ADMINISTRATIVE LAW – JUDICIAL REVIEW – GROUNDS OF REVIEW
– GENERALLY – where a delegate of the respondent
declined to deal
with three separate privacy complaints made by the applicant against three
Source
Original judgment source is linked above.
Catchwords
ADMINISTRATIVE LAW – JUDICIAL REVIEW – GROUNDS OF REVIEW– GENERALLY – where a delegate of the respondentdeclined to dealwith three separate privacy complaints made by the applicant against threemanufacturers of alcohol ignition interlockdevices – where the applicantsought a review of each of the decisions – where the delegate declined todeal with thecomplaints by exercising the discretion under s 168(1)(c) of theInformation Privacy Act 2009 (Qld), on the basis that various componentsof each complaint were “lacking in substance” – whether any ofthecomponent parts of the privacy complaints relating to individual InformationPrivacy Principles were the subject of error in respect
of any of the grounds
for review in s 20(2) of the Judicial Review Act 1991 (Qld)
Anti-Discrimination Act 1991 (Qld), s 139, s 168
Information
Privacy Act 2009 (Qld), s 26, s 27, s 34, s 35,
s 36, s 39, s 59, s 60,
s 64, s 167, s 168, s 171, s 175, s 176,
s 178, Sch 3
Judicial Review
Act 1991 (Qld), s 20
Privacy Act 1988 (Cth), s 41
Queensland
Civil and Administrative Tribunal Act 2009 (Qld)
Transport Operations
(Road Use Management - Driver Licensing) Regulation 2021 (Qld), s
334
Transport Operations (Road Use Management) Act 1995 (Qld), s
91K(1)(a), 91L(2)
George v Rockett [1990] HCA 26
(1990) 170 CLR
104
Madzikanda v Australian Information Commissioner [2023] FCA
1445
Minister for Immigration and Citizenship v Li [2012] HCA 61
ADMINISTRATIVE LAW - JUDICIAL REVIEW - GROUNDS OF REVIEW - GENERALLY - where a delegate of the respondent declined to deal with three separate privacy complaints made by the applicant against three manufacturers of alcohol ignition interlock devices - where the applicant sought a review of each of the decisions - where the delegate declined to deal with the complaints by exercising the discretion under s 168(1)(c) of the Information Privacy Act 2009 (Qld), on the basis that various components of each complaint were "lacking in substance" - whether any of the component parts of the privacy complaints relating to individual Information Privacy Principles were the subject of error in respect of any of the grounds for review in s 20(2) of the Judicial Review Act 1991 (Qld)
Toodayan v Anti-Discrimination Commissioner Queensland[2018] QCA 349
[16]
Office of the Information Commissioner for the respondent
[17]
[1] Mr Gear has brought applications for statutory orders of review in respect of three separate decisions by a delegate of the Office of the Information Commissioner ("OIC"). Each of those decisions were made on 11 November 2024, and each decision dismissed a privacy complaint that had been commenced by Mr Gear. The circumstances of the privacy complaints were as follows.
[2] Mr Gear had previously been involved in a drink driving incident. In consequence of that incident, and in order to minimise the time during which his licence was suspended under a statutory scheme, Mr Gear sought to participate in what was known as the Alcohol Ignition Interlock Program ("AIIP"). This was a program promulgated by the Department of Transport and Main Roads ("TMR").
[3] TMR had generated a document which identified what was required under the AIIP. The requirements in that document included the installation of a vehicle locking device (an "interlock device") which had a camera as part of its components. The interlock device would collect photographs and other biometric data from Mr Gear, at least at times when he sought to engage the vehicle via the relevant interlock device.
[4] The Transport Operations (Road Use Management - Driver Licensing) Regulation 2021 (Qld) ("the Regulations") identified six devices, produced by three manufacturing entities, which were approved interlock devices.[1]
[5] The three manufacturing entities were as follows:
[6] Each of the six interlock devices from those three manufacturers had a camera incorporated into the approved device.
[7] Mr Gear made a privacy complaint against each of those manufacturers. The complaints were made under the Information Privacy Act 2009 (Qld) ("the IP Act").
[8] The content of each privacy complaint was many and varied in substance, but broadly uniform as between the manufacturers. It is clear that Mr Gear did not like being photographed or videoed by the interlock devices.
[9] Ultimately, the Assistant Privacy Commissioner, as the delegate of the Information Commissioner, decided to exercise her discretion under s 168(1)(c) of the IP Act, to decline to deal with each of the complaints.
[10] The Assistant Privacy Commissioner did so on the basis that she purportedly formed a reasonable belief that the various components of each complaint were "misconceived" or "lacking in substance."
[11] In reaching that final conclusion, her decisions dealt with the component parts of each complaint. These component parts asserted various alleged breaches of Information Privacy Principles ("IPPs"), which are a series of statutory principles established under the IP Act.[5] Each of the three manufacturers were bound to comply with those IPPs.
[12] The structure of each decision meant that the final conclusion was dependent on the integrity of the decision-making process applied to each component part. If the decision-making process miscarried for a component part, then the whole decision would be amenable to being quashed.
[13] The real issue then is whether any of the individual determinations of the component parts of the complaints relating to specific IPPs were the subject of error as contemplated by s 20(2) of the Judicial Review Act 1991 (Qld) ("").
