EPR v Commissioner of Police

Issues for determination

1. The real and substantive issue between the parties is whether the Respondent is exempt from compliance with IPP 11 in the circumstances of this matter and if not, but only if not, whether the Conduct of Concern resulted in any non‑compliance by the Respondent with IPP 11.
2. There is no dispute between the parties that the information provided by the NSWPF to the Applicant's aunt and/or her legal representative was the personal information of the Applicant held by the NSWPF for the purposes of the PPIP Act and that it was collected and disclosed in accordance with the facts noted in paragraph [5] above.

Relevant legislation

1. Section 18 PPIP Act (IPP 11) provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless - (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
2. The Respondent relies on s 27 PPIP Act which, in summary and most relevantly, provides: 27 Specific exemptions (ICAC, ICAC Inspector and Inspector's staff, NSW Police Force, LECC, Inspector of LECC and Inspector's staff and NSW Crime Commission) (1) Despite any other provision of this Act, … the NSW Police Force, … are not required to comply with the information protection principles. (2) However, the information protection principles do apply to … the NSW Police Force, … in connection with the exercise of their administrative and educative functions.

Scope of administrative proceedings under the PPIP Act

1. The scope of the request for internal review (i.e. IR Request in this case) limits the scope of the AR Application (in this case) before the Tribunal, without the agreement of the Respondent to expand the scope of the AR Review. The scope of the IR Request (i.e. the conduct of concern) is a matter of fact to be determined by objectively and reasonably construing the IR Request.
2. The Tribunal's role is to review the conduct of concern in issue (i.e. the Conduct of Concern in this case) and to consider the action proposed to be taken by the agency (i.e. the Respondent in this case), not to review the findings of the internal review report (i.e. the IR Decision in this case): DED v Randwick City Council [2017] NSWCATAD 327 at [50]. The Tribunal considers the Conduct of Concern (in this case) afresh, based on the evidence and material before it at the time of the hearing: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409 and KT v Sydney Local Health Network [2011] NSWADT 171 at [64].
3. It is not in dispute that the AR Application and these proceedings are within the scope of the IR Request, in particular the Conduct of Concern as set out in the IR Request.

Material before the Tribunal

1. Each of the parties has provided written submissions in regard to the AR Application as follows: 1. the Applicant Submissions filed on 16 May 2021; and 2. the Respondent Submissions filed on 7 June 2021 and a bundle of s 58 Administrative Decisions Review Act 1997 materials filed with the Tribunal on 12 April 2021.

The Applicant's submissions

1. In addition to setting out the facts as summarised in paragraph [5] above (on which basis the Respondent has agreed to proceed) the Applicant submits, in summary and most relevantly: 1. Despite informing the Applicant it was a civil matter and no action would be taken, and without notice to the Applicant, on 3 December 2020 the NSWPF disclosed the Applicant's personal information to either or both of the Applicant's aunt and/or her legal representative. 2. The NSWPF have asserted that, in these circumstances, the s 27 PPIP Act exemption applies exempting the NSWPF from compliance with the "Disclosure IPP" (i.e. IPP 11). 3. On the basis of the matter being considered by the NSWPF as "civil" and "not a Police matter" the Applicant submits that the disclosure of the Applicant's personal information was in fact in connection with the exercise of the NSWPF's administrative or educative functions and hence is subject to compliance with the "Disclosure IPP"/IPP 11. 4. Section 27(1) PPIP Act confers on the NSWPF a blanket exemption from compliance with the IPPs in relation to all activities, subject only to the qualifications set out in s 27(2) PPIP Act. Accordingly, the starting point is that all activities of the NSWPF have the benefit of the exemption in s 27(1) PPIP Act unless and until an activity is brought back within the ambit of the PPIP Act/IPPs because of a connection between the activity and the exercise of an administrative or educative function of the NSWPF. 5. If the matter was "civil" and "not a police matter" any work undertaken by NSWPF to complete and essentially close out the report that the Applicant had made could only be considered as administrative. As such the s 27 PPIP Act exemption in relation to the compliance with the Disclosure IPP (i.e. IPP 11) in this case will not apply.

The Respondent's submissions

1. The Respondent submits, most relevantly and in summary: 1. The Respondent accepts that the starting point is that s 27 PPIP Act confers a blanket exemption on the NSWPF, except in so far as the NSWPF deals with personal information in connection with the exercise of its administrative or educative functions. 2. The question in dispute between the parties is whether disclosing the fact of the Applicant's complaint to the Applicant's aunt and/or her legal representative was part of the NSWPF administrative functions. The Applicant's submissions misconceive the scope of "administrative functions". 3. Citing HW v Commissioner of Police, NSW Police [2003] NSWADT 214 (HW) the Respondent notes that "administrative functions" of the NSWPF relate to "corporate services areas performing functions such as personnel, budget and information technology" which has continued to be applied in subsequent cited cases. 4. The disclosure of relevant information to the Applicant's aunt and/or her legal representative plainly was not related to "corporate service areas performing functions such as personnel, budget and information technology". After noting the rejection of the core versus non‑core functions approach by the Tribunal in Commissioner of Police, NSW Police Force v YK (GD) [2008] NSWADTAP 78 (YK), the Respondent submits that the Applicant's submissions make a similar distinction as drawn in HW between core and non‑core functions by considering civil and non‑civil (i.e. criminal matters). While the Applicant may be proceeding from the premise that the functions of the NSWPF are to deal only with criminal matters, any distinction between civil and non‑civil (i.e. criminal matters) in the context of s 27 PPIP Act is erroneous. Likewise, any premise that the functions of the NSWPF are purely criminal in nature is mistaken. The description of a complaint as "civil" by an officer or officers of the NSWPF does not bring it within the NSWPF's "administrative functions". 5. While somewhat at odds with the facts and the Respondent's other submissions, the Respondent submitted that it is possible that family disputes of this nature (i.e. civil matters) could involve criminal elements such as fraud or larceny and the Applicant had urged the NSWPF to consider the matter a criminal one and to investigate it on that basis. The Conduct of Concern either involved the provision of services by way of detection of crime or, at the very least, it was incidental to the provision of those services. 6. Even if this matter was determined on the mistaken premise that the relevant distinction is between civil and criminal functions, the Conduct of Concern was related to, or was incidental to, crime detection functions. The Respondent submits that s 27 PPIP Act applies to the Conduct of Concern such that IPPs have no application. 7. The Respondent also made a number of submissions on the alternative basis that, if IPP 11 does apply to the NSWPF in these circumstances, the Conduct of Concern did not breach s 18 PPIP Act/IPP 11. In particular, at paragraph [30] of the Respondent Submissions, the Respondent submits that: "30. In making a complaint of alleged criminal conduct to the NSWPF, the applicant can be expected to have been aware that the following steps may have been taken: a. The NSWPF may have treated the complaint as a criminal matter; b. The NSWPF may have investigated the complaint; c. The NSWPF may have found that the complaint was substantiated; d. The NSWPF may have chosen to prosecute [the Applicant's aunt]; e. In the course of investigating and prosecuting [the Applicant's aunt], the NSWPF would have been required to inform her of the case against her; and f. In the course of a prosecution of [the Applicant's aunt], the applicant may have been called to give evidence, either by way of written statement or oral testimony. 31. The respondent submits that the applicant was reasonably likely to have been aware the information may be disclosed to [the Applicant's aunt] in the course of any of the above steps and that she would usually be aware of the information by the time of any prosecution." 1. Finally, any reference by the Applicant to s 132 Police Act is outside of the Tribunal's jurisdiction for administrative review under the PPIP Act and the Respondent notes that the Applicant has not pressed that complaint in the Applicant Submissions.
2. Given the focus of these proceedings and thus the Applicant Submissions and the Respondent Submissions was whether s 27 PPIP Act exempted the Respondent from IPP 11 in this case, there were no further submissions or evidence from either party on the Respondent's alternative argument noted in paragraph [15(7)] above. Also, by accepting the facts as proposed by the Applicant in the Applicant Submissions (see paragraph [5] above), whether an IPP 3 compliant notice was actually provided by the NSWPF to the Applicant as regards collection of the Applicant's personal information was not tested and is not within the Tribunal's consideration (or jurisdiction) in these proceedings.

Consideration and findings

1. The IPPs are provided in Div 1 of Part 2 of the PPIP Act in ss 9-19. Div 2 of Part 2 PPIP Act includes general provisions, including s 20 PPIP Act which states that the IPPs apply to public sector agencies and s 21 PPIP Act which states that a public sector agency must not do anything or engage in any practice that contravenes an IPP applying to the agency.
2. Div 3 of Part 2 provides specific exemptions from the PPIP Act and complying with the IPPs. The Respondent relies on the specific exemption applicable to the NSWPF (and other specified law enforcement agencies) in s 27(1) PPIP Act. However, under s 27(2) PPIP Act the exemption granted by s 27(1) does not apply to those agencies (in this case, the NSWPF) "in connection with the exercise of their administrative and educative functions". The interpretation of s 27 PPIP Act and, in particular, the term "administrative" as used in s 27(2) PPIP Act, has been considered in a number of decisions of this Tribunal and its predecessor, the Administrative Decisions Tribunal.
3. In HW the Tribunal distinguished between what it described as "core" responsibilities of the NSWPF, which would not be described as "administrative", and other responsibilities which are not part of the core responsibilities of NSW Police: 25 The question therefore is where does the conduct in issue lie along the spectrum of the operational areas identified by s 27. The section seeks, I consider, to draw a distinction between the core responsibility of the Police Service and its 'administrative' and 'educative' functions. 26 The provision of 'police services' could perhaps be described as the core responsibility. Another way it was put in submissions was that its core responsibility was 'law enforcement'. The Police Act 1990 s 6 provides that the Police Service has three functions, the first of which is 'to provide police services for New South Wales'. 'Police services' are defined as follows: "police services" includes: (a) services by way of prevention and detection of crime, and (b) the protection of persons from injury or death, and property from damage, whether arising from criminal acts or in any other way, and (c) the provision of essential services in emergencies, and (d) any other service prescribed by the regulations. 27 A broad interpretation of 'administrative functions' may be appropriate in a legislative scheme which does not otherwise compartmentalise the functions of a public sector agency (as I considered to be the case in relation to the way that expression applies to the Police Service in the setting of the amendment of personal record provisions in the Freedom of Information Act 1989: see N (No. 3) -v- Commissioner of Police, New South Wales Police Service [2002] NSWADT 34 (subject to appeal)). However in s 27 the Parliament has taken a compartmentalised approach to the functions of the law enforcement agencies mentioned. The division, as I see it, is as between their core responsibilities and those responsibilities which are not part of their core responsibilities. In particular the meaning of the word 'administrative' is to be read down so as not to embrace those core responsibilities. Similarly 'educative' responsibilities, which might on one view simply be a component of 'administrative' activity are to seen as separate from administrative responsibilities and again not forming part of the core responsibilities. 28 In my view the activities of a police officer in supporting a prosecution, at least where he or she is asked to exercise independent discretion and judgment in performing a task, are activities that form part of the core responsibilities of the Police Service. The fundamental responsibility of the Police Service is the investigation of crime. While the Police Service's responsibility for investigation is usually at an end by the time a case has gone to the District Court for trial, there may be a continuing need for some activity of that kind. In this instance the prosecution team called for a further narrow work of an investigative kind to be done. The means to be used was a subpoena for documents. This in my opinion was work of a investigative nature (though not connected with the crime itself) and related to the Police Service's core responsibilities. 29 It was not 'administrative' in the sense in which I consider this term is used in this Act. In order for the primary provision, s 27(1), to be given effect, the term can not be used to refer to the entirety of the administrative activity of the Police Service, which includes the investigation of crime. Read in context, I am satisfied that it is intended to have a narrower compass going to those aspects of the operation of the agency that, as I see it, do not directly involve the carrying out of the core responsibilities. As I see it, 'administrative' when used in contradistinction to s 27(1) and alongside the term 'educative' seeks to refer to those activities of the Police Service that have to do with providing administrative support for the conduct of its core responsibilities. 30 So, for example, corporate services areas performing functions such as personnel, budget and information technology involve the performance of 'administrative' functions. There may be areas of the Police Service where the characterisation of the activity in terms of core/administrative/educative may vary depending on context that has given rise to the conduct in issue. (The handling of criminal records may provide an example where in some instances the disclosures occur in the course of the investigation of crime, while in other instances they are done administratively, for example for background checks on prospective employees. The exception in s 27(2) may also cover licensing responsibilities vested in the Commissioner, such as for firearms licensing and security industry licensing. It is not necessary to pursue these questions any further here.)
4. In YK the Appeal Panel disapproved of the reliance in the decision under appeal on a "core" and "non-core" distinction in respect of the activities of the NSWPF. The Appeal Panel said: 17 In our view, the Tribunal erred in depicting the question of whether a 'core'/'non-core' distinction provides the basis for analysis. We agree with the Police submission that the Tribunal in para [26] mischaracterised the question. The President was using, as we see it, 'core' as an aid to understanding the generality of the policing functions of the Police Force. The term was not being used to prescribe a legal test. … 20 In our opinion, section 27(1) gives a blanket exclusion from the application of the Act to the named agencies in respect of all of their activities, subject only to the qualification set out in s 27(2). Therefore the starting point is that all functions of the Police Force have the benefit of the s 27(1) exclusion. It is not necessary to refer to the Police Act list of functions. The question is simply whether the activity is brought back under the regulation of the Act because it belongs to the 'administrative' or 'educative' services of the Police Force. In our view, the way 'administrative services' is depicted in para [30] of the President's reasons in HW, especially sentence one, captures the meaning intended for this term in sub-section (2).
5. In AEC v Commissioner of Police, NSW Police Force [2013] NSWADTAP 30 (AEC) the Appeal Panel gave further consideration to the meaning of the term "administrative" as used in s 27(2) PPIP Act: 23 The view has been expressed that the adjective 'administrative' bears in this context the connotation of activities relating to the internal administration of the agency, i.e. activities that are the usual incidents of any organisation whatever its official, public functions may be. See, to that effect, Commissioner of Police, NSW Police Force v YK [2008] NSWADTAP 78 at [20] ff. The Appeal Panel in that case expressed the view that the 'administrative functions' to which s 27(2) refers are those necessary in any agency or any organisation, such as the management of personnel records. The Commissioner accepts this interpretation. 24 It may be that this is too narrow a construction. Section 6 of the Police Act 1990, 'Mission and functions of the NSW Police Force', provides: 6 Mission and functions of NSW Police Force (1) The mission of the NSW Police Force is to work with the community to reduce violence, crime and fear. (2) The NSW Police Force has the following functions: (a) to provide police services for New South Wales, (b) to exercise any other function conferred on it by or under this or any other Act, (c) to do anything necessary for, or incidental to, the exercise of its functions. (3) In this section: police services includes: (a) services by way of prevention and detection of crime, and (b) the protection of persons from injury or death, and property from damage, whether arising from criminal acts or in any other way, and (c) the provision of essential services in emergencies, and (d) any other service prescribed by the regulations. (4) A reference in this section to the functions of the NSW Police Force includes a reference to the functions of members of the NSW Police Force. (5) The provision of police services in emergencies and rescue operations is subject to the State Emergency and Rescue Management Act 1989 and to the Essential Services Act 1988. (6) Nothing in this section confers on the NSW Police Force a power to provide a police service in a way that is inconsistent with any provisions applicable to police officers under the Law Enforcement (Powers and Responsibilities) Act 2002. 25 The primary function of the Police Force is the one set out in s 90(2)(a), i.e. 'to provide police services for New South Wales'. Functions vested in the Police Force under sub-section (2)(b) may fall outside the immunity conferred by s 27 of the Privacy Act, for example the functions connected with security and firearms licensing. 26 In these proceedings the issue is whether LSCON Parker's notification to the school Principal of the incident involving EFR was "in connection with the exercise of …administrative" functions of the NSW Police Force. If it could not be so characterised, the NSW Police Force was not required to comply with the IPPs in respect of that conduct.
6. In EFR v Commissioner of Police [2020] NSWCATAD 159 (EFR) Principal Member Pearson, after considering the cases noted above in [19] to [21] above, summarised the current approach of the Tribunal to applying the s 27 PPIP Act exemption as follows: 29 As YK holds, the language of "core" and "non core" is not the basis for analysis, and the word "core" was used in HW as an aid to understanding the generality of the policing functions of the NSW Police Force. As noted in HW at [29], the term "administrative" cannot refer to the entirety of the administrative activity of the NSW Police, which would include investigation of crime, and it is intended to have a narrower compass. As discussed in HW at [30], in determining what that is, the context that has given rise to the conduct in issue is relevant. 30 Section 27(1) PPIP Act excludes all of the functions of the NSWPF from compliance with the IPPs. The question then is, under s 27(2) PPIP Act, whether the particular activity or conduct the subject of the complaint is, to use the language of YK at [20], "brought back under the regulation of the Act because it belongs to the 'administrative' or 'educative' services of the Police Force".
7. In CTU v NSW Police Force [2017] NSWCATAD 204 at [18] (CTU) and as referenced in EFR at [31] the Tribunal has held that, unless the context indicates some other meaning is intended, the word "administrative" in s 27(2) PPIP Act is to be given its ordinary or commonly understood meaning. According to the Macquarie Dictionary, that meaning is "relating to administration; executive; administrative ability; administrative functions". As held in HW at [30], 'administrative functions' include "corporate services areas performing functions such as personnel, budget and information technology". However, as discussed in AEC, the term "administrative" is not limited to functions relating to the NSWPF's corporate services.
8. Again, the Tribunal's decisions in relation to what might be encompassed in the term "administrative" and how to consider the application of this term to the relevant circumstances was summarised in EFR by Principal Member Pearson as follows: 32 In AEC the NSW Police had disclosed information about a spent conviction for AEC to his ex-partner in the course of Local Court proceedings in which AEC's ex-partner sought an Apprehended Violence Order and AEC was charged with assault. The Tribunal at first instance (AEC v NSW Police Force [2013] NSWADT 32) had found that dealing with AEC's criminal records in that matter could not be characterised as administrative, referring to the distinction drawn in HW in the context of handling of criminal records to disclosures which occur in the course of the investigation of crime, and those which are done administratively, for example for background checks on prospective employees. That conclusion was not disturbed on appeal: AEC at [29]. 33 In CTU the applicant had been convicted in 2005 and sentenced to imprisonment, suspended on his entering into a bond. In 2015 the applicant was issued with a National Criminal History Check and a National Police Certificate, each showing the conviction. It was not in dispute that the NSWPF provided information about the applicant's conviction to third parties for the purposes of the National Criminal History Check and National Police Certificate. The issue was whether the provision of a criminal record check to members of the public was in connection with the administrative functions of NSW Police. The Tribunal rejected a submission that information sharing is a public function which is not administrative, holding at [19] that the provision of criminal history information to a third party for the purposes of a National Criminal History Check or National Police Certificate, where done as part of a routine application, is an administrative function according to the ordinary meaning of the terms. The processing of an application for a National Police Check, online and on payment of a fee, is an administrative function as is the processing of an application for a criminal records check.
9. In CTU, the Tribunal distinguished AEC stating at [22]: 22. The facts of AEC are clearly distinguishable from those of the present case. AEC involved a situation where the Police disclosed information about a person's criminal history in the course of proceedings for an apprehended violence order (or perhaps for the purposes of the assault proceedings). The disclosure was not done as part of any routine processing of a criminal history application or similar; rather it was in the context of court proceedings involving an alleged crime. The provision of criminal history information in a routine way when an individual completes a form is of a more administrative nature. Consistently with what was said in AEC, the context in this case requires a different result.
10. The reasoning of CTU was also followed in DKB v Commissioner of Police, NSW Police Force [2018] NSWCATAD 193 and EFR.
11. In the present circumstances, Chief Inspector Peet informed the Applicant's aunt and/or her legal representative about the Applicant's allegation after informing the Applicant it was a civil matter and no further action would be taken by the Respondent.
12. Despite the disclosure in the course of the NSWPF's "investigation" of the Applicant's allegation, even though contrary to prior statements, the Conduct of Concern was not done "in connection with the exercise of…administrative ...functions" of the NSWPF so as to fall within s 27(2) PPIP Act. That means, applying s 27(1) PPIP Act, the NSWPF was not required to comply with the IPP 11 as regards the Conduct of Concern in this case.
13. I am satisfied that the Conduct of Concern fell within the exemption for the NSWPF provided by s 27(1) PPIP Act. In this case, the disclosure of the Applicant's personal information was not "in connection with the exercise of…administrative ...functions" of the NSWPF so as to fall within s 27(2) PPIP Act. The NSWPF was not required to comply with the IPP 11 (s 18 PPIP Act) relating to the disclosure of personal information. This conclusion means that the disclosure of the Applicant's personal information to the Applicant's aunt and/or her legal representative cannot be in contravention IPP 11 as, in these circumstances, the Conduct of Concern is not subject to (ie is exempt from) IPP 11.
14. Section 55(2) PPIP Act sets out the orders the Tribunal can make on reviewing conduct of an agency that is alleged to amount to a contravention of an IPP (i.e. the Conduct of Concern in this case). This includes deciding to take no further action. In these circumstances and where the Respondent is not required to comply with IPP 11 in respect of the Conduct of Concern, I am satisfied that the appropriate order is to decide to take no further action.
15. As noted above (see paragraphs [15(7)] and [16]), the Respondent's conduct in relation to the collection of the Applicant's personal information (as set out in the "agreed" facts detailed in paragraphs [5(1)] to [5(3)] above) is not in issue in these proceedings (i.e. it was not part of the Conduct of Concern or in the IR Request) and is not within the jurisdiction of the Tribunal in these proceedings to determine. Thus, I make no decision here as to whether the collection of the Applicant's personal information and the Respondent's compliance with IPP 3 is or is not exempted under s 27 PPIP Act.

Orders 1. Pursuant to s 55(2) of the Privacy and Personal Information Protection Act 1998 no action will be taken in this matter. 2. Pursuant to s64 of the Civil and Administrative Tribunal Act 2013 the publication of the name of the applicant in these proceedings or reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person is prohibited.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 16 August 2021 - Fixed gaps on Coversheet. 17 August 2021 - Updated grammer error in paragraph 31 sentence 1 DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 17 August 2021