[2020] WASC 150
General information, not legal advice.
Supreme Court of WA
2020-05-11
Archer J
Original judgment source is linked above.
Ground 1: With respect to KA 4449/17, KA 4452/17 and KA 4453/17, the learned magistrate erred in fact and in law in finding that the appellant used the restricted‑access computer system ASSIST other than in accordance with her authorisation, in circumstances where:
(a) The magistrate made no findings as to the terms of the appellant's authorisation to use ASSIST; and
(b) The prosecution did not lead any evidence of the terms of the appellant's authorisation to use ASSIST.
Ground 3: With respect to KA 4449/17, the appellant suffered a miscarriage of justice as the charge is duplicitous.
Appeals from magistrates' decisions[4]
it is not appropriate to scrutinise the reasons for decision given by magistrates with a fine tooth comb or with an eye keenly attuned to the identification of error. Nor is it appropriate for the court to infer from infelicity of language that error is thereby demonstrated. That is because, of necessity, magistrates are required to perform their important functions in a different time frame to that which applies in the superior courts and in that context it is to be expected that some infelicity of language is likely to occur from time to time.
'For the purposes of this section a person unlawfully uses a restricted-access computer system -
(a) if the person uses it when he or she is not properly authorised to do so; or
(b) if the person, being authorised to use it, uses it other than in accordance with his or her authorisation.'
12.1. That ASSIST was a 'restricted-access computer system' as defined in s 440A(1);
12.2. That the appellant did 'use' ASSIST, as defined in s 440A(1);
12.3. That the appellant had the authority to use ASSIST at the time of each of the impugned searches.
'Important reminder of confidentiality obligations. In accessing client information by clicking okay below I undertake to comply with the provisions of confidentiality documented in section 241 of the Children and Community Services Act 2004, section 127 of the Adoption Act of Western Australia 2004 [sic: 1994], section 81 of the Criminal Code of Western Australia, section 440A of the Criminal Code of Western Australia and the Public Service Commission Administration Instructions 771 [sic: 711 ].'[14]
(a) Section 241 of the Children and Community Services Act 2004 (WA) and s 127 of the Adoption Act 1994 (WA) restrict the recording, disclosure and use of information that has been obtained. They do not define the purposes for which information can be obtained;
(b) Section 81 of the Criminal Code deals with unlawful disclosure of information;
(c) Section 440A of the Criminal Code prohibits a person from using a restricted‑access computer system without proper authorisation or other than in accordance with a person's authorisation. However, it does not itself define the scope of a person's authorisation; and
(d) Public Service Commission Administration Instruction 711 prohibits giving or disclosing information and documents obtained in the course of official duty.
And what was the policy surrounding access to ASSIST when you were at DCP? ‑‑‑ There was, like, something to do with not accessing someone that you weren't working with and things like that so, but also, like, I mean, our families are all linked into each other so a lot of our families that we were directly working with, so you could sometimes go into somebody else not - you're not working with because they're already linked to that family so.
...
And in that three to four months was there any policy in relation to accessing ASSIST? ‑‑‑ Only that - like I said, they had to be - like, you had to be working with that family but, like I said, all families are interacting so - and in the instance - like, if you needed to access somebody to advise, like, to find out who the case manager was, for instance, that was the easiest way to find out who the case manager was: by looking at ASSIST.
...
Why does an audit show that your login details were used on ASSIST to access [CD]? - ... I used him to look up his mother to see who the case manager was for the family and I immediately emailed the case manager to advise what had happened the day before and that [another person] may be getting charged because she was in possession of my stolen property and that's pretty much how I know [CD]. ...
How was using ASSIST to look up [CD] part of your job at DCP? ‑‑‑ Well, on that day I think it was - I believe, like, I should have, like, as a DCP officer I should advise my co‑worker of what had actually happened on the weekend so I believe that's why I looked at ASSIST to find out his case manager.
...
And how was using assist to look up [RC] part of your job at DCP? ‑‑‑ Again, to advise a co‑worker of information I had about a client.
Who is [AC]? ‑‑‑ [AC] is related to the - if it's the [AC] Junior or [AC] Senior, it's the partner or son of [LM].
Okay. And why does an audit of ASSIST show [AC] is accessed using your login details? ‑‑‑ In relation to that it was when we - [TS] and I were working on - together on a referral in regards to [AC] to DCP.
...
And so why didn't you just ring up the Hedland office and say, 'Who's looking after [RC]'? ‑‑‑ Because I had discussed with her at orientation and she said to contact her and I just - and I don't know, just - - -
Or to research on who's at Hedland and just CC everyone and send an email that way? ‑‑‑ Well, I just don't know. It was just easier to look up ASSIST and get her name.
But you agree that for ASSIST you're only allowed to do it - related to the five families? ‑‑‑ Well, I was just trying - like, maybe I shouldn't have done it that way. I agree now that I shouldn't have. If I had of known I was going to get into trouble for it I would have sent an email, but at the time I just looked on ASSIST to see what her name was.
Do you agree that [RC] was outside the five families, like, not related to those five families - - - ? --- Yes.
- - - that [TS] and yourself looked after. Okay?‑‑‑Yes.
In relation to the ASSIST searches, naturally [DR's] evidence is also relevant to the ASSIST searches and I won't repeat what I've already said about his evidence.
[DR] was clear and unshakeable about what might constitute a legitimate business purpose for his teams - or his department. He was equally clear about the processes within the team. Although they worked together, there were specific portfolios held by each team member and a defined publish process or protocol regulating how information passing between the DCP unit he operated and outside agencies was to be conducted. [DR] was also clear about the parameters of the accused's role.
...
Defence counsel poses a very interesting a very interesting argument about the definition of authorisation and he's right. There is no definition in the Code or that section. So authorisation or authority must be given their normal dictionary meaning. [DR] outlined that the accused underwent two days of training before she could access ASSIST and that training covered confidentiality requirements and legal requirements.
In respect of [AC] then, ... In relation to child protection issues, the accused had no authority to assess harm. She should have referred her concerns to the line manager, which was [DR], or [NM], whose portfolio was protection. I make it clear that she may have had a benign purpose and a desire to be helpful. The issue though is whether or not she could access ASSIST in this way, and she can't.
In relation [to CD], the accused gave evidence that [she] accessed [CD] in ASSIST in order to find the name of the case manager for the family so she could advise him or her that [RC's mother], may be charged in relation to a burglary committed at her house. In cross examination, she conceded that this search was not work related, but justified it on the basis that she outlined in her examination. Her answers in cross‑examination did not sit well with her statement, which was tendered into evidence, and that doesn't refer to [CD] at all.
This search in particular can have no legitimate business purpose relating to the accused's role at DCP and therefore it's unauthorised. This search has the flavour a personal matter. I don't deny that she may have searched in order to see [RC's] DCP worker or case worker but it's the physical search that she performed that could not be authorised. That she could not have any mistake that she had the authority to perform this search, particularly because of its personal flavour.
Similarly, accessing ASSIST to locate [RC's] case manager can have no legitimate business purpose. In cross-examination, the accused admitted that her access to the information was easier than following the policy to achieve the same end. That indicates an awareness of the correct procedure and a deliberate decision to bypass it. The accused may have had a desire to be helpful to a fellow DCP worker by passing on information as to [RC's] drug use, but this does not constitute a legitimate business purpose and so the use of ASSIST in this case must be unauthorised also.
Where, as is the case here, the question is whether the entry was with permission, it will be important to identify the entry and to determine whether that entry was within the scope of the permission that had been given. If the permission was not subject to some express or implied limitation which excluded the entry from its scope, then the entry will be with lawful justification but if the permission was subject to an actual, express or implied limitation which excluded the actual entry made, then the entry will be 'without lawful authority to do so'.
When the only suggested justification for entry is the permission of the person in possession, the question whether entry was as a trespasser involves no more than identification of the limits of the actual permission, the definition of the actual entry and the determination of whether that entry was within the scope of that permission.[25]
In my view the section requires attention to whether the particular entry in question was an entry that was made without lawful authority. In the case of a hacker it will be clear that he has no authority to enter the system. In the case of an employee the question will be whether that employee had authority to effect the entry with which he stands charged. If he has a general and unlimited permission to enter the system then no offence is proved. If however there are limits upon the permission given to him to enter that system, it will be necessary to ask was the entry within the scope of that permission? If it was, then no offence was committed; if it was not, then he has entered the system without lawful authority to do so.
Should the global penalty be set aside and the appellant re-sentenced?
I certify that the preceding paragraph(s) comprise the reasons for decision of the Supreme Court of Western Australia.
[1] Now part of the Department of Communities.
[2] Respondent's Outline of Submissions filed 19 March 2020 [11].
[3] Email from Mr Murray, counsel for the respondent, dated 21 April 2020.
[4] This section reproduces or draws on my reasons in Heesom v O'Keefe [2017] WASC 362 and Vucemillo v Ambrose [2019] WASC 411, but is repeated here
[8] Samuels v The State of Western Australia [2005] WASCA 193; (2005) 30 WAR 473 [56].
[11] Ninyette v Holmes [2015] WASC 287 [65]; WS v Gardin [2015] WASC 97 [239] ‑ [241].
[12] Strahan v Brennan [2014] WASC 190 [89] ‑ [90].
[16] ts 3, 21 June 2019, last full paragraph. In the context of the reasons surrounding this statement, it was clearly intended to reflect the prosecutions argument.
[20] Inglis v Pinch [2016] WASC 30; (2016) 256 A Crim R 502 [26].
[21] Giles v Douglas [2011] WASC 14.
[22] Director of Public Prosecutions v Murdoch [1993] VicRp 30; [1993] 1 VR 406.
[23] Murdoch (409 - 410) cited in Salter v Director of Public Prosecutions [2011] NSWCA 190; (2011) 81 NSWLR [21] ‑ [22].
[24] Barker v R [1983] HCA 18; (1983) 153 CLR 338.
[26] Murdoch (410); cited in Salter [22].
[27] ts 12 ‑ 14, 20 December 2018, extracted earlier.
[28] See for example, ts 13, 21 June 2019, where the magistrate described something the appellant had said in evidence as 'nonsensical'.
[30] See Michaels v Western Australia [2009] WASCA 174 [8]; Green v The State of Western Australia [No 2] [2014] WASCA 53; (2014) 240 A Crim R 73.
[31] A charge must allege one offence only unless cl 8 of sch 1 of the Criminal Procedure Act or another written law permits otherwise - see s 23, read with cl 2(4) of sch 1. Neither cl 8 nor another written law permitted the charge in this case to allege more than one offence.
[32] See ts 10, 20 December 2018. See also ts 37 in relation to the two ASSIST searches the same day.
[33] City of Swan v Bluebay Holdings Pty Ltd [2015] WASCA 227.
[34] As it was an appeal from a decision of a single judge of the Supreme Court - see s 18 of the Criminal Appeals Act. As for the court's powers, see in particular s 14(1)(c), s 14(1)(b) and s 14(4).
[35] City of Swan [54]. See also Wellington v Police [2009] SASC 294; (2009) 105 SASR 215.
(2005) 30 WAR 473
(1983) 153 CLR 338
(2009) 105 SASR 215