[20]
(a) first, the relevant legislation will be set out;
(b) secondly, a short factual background will be set out;
(c) thirdly, the real issue will be dealt with; and
(d) fourthly, the conclusion and appropriate orders will be expressed.
[21]
[17] Mr Gear, as a result of his drink driving incident, agreed to be the subject of an interlock device condition, which required him to have an approved alcohol ignition interlock device installed in his vehicle. This requirement was imposed by the Transport Operations (Road Use Management) Act 1995 (Qld) ("Transport Act").
[18] Under s 91K(1)(a) of the Transport Act, Mr Gear was a person whose licence was subject to an interlock device condition. He had nominated a vehicle under s 91L of the Transport Act in which the interlock device was to be installed.
[19] The approved interlock devices are specified in s 334 of the Regulations as follows:
For section 91I of the Act, definition approved, the following interlocks are approved -
[24]
(b) Dräger Interlock® 7000 (also known as Draeger Interlock® 7000);
(c) Dräger Interlock® 7500 (also known as Draeger Interlock® 7500);
[25]
[20] It is uncontroversial that each of these devices has a camera as part of its physical makeup.
[21] Mr Gear, at various later times, entered into agreements with each of the three manufacturers for the installation of one of their approved interlock devices.
[22] I turn then to the IP Act. It is uncontroversial that each of the approved interlock devices acquired "personal information" of Mr Gear as defined in the IP Act.[6] That personal information included photographs or videos, together with biometric data associated with Mr Gear's use of the interlock device.
[23] Section 26 of the IP Act, as in force at the relevant time, identifies that the IPPs are those principles set out in Schedule 3 to the IP Act.
[24] Schedule 3 relevantly included IPP 6 in the following terms:
[26]
"6 IPP 6 - Access to documents containing personal information
[27]
(1) An agency having control of a document containing personal information must give an individual the subject of the personal information access to the document if the individual asks for access.
[28]
(2) An agency is not required to give an individual access to a document under subsection (1) if -
[29]
(a) the agency is authorised or required under an access law to refuse to give the access to the individual; or
(b) the document is expressly excluded from the operation of an access law."
[30]
[25] It is uncontroversial that the TMR was an "agency" as defined in s 17 of the IP Act.
[26] Section 27 of the IP Act imposed upon TMR a statutory obligation to comply with the IPPs, which included IPP 6.
[27] Section 27 of the IP Act relevantly provides as follows:
[31]
(1) An agency, other than health agencies, must comply with the IPPs.
[32]
(a) must not do an act, or engage in a practice, that contravenes, or is otherwise inconsistent with a requirement of, an IPP; and
(b) must not fail to do an act, or fail to engage in a practice, if the failure contravenes, or is otherwise inconsistent with a requirement of, an IPP.
[33]
(3) An act or practice mentioned in subsection (2) includes any act or practice relating to the agency's collection, storage, handling, accessing, amendment, management, transfer, use or disclosure of personal information."
[34]
[28] It is uncontroversial that each of the three manufacturers of the approved interlock devices were "contracted service providers" as defined in s 34(1) of the IP Act.
[29] Section 34 of the IP Act provides as follows:
[35]
(1) In this Act, a service arrangement is a contract or other arrangement entered into after the commencement of this section under which an entity other than an agency (the contracted service provider) agrees or otherwise arranges with an agency (the contracting agency) to provide services.
[36]
(a) the services must be for the purposes of the performance of 1 or more of the contracting agency's functions; and
[37]
(ii) to another entity on the contracting agency's behalf; and
(c) the contracted service provider must not be in the capacity of employee of the contracting agency in providing the services."
[38]
[30] Section 35 of the IP Act imposes an obligation on an agency which enters into a service agreement with a service provider to ensure that that service provider complies with inter alia the IPPs contained in Schedule 3 of the IP Act, as if the service provider was the agency. That obligation is subject to certain qualifications which are set out in s 35 of the IP Act. There was no suggestion in the relevant decisions that any of those qualifications were applicable here.
[31] Section 35 of the IP Act provides as follows:
[39]
"35 Binding a contracted service provider to privacy principles
[40]
(1) An agency entering into a service arrangement must take all reasonable steps to ensure that the contracted service provider is required to comply with part 1 or 2 and part 3, as if it were the agency, in relation to the discharge of its obligations under the arrangement.
[41]
(2) However, the agency must comply with subsection (1) only if -
[42]
(a) the contracted service provider will in any way deal with personal information for the contracting agency; or
(b) the provision of services under the arrangement will involve -
(i) the transfer of personal information to the contracting agency; or
(ii) the provision of services to a third party for the contracting agency.
[43]
(3) The agency is not required to comply with subsection (1) if -
[44]
(a) the contracted service provider is to receive funding from the contracting agency; and
(b) the contracted service provider will not collect personal information for the contracting agency; and
(c) the contracted service provider will not receive any personal information from the contracting agency for the purposes of discharging its obligations; and
(d) the contracted service provider will not be required to give the contracting agency any personal information it collects in discharging its obligations.
[45]
[32] Section 36 of the IP Act then creates a statutory obligation with the effect that a "bound contracted service provider" under a service arrangement must comply inter alia with the IPPs set out in Schedule 3 as if it were the entity that is the contracting agency. It is uncontroversial that each of the three manufacturers were "bound contracted service providers."
