MJ v Department of Education and Communities

RELEVANT LEGISLATION

1. Part 5 of the Privacy and Personal Information Protection Act 1998 applies to the review of certain conduct (including alleged conduct) by a public sector agency, such conduct including the agency's contravention of an information protection principle or a health privacy principle (Privacy and Personal Information Protection Act 1998, s 52(1)(a) and Health Records and Information Privacy Act 2002, s 21(1)(a)).
2. Section 52(4) of the Privacy and Personal Information Protection Act 1998, which is in Part 5 of that Act, provides: 52 Application of Part … (4) Section 53 (Internal reviews) of the Administrative Decisions Review Act 1997 does not apply to or in respect of conduct to which this Part applies.
3. Section 53 of the Privacy and Personal Information Protection Act 1998 provides for the making of applications for internal review of conduct by a public sector agency. Section 53(6) and (8) deal with the completion (or non-completion) of the internal review. They provide: 53 Internal review by public sector agencies … (6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for an administrative review of the conduct concerned. … (8) As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of: (a) the findings of the review (and the reasons for those findings), and (b) the action proposed to be taken by the agency (and the reasons for taking that action), and (c) the right of the person to have those findings, and the agency's proposed action, administratively reviewed by the Tribunal.
4. Section 55(1) of the Privacy and Personal Information Protection Act 1998 provides for a person who has applied for an internal review to apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 (NSW) of the conduct that was the subject of the internal review application.
5. The Administrative Decisions Review Act 1997 provides, in s 55(2), for the making of an application to the Tribunal: 55 Making of applications … (2) Subject to enabling legislation, an application is to be made in the time and manner prescribed by the procedural rules.
6. The term "procedural rules" is defined in s 4 of the Administrative Decisions Review Act 1997 as having the same meaning as in the Civil and Administrative Tribunal Act 2013 (NSW) ("NCAT Act"). The term is defined in s 4(1) of the NCAT Act to mean the Tribunal rules and the regulations in their application to the practice and procedure of the Tribunal. The "Tribunal rules" are defined in the same provision to mean the rules of the Tribunal made by the Rule Committee.
7. The Civil and Administrative Tribunal Rules 2014 (NSW) ("NCAT Rules") were amended on 21 November 2014 to make provision for the time limits applicable to applications under the Privacy and Personal Information Protection Act 1998. At the time of the applicant's application, however, rule 24 provided as follows: 24 Administrative review applications (1) An administrative review application must be: (a) in or to the effect of the approved form, and (b) duly completed, and (c) lodged at the Registry, and (d) accompanied by the applicable fee (if any) for the application. (2) An administrative review application need not specify the Division of the Tribunal to which the function of determining the application is allocated by the Act. However, if the appropriate Division is not specified or an incorrect Division is specified, a registrar may complete or alter the application form accordingly. (3) Unless the Tribunal grants an extension under section 41 of the Act, an application must be made: (a) in the case where enabling legislation specifies the period within which the application is to be made - within the period specified, or (b) in any other case - by the end of the default application period. (4) The default application period for the purposes of subrule (3)(b) is: (a) in the case where the applicant has duly applied for an internal review of the administratively reviewable decision under the Administrative Decisions Review Act 1997 - the period of 28 days after the day on which the internal review is taken to have been finalised under section 53(9) of that Act, or (b) in any other case - the period of 28 days after: (i) if the applicant has requested reasons under section 49 of the Administrative Decisions Review Act 1997 for the administratively reviewable decision - the day on which the applicant was either provided with a statement of reasons under section 49 of that Act or notified under section 50 of that Act of a refusal to provide reasons, or (ii) if the applicant has not requested reasons under section 49 of that Act - the day on which the applicant was notified of the making of the administratively reviewable decision.
8. The NCAT Act provides in s 40 for the making of applications to the Tribunal as follows: 40 Making of applications and appeals An application or appeal to the Tribunal is to be made in the time and manner prescribed by enabling legislation or the procedural rules.

WHAT TIME LIMITS APPLIED TO PRIVACY APPLICATIONS TO NCAT BETWEEN FEBRUARY AND AUGUST 2014?

