Norkin v University of New England

The University's requests for information and Mr Norkin's responses

1. The primary judge summarised the information sought from both Mr Norkin and his brother as follows (at [9]): To satisfy the GTE requirements, the University collected or sought to collect personal information about [Mr Norkin's brother], about [Mr Norkin], and about [his brother's] immediate family members. This included [his brother's] Year 10 and Year 11 equivalent educational qualifications, photographs of [his] wedding, and certified copies of his wife's and child's passports. The University required [Mr Norkin's brother] to complete a statement of purpose in his own handwriting. The University also sought information about [Mr Norkin's] annual salary and annual tax return, and the name, age, place of residence, and marital status of relatives and ex-spouses of [Mr Norkin] and of [his brother].
2. Some further information was provided by both Mr Norkin and his brother, although it fell short of the University's request. On 14 June 2018, the University advised that the application would be rejected: Thank you for submitting the completed UNE GTE Form on behalf of [his brother]. As part of UNE's GTE procedure, your completed form and supporting documentation were scrutinised for a comprehensive assessment against Genuine Temporary Entrant (GTE) and financial evidence criteria. UNE now advise that you have not met GTE and financial evidence requirements for admission to UNE. On the basis of this advice UNE is not able to provide you with an offer without the condition of further GTE screening and so is not able to assist you further with admission to on-campus study at UNE.
3. There was further correspondence between the University and Mr Norkin, largely directed to his providing a fully completed SOP. The application was ultimately sent to the University's external assessor, which led to an email dated 18 July 2018 from the University's International Admissions section. It was mostly directed to information and primary documentation concerning Mr Norkin's brother, but it also sought information concerning the sponsor himself. The email included the following: Our Assessor has requested the following: Additional information and/or Documents Request: … Applicant's brother (Mr Anton Norkin) must supply evidence of his annual salary income, such as his Certificate of Employment, bank statements where his salary was deposited, Payslips etc, which has been included in this visa application along with evidence of Tax payment.
4. The email concluded: The SOP - GTE Profile supplied is very generic and we observe that the applicant has answered "N/A" in many sections in the attached SOP, the applicant is therefore requested to provide detailed answers in his SOP in clear handwriting for the sections where he has answered as "N/A" in the attached GS GTE Profile or else any conflicting details may result in an outright visa rejection. Applicant must read Part A, Ques. No 1 carefully and then re-write the answer - he needs to provide complete details of his education history. He should then return this document to the UNE compliance Team for final scrutiny and approval/records [sic]
5. Mr Norkin provided some but not all of the information sought in relation to his brother. In relation to the request for information concerning himself as sponsor, he wrote by email dated 15 August 2018, responding to the individual requests made of him: ● The applicant must provide copy of passport for his brother, Mr Anton Norkin, along with his current visa copy Financial sponsor - brother Anton Norkin is a citizen, DHA should be aware of this fact. Provision of such documents to third unknown parties is unsafe. NSW Privacy Commission would be notifies of such demand. [sic] ● Applicant's brother (Mr Anton Norkin) must supply evidence of his annual salary income, such as his Certificate of Employment bank statements where his salary was deposited, Payslips etc, which has been included in this visa application along with evidence of Tax payment. Not relevant - sponsor is relying of his savings, not on income from employment. The savings are hold into account for long time, so no more evidence would be required. Statement of such fact is attached. Tax payment is obviously outside of assessor's jurisdiction. [sic]
6. The University did not make an admission offer to Mr Norkin's brother. It advised Mr Norkin that its contracted third party assessor was of the view that the requirements for admission had not been satisfied and that Mr Norkin's brother was "high-risk" and unlikely to meet the Department of Home Affair's GTE requirements.
7. In response to Mr Norkin's request for reasons, the Senior Admissions Officer wrote: Assessment had to be finalised based on the incomplete documentation which was provided. [Mr Norkin's brother's] case presents a high level of risk that a Student Visa application he submits would be rejected by the Department of Home Affairs (DHA). On this basis, UNE has provided a negative GTE outcome. Risks include: 30 weeks of ELICOS that the applicant is required to undertake prior to their Principal Course will be carefully scrutinised by visa officers and poses a high risk of visa refusal when considered with other areas of concern with the applicant's profile. Direction No 69 Alert Related to the Student Visa Interview Warning Related to the Applicant's Change of Career Path: The applicant completed a 6-year Bachelor of General Medicine in 2008 and also studied in the following clinical specialty: "Traumatology & Orthopedics" from 2008 - 2010. Although he has more than 7 years of work experience as a Medical Practitioner, he has decided to change his discipline and career path completely to a career in Nursing. This change in career may raise serious concerns by student visa officers as the downgrading from medicine to nursing is likely to result in an outright visa refusal. Direction No 69 Alert & Student Visa Interview Warning Related to an Applicant's Close Family Ties in Australia; This applicant has an Australia based brother, Mr Anton Norkin who is an Australian Citizen and is also the applicant's financial sponsor. Keeping the requirements of Direction, No 69 in mind, the fact that the applicant has very closely related Australian-based relatives, may bring additional focus to this case when it is being assessed by officials, who are required to assess GTE conditions more closely when an applicant already has established family links in Australia.