[33] Section 36(3) provides that a bound contracted service provider's compliance with inter alia the IPPs may be enforced under the IP Act as if it were an agency.
[34] Section 36 provides as follows:
[46]
"36 Bound contracted service provider to comply with privacy principles
[47]
(1) A bound contracted service provider under a service arrangement must comply with part 1 or 2 and part 3 in relation to the discharge of its obligations under the arrangement as if it were the entity that is the contracting agency.
[48]
(2) The requirement to comply under subsection (1) continues to apply to the bound contracted service provider in relation to personal information it continues to hold after its obligations under the service arrangement otherwise end.
[49]
(3) A bound contracted service provider's compliance with part 1 or 2 and part 3 may be enforced under this Act as if it were an agency.
[50]
(4) Subsections (1) to (3) are not intended to prevent a service arrangement from including a requirement for the contracted service provider to comply with all or part of the privacy principles even though this part does not require that the service arrangement include the requirement."
[51]
[35] Section 39 of the IP Act makes clear that certain statutorily imposed obligations do not give rise to any civil cause of action or operate to create in any person a legal right enforceable in a court or tribunal, other than as stipulated in the IP Act itself. This included obligations limited to the respective IPPs.
[37] The reference to chapter 5 in the above section is a reference to a subsequent chapter of the IP Act which regulates the making of privacy complaints. This is the chapter under which Mr Gear made his three privacy complaints.
[38] Chapter 3 of the IP Act establishes a route by which an individual can make an application to an agency or a Minister for access to personal information controlled by those entities.
[39] Access to the information may be refused by the agency or Minister in certain circumstances. For example, s 59 allows for a refusal in respect of what is defined as "exempt information." Equally, s 60 allows for a refusal where the agency or Minister considers that the work involved in carrying out the disclosure would substantially or unreasonably divert the resources of the agency from the use of the agency in the performance of its functions, or interfere substantially or unreasonably with the performance by the Minister of the Minister's functions.
[40] There was no finding in any of the three decisions that either of those two circumstances existed, or were relevant to the decision-making process.
[41] Sections 64(1) and 64(4) of the IP Act emphasises Parliament's express intention that there be pro-disclosure bias for personal information by agencies and Ministers. These sections provide as follows:
[57]
"64 Pro-disclosure bias in deciding access to documents
[58]
(1) It is the Parliament's intention that if an access application is made to an agency or Minister for a document, the agency or Minister should decide to give access to the document unless giving access would, on balance, be contrary to the public interest.
[59]
(4) However, it is the Parliament's intention that this Act should be administered with a pro-disclosure bias and an agency or Minister may give access to a document in relation to an applicant's personal information even if this Act provides that access to the document may be refused."
[60]
[42] Sections 65 through to 68 of the IP Act set out a procedure for the making of decisions by agencies and Ministers, which includes deemed decisions if there is no response within a designated timeframe. However, every decision ultimately requires the provision of a written decision notice, including for deemed decisions.
[43] In relation to decisions by agencies and Ministers, there are internal and external review rights. These are found in ss 93 to 126 of the IP Act. The external review includes a reference to the Queensland Civil and Administrative Tribunal ("QCAT").
[44] As adverted to above, chapter 5 then deals with privacy complaints. Section 164(1) of the IP Act defines "privacy complaint" to include complaints about the relevant entity's obligations under the IP Act to comply with, amongst other things, the IPPs. Section 164(2) defines "relevant entity" to include a bound contracted service provider, in relation to documents held by the bound contracted service provider for the purposes of performing its obligations under a service arrangement.
[45] Critical to the present proceedings brought by Mr Gear, ss 167 and 168 of the IP Act deal with mechanisms whereby the Information Commissioner can, at a preliminary stage, decline to deal with a complaint. These sections of the IP Act provide as follows:
[61]
The information commissioner may make preliminary inquiries of the complainant and the respondent for a privacy complaint to decide whether the commissioner is authorised to deal with the privacy complaint and whether the commissioner may decline to deal with the complaint.
[62]
168Information commissioner may decline to deal with or to deal further with complaint
[63]
(1) The information commissioner may decline to deal with a privacy complaint, or a part of a privacy complaint, made or referred to the commissioner if -
[64]
(a) the act or practice the subject of the complaint or part does not relate to the personal information of the complainant; or
(b) the requirements under section 166(3) for making a complaint have not been fully satisfied; or
(c) the commissioner reasonably believes the complaint or part is frivolous, vexatious, misconceived or lacking in substance; or
(d) there is a more appropriate course of action available under another Act to deal with the substance of the complaint or part; or
(e) although the complainant made the complaint to the respondent as required under section 166(3), in the circumstances, the respondent has not yet had an adequate opportunity to deal with the complaint or part; or
(f) 12 months have elapsed since the complainant first became aware of the act or practice the subject of the complaint or part.
[65]
[46] If a complaint proceeds, then the Information Commissioner may direct it to mediation pursuant to s 171 of the IP Act.
[47] Section 174 of the IP Act provides that if the Information Commissioner forms the view that it is reasonably likely that the complaint will not be resolved through mediation, or alternatively, if mediation has been attempted and failed, then the relevant part 4 of chapter 5 will apply.
