FQS v Independent Commission Against Corruption

Procedural directions

1. Senior Member Montgomery conducted a case conference on 23 January 2022, at which the Applicant appeared in person and Mr J McDonnell, Crown Solicitor's Office, appeared for the Respondent. The Senior Member made an order under s 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) (the NCAT Act), which prohibited the publication or broadcast of the Applicant's name. He also ordered the Applicant to file and serve her evidence, including statements, documents and a summary of legal arguments about the alleged conduct and about any financial, psychological or physical harm suffered because of the conduct, by 6 February 2023. He ordered the Respondent to file and serve all material in Reply and any application for dismissal by 20 February 2023. He ordered the Applicant to file and serve any material in reply by 6 March 2023. He also made the following orders: 5. Having afforded the parties an opportunity to make submissions under s 50(3) of the Civil and Administrative Tribunal Act 2013, and having considered the submissions made, and being satisfied that any dismissal application (the dismissal application) can be adequately determined in the absence of the parties by considering the written submissions and other documents and material provided to the Tribunal (the papers), a hearing on the dismissal application is dispensed with, and the dismissal application will be determined on the papers. 6. Either party my apply to have the matter relisted to deal with the dismissal application should the need arise.

Issues for determination

1. The real and substantive issues between the parties are: 1. Whether s 27(1) of the PPIP Act operates to exempt the Respondent from compliance with ss 12 and/or 18 of the PPIP Act in the circumstances of this matter. 2. If 'yes', whether the proceedings be dismissed pursuant to s 55(1)(b) of the NCAT Act on the basis that the Tribunal considers that they are frivolous or vexatious or otherwise misconceived or lacking in substance. 3. If 'no', has the Respondent breached ss 12 and/or 18 of the PPIP Act?

Relevant legislation

1. Section 12 of the PPIP Act provides: 12 Retention and security of personal information A public sector agency that holds personal information must ensure - (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information.
2. Section 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless - (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it.
3. Section 27 of the PPIP Act provides, relevantly: 27 Specific exemptions for certain law enforcement agencies (1) Despite any other provision of this Act, the following are not required to comply with the information privacy principles - (a) the Independent Commission Against Corruption,… (2) However, the information protection principles do apply to a public sector agency mentioned in subsection (1) in connection with the exercise of the agency's administrative and educative functions. which, in summary and most relevantly, provides:

Scope of administrative review proceedings under the PPIP Act

1. The scope of the current application for administrative review is limited by the internal review request and the scope of the internal review request, which set out the conduct of concern, is a matter of fact to be determined by objectively and reasonably construing the internal review request.
2. The Tribunal's role is to consider the conduct afresh, based on the evidence and material before it at the time of the hearing: Drake v Minister for Immigration and Ethnic Affairs (1979) 46 FLR 409 and KT v Sydney Local Health Network [2011] NSWADT 171 at [64].
3. There is no dispute that the current application for administrative review and these proceedings are within the scope of the internal review request, in particular the conduct of concern as set out in that request.

Applicant's evidence and submissions

1. On 25 January 2023, the Applicant filed her evidence, in the form of a letter to the Tribunal. She alleged that sixty-five files were filed with the Respondent by email in April 2022 "instructed by Mr Michael Froni". After filing those documents, she "became compromised and was under severe verbal abuse by any race from local, followed by the high". For her safety, she "had to reach out to police, follow their instructions, and report all the incidents through the Australian Cybersecurity website". The Respondent's website did not have the option of uploading files and due to their size, she sent three emails to ICAC, but after sending them, "…my email shut down, and I had no more access. I had the activities on my online. I had to call the police for safety and follow their instructions.
2. The Applicant stated that she filed a complaint with "the Microsoft department", and she notified the police, but she is "still waiting to hear back from the Privacy Commissioner about their investigations". She then had to change her network, but she still has issues and "telecommunication is helping me to secure my communication with the ongoing challenges". She also stated: …Only recently, on 23 January 2023, the ICAC told me that my email was used and had the information of cc to others. The same thing has happened with the other emails that I have created. I have had to use the icloud.com hide features to develop many email addresses to communicate with various places to prevent those hackers from being able to follow me. Only I and the ICAC department had access to those files. Centrelink local told me to remove the file even from my record where I put the threat of Liverpool Hospital. That file was also given to your department. Those hackers are well aware of any organisation I have been communicating with - internally using any organisations to stop my communication to seek help. ICAC knew about my files, the disadvantages I had, and the period of loss of speech, facial problems and loss of almost vision. ICAC knew the status of how I entered Australia, with refugee status and ICAC asked for those details. I forward every detail to ICAC. This put me at a considerable risk of being unsafe, and they did not bother to contact me. ICAC knew about my refugee status and how I had to reach out for my safety to Human Rights, and previous federal government, and the NSW government. After filing those reports with ICAC, I was under severe pressure and attack, and for safety, I had to reach out to the police on May 2022. So to seek help, I reach out to the ACT, which is underway coming back. In my home mailbox is a card of appointment for the mental health institution left by the NSW Liverpool Hospital. I had to go police station to get help. They mentioned it was from NSW gov/NSW health and asked me to wait to be seen by the team is coming. I was interviewed by two females who did not introduce themselves. Only they did it after the interview and questioned the monetary value of my next PhD project and their insistence on taking me to the hospital to scan my brain. These two women carried the idea of NSW health on them; they knew about the system and me. All these incidents started after filing those files to the ICAC department. The Liverpool Hospital harassed my mother after losing I lost my identity due to filing those documents to your department. If I had been informed that filing those files will be put me at high risk with ICAC, I would not file anything to put myself in this situation. However, my status of safety and network became much worse when I notified ICAC through email. This almost cost the life of not me but the police force. I report the ongoing corruption with various departments to your department. The hackers well knew about the Australian system, and I am doing my best to keep informing anyone I can and to get help. They are internal hackers. I have given all the evidence to your department through 65 files about ongoing stressful situations I was facing from 2018 to 2021 as a result of the initial report of corruption of Liverpool Hospital to UNSW, where the previous Federal Government was well aware of my situation. Corruption allowed hacking to steal and destroy my reputation, loss of identity, have my identity completely exposed to international criminals. After losing my identity and filing those files, I suffered more severe attacks and difficulties with the help of NSW police, trying to move forward. This is because the internal criminals and those hackers repeatedly try to reap me, and I have filed all those incidents and reached out for help to the NSW police forces under case number (number provided). The internal corruption and internal hackers caused enough confusion. I have to seek GIPA to ensure those criminals have not touched my police records because they have access to all my details. Repeatedly I have notified places with anything changes and physically go places so they can see me. I have no more normal life. After filing those documents to your department, I had a lady exactly looking like me follow me in the street. They are doing everything to destroy me. It made me unemployed and lost dignity, my identity reputation caused my safety, and for every incident, I have reached out to the police. As a result, I am doing my best to leave the country and have some stability. Twenty years never had issues to this extreme that, for my safety reached out to the police readily. This started after filing those files to the ICAC department due to the bridge of data and privacy. When I reached out to Mr Michael Froni, he clearly stated that Government needs something for me to reach out to the NSW police and private company. It is shocking to hear such advice from a member of ICAC and put me at risk the same others, who were doing their best to help me. Forty thousand police are not equipped with high te4chnology, and ICAC did know about the files. My privacy bridged put me at this high risk where for my safety, I had to reach out to the police. I had to deal with Centrelink's unprofessional behaviour, and verbal and emotional abuse at two places (Liverpool and Fairfield), who wanted me to remove a file from the record about the corruption of Liverpool Hospital's behaviour for how they put the threat on me and ICAC is aware of that file. This has happened recently, and the police are well aware of it the Centrelink has done. Attached with this letter is the information of my repeatedly contacting the various department to get help as a result of my exposure of my privacy of data with ICAC department…
3. The Applicant annexed a schedule comprising 75 pages of her contact/reporting of alleged incidents to multiple organisations to her Submissions.
4. However, I note that the Applicant did not address the matters raised in Mr McDonnell's email to her in December 2022 and she did not address the exemption under s 27(1) of the PPIP Act.

Application for dismissal and the Respondent's written submissions

1. On 20 February 2023, the Respondent filed an Application for Miscellaneous Matters, which sought an order that the proceedings be dismissed under s 55(1)(b) of the NCAT Act. The grounds of the application are set out in the Respondent's written submissions, which are summarised below.
2. The Respondent referred to the Applicant's submissions dated 23 January 2023 and noted that she appeared to allege that it: (1) Disclosed her personal information in breach of s 18 of the PPIP Act; and (2) Failed to protect her information against unauthorised access, use or disclosure in breach of s 12 of the PPIP Act.
3. The respondent argued that the Tribunal's power to dismiss proceedings under s 55 (1)(b) of the NCAT Act is to be construed broadly to capture any kind of abuse of process that can reasonably be seen to fall within the four categories of conduct: BDK v Department of Education and Communities [2-15] NSWCATAP 129 (BDK) at [66], which was approved in Minister for Education and Early Childhood Learning v Zonnevylle [2020] NSWCA 232 at [45]. It is a discretionary power: Hariz v Commissioner of Police [2021] NSWCATAD 6 at [39]; Samuell v Medical Council of New South Wales [2020] NSWCATOD 149 at [1].
4. The respondent stated that the words "frivolous, vexatious, misconceived or lacking in substance" have been held to refer to "the insufficiency or to the absence of merit or factual basis for the allegations made in the complaint rather than to whether the complaint is one within the provisions of the Act at all": Langley v Niland [1981] 2 NSWLR 104 at 107, cited by the Tribunal in Eagle Arts and Vocational College v State of New South Wales [2018] NSWCATAD 147 at [26].
5. The respondent argued that proceedings are "misconceived" if no cause of action is disclosed because there is a misunderstanding of legal principle: Alchin V Rail Corporation NSW [2012] NSWADT 142 at [26]. Further, proceedings are "lacking in substance" if the complaint is based on "an untenable proposition of fact or law" or is otherwise not "reasonably arguable": Chalker v Murrays Australia Pty Ltd [2016] NSWCATAD 283 at [22]; Braiding v Charles Sturt University [2016] NSWCATAD 90 at [27], which the Tribunal applied in Hariz at [42].
6. The respondent submitted that these proceedings are lacking in substance because there is no evidence to support the essential elements of the Applicant's complaint: see, by analogy, Riseley v Suncorp Portfolio Services Ltd [2022] FCAFC 8 at [102]-[103]. Specifically, it stated that the Audit conducted on 14 November 2022 found no evidence that its systems were hacked by external parties (grounding a possible breach of s 12 of the PPIP Act) or that information relating to the applicant has been released by its staff (grounding a possible breach of s 18 of the PPIP Act).
7. Accordingly, there is no material before the Tribunal that could lead to a sound conclusion that the Applicant's personal information was disclosed, and in turn, not stored securely. The absence of evidence has the effect that the complaint is not reasonably arguable. The proceedings should be dismissed because they are lacking in substance.
8. The respondent argued that the proceedings are misconceived, as even if the Applicant's personal information was disclosed, s 27 of the PPIP Act would apply to exempt it from compliance with the Information Privacy Principles (the IPPs). This provides, relevantly: 27 Specific exemptions for certain law enforcement agencies (1) Despite any other provision of this Act, the following are not required to comply with the information privacy principles - (a) the Independent Commission Against Corruption, … (2) However, the information protection principles do apply to a public sector agency mentioned in subsection (1) in connection with the exercise of the agency's administrative and educative functions.
9. The respondent stated that s 27(1) confers upon it a blanket exclusion from compliance with the IPPs in respect of all of its activities, subject only to the qualification set out in s 27(2): Commissioner of Police, NSW Police Force v YK (GD) [2008] NSWADTAP 28 at [20]. The starting point is that all of its functions have the benefit of the exclusion in s 27, unless the activity is brought back under the regulation of the PPIP Act because it is an administrative or educative function: see Cavallaro v Commissioner of Police [2020] NSWCATAD 132 at [116]; EFR v Commissioner of Police [2020] NSWCATAD 159 at [30].
10. The effect of the immunity afforded by s 27(1) "is not without controversy": AEC v Commissioner of Police, NSW Police Force (GD) [2013] NSWADTAP 30 at [30]. However, in recent times, the Tribunal has rejected the "core/non-core" distinction that had been previously drawn and concluded that the word "administrative" in s 27(2) of the PPIP Act bears its ordinary meaning of "relating to administration; executive; administrative ability; administrative problems": CTU v NSW Police Force [2017] NSWCATAD 204 at [18], which was cited by the Tribunal in EFR at [31]. Administrative functions include, but are not limited to, "corporate services areas performing functions such as personnel, budget and information technology": EPR v Commissioner of Police [2021] NSWCATAD 237 at [23].
11. For an act to fall within the meaning of an "educative function" of an agency, it requires "something more than [the] mere provision of information: AEC at [34]. For example, the Tribunal has found that work done by the NSW Police Force "in connection with community and school education programs, as well as in relation to its internal education and training programs" is part of its educative functions: HW v Commissioner of Police, New South Wales Police Service [2003] NSWADT 214 at [31] (HW).
12. In this matter, the asserted breaches of the PPIP Act are alleged to have occurred after the Applicant emailed documents to it in connection with her complaint about suspected corrupt conduct. It then dealt with those documents, and the personal information contained within them, for the purpose of making a preliminary decision as to whether to investigate the complaint.
13. Section 13(1)(a) of the Independent Commission against Corruption Act 1988 (NSW) (the ICAC Act) provides that the investigation of complaints about suspected corrupt conduct is one of its principal functions. The function of assessing documents provided by complainants for the purpose of determining whether to investigate cannot, on any view, be appropriately described as an "administrative or educative function". Therefore, s 27(2) of the PPIP Act is not engaged and the conduct falls squarely within the exemption in s 27(1)(a).
14. Further, even if there had been a disclosure of the Applicant's personal information, it would not be open to the Tribunal to conclude that the Respondent breached either s 12 or s 18 of the PPIP Act. Therefore, the current application for administrative review is based on a misunderstanding of legal principle as it does not have regard to the effect of s 27 of the PPIP Act.
15. Accordingly, the respondent concluded that these proceedings should be dismissed under s 55(1)(b) of the NCAT Act.

Consideration and Findings

1. The IPPs are set out in Div 1 of Part 2 of the PPIP Act (in ss 9-19). Div 2 of Part 2 of the PPIP Act includes general provisions, including s 20, which states that the IPPs apply to public sector agencies, and s 21, which states that a public sector agency must not do anything or engage in any practice that contravenes an IPP applying to the agency.
2. However, Div 3 of Part 2 of the PPIP Act provides specific exemptions from the PPIP Act and compliance with the IPPs. The Respondent relies on the specific exemption applicable to it in s 27(1)(a) of the PPIP Act. However, under s 27(2) PPIP Act the exemption granted by s 27(1) does not apply to the agency "in connection with the exercise of their administrative and educative functions".
3. The interpretation of s 27 of the PPIP Act and, particularly the term "administrative" as used in s 27(2), has been considered in a number of decisions of this Tribunal and its predecessor, the Administrative Decisions Tribunal.
4. In HW, the Administrative Decisions Tribunal distinguished between what it described as "core" responsibilities of the New South Wales Police Force, which would not be described as "administrative", and other responsibilities which are not part of the core responsibilities of NSW Police: 25 The question therefore is where does the conduct in issue lie along the spectrum of the operational areas identified by s 27. The section seeks, I consider, to draw a distinction between the core responsibility of the Police Service and its 'administrative' and 'educative' functions. 26 The provision of 'police services' could perhaps be described as the core responsibility. Another way it was put in submissions was that its core responsibility was 'law enforcement'. The Police Act 1990 s 6 provides that the Police Service has three functions, the first of which is 'to provide police services for New South Wales'. 'Police services' are defined as follows: "police services" includes: (a) services by way of prevention and detection of crime, and (b) the protection of persons from injury or death, and property from damage, whether arising from criminal acts or in any other way, and (c) the provision of essential services in emergencies, and (d) any other service prescribed by the regulations. 27 A broad interpretation of 'administrative functions' may be appropriate in a legislative scheme which does not otherwise compartmentalise the functions of a public sector agency (as I considered to be the case in relation to the way that expression applies to the Police Service in the setting of the amendment of personal record provisions in the Freedom of Information Act 1989: see N (No. 3) -v- Commissioner of Police, New South Wales Police Service [2002] NSWADT 34 (subject to appeal)). However in s 27 the Parliament has taken a compartmentalised approach to the functions of the law enforcement agencies mentioned. The division, as I see it, is as between their core responsibilities and those responsibilities which are not part of their core responsibilities. In particular the meaning of the word 'administrative' is to be read down so as not to embrace those core responsibilities. Similarly 'educative' responsibilities, which might on one view simply be a component of 'administrative' activity are to seen as separate from administrative responsibilities and again not forming part of the core responsibilities. 28 In my view the activities of a police officer in supporting a prosecution, at least where he or she is asked to exercise independent discretion and judgment in performing a task, are activities that form part of the core responsibilities of the Police Service. The fundamental responsibility of the Police Service is the investigation of crime. While the Police Service's responsibility for investigation is usually at an end by the time a case has gone to the District Court for trial, there may be a continuing need for some activity of that kind. In this instance the prosecution team called for a further narrow work of an investigative kind to be done. The means to be used was a subpoena for documents. This in my opinion was work of a investigative nature (though not connected with the crime itself) and related to the Police Service's core responsibilities. 29 It was not 'administrative' in the sense in which I consider this term is used in this Act. In order for the primary provision, s 27(1), to be given effect, the term cannot be used to refer to the entirety of the administrative activity of the Police Service, which includes the investigation of crime. Read in context, I am satisfied that it is intended to have a narrower compass going to those aspects of the operation of the agency that, as I see it, do not directly involve the carrying out of the core responsibilities. As I see it, 'administrative' when used in contradistinction to s 27(1) and alongside the term 'educative' seeks to refer to those activities of the Police Service that have to do with providing administrative support for the conduct of its core responsibilities. 30. So, for example, corporate services areas performing functions such as personnel, budget and information technology involve the performance of 'administrative' functions. There may be areas of the Police Service where the characterisation of the activity in terms of core/administrative/educative may vary depending on context that has given rise to the conduct in issue. (The handling of criminal records may provide an example where in some instances the disclosures occur in the course of the investigation of crime, while in other instances they are done administratively, for example for background checks on prospective employees. The exception in s 27(2) may also cover licensing responsibilities vested in the Commissioner, such as for firearms licensing and security industry licensing. It is not necessary to pursue these questions any further here.)
5. In YK, the Appeal Panel disapproved of the reliance on a "core" and "non-core" distinction in respect of the activities of the New South Wales Police Force and stated: 17 In our view, the Tribunal erred in depicting the question of whether a 'core'/'non-core' distinction provides the basis for analysis. We agree with the Police submission that the Tribunal in para [26] mischaracterised the question. The President was using, as we see it, 'core' as an aid to understanding the generality of the policing functions of the Police Force. The term was not being used to prescribe a legal test. … 20 In our opinion, section 27(1) gives a blanket exclusion from the application of the Act to the named agencies in respect of all of their activities, subject only to the qualification set out in s 27(2). Therefore the starting point is that all functions of the Police Force have the benefit of the s 27(1) exclusion. It is not necessary to refer to the Police Act list of functions. The question is simply whether the activity is brought back under the regulation of the Act because it belongs to the 'administrative' or 'educative' services of the Police Force. In our view, the way 'administrative services' is depicted in para [30] of the President's reasons in HW, especially sentence one, captures the meaning intended for this term in sub-section (2). … 25 The primary function of the Police Force is the one set out in s 90(2)(a), i.e. 'to provide police services for New South Wales'. Functions vested in the Police Force under sub-section (2)(b) may fall outside the immunity conferred by s 27 of the Privacy Act, for example the functions connected with security and firearms licensing. 26 In these proceedings the issue is whether LSCON Parker's notification to the school Principal of the incident involving EFR was "in connection with the exercise of …administrative" functions of the NSW Police Force. If it could not be so characterised, the NSW Police Force was not required to comply with the IPPs in respect of that conduct.
6. In EFR, Principal Member Pearson summarised the Tribunal's current approach to applying the s 27 PPIP Act exemption as follows: 29 As YK holds, the language of "core" and "non-core" is not the basis for analysis, and the word "core" was used in HW as an aid to understanding the generality of the policing functions of the NSW Police Force. As noted in HW at [29], the term "administrative" cannot refer to the entirety of the administrative activity of the NSW Police, which would include investigation of crime, and it is intended to have a narrower compass. As discussed in HW at [30], in determining what that is, the context that has given rise to the conduct in issue is relevant. 30 Section 27(1) PPIP Act excludes all of the functions of the NSWPF from compliance with the IPPs. The question then is, under s 27(2) PPIP Act, whether the particular activity or conduct the subject of the complaint is, to use the language of YK at [20], "brought back under the regulation of the Act because it belongs to the 'administrative' or 'educative' services of the Police Force".
7. In CTU at [18], and as referenced in EFR at [31], the Tribunal has held that, unless the context indicates some other meaning is intended, the word "administrative" in s 27(2) of the PPIP Act is to be given its ordinary or commonly understood meaning. According to the Macquarie Dictionary, that meaning is "relating to administration; executive; administrative ability; administrative functions". As held in HW at [30], 'administrative functions' include "corporate services areas performing functions such as personnel, budget and information technology". However, as discussed in AEC, the term "administrative" is not limited to functions relating to the NSWPF's corporate services.
8. Principal Member Pearson summarised the Tribunal's decisions in relation to what might be encompassed by the term "administrative" and how to consider the application of that term to the relevant circumstances, as follows: 32 In AEC the NSW Police had disclosed information about a spent conviction for AEC to his ex-partner in the course of Local Court proceedings in which AEC's ex-partner sought an Apprehended Violence Order and AEC was charged with assault. The Tribunal at first instance (AEC v NSW Police Force [2013] NSWADT 32) had found that dealing with AEC's criminal records in that matter could not be characterised as administrative, referring to the distinction drawn in HW in the context of handling of criminal records to disclosures which occur in the course of the investigation of crime, and those which are done administratively, for example for background checks on prospective employees. That conclusion was not disturbed on appeal: AEC at [29]. 33 In CTU the applicant had been convicted in 2005 and sentenced to imprisonment, suspended on his entering into a bond. In 2015 the applicant was issued with a National Criminal History Check and a National Police Certificate, each showing the conviction. It was not in dispute that the NSWPF provided information about the applicant's conviction to third parties for the purposes of the National Criminal History Check and National Police Certificate. The issue was whether the provision of a criminal record check to members of the public was in connection with the administrative functions of NSW Police. The Tribunal rejected a submission that information sharing is a public function which is not administrative, holding at [19] that the provision of criminal history information to a third party for the purposes of a National Criminal History Check or National Police Certificate, where done as part of a routine application, is an administrative function according to the ordinary meaning of the terms. The processing of an application for a National Police Check, online and on payment of a fee, is an administrative function as is the processing of an application for a criminal records check.
9. In CTU, the Tribunal distinguished AEC stating at [22]: 22. The facts of AEC are clearly distinguishable from those of the present case. AEC involved a situation where the Police disclosed information about a person's criminal history in the course of proceedings for an apprehended violence order (or perhaps for the purposes of the assault proceedings). The disclosure was not done as part of any routine processing of a criminal history application or similar; rather it was in the context of court proceedings involving an alleged crime. The provision of criminal history information in a routine way when an individual completes a form is of a more administrative nature. Consistently with what was said in AEC, the context in this case requires a different result.
10. The reasoning of CTU was also followed in the matters of DKB and EFR.
11. In this matter, the Applicant alleges that the breaches of the PPIP Act occurred after the she emailed sixty-five files of documents to the Respondent in relation to her complaint about suspected corrupt conduct and that it was responsible for compromising her privacy by either releasing her confidential information or allowing the information that it held to be hacked, resulting in her information being accessed by others and placing her in danger.
12. Based on a consideration of the information before me, which includes the Audit report that the Respondent completed on 14 November 2022, I am satisfied that there is no evidence that the Respondent's systems were hacked or that it otherwise released the Applicant's information.
13. I am satisfied that the Respondent dealt with the documents provided by the Applicant, and the personal information contained in those documents, in order to make a preliminary decision as to whether or not to investigate her complaint. I note that s 13(1)(a) of the ICAC Act provides that a principal function of the Respondent is to investigate complaints about suspected corrupt conduct.
14. In my view, the function of assessing documents provided by complainants for the purposes of deciding whether or not to investigate a complaint is clearly a principal function of the Respondent and it cannot be considered an "administrative" or "educative" function.
15. For these reasons, I am satisfied that the conduct of concern falls within the exemption under s 27(1)(a) of the PPIP Act and that the Respondent was not required to comply with the IPPs (and specifically ss 12 and/or 18 of the PPIP Act).
16. It follows that the information before me does not disclose any cause of action and in my view there is a clear misunderstanding of legal principle in the Applicant's case. I am therefore satisfied that the current proceedings are misconceived and that they are also lacking in substance, as the Applicant's complaint against the Respondent is based on an untenable proposition of fact or law and, based on the Audit report, it is not reasonably arguable.

Conclusion

1. I am satisfied that it is appropriate to dismiss the proceedings under s 55(1)(b) of the NCAT Act.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 04 April 2023