Mr Norkin's complaint and application for review

1. On 16 August 2018, Mr Norkin made a formal complaint pursuant to s 53 of the Protection Act on his own behalf and on behalf of his brother. The complaint had five aspects: (i) the collection of information indirectly (for example, details of relatives and ex-spouses), (ii) the absence of any legislation authorising the collection, (iii) that some of the information sought was irrelevant and therefore not reasonably necessary, (iv) that some of the information sought (for example, wedding photos) amounted to an unreasonable intrusion on personal affairs, and (v) that the intended recipients of the information were not disclosed.
2. I shall come in due course to the legislative regime, but by way of overview, the first aspect was directed to the requirement in s 9 that personal information be collected directly from the person to whom the information relates. The second and third were directed to the requirement in s 8(1) of the Protection Act that any collection of personal information be for a lawful purpose that is directly related to a function or activity of the University. The fourth was directed to the requirement in s 11 for the University to take reasonable steps to ensure that the collection does not unreasonably intrude on the individual's personal affairs, and the fifth was directed to the requirement in s 10 to disclose the recipients of the personal information.
3. Part of the response by a Senior Legal Officer of the University, dated 22 October 2018, was the following: Given that the assessment made by the Department of Home Affairs is based on the material it is provided with by or on behalf of the education provider and that it is not required to request further information if there are deficiencies in an application, it is imperative that all documentation that could possibly be required in relation to an Applicant is supplied to the Department at the time of lodgement. [Emphasis added.]
4. (The emphasised words are now said by the University to be factually wrong.)
5. Dissatisfied with the University's internal review, Mr Norkin and his brother sought external review in NCAT pursuant to s 55. After a hearing, the tribunal determined to take no action: DQU v University of New England [2020] NSWCATAD 226. For present purposes, the critical reasoning was at [119]-[121]: Finding On the information before the Tribunal and for the reasons set out above, I am satisfied that the SSVF authorises the University to undertake, as part of its admission processes for overseas students, a pre-student visa assessment of prospective overseas students so as to minimise its immigration risk that the courses for which [it] has offered admission and enrolment is not undersubscribed. I am also satisfied that the collection of personal information from a prospective overseas student for the purpose of a pre-visa assessment by the University is for a lawful purpose that is directly related to the functions of [the] University as set out in s 6(2)(c) and (g) of the UNE Act. Based on the requirements of Migration Regulations (see below), I make a similar finding in regard to the collection of the personal information about the family members and sponsor of the prospective overseas student.
6. Section 6(1) of the University of New England Act 1993 (NSW) states that the object of the University is "the promotion, within the limits of the University's resources, of scholarship, research, free inquiry, the interaction of research and teaching, and academic excellence". Paragraphs (c) and (g) of s 6(2) identify that principal functions of the University for the promotion of that object are: (c) the provision of courses of study or instruction across a range of fields, and the carrying out of research, to meet the needs of the community and (g) the development of governance, procedural rules, admission policies, financial arrangements and quality assurance processes that are underpinned by the values and goals referred to in the functions set out in this subsection, and that are sufficient to ensure the integrity of the University's academic programs.
7. Mr Norkin (but not his brother) sought leave to appeal to the Appeal Panel, which dismissed his application on 9 July 2021: DQV v University of New England [2021] NSWCATAP 208. Relevantly for present purposes, on the issue of whether the collection of personal information was for a lawful purpose that is directly related to a function or activity of the University, the Appeal Panel disagreed with both aspects of the reasoning of the Senior Member who constituted the Tribunal at first instance. The Appeal Panel said at [45]-[46]: The purpose of undertaking a pre-visa assessment is not, on its face, directly related to the University's function of providing a course of study within s 6(2)(c) of the UNE Act. It may be indirectly related to doing so, but that is not sufficient for s 8(1)(a) of the Privacy and Personal Information Protection Act. Nor is the purpose of undertaking a pre-visa assessment, on its face, directly related to the development of admission policies. The University's admission policies provide for the University to collect personal information for the purposes of assessing whether a prospective overseas student meets the "Genuine Student, Genuine Temporary Entrant and financial evidence requirements" (see web page headed "Admission Information" and "Postgraduate Admissions for International Students - Operating Procedure," which are annexed to the witness statement of Ingrid Elliston, Director of UNE International, filed on 18 March 2019). However, the University did not collect the personal information of sponsors such as the appellant in order to develop those policies; it collected that information in accordance with policies which had already been developed.
8. However, an appeal to the Appeal Panel only lay as of right on a question of law, although an appeal on all issues was available by leave: Civil and Administrative Tribunal Act 2013 (NSW), s 80. The Appeal Panel regarded that error as an error of fact, and formed the view that it was inappropriate to grant leave because it identified a different basis upon which there was compliance with s 8 of the Protection Act. It is best to reproduce the entirety of the reasoning ([49]-[52]) dealing with this aspect of the decision: Should leave to appeal be given? We consider that the Tribunal made an error of fact in concluding that the University's collection of personal information was directly related to its functions in s 6(2)(c) and (g) of the UNE Act. The appellant requires leave to appeal. The error we have identified does not necessarily mean that the University's collection of the appellant's personal information was not directly related to a function or activity of the University. In addition to the functions already identified, the University "has such general and ancillary functions as may be necessary or convenient for enabling or assisting the University to promote the object and interests of the University, or as may complement or be incidental to the promotion of the object and interests of the University" (UNE Act, s 6(3)(c)). The Tribunal was not asked to consider whether the purpose of collecting the appellant's personal information directly related to a general or ancillary function of the University. Further, an agency is permitted to collect personal information for a lawful purpose that is directly related to an activity of the agency (Privacy and Personal Information Protection Act, s 8(1)(a)). Whilst the University's "functions" are probably limited to those identified in s 6 of the UNE Act (including functions conferred or imposed on it by other Acts: s 6(3)(d)), the term "activity" is much broader. There was no dispute that one of the University's activities was undertaking pre-visa assessments for prospective overseas students. In these circumstances, there can be little doubt that the University collected the appellant's personal information for a purpose that was directly related to one of its activities (which could be characterised as undertaking pre-visa assessments or providing the results of those assessments to the Commonwealth). In considering whether to grant leave to appeal on this ground, we have had regard to the factors in Collins v Urban [2014] NSWCATAP 17 at [84], which are set out above. We have also had regard to the guiding principle for the NCAT Act, being "to facilitate the just, quick and cheap resolution of the real issues in the proceedings" (NCAT Act, s 36(1)). Given that there was no dispute that one of the University's activities was conducting pre-visa assessments and providing the outcome of those assessments to the Commonwealth, we are of the view that there would be little utility in granting leave to appeal on this ground. [Emphasis added.]