[48] In such a case, the Information Commissioner must give a written advice to the parties under s 175, which identifies that the Commissioner will, if asked by the complainant, refer the privacy complainant to QCAT for hearing.
[49] Section 176 of the IP Act provides that, if within 20 business days of the notice, and if the complainant requests the privacy complaint to be referred to QCAT, then the Information Commissioner must refer it, and QCAT will then exercise its original jurisdiction under the QCAT Act[7] to hear and decide the privacy complaint.
[50] Section 178 of the IP Act then empowers QCAT to dispose of the privacy complaint in a number of substantive ways. It provides as follows:
[66]
After the hearing of a privacy complaint referred to QCAT, QCAT may make 1 or more of the following orders -
[67]
(a) an order that the complaint, or a part of the complaint, has been substantiated, together with, if considered appropriate, an order in accordance with 1 or more of the following -
(i) that an act or practice of the respondent is an interference with the privacy of the complainant for the complaint and that the respondent must not repeat or continue the act or practice;
(ii) that the respondent must engage in a stated reasonable act or practice to compensate for loss or damage suffered by the complainant;
(iii) that the respondent must apologise to the complainant for the interference with the privacy of the complainant;
(iv) that the respondent must make stated amendments of documents it holds;
(v) that the complainant is entitled to a stated amount, of not more than $100,000, to compensate the complainant for loss or damage suffered by the complainant because of the act or practice complained of, including for any injury to the complainant's feelings or humiliation suffered by the complainant;
(b) an order that the complaint, or a part of the complaint, has been substantiated together with an order that no further action is required to be taken;
(c) an order that the complaint, or a part of the complaint, has not been substantiated, together with an order that the complaint or part is dismissed;
(d) an order that the complainant be reimbursed for expenses reasonably incurred in connection with making the complaint."
[68]
[51] It is within this legislative scheme that the real issue is to be determined.
[69]
[52] I have summarised much of the background facts above.
[53] It was identified by the OIC at the hearing of these applications that essentially the same substantive decision was made by the delegate in relation to each of the IPP 6 complaints made against each of the three manufacturers.
[54] Accordingly, in argument I was taken to the decision which concerned the complaint against Dräger as representative of all the decisions. I will also use the decision relating to Dräger for the purposes of addressing the IPP 6 issue for each of the decisions. I am satisfied that each of the three decisions is, in substance, effectively in identical terms on this issue.
[55] The delegate's decision on IPP 6 was coupled with her decision on IPP 5. It is only the response which pertains to IPP 6 which constitutes the real issue under consideration.
[56] The delegate's decision of 11 November 2024 for Dräger relevantly provided as follows:
[70]
Your complaint included complaints about breaches of IPPs 5 and 6, in relation to not receiving a response to an information access request made to Draeger on 27 October 2023:
[71]
Draeger has refused to acknowledge my application and failed to inform me whether they possess the requested information ... While I have a basic understanding that Draeger was collecting my personal information, I have not been provided with detail information regarding the types of, and extent of personal information contained in the documents which Draeger is or was in possession of.
[72]
In an email to the OIC on 9 July 2024, you also clarified that your application "specifically stated that the request was being made under the Information Privacy Act 2009."
[73]
In my Preliminary View Letter, I advised you that I did not further consider your complaints regarding IPPs 5 and 6, as I considered there were more appropriate mechanisms available to deal with this matter.
[74]
In your 21 October 2024 response to OIC's Preliminary View Letter you submit that "there is no mechanism under chapter 3 which allows an individual to complain about a failure of a bound entity to comply with its obligations under the Act. Additionally, contracted service providers are not subject to external reviews...this complaint represents the only available action I have at my disposal, and therefore, I would appreciate that you would not exclude these points from my complaint."
[75]
With regards to IPP 5, Clause 68 of Draeger's Client Agreement appears to me to set out the information of the kind reasonably required under this privacy principle, in that it states "Draeger is collecting the Client's personal information directly from the Client and also via the Interlock device (including images)" and TMR's Alcohol Ignition Interlock Program Notice Agreement provides notice that the interlock device records "information about alcohol readings and vehicle use." My reasonable belief is that this part of your complaint lacks substance, and I may decline to deal with it under section 168(1)(c) of the IP Act.
[76]
Under IPPs 5 and 6 an agency is not required to give a person information, or access to a document if, under an access law, the agency is authorised or required to refuse to give the information, or access to the individual.
[77]
As a BCSP,[8] Draeger is required to comply with IPP 5 and 6 as if it was TMR. TMR is authorised to refuse access to information and documents under Chapter 3 of the IP Act. There are no review rights of the decision by a BCSP, including a 'deemed decision', by OIC.
[78]
Documents in a BCSP's possession, however, may be subject to an access request made to the contracting agency (ie TMR) under Chapter 3 of the IP Act, if the contracting agency is entitled to access the documents, or the documents are in the agency's possession or legal control. TMR's Information Privacy Plan sets out that any personal information collected or used by a BCSP remains under TMR's control. I further note that TMR's service agreement with Draeger contains privacy and confidentiality clauses that require Draeger to fully cooperate with TMR, to enable TMR to respond to applications for access to document(s) containing an individual's personal information.
[79]
On the material before me, it therefore appears that the personal information you seek to obtain from Draeger may be the subject of an application to TMR under Chapter 3 of the IP Act (which application would then enjoy formal review rights noted in my previous letter). Given the availability to you of this formal means of pursuing access to the same information from TMR, I reasonably believe that this part of your complaint against Draeger is lacking in substance. I may therefore decline to deal with it under section 168(1)(c) of the IP Act.
[80]
[57] In the ultimate conclusion and decision sections of the Dräger decision, it can be seen that the delegate concluded that no part of the privacy complaint raised an arguable case that the manufacturer had breached the IPPs. This included the alleged breach of IPP 6. This finding was based on the delegate having formed the reasonable belief that the privacy complaint was "misconceived" or "lacking in substance" within the meaning of s 168(1)(c) of the IP Act. It was this finding which underlay the exercise of the statutory discretion found in s 168(1) of the IP Act to decline to deal with the complaint. The conclusion and relevant findings of the delegate were as follows:
[81]
After carefully considering all the material before OIC in this matter, I have decided to adopt as final the views and reasoning set out in my Preliminary View Letter, together with the above, and decline to deal with your complaint against Draeger under section 168(1)(c) of the IP Act.
[82]
In making this decision I have, as noted, considered all the material before OIC, including your further submissions in reply to the Preliminary View Letter, summarised above. There is no fresh material in those submissions to dissuade me from the views and reasoning expressed in my Preliminary View Letter. For the reasons explained in my Preliminary View Letter, and as outlined above, my view remains that your complaint, to the extent that it raises matters within OIC's privacy jurisdiction, does not raise an arguable case that Draeger has breached the privacy principles. On that basis, it is my reasonable belief that your complaint is misconceived or lacking in substance, and it is appropriate to exercise the discretion conferred by section 168(1)(c) of the IP Act and decline to deal with your complaint.
[83]
I am a delegated officer within OIC with the authority to consider and make decisions on privacy complaints. On the basis of the above information, I have decided to decline to deal with your complaint under section 168(1)(c) of the IP Act.
[84]
In reaching this decision, proper consideration was given to the relevant human rights under the Human Rights Act 2019 (Qld) (HR Act). My decision is compatible with these rights.
[85]
The complaint process is now finalised. OIC will advise Draeger and close our file..." (Footnotes omitted)
[86]
[58] Those findings and the exercise of the power rested upon each component part of the complaint being found to be "misconceived" or "lacking in substance." The integrity of the decision thereby rested on the reasoning process for each component part of the complaint being unaffected by the relevant error grounds found in s 20(2) of the JRA.
[59] Relevantly, for the determination of each of the three proceedings before the Court, the OIC at the hearing accepted the following:
The decision-maker had found that each of the manufacturers were required to comply with IPP 6 as if each manufacturer was TMR.
Whilst the decision-maker had found that TMR, as an agency, could be authorised to refuse access to "personal information" under chapter 3 of the IP Act, there was no finding by the decision-maker that any of the criteria which would actually authorise the refusal of access was present in the circumstances of Mr Gear's requests for access to his personal information.
The decision-maker had found that a chapter 3 application to TMR as an agency would have enjoyed formal review rights.
The decision-maker had found that she had reasonably formed the belief that the complaint of a contravention of IPP 6 against each manufacturer was "lacking in substance" solely on the basis that there was another available formal means of pursuing access to the same personal information from TMR, namely via chapter 3 of the IP Act.
It was the formation of the above reasonable belief about this component part of the primary complaint against each manufacturer which formed part of the basis of the delegate declining to deal with the privacy complaint as a whole under s 168(1)(c) of the IP Act.
[87]
[60] The real issue is as follows: were any of the component parts of the privacy complaints relating to individual IPPs the subject of error in respect of any of the grounds for review set out in s 20(2) of the JRA.
[61] I have determined that the real issue is answered in the affirmative. In doing so, it is only necessary to consider the component part of the privacy complaints which concern the alleged breaches of IPP 6.
[88]
[62] Mr Gear is a self-represented litigant. He is not a trained lawyer.
[63] Mr Gear had approached the challenges to the decisions, to the extent that they concerned the finding that the alleged breaches of IPP 6 were "lacking in substance," on the basis that such a finding was unreasonable in the sense articulated in Minister for Immigration and Citizenship v Li[2012] HCA 61; (2013) 249 CLR 332 at [76].
[64] It seemed to me that the proper ground for such a challenge was not on the ground of unreasonableness, but rather on the ground that the finding involved a potential error of law[9] concerning the construction and operation of s 168(1)(c) of the IP Act, and more particularly the construction of the words "lacking in substance" as they appeared in that section.
[65] In order to ensure procedural fairness, I explored this alternative error of law ground with counsel for the OIC during the hearing.
[89]
[66] The contentions advanced by the OIC on this alternative error of law ground can be summarised as follows.
[67] First, the OIC referred to the decision in Madzikanda v Australian Information Commissioner[2023] FCA 1445, where Wheelahan J was considering the Privacy Act 1988 (Cth). In particular, the learned judge was considering the operation of s 41 of the Privacy Act (Cth). The OIC sought to align the gateway feature of s 41 of the Privacy Act (Cth) with s 168(1) of the IP Act.