1. The respondent submitted that the default period of 28 days, identified in r 24(4)(b)(ii) of the NCAT Rules as being 28 days from the day on which the applicant was notified of the administratively reviewable decision, is the applicable period for applications made under the privacy legislation.
2. The applicant did not refer to the legislative provisions determining the applicable time limits. Rather, she submitted that she had been advised by the internal reviewer that she could apply to the Administrative Decisions Tribunal within a reasonable time, preferably 60 days. She said a reasonable time is the amount of time that is fairly required to do whatever is required to be done, conveniently under the permitted circumstances. The applicant submits that her application was filed within a reasonable time.

Application of NCAT Rules

1. In my view, r 24(3) and (4) of the NCAT Rules, as they stood between the notification to the applicant of the internal review determination (17 February 2014) and the applicant's application to the Tribunal (22 August 2014), did not apply to applications for a review of conduct made under the Privacy and Personal Information Protection Act 1998.
2. Rule 24(3)(a) of the NCAT Rules does not apply on its terms because the enabling legislation, being the Privacy and Personal Information Protection Act 1998, does not specify the period within which the application is to be made.
3. Rule 24(3)(b) provides that, if no time limit is specified in the enabling legislation, an application must be made "by the end of the default application period". The "default application period" is defined under r 24(4)(a) for the purposes of an applicant who has applied for internal review under the Administrative Decisions Review Act 1997. This does not include an applicant for review under the Privacy and Personal Information Protection Act 1998, since the internal review provisions of the Administrative Decisions Review Act 1997 do not apply to conduct under the privacy legislation (see Privacy and Personal Information Protection Act 1998, s 52(4)).
4. Rule 24(4)(b) defines the "default application period" for other situations as being 28 days after the applicant has either been given written reasons (if requested under s 49 of the Administrative Decisions Review Act 1997) or, if no such written reasons were requested, 28 days after "the day on which the applicant was notified of the making of the administratively reviewable decision."
5. In this case, the applicant did not request reasons under s 49 of the Administrative Decisions Review Act 1997 so that, on its face, r 24(4)(b)(ii) of the NCAT Rules applies. This raises the question as to whether either conduct under the Privacy and Personal Information Protection Act 1998 or an internal review determination under the Privacy and Personal Information Protection Act 1998, or both, is an "administratively reviewable decision."
6. "Administratively reviewable decision" is defined in s 30(3) of the NCAT Act as "a decision of an administrator over which the Tribunal has administrative review jurisdiction". "Decision" is defined in s 5(g) of that Act to include "doing or refusing to do any other act or thing" (so could include conduct which is reviewable under the Privacy and Personal Information Protection Act 1998). Section 30(1) of the NCAT Act provides that the Administrative Decisions Review Act 1997 provides for the circumstances in which the Tribunal has administrative review jurisdiction over a decision of an administrator. The Administrative Decisions Review Act 1997 provides, in s 9, that the Tribunal has administrative review jurisdiction over a decision of an administrator if enabling legislation provides that applications may be made to the Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of any such decision in the exercise of functions of the administrator identified by the legislation.
7. It follows that conduct under the Privacy and Personal Information Protection Act 1998 is an "administratively reviewable decision" for the purposes of the NCAT Act. An internal review determination under the privacy legislation is not an "administratively reviewable decision" because s 55(1) of the Privacy and Personal Information Protection Act 1998 provides that the Tribunal's review is to be of the conduct that was the subject of the internal review application (that is, the Tribunal is not directly reviewing the internal review determination).
8. If r 24 of the NCAT Rules applies to privacy applications, then, on a literal reading of that rule, the default application period is 28 days after the day on which the applicant was notified of the agency's conduct under the Privacy and Personal Information Protection Act 1998, pursuant to r 24(4)(b)(ii). This reading of r 24, however, would work an absurdity, because a person cannot apply to the Tribunal for a review of conduct until an internal review has been conducted, or until 60 days have elapsed since the making of an internal review application. Another factor indicating that r 24(4)(b)(ii) does not apply to privacy applications is that it is not always the case that a person is "notified" of conduct under the Privacy and Personal Information Protection Act 1998; sometimes a person discovers such conduct, such as a disclosure of personal information, for himself or herself. This is implicitly recognised by the legislature in the reference to an applicant becoming "aware of the conduct" in s 53(3)(d) of the Privacy and Personal Information Protection Act 1998.
9. These factors indicate that r 24(3) and (4) of the NCAT Rules were, at the relevant time, inconsistent with the provisions governing the review of conduct under the Privacy and Personal Information Protection Act 1998.
10. The Rule Committee's power to make the Tribunal rules does not extend to making rules inconsistent with enabling legislation such as the Privacy and Personal Information Protection Act 1998 (NCAT Act, s 25(1)). Section 25(1) of the NCAT Act provides: 25 Tribunal rules may provide for practice and procedure (1) The Rule Committee may make rules of the Tribunal (referred to in this Act as the Tribunal rules), not inconsistent with this Act or enabling legislation, for or with respect to the following: (a) the practice and procedure to be followed in proceedings in the Tribunal, (b) any matter that is, by this Act or any other legislation, required or permitted to be prescribed by the Tribunal rules.
11. The matters which are, by the NCAT Act, permitted to be prescribed by the Tribunal rules include the time and manner for making applications to the Tribunal (NCAT Act, s 25(2), Sch 7, item 1).
12. As r 24 of the NCAT Rules was inconsistent with the Privacy and Personal Information Protection Act 1998, and the power to make rules does not extend to making such an inconsistent rule, rule 24 (in its previous form) has to be construed as operating to the full extent of, but so as not to exceed, the power conferred by the Act under which it is made, being the NCAT Act (see Interpretation Act 1987, s 32). That is, r 24(3) and (4), as they stood prior to 21 November 2014, must be read down so as not to apply to applications made under the Privacy and Personal Information Protection Act 1998.
13. The consequence of the non-application of r 24(3) and (4) of the NCAT Rules, at the time of the respondent's internal review determination, is that there was no express statutory time limit for the making of a privacy application in the Tribunal.