The reasons of the primary judge

1. As noted above, the primary judge dismissed Mr Norkin's further application for leave to appeal to the Supreme Court. That appeal was one which was confined to questions of law: Civil and Administrative Tribunal Act 2013 (NSW), s 83. His Honour regarded the Appeal Panel to have erred, insofar as it had determined that the Senior Member had made an error of fact in applying s 8: at [32]-[33]. His Honour, relying on Tarrant v Australian Securities and Investments Commission [2015] FCAFC 8; 317 ALR 328 at [100(e)], observed, correctly, that where the issue is whether the facts as found fall within a statutory question, there is ordinarily a question of law. But nothing turns on this. His Honour said at [33]-[34] (emphasis added): The question whether the University's collection of personal information fell within s 8 of the PPIP Act because it fell within s 6 of the UNE Act was a question of law, with the result that the plaintiff did not need leave to appeal to the Appeal Panel. However, the error made by the appeal panel in determining that the matter was a question of fact does not go anywhere, because the appeal panel dealt with the substance of the ground by finding that the data collection was "directly related to activity" of the University under s 8(1)(a) of the PPIP Act. They did so because they held, and it was not disputed, that one of the University's activities was conducting pre-visa assessments and providing the outcome of those assessments to the Commonwealth. In my opinion, that determination was correct, with the result that nothing is achieved by giving leave to the plaintiff to argue that the appeal panel's determination that there was only an error of fact and not one of law is futile.
2. His Honour thereafter addressed the issues arising under s 8, but principally in dealing with Mr Norkin's submission that he had been denied procedural fairness, a submission which was rejected. However, his Honour also recorded at [41] that "the plaintiff submitted that under s 8 of the PPIP Act, there are three elements that the agency needed to prove to justify collection of the information. Those three elements were said to be (1) collection for the (2) purpose, and (3) for the function or activity. The plaintiff submitted that the appeal panel confused the second and third of those elements". His Honour was of the view that no such error was disclosed, and that the Appeal Panel had expressed the terms of s 8 in a shorthand way: at [43].
3. The balance of his Honour's reasons addressed a series of discrete points advanced by Mr Norkin, concerning the rejection of his brother's claim (ground 3), "fundamental common law rights" (ground 4); "The SSVF's status and the need for its publication" (ground 4.1), and "[t]he appeal panel's use of precedent" (ground 6). It will not be necessary to address those aspects of his Honour's reasons.
4. Because the proceedings in this Court no longer include Mr Norkin's brother, the complaints concerning non-compliance with the Protection Act are considerably more confined than they had been at earlier stages in the litigation. Nevertheless, as part of the application process, Mr Norkin, as sponsor, was asked by the University to supply copies of his bank statement, annual income and statement from his employer and his passport. That information, together with a great deal more information pertaining to his brother, was said by the University to be required for its pre-assessment of a student visa which would be required in the event that it made an offer which was accepted by Mr Norkin's brother.

Anonymity

1. In the litigation summarised above, the names of Mr Norkin (sometimes) and his brother (invariably) have been anonymised. That appears to reflect a general practice in NCAT. In the hearing in this Court, the parties confirmed that there was no basis for the identities of Mr Norkin or his brother to be suppressed.

Applicable statutory regime

1. It was common ground that the University was a "public sector agency" for the purpose of the Protection Act. This comes about because the definition of public sector agency includes "an auditable entity within the meaning of the Government Sector Audit Act 1983", and an "auditable entity", as defined in s 4 of the latter statute includes a university, which includes the University established by s 4 of the University of New England Act 1993 (NSW). The University was thereby subject to the information protection principles in Part 2 of the Protection Act, including ss 8 and 10: 8 Collection of personal information for lawful purposes (1) A public sector agency must not collect personal information unless - (a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and (b) the collection of the information is reasonably necessary for that purpose. (2) A public sector agency must not collect personal information by any unlawful means. 10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following - (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information.
2. "Personal information" is defined in s 4 to mean, subject to certain exclusions, "information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion". It was not disputed that the University collected personal information from Mr Norkin and his brother when the application for admission as a postgraduate student was made.
3. In Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 at [20] Spigelman CJ, writing for this Court, identified a "clear bifurcation" between the information protection principles in ss 8-11, which applied to the collection of personal information, and those in ss 12-19, which applied to the holding of personal information. This appeal is concerned with the former.
4. The obligations in ss 8 and 10 (and the other information protection principles) do not give rise to any cause of action: s 69(1). Instead, the legislation creates its own sanctions. Without being exhaustive, s 21 provides that a public sector agency must not do anything, or engage in practice, which contravenes an information protection principle applying to the agency, and that any such contravention is conduct to which Part 5 applies. Section 53 (within Part 5) entitles a person who is aggrieved by a contravention of an information protection principle to a review, and if not satisfied by the review, s 55 (also within Part 5) confers a right of administrative review to NCAT. Amongst other remedies, damages to a maximum of $40,000, and orders in the nature of mandatory and prohibitory injunctions are available in appropriate cases.
5. Central to s 8(1)(a) and s 10(b) is the concept of the purposes for which the information is being collected. The legislation explicitly contemplates collection for multiple purposes. The exemption in s 8(1)(a) turns upon there being "a lawful purpose that is directly related to a function or activity of the agency", and the obligation to make individuals aware in s 10(b) extends to all of the purposes for which the information is collected.
6. There is a prohibition on the University collecting personal information except and to the extent that (a) and (b) of s 8(1) apply. I respectfully agree with the submission made by the amici that when the University chooses to collect personal information, it should have squarely in mind its purposes for doing so. That is because the University is doing something which is prohibited unless it falls within an exception, and in order to identify whether an exception is available, it is necessary to ask two questions: is there a lawful purpose for which the collection is occurring directly related to a function or activity, and is the collection reasonably necessary for that purpose. Neither question can be addressed without identifying the purpose. If the University does not attend to both questions, it runs the risk of doing something which is unlawful.
7. That is not an end to the obligations imposed upon the University, because s 10 imposes further obligations to take reasonable steps so as to make the person to whom the information relates aware of certain matters including the fact that the information has been collected, the purposes of doing so and the intended recipient.
8. That is to say, even if the collection of information is reasonably necessary for a lawful purpose which is directly related to a function or activity of the University, there will still be a contravention of the information protection principles if there are other undisclosed purposes of the collection. All of those purposes must be disclosed to the individuals whose personal information is being collected. That cannot occur unless the purposes have been identified at the time the information is collected.
9. The legislation gives little explicit guidance as to the specificity of the lawful purpose, or the identification of the function or activity. However, two points do emerge from the legislative text.
10. The first is that the relationship between the purpose and the function or activity must be one which is direct, as opposed to indirect.
11. The second is that there is a contrast between the purpose for which the information is collected, and the function or activity of the agency. The purpose is the end, or the objective or the goal in the furtherance of which the information is collected. As already noted, there may be more than one purpose. The function or activity is something that the agency does. If the purpose is conflated with the activity for the purpose of applying the section, then it is probable that something has gone awry with the characterisation of either the purpose or the activity.

The variety of purposes relied on by the University

1. Although the purposes should have been given careful attention at the time the personal information was collected, and indeed more squarely given Mr Norkin's complaint and subsequent administrative review, the written submissions of the amici pointed out, correctly, that the University identified its purpose in a variety of ways.
2. In (very) fine print in its initial conditional offer to Mr Norkin's brother, there was the following passage: Personal Information and Privacy UNE collects, manages, corrects and protects personal information relating to students in accordance with relevant State and Federal legislation. The personal information you provide to UNE will be used for the purpose you provided it, to assist the University in undertaking its primary purposes (outlined within the University of New England Act 1993 (NSW) and its associated By-laws) and any secondary purposes related to the primary purposes. … As an international student studying at UNE on a student visa, your personal details are collected during your admission and enrolment in order to meet UNE's obligations under the ESOS Framework and to ensure that you comply with the conditions of your Student Visa. The authority to collect this information is contained in the ESOS Framework.
3. The first paragraph is problematic for a number of reasons. From its heading it seems to be directed to compliance with the Protection Act but it is likely that the reference to the University's "primary purposes" and "secondary purposes" are mistakes. That is because the statute does not identify a primary purpose or a secondary purpose, but instead identified "principal functions" and "other functions" (in s 6(2) and (3)), and if read literally, the statement departs from the test in s 8. But separately from those points, the paragraph does not meaningfully make the reader aware of any purpose at all. It simply refers to the entirety of all "purposes" both primary and secondary, and says that information is collected for the purpose it was submitted and for any of the University's other purposes. That may be true, but it does not enlighten the person whose personal information is being collected who is entitled under s 10 to be told at the time the purposes for which it is being collected. A generic statement that identifies the entirety of the University's functions and activities and says that information is collected for those purposes falls short of achieving the object of s 10. If that were not so, then a statement such as that which appeared in the University's form would discharge this aspect of the disclosure obligation in s 10 in every case. There is no sound reason to construe a provision in legislation intended to permit persons whose personal information was being collected to make an informed choice in such a fashion.
4. The second paragraph is also problematic. The purpose of ensuring "that you comply with the conditions of your Student Visa" is not a purpose sought to be defended in the litigation subsequently. Nor was it said that the Education Services for Overseas Students was a source of authority for the collection of personal information.
5. In its initial submissions to NCAT, UNE said that its purpose was "in relation to the provision of facilities of courses of study, the conferring of degrees and the provision of teaching and learning … to local and international students". In its subsequent submissions, UNE said that its purpose was to "ensure" Mr Norkin's brother was a genuine temporary entrant as part of its functions in offering admission to an international student.
6. The formulation of purpose in the University's initial submissions to NCAT is too broad. It is to be borne in mind that in addition to enabling the University to comply with s 10, another reason for fully identifying the purposes is so that the University can comply with s 12(a), which provides that a public sector agency that holds personal information must ensure that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used. No issue concerning s 12 arose in this appeal. However, it is obviously important that a university which collects electronic scans of personal information, such as passports, securely destroy the information when it is no longer needed. It is far from clear that the risk of keeping data (or the exposure of a public sector agency to claims for loss in the event that the data is kept insecurely) is fully appreciated, despite the fact that the Protection Act is now a quarter of a century old. The articulation of a purpose at the level of generality of the provision of courses to students will lead to difficulties in the University establishing the requisite "direct relationship" and it will also not assist the University in complying with s 12.
7. On the other hand, the purpose of making an assