DYD16 v Minister for Immigration and Border Protection

Decision of the delegate 8 By a decision dated 19 August 2016, the delegate refused the appellant's application for a protection visa. The delegate considered the data breach claim with the claim for complementary protection, i.e. that there are substantial grounds for believing that, as a necessary and foreseeable consequence of the appellant being removed from Australia to Sri Lanka, there is a real risk that the appellant will suffer significant harm (s 36(2)(aa)). These grounds were considered at some length. 9 The decision of the delegate records that at his protection visa interview the appellant's representative stated that the data breach is a breach of privacy: ultimately affecting the safety of our client and his family. Although this breach was unintentional, personal information of our client was accessible to the public domain, obtainable by the Sri Lankan Police Department, Sri Lankan Army, Sri Lankan Government authorities and community gang members. As a result, it would be extraordinarily unsafe for our client to travel back to Sri Lanka and have these members of the community harm him knowing that he sought refuge in another country. It would be a breach of human rights to force our client into a situation that was possibly worsened by a mistake of the department. 10 Although the delegate accepted that the Sri Lankan authorities will be aware that the appellant had resided in Australia, and that they may be aware that he had travelled to Australia as an unauthorised maritime arrival and may therefore deduce that he did so for the purpose of seeking asylum, he concluded that on the information before him failed asylum seekers do not face a real chance of being harmed or mistreated on account of that status. He said that he was satisfied that the appellant is not a person of particular interest to the authorities and that the nature of his interaction with authorities will involve standard questioning and will not result in him being subjected to significant harm. 11 The delegate also dismissed the other grounds for the appellant's claim for protection. 12 The appellant is a "fast track applicant" as defined in s 5(1) of the Act and therefore the delegate's decision was automatically referred by the Department to the Authority for limited merits review under the "Fast Track Assessment Process" in Part 7AA of the Act.

Decision of the Authority 13 The Authority affirmed the decision of the delegate not to grant the appellant a protection visa on 25 November 2016. Those parts of its 55 paragraph decision that deal with or are directly relevant to the data breach ground are the following: Failed Asylum Seeker 23. The applicant claims to have left Sri Lanka in October 2012 to travel to Australia as a passenger in a boat organised by a smuggler. He does not have a passport. The applicant was one of a number of asylum seekers whose information was published by the Department of Immigration and Border Patrol in 2014 due to a data breach on its website. I find that, if he were to return to Sri Lanka, he will be considered a failed asylum seeker who departed illegally by the Sri Lankan authorities. … 29. I am satisfied that the applicant will not face a real chance of harm from D, his gang or the Sri Lankan authorities due to the family's dispute with D in 2008 or for any other reason on return to Sri Lanka now or in the reasonably foreseeable future. … 37. I accept that the applicant will be considered a failed asylum seeker on his return. DFAT reports that there have been thousands of asylum seekers returned to Sri Lanka since 2009, including some 1500 from Australia, with relatively few allegations of torture and mistreatment and assesses the risk of harm for the majority of returnees as low. While DFAT notes there are a small number of reports of mistreatment upon return by asylum seekers, they cannot verify these reports, which are often anonymous and made to third parties. I accept that an asylum seeker with actual or perceived links to the LTTE may be at risk of harm when processed at the airport. However, the country information does not suggest that simply returning to Sri Lanka as a failed asylum seeker leads the authorities to impute any anti-government political views to a returnee. The applicant is Sinhalese, has no links to the LTTE and, based on my findings, is of no adverse interest to the Sri Lankan authorities for any reason. Taking into account those findings and the country information, as well as the data breach that occurred in 2014, I do not accept that the applicant as a failed asylum seeker will be at risk of adverse attention from the current Sri Lankan authorities when scrutinised on arrival in Sri Lanka. … Complementary protection: conclusion 55. There are not substantial grounds for believing that, as a necessary and foreseeable consequence of being returned from Australia to a receiving country, there is a real risk that the applicant will suffer significant harm. The applicant does not meet s 36(2)(aa).

Federal Circuit Court 14 By application filed on 16 December 2016, the appellant applied to the FCC to quash the decision of the Authority. Four grounds of review were pressed before the primary judge: 1. The Applicant's personal information was published online in 2014 due to a data breach on the Department of Immigration and Border Control website. 2. This breach placed the Applicant in greater danger than he otherwise would be of being: a. Killed, harmed or mistreated by the Sri Lankan Army, Police and Sri Lankan Government Authorities; b. Indefinitely imprisoned by the Sri Lankan Army, Police and Sri Lankan Government Authorities; and c. Killed, harmed or mistreated by a named person ("D") and other gang members who have power and control in the community. 3. The Immigration Assessment Authority's review of the Applicant's matter, conducted on 25 November 26 (provided in Affidavit of [the Applicant] dated 14th December 2016,) did not address or consider the added danger posed to the Applicant as a result of the 2014 data breach. 4. In Paragraphs 23 and 37 of the Immigration Assessment Authority's review of the Applicant's matter, conducted on 25 November 2016, no reasons were provided as to why the 2014 data breach posed no added danger to the Applicant. 15 It is readily apparent from the articulated grounds of review that although they are separately numbered they really run together and should be understood in that way. Given that the appellant was unrepresented before the FCC, as he is before me, it is not surprising that the grounds of review are not set out as self-standing separate grounds. 16 The primary judge nevertheless dealt with each ground separately. Ground 1 was dismissed on the basis that it is merely a factual allegation and does not identify jurisdictional error. Ground 2 was dismissed on the basis that the Authority meaningfully considered and had regard to the appellant's claims. Reference was made to paragraph [29] of the decision of the Authority which I have quoted at [13] above. 17 Ground 3 was dismissed on the basis that the Authority addressed the appellant's contention that the data breach posed an added danger to him. Reference was made, by the primary judge, to paragraphs [23], [26], [27], [29] and [37] of the Authority's decision. Paragraphs [26] and [27] contain the Authority's reasoning on why the appellant no longer faced a threat from D and his gang on his return to Sri Lanka, mostly because the last time there were such threats by D was in 2008. The other paragraphs are quoted at [13] above. 18 Ground 4 was dismissed on the basis that the Authority had provided reasons for its decision. Reference was made to paragraph [37] of the Authority's decision which is quoted at [13] above.

Grounds of appeal 1-4: data breach 19 Grounds of appeal 1 to 4 before me all deal with the question of the data breach. I will accordingly consider them together. Grounds of appeal 1. The Federal Circuit Court Judge Dowdy erred in holding that ground 1 of the application comprises merely a factual allegation and does not constitute any meaningful assertion of jurisdictional error and, accordingly, fails to establish jurisdictional error and is not made out. Particulars a) The Applicant's personal information was published online in 2014 due to a data breach on the Department of Immigration and Border Control website. b) This breach placed the Applicant in greater danger than he otherwise would be of being: i. Killed, harmed or mistreated by the Sri Lankan Army, Police and Sri Lankan Government Authorities; ii. Indefinitely imprisoned by the Sri Lankan Army, Police and Sri Lankan Government Authorities; and Killed, harmed or mistreated by a named person ("D") and other gang members who have power and control in the community. 2. The Federal Circuit Court Judge Dowdy ought to have found that the Immigration Assessment Authority (IAA) gave "no reasons" as to why the data breach posed no added danger to the Applicant. 3. The Federal Circuit Court Judge Dowdy erroneously held at paragraph [37] of the Decision Record of the IAA indicates that it had considered country information, that it took into account its earlier findings that the Applicant would not suffer harm upon return to Sri Lanka for any reason and in effect that the data breach did not add to or augment any risk of adverse attention if the Applicant returned to Sri Lanka. 4. The Federal Circuit Court Judge Dowdy erroneously held "In my view, the IAA in its Decision Record did provide reasons as to why the 2014 data breach posed no danger to the Applicant and, in my view, Ground 4 also fails to establish jurisdictional error." [at 27]. 20 The essential question that these grounds of appeal raise is whether the Authority committed jurisdictional error in the way in which it considered and dealt with the data breach claim, including whether it gave adequate reasons for its conclusions. 21 In my view there is no jurisdictional error in the Authority's treatment of the data breach issue. It underlies the Authority's reasoning that it was prepared to assume that relevant people in Sri Lanka, both from government and security agencies and private people such as D and his gang, might know that the appellant had applied for asylum in Australia and failed. That assumption applied both in respect of whether there had been a data breach or not - in either event the Authority reasoned that there was no well-grounded apprehension of significant harm to the appellant on his return to Sri Lanka. On the facts that the Authority found, as it was entitled to do within its jurisdiction, there was no error in its reasoning to the conclusion that the data breach did not give rise to circumstances such as to mean that Australia has protection obligations to the appellant. 22 In the circumstances, the appeal on grounds 1 to 4 must fail.

Ground of appeal 5: pre-trial detention 23 This ground asserts that the Authority did not properly address and deal with the likelihood of pre-trial detention of the appellant on his return to Sri Lanka. 24 The first difficulty with this ground is that it was not raised before the primary judge. That would not necessarily be an absolute bar, as the appellant could be granted leave to raise the ground before me. That, however, leads to the second difficulty, which is that the ground must in any event fail. 25 The delegate stated as follows with regard to the possible detention of the appellant on his return to Sri Lanka: The information outlined above indicates that the applicant will likely be questioned, briefly detained and fined as a result of departing Sri Lankan illegally. I have given regard to Minister for Immigration and Border Protection v WZAPN [2015] HCA 22. I am satisfied that a very short period of detention to facilitate the processing of such charges and fines does not meet the definition serious harm. I am not satisfied that there is a real chance that the applicant will face serious harm on return to Sri Lanka for this reason. 26 In Minister for Immigration and Border Protection v WZAPN [2015] HCA 22; 254 CLR 610 it was held that loss of liberty that did not constitute "serious harm" did not provide a basis for protection, and that the question of whether a threat to a person's liberty involved serious harm required a qualitative judgment including an evaluation of the nature and gravity of the apprehended loss of liberty; it requires a qualitative judgment, involving the assessment of matters of fact and degree (at [41] and [45]). There, anticipated temporary detention and questioning on being returned to the receiving country was not found to amount to serious harm such as to give rise to an entitlement to protection (at [51]). 27 The Authority found on the basis of country information that the appellant is likely to be detained and questioned at the airport, for up to 24 hours, before being taken by the police to the nearest Magistrates Court on returning to Sri Lanka. The Authority went on to consider in some detail what would be likely to occur thereafter, including reasoning that if the appellant was held over a weekend or public holiday until seen by a Magistrate, he would face only a brief period in detention. The Authority referenced WZAPN and concluded that even having regard to general poor prison conditions, and the appellant's age, it did not consider that a brief period - 1 to 3 days - in detention would constitute the necessary level of threat to his life or liberty, or to significant physical harassment or treatment under s 5J(5) of the Act, or otherwise amounts to serious harm. 28 In the circumstances, ground of appeal 5, which asserts that the Authority did not properly address and deal with the likelihood of pre-trial detention, must fail. The Authority dealt with that likelihood at some length in its reasons, including by relying on country information as a basis to support the conclusions that it reached.

Further matters 29 In oral submissions at the hearing of the appeal, the appellant said that the situation in Sri Lanka has recently changed which makes matters more dangerous for him. He referred to the highly publicised and devastating bomb attacks over Easter this year, as a consequence of which tourists have been warned not to travel to Sri Lanka. He said that the situation following the bombing can be used by his opponents (whom I take to be D and his gang). 30 The appellant also said that two of his cousins were murdered on Christmas Day last year in the harbour. He said that although no one has taken responsibility, it is "obvious" that D and his gang carried out the murders. 31 The appellant submitted that due to the current situation in Sri Lanka it is not safe for him to be returned there. 32 Mr Liu, who appeared for the Minister, submitted that I cannot take these matters into account because they are not covered by the notice of appeal, there is no evidence in support of them, and they were not before the Authority or the primary judge. I accept those submissions. In addition, there is no basis upon which an application to amend the notice of appeal and to adduce evidence on appeal, if made, could succeed.

Conclusion 33 The appeal must accordingly be dismissed with costs. 34 I certify that the preceding thirty three (33) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Stewart.