies ordered. No basis has been articulated by the Applicant in support of such an order and it is submitted that an order of this kind would be inappropriate.
2. In the Respondent Further Submissions the Respondent submits, in summary and most relevantly, that: 1. The question of the Applicant's entitlement to their personal information was not before the Tribunal for review and was not the subject of a determination by it. The Tribunal, having now reviewed the Respondent's conduct and decided the breach issue, is functus officio on the question of breach. 2. The remedy of requiring the Respondent to perform its obligation under IPP 7 by providing the Applicant with access to the Applicant's personal information (the subject of requests in Emails 1‑5) is not a remedy within the scope of the Tribunal's powers to order as that conduct was not the subject of an internal review application made by the Applicant. 3. Further to the Respondent's submissions in the Respondent Submissions that the term "administrative measures" does not encompass the implementation or amendment of a PMP, the Respondent submits that s 33(4) PPIP Act provides that a public sector agency may amend its PMP from "time to time" without imposing any condition on when the amendment can occur. However, s 53(7)(e) only permits an agency to "implement administrative measures" for the purposes of ensuring that the "conduct will not occur again" after an internal review has been completed. As a matter of construction, the differences between the powers that can be exercised by an agency indicates that they are intended to be distinct and not cover the same subject manner. Also, s 33 is located in Part 3 PPIP Act which is a different part of the Act from where ss 53 and 55 PPIP Act are located (Part 5). Again, as a matter of construction, the structure of the PPIP Act suggests that the implementation and amendment of an agency's PMP is intended to be discrete and separate from the implementation of administrative measures under s 53(7). 4. Finally, s 55(2) PPIP Act does not provide a source of power to the Tribunal to order the amendment of the Respondent's PMP. An "ancillary order", as that term is used in s 55(2)(g) PPIP Act, has been construed by the Tribunal to mean an "order that is incidental or supplemental to an order the Tribunal is empowered to make". It does not follow that ancillary orders made under s 55(2)(g) PPIP Act could be "incidental to or supplemental to" an order made under s 63(2) ADR Act and s 53(7) PIPP Act.

Consideration

1. In considering the submissions of and matters raised by the parties and in deciding as to appropriate remedies I have considered: 1. that the PPIP Act is beneficial legislation that should be construed beneficially such as to generally protect an individual's rights under it (see Taciak v Commissioner of Australian Federal Police [1995] 131 ALR 319, MT v Director General, NSW Department of Education & Training [2004] NSWADT 194 and Pearce v AQO [2015] NSWCATAP 162); 2. the s 36(a) of the Civil and Administrative Tribunal Act 2013 (CAT Act) "guiding principle" of the Tribunal. That is, the Tribunal is obliged to facilitate the just, quick and cheap resolution of the real issues in the proceedings. The parties are also under a duty to cooperate with the Tribunal and to give effect to the guiding principle (s 36(3) CAT Act); 3. the Conduct of Concern which is the subject of the Applicant's internal review requests and the Decision; 4. as noted in paragraphs [26] to [27] of the Decision, that the words of s 14 PPIP Act/IPP 7 are clear and unambiguous. IPP 7 gives individuals the right to (i) access their personal information held by agencies and (ii) be provided with access without excessive delay or expense; 5. s 52(4) PPIP Act. That is, that s 53 ADR Act does not apply to or in respect of conduct to which Part 5 of the PPIP Act "Review of Certain Conduct" applies; and 6. it has been some four years and four months since the date of the first of these requests of the Applicant for access to their personal information were received by the Respondent.
2. For the purposes of determining the remedies to be awarded by the Tribunal arising from the Decision, I do not need to address all of the submissions of the parties (paraphrased and summarised in paragraphs [11] to [14] above). However, it is necessary to specifically address some of the submissions relating to the interpretation and application of IPP 7 and the powers of this Tribunal: 1. As regards the submissions referred to in paragraphs [12(2)], [13(1)] and [14(2)] I note that: 1. in addition to the internal review request in relation to Emails 1‑5 the Applicant also applied for internal review of the Respondent's conduct of concern in relation to Email 6 in the same terms as the internal review requested in relation to Emails 1‑5; and 2. the Conduct of Concern (raised in both internal review requests), as quoted in the Respondent's submissions (see paragraph [13(1)] above), was that in relation to IPP 7 the Respondent had "failed to provide [the Applicant] with access to my personal information [as requested…] without excessive delay". Both internal review requests requested review of the Conduct of Concern which the Applicant alleged resulted in the breach of IPP 7 by the Respondent in respect of the Applicant's six separate access requests. That is, neither of the Applicant's internal review requests limited the scope of those reviews nor the alleged consequences arising from the Conduct of Concern to only excessive delay. 1. As regards the submissions referred to in paragraphs [12(2)] and [13(2)], [13(3)] and [14(1)] above, assuming the information requested is an applicant's personal information and, in the absence of the agency establishing a lawful basis for non-performance (ie refusing access), an IPP 7 access request does not require the applicant to prove their entitlement to access their requested personal information. Access to their personal information held by the agency is their right under IPP 7, unless and until the agency can establish an applicable lawful excuse or exemption as the basis for its refusal to provide access to that information (in whole or in part). 2. In relation to the submission referred to in paragraphs [11(1)], [12(3) and (4)] and [13(4)] above, where the Tribunal orders an apology the terms of that apology may (and often do) include an apology for any inconvenience, annoyance, frustration, distress or similar that the agency's breach of one or more IPPs may have caused that individual. No separate proof along the lines of that which is required under ss 55(2)(a) and (4) PPIP Act is required for the Tribunal to order an apology for any inconvenience, annoyance, frustration and/or distress that may have flowed from the breach of that individual's rights under the PPIP Act, in addition to an apology in relation to the conduct itself. 3. As regards the submission referred to in paragraphs [11(1)] and [13(6)] above I note that, without deciding whether a personal undertaking as requested by the Applicant may be ordered, it is within the power of the Tribunal to require an undertaking to be provided by the agency under s 53(7)(d) PPIP Act. 4. As regards the submissions referred to in paragraphs [11(2)] and [13(7)], the intention of any order for administrative measures addressing systemic issues (brought to light while examining the relevant conduct of concern in a particular case) is to address those systemic issues of the agency so that the conduct of concern and relevant similar conduct will be corrected by the agency so that the resulting breaches of the relevant IPPs will not occur again, whether in relation to the specific applicant or any other individual.
3. The Applicant sought a review of the Conduct of Concern and the consequences of such conduct (i.e. whether such conduct breached IPP 7). Without express words to the contrary and in circumstances where an applicant has not received their requested information, the review of that agency's alleged breaches of IPP 7 must include a review of both (i) the failure to that date to provide the Applicant with access to their requested personal information and (ii) any excessive delay or expense in providing such access. In the circumstances where access to such information had not yet been provided to the Applicant and in the absence of any express words limiting the scope of the internal review requests, I am satisfied that in the Decision the Tribunal found that the Conduct of Concern and the alleged resulting breaches by the Respondent of IPP 7 were (i) the failure of the Respondent to provide access to the requested information and (ii) for Emails 1-5 the excessive delay in providing such access to the Applicant.
4. The Tribunal must, based on the submissions and evidence before it, decide the real issue(s) in dispute in these remedy proceedings in line with the guiding principle and plain words of IPP 7. In this case, the real issue in dispute is the remedies to be awarded based on the findings as to liability in the Decision, including the enforcement of the Applicant's right to access their personal information under IPP 7. If the Respondent wished to claim that it is exempt or excused from performance of IPP 7, in whole or in part, it is incumbent on the Respondent to raise and, ultimately, establish such before the Tribunal and it has not done so in the case.
5. Given the comments and findings in paragraphs [15] to [18] above and considering the guiding principle, I am satisfied that an order under s 55(2)(c) PPIP Act requiring the performance of IPP 7 is appropriate in these circumstances.
6. Based on the submissions and evidence before the Tribunal, no systemic issues have been established.
7. I am satisfied that, given the number of the Applicant's access requests not fulfilled by the Respondent and the length of the excessive delays, an undertaking from the Respondent in accordance with s 53(7)(d) PPIP Act would have been appropriate as a possible remedial action available to the internal reviewer of the Respondent. However, given that the Conduct of Concern was the subject of administrative review by the Tribunal resulting in the Decision, rather than ordering an undertaking I am satisfied it is more appropriate for the Tribunal in this case to use its power under s 55(2)(b) PPIP Act. That is to order the Respondent to, as regards the Applicant, refrain from repeating the Conduct of Concern or similar conduct in contravention of IPP 7.
8. If the Tribunal makes an order under s 55(2)(b) PPIP Act in respect of the Conduct of Concern, I am satisfied that also ordering an apology would not add anything of value to the Applicant's remedies in these circumstances.
9. Having not found any systemic issues arising and given the other orders I am making, I am satisfied that an order specifically relating to training is not required in these circumstances.
10. Given that neither the Conduct of Concern nor the consequences of it were made public, I am satisfied that it is not appropriate in these circumstances to order the publication of the notices requested by the Applicant.

Orders 1. From the date of these Reasons for Decision the Respondent is to refrain from repeating any of the conduct of concern (as detailed in the Decision) and conduct similar to it in contravention of IPP 7 in relation to any IPP 7 access requests made by the Applicant. 2. Within 30 days of the date of these Reasons for Decision the Respondent will perform IPP 7 by providing the Applicant with access to all of the Applicant's personal information requested in Emails 1-6 (as defined in the Decision).

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 01 November 2021 - Citation delimiter included DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 01 November 2021