Whether a privacy application had to be made within a reasonable time

1. A question then arises as to whether s 55 of the Privacy and Personal Information Protection Act 1998 implicitly required applications to the Tribunal to be made within a reasonable time.
2. A similar issue of construction arose when the Administrative Decisions Tribunal ("ADT") was the body responsible for reviewing the conduct of agencies under the Privacy and Personal Information Protection Act 1998. There was no express provision for the time limits for making a privacy application to the ADT in the ADT's governing legislation.
3. In AT v Commissioner of Police, New South Wales Police Force [2009] NSWADTAP 1 at [34], the ADT Appeal Panel construed s 55 of the Privacy and Personal Information Protection Act 1998 as being subject to a "reasonable time" limitation. At the time of that decision, s 55(1) provided: 55 Review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53.
4. The Appeal Panel effectively read this provision as including the words "within a reasonable time" after the word "Tribunal".
5. The Appeal Panel considered that what constitutes a reasonable time would depend on the circumstances of the case but that "60 days should be regarded as the ordinary outer limit of a reasonable time" (at [36]-[37]). It found that, although the ADT at first instance had erred in failing to apply the reasonable time test, and in wrongly applying a time limit in the tribunal's governing legislation, the review applicant had not made her application in a reasonable time. It therefore dismissed the appeal.
6. The review applicant appealed to the Court of Appeal. The applicant did not challenge the Appeal Panel's finding that an application must be made within a reasonable time, or its comments about what constitutes a reasonable time. Rather, the applicant argued that the Appeal Panel should have remitted the matter to a single member for a further hearing and that she was denied procedural fairness because she did not have an opportunity to provide evidence or make submissions as to whether the delay in making her application was reasonable.
7. The Court of Appeal upheld the appeal on procedural fairness grounds (AT v Commissioner of Police, NSW [2010] NSWCA 131). It did not comment on the Appeal Panel's construction of s 55 as containing an implication that an application was required to be made within a "reasonable time".
8. Since the decision in AT, s 55(1) of the Privacy and Personal Information Protection Act 1998 has been amended. It now provides: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.
9. The amendment to the provision was made by the Civil and Administrative Legislation (Repeal and Amendment) Act 2013 (NSW), Sch 2, item 2.118 [6]. This amendment was one in a suite of legislative changes made to effect the abolition of a number of tribunals and their replacement by the Civil and Administrative Tribunal. On the same day that the Civil and Administrative Legislation (Repeal and Amendment) Act 2013 was assented to, being 20 November 2013, the Civil and Administrative Tribunal Amendment Act 2013 (NSW) also received assent. The Civil and Administrative Tribunal Amendment Act 2013 amended what was then known as the Administrative Decisions Tribunal Act 1997, renaming it the Administrative Decisions Review Act 1997 and making other amendments. These amendments included the insertion of a new s 55 into the Administrative Decisions Review Act 1997, subsection (2) of which is set out above.
10. The amendment to s 55(1) of the Privacy and Personal Information Protection Act 1998 is significant, because it now makes clear that the Tribunal's review is to occur "under the Administrative Decisions Review Act 1997". As will be clear from the discussion above, the Administrative Decisions Review Act 1997 is closely connected to the NCAT Act through a series of references in both Acts to the other Act. For example, s 28(2)(b) of the NCAT Act identifies one of the kinds of jurisdiction the Tribunal exercises as being its administrative review jurisdiction. Section 30(1) of the NCAT Act provides that the Administrative Decisions Review Act 1997 provides for the circumstances in which the Tribunal has administrative review jurisdiction over a decision of an administrator. The Administrative Decisions Review Act 1997 then makes provision for those circumstances in s 9. Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997 makes provision for applications to the Tribunal for administrative review and for their handling in the Tribunal. The two Acts, then, are intended to be read together.
11. The circumstance that the amended s 55(1) of the Privacy and Personal Information Protection Act 1998 refers to administrative review occurring "under the Administrative Decisions Review Act 1997" indicates that the legislature is integrating privacy reviews into the new system of regulation governing administrative reviews in NCAT. That system already makes provision for time limits to be imposed by procedural rules.
12. The NCAT Act provides that applications to the Tribunal are to be made "in the time and manner prescribed by enabling legislation or the procedural rules" (NCAT Act, s 40). Section 55(2) of the Administrative Decisions Review Act 1997 similarly provides that "[s]ubject to enabling legislation, an application [to the Tribunal] is to be made in the time and manner prescribed by the procedural rules."
13. There must be some doubt as to whether s 55(2) of the Administrative Decisions Review Act 1997 applies to privacy reviews, because other subsections of s 55 appear to be inconsistent with the privacy legislation. Section 55(1) of the Administrative Decisions Review Act 1997 applies an "interested person" standing test, whereas s 55(1) the Privacy and Personal Information Protection Act 1998, read with s 53(1) of that Act, applies a different standing test. Further, s 55(3) of the Administrative Decisions Review Act 1997 refers to the undertaking of an internal review under that Act (see definition of "internal review" in s 4(1)), whereas such internal reviews are not available to privacy applicants. Subsections 55(4) to (6) also refer to applications to the Tribunal made after internal reviews carried out under the Administrative Decisions Review Act 1997. However, even if s 55(2) of the Administrative Decisions Review Act 1997 does not apply to privacy reviews, s 40 of the NCAT Act does.
14. The Privacy and Personal Information Protection Act 1998 does not, on its face, make any provision for the making of applications to the Tribunal within a particular time frame. It does not "prescribe" the time and manner of making an application to the Tribunal, within the meaning of s 40 of the NCAT Act. The legislative scheme for administrative review, established under the NCAT Act and the Administrative Decisions Review Act 1997, contemplates that, where no specific provision for the time and manner of making an application to the Tribunal is made under the enabling legislation, this is to be dealt with in accordance with the procedural rules.
15. If it were otherwise, and s 55(1) of the Privacy and Personal Information Protection Act 1998, on its proper construction, required applications to the Tribunal to be made within a reasonable time, then any provision made for privacy applications to be made within a specified time under the Tribunal rules would be inconsistent with s 55(1) and invalid. This is because a time specified by those rules might be a "reasonable time" in some circumstances, but not in others. The amended rule 24 of the NCAT Rules, which now provides for time limits for the making of privacy review applications in r 24(4)(a1) would therefore be invalid. It cannot, in my view, have been intended by the legislature that the Rule Committee would not have the power to make rules determining time limits for applications to the Tribunal in privacy matters.
16. For these reasons, I find that s 55(1) of the Privacy and Personal Information Protection Act 1998 does not require applications to the Tribunal to be made within a reasonable time or within any specified time frame. While this interpretation may have some unfortunate consequences, those consequences are not, of themselves, sufficient to justify a construction of s 55(1) which is inconsistent with the legislative scheme.
17. That being the case, the circumstance that the applicant waited for more than six months before making her application to the Tribunal does not deprive the Tribunal of jurisdiction to review her application.
18. These reasons should not be taken to indicate that the Tribunal has made a decision about any other jurisdictional issues which might arise. The Tribunal notes that there is a dispute between the parties as to whether conduct, of which the respondent says the applicant was aware more than six months before she applied for internal review, is properly the subject of an application to this Tribunal. The Tribunal has not yet considered this question.
19. Matter to be listed for a planning meeting on Tuesday, 7 April 2015 at 11.30am for the making of further directions. I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 24 February 2015