"41 Commissioner may or must decide not to investigate etc. in certain circumstances
[91]
(1) The Commissioner may decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under section 36 if the Commissioner is satisfied that:
[92]
(da) an investigation, or further investigation, of the act or practice is not warranted having regard to all the circumstances..."
[93]
[69] The Privacy Act (Cth) provided for a statutory means of complaining about an alleged interference with privacy. In Madzikanda, Wheelahan J observed that the role of the Commonwealth Commissioner under that Act was as an administrative gatekeeper of complaints about interferences with privacy. It also noted that the Privacy Act (Cth) did not create a directly enforceable action by individuals for the infringement of privacy.
[70] In construing the words of s 41(1)(da) of the Privacy Act (Cth), Wheelahan J observed that the words of the section must be construed in light of the gatekeeping role given to the Commonwealth Commissioner, and that there was nothing in the text, structure or purpose of the Privacy Act (Cth) which detracted from giving to s 41(1)(da) the broad meaning which the text of the provision bore on its face.
[71] In the present proceedings, the OIC submitted that the delegate also held such a gatekeeping role and that a similar approach to the construction of s 168(1) of the IP Act should be adopted here. The effect of that submission is that s 168(1) of the IP Act ought to be construed broadly so as to provide a wide discretion to decline to proceed with complaints.
[72] Secondly, reference was made to the decision in Purrer v Information Commissioner[2018] QSC 272, where Boddice J (as his Honour then was) briefly considered
[94]
[73] His Honour found that s 168(1)(c) gave the respondent a broad discretion to decline to deal with the whole or part of a privacy complaint, if the respondent "reasonably believes the complaint or part, is frivolous, vexatious, misconceived or lacking in substance."[10] In that particular case, his Honour found there was nothing in the applicant's complaint which raised a proper basis to call into question the respondent's belief to that effect, or the reasonableness of that belief. In speaking of the concept of a "reasonable belief," Boddice J noted that the formation of such a state of mind did not require proof of the existence of the subject matter. In so concluding, his Honour relied on observations in George v Rockett[1990] HCA 26; (1990) 170 CLR 104 at 116 as follows:[11]
[95]
"The objective circumstances sufficient to show a reason to believe something need to point more clearly to the subject matter of the belief, but that is not to say that the objective circumstances must establish on the balance of probabilities that the subject matter in fact occurred or exists: the assent of belief is given on more slender evidence than proof. Belief is an inclination of the mind towards assenting to, rather than rejecting, a proposition and the grounds which can reasonably induce that inclination of the mind may, depending on the circumstances, leave something to surmise or conjecture."
[96]
[74] Thirdly, it was submitted that the concept of "lacking in substance" as it appeared in s 168(1)(c) of the IP Act accommodated a circumstance where the complainant had an alternative route within the IP Act to seek the same personal information. That alternative route being a chapter 3 application to the relevant agency (here, TMR) for access to the personal information of Mr Gear.
[75] In support of that proposed construction, the OIC pointed out that s 168(1)(d) of the IP Act provided a separate basis for the delegate being able to exercise the discretion to decline to proceed with a privacy complaint, where "there is a more appropriate course of action available under another Act to deal with the substance of the complaint or part."[12]
[76] It was acknowledged that the alternative course of action to deal with the substance of the complaints here was not in another Act, but was, in fact, found within the IP Act, and that therefore s 168(d) was inapplicable to each of the complaints in question. However, the contention of the OIC was that it must have been the intention of Parliament that if such an alternative route to deal with the substance of the complaint was present in the IP Act itself, then there must be a basis within s 168(1) to decline to deal with the privacy complaint. It was submitted that the words "lacking in substance" as they appeared in s 168(1)(c) provided the appropriate vehicle for the meaning of what was said to be this obvious Parliamentary intent.
[97]
[77] I find that the decision-making process, to the extent it concerned the alleged breach of IPP 6, involved an error of law. That error of law was in respect of the proper construction and operation of s 168(1)(c) of the IP Act, and more particularly, the construction of the words "lacking in substance."
[78] The words "lacking in substance," as they appear in s 168(1)(c) of the IP Act, naturally focus on the substance of the complaint itself. Such a phrase would not, on an ordinary reading of the words, contemplate that a complaint would be "lacking in substance" merely because an alternative course of action was available under the IP Act to obtain compliance with IPP 6. Far from "lacking in substance," that scenario would continue to involve a complaint which had substance.
[79] Secondly, that textural construction is not altered by the context in which those words appear in the IP Act. It may readily be accepted that s 168(1) is a form of gateway provision. Such provisions are common in Acts where complaints or claims are authorised to be made to a regulatory body.
[80] However, reference to broad concepts of such sections being gateway provisions does not provide a basis for a construction and operation divorced from the text. The gateway provided for by s 168(1) of the IP Act is bounded by the specifically worded qualifications which enliven the power to decline consideration, or further consideration, of a complaint. If a complaint does not fall within one of the expressed qualifications, s 168 does not otherwise provide a free-floating discretion in the delegate to decline to deal with the complaint.
[81] Thirdly, the decision in Madzikanda v Australian Information Commissioner,[13] which dealt with s 41(1)(da) of the Privacy Act 1988 (Cth), is of little assistance to the process of constructing s 168 of the IP Act. Each Act needs to be construed in terms of the text which appears in it, giving appropriate consideration to context and relevant extrinsic material where appropriate. Quite clearly, of the (Cth) is a broadly-worded qualification. It bears no resemblance to the text of the qualification which appears in s 168(1)(c) of the IP Act. It is also relevant to note that there is no equivalent of s 41(1)(da) in s 168(1) of the IP Act.
[98]
"139 Commissioner must reject frivolous, trivial etc. complaints
[99]
The commissioner must reject a complaint if the commissioner is of the reasonable opinion that the complaint is -
[100]
[89] The delegate decision-maker in Toodayan had declined to deal with the complaints on the basis that the qualifications in s 139(b) of the Anti-Discrimination Act were met.
[90] Relevantly, Burns J made the following observation on the meaning of the words "lacking in substance" and "misconceived" as they appeared in s 139(b) of the Act under construction in that proceeding:[15]
[101]
"[42] The nature of the commissioner's task under s 139(b) is informed by these statutory features as well as the protective purpose of the legislation. A complaint cannot be expected to "allege the relevant facts with the particularity of an indictment or of a pleading". Nor should it be assumed that the details supplied are comprehensive or that they aspire to do any more than indicate what is intended to later be proved to establish the complaint. Thus, when forming an opinion under that provision, the question for the commissioner is whether the details provided in and with the complaint, if proved at a hearing of the tribunal, are indicative of a contravention that is neither misconceived nor lacking in substance. A complaint will be "misconceived" if it is based on a false conception or notion such as an allegation of discrimination on the basis of an attribute that is not protected by the ADA and "lacking in substance" where the detail provided in the complaint fails to point to conduct on the part of the named respondent that is capable, if proved, of amounting to a contravention under the ADA. Obviously, because rejection will deprive the complainant of a hearing, it must clearly appear that the complaint is misconceived or lacking in substance before the requisite opinion may reasonably be formed.
[102]
[50] It is apparent that the delegate approached the task under
[103]
s 139(b) ADA as though the detail contained in, with and subsequent to the complaint was comprehensive of the matters relied on by the appellants to support an inference of discrimination. That was not only the wrong approach in circumstances where the appellants had expressly advised the Commission that they had made requests for potentially relevant material from the hospital that were still outstanding, but also because s 139(b) requires no more of a complainant than to provide reasonably sufficient details to indicate a contravention. The correct approach should have been to reach an opinion as to whether the details were indicative of a contravention that was not, relevantly, lacking in substance. Furthermore, although it was accepted that the details provided by the appellants were sufficient to support an inference of discrimination, the delegate erroneously embarked on an evaluation of the available competing inferences - one that would support the contravention about which the appellants complained and one that would not - before deciding that the former was only a "mere possibility" and that the latter was not only the preferred inference but that it provided the explanation for why a counter terrorism investigation was initiated.
[104]
[51] Of course, it should not be thought that s 139(b) does not require an evaluation of the substance of each complaint; it does. Indeed, there might be some irremediable defect in the chain of reasoning or logic behind a complaint or some incurable gap in the evidence that might be gathered in support of it that makes it clear that there can be no substance in it, but where, as here, the details provided are indicative of circumstances that, if ultimately proved, are capable of supporting a conclusion of discrimination under the ADA it cannot reasonably be concluded that the complaint lacks substance.
[105]
[52] It follows that the appellants' contention before the primary judge that the delegate applied the wrong test when rejecting their complaint must be accepted as correct..."
[106]
[91] The construction adopted by Burns J was consistent with the words "misconceived" and "lacking in substance" looking inwardly at the substance or intrinsic merit of the complaint.
[92] The decision in Toodayan, which considered a section worded in a broadly similar fashion to s 168(1) of the IP Act, strongly supports the construction of the words "lacking in substance" in the way I have previously arrived at.
[93] Fifthly, the submission by the OIC that this Court ought to give a different construction to the words "lacking in substance" as they appear in s 168 of the IP Act to the construction given by the Court of Appeal to the exact same words as they appear in s 139 of the Anti-Discrimination Act ought to be rejected. The justification put forward by the OIC for such a different construction was the presence of
[107]
s 168(1)(d) of the IP Act. Section 168(1)(d) contains a qualification that where "...there is a more appropriate course of action available under another Act to deal with the substance of the complaint or part" the Information Commissioner can decline to proceed with the complaint.
[108]
[94] There is nothing in the presence of s 168(1)(d) of the IP Act which would support the construction contended for by the OIC.
[95] There is nothing which supports the alleged obvious legislative intent contended for, so as to justify the imposition of a construction of the words "lacking in substance" which is so foreign to their ordinary meaning.
[96] This is so in part because, objectively, the drafters of the IP Act ought to be assumed to have been well aware that personal information could be separately requested from an agency by a chapter 3 application. They were the very creators of the alternative chapter 3 and chapter 5 routes. Further, the IP Act provides at various places for a disclosure bias. Providing two potential routes for disclosure is consistent with such a bias.
[97] The compelling inference from the context of the IP Act is that the legislature fully intended that there be two routes open for individuals to either seek personal information from the agency by chapter 3, or seek it from the bound contracted service provider by a chapter 5 complaint.
[98] The second route is one which ultimately may result in an action being brought in QCAT within its original jurisdiction, which may potentially result in damages or compensation in an appropriate case.
[99] If the intent was to discretionally preclude a person from seeking the statutory relief created by chapter 5 merely because there was an alternative route to the "personal information" via chapter 3, clear words would have been expected. The wording of
[109]
s 168(1)(d) of the IP Act not only fails to contain such clear language, but is drafted expressly to focus on more appropriate causes of action available under "another Act." That seems to be quite deliberate language which excludes any consideration of a more appropriate course under the IP Act.
[110]
[100] It would be an extraordinary result to conclude that the identical words in a gateway provision in two separate State Acts would have such fundamentally different operations. No textual or contextual justification for such a result exists here.
[101] Accordingly, the delegate decision-maker, in each of the decisions, has erred in law in her misconstruction of s 168(1)(c) of the IP Act, and specifically the words "lacking in substance." That error in law has caused each of the decisions to have miscarried.
[102] Accordingly, the real issue is answered in the affirmative for each decision.
[111]
[103] The error of law has caused the decision-making process to miscarry in respect of each of the three decisions.
[104] Each of those decisions should accordingly be quashed.
[105] The delegate misconstrued s 168(1)(c) of the IP Act. She has construed a component part of the complaint to be "lacking in substance," solely because the IP Act provides an alternative route to the personal information which was the subject of the complaints. The existence of an alternative route has nothing to do with the substance of the complaints themselves.
[106] I note that there were many other grounds raised by Mr Gear in respect of the decisions. It is unnecessary to deal with those other grounds because the existence of the above error of law has caused the decision-making process for each of the decisions to miscarry.
[107] My not dealing with the alternative grounds should not be taken as any indication that those grounds had any particular merit. Mr Gear would be well advised to review the ambit of his complaints lest the Information Commissioner seeks to make a fresh decision under s 168(1) of the IP Act.
[108] The orders of the Court are as follows:
In proceeding 16324 of 2024, the decision of the Information Commissioner of
[112]
In proceeding 16326 of 2024, the decision of the Information Commissioner of 11 November 2024 is quashed.
3. In proceeding 16327 of 2024, the decision of the Information Commissioner of
[15]Toodayan v Anti-Discrimination Commissioner[2018] QCA 349 at [42], [50], [51] and [52].
Parties
Applicant/Plaintiff:
Gear
Respondent/Defendant:
The Information Commissioner [2025] QSC 162
Legislation Cited (6)
Privacy Act 2009
Review Act 1991
Civil and Administrative Tribunal Act 2009
Operations (Road Use Management - Driver Licensing) Regulation 2021
Operations (Road Use Management) Act 1995
Rights Act 2019
Cases Cited (2)
(1990) 170 CLR 104
(2013) 249 CLR 332
JRA
[14] If the answer to the real issue is in the affirmative, then the whole of the decision ought to be quashed.
[15] I have determined that the answer to the real issue question is in the affirmative in respect of the component part of each complaint which asserted a breach of IPP 6. IPP 6 relates to Mr Gear having requested each of those manufacturers to provide him access to his personal information which they had control of.
[16] In explaining the answer to this real issue, these reasons will be structured in the following way:
[82] Unlike the Privacy Act (Cth), the IP Act does independently grant and create statutory causes of action which may be pursued in QCAT where a privacy complaint has been made and it has proceeded beyond the gateway. As I have summarised above, a complainant who has not had their complaint declined to be dealt with under s 168(1) of the IP Act can, in the absence of a successful mediation, go to QCAT in its original jurisdiction and seek statutory relief which includes damages or compensation in appropriate cases.
[83] Fourthly, there is nothing in the decision of Purrer v Information Commissioner[14] which is inconsistent with the observations made in the third point above. In Purrer, Boddice J was not dealing with the proper construction of the words "lacking in substance" as they appeared in s 168(1)(c) of the IP Act.
[84] Fifthly, during the hearing I raised with counsel for the OIC the proposition that the words "lacking in substance" indicated an inwards looking examination of the substance of the privacy complaint itself. In a similar vein, I suggested to counsel that the term "misconceived" also looked inwardly to the privacy complaint.
[85] None of the authorities identified by the OIC dealt with the construction of the words "lacking in substance" or "misconceived," as they appeared in s 168(1) of the IP Act or a similar type Act. As provisions such as s 168(1) are relatively common in regulatory Acts, I gave leave to each party to identify after the hearing any decisions they may locate dealing with the construction of these specific words in a similar type Act.
[86] Shortly after I had indicated that such an additional opportunity would be provided, my Associate drew to my attention, whilst the hearing was still on foot, to the decision of the Court of Appeal in Toodayan v Anti-Discrimination Commissioner Queensland[2018] QCA 349.
[87] That decision dealt with four applications for statutory orders of review brought under the JRA. The leading judgment was delivered by Burns J, with whom Fraser and Philippides JJA agreed.
[88] Toodayan concerned a series of complaints that had been made to the Anti-Discrimination Commissioner about alleged contraventions of the Anti-Discrimination Act 1991 (Qld). The relevant Act had a gateway provision which included the words "lacking in substance" and "misconceived." Section 139 of that Act provided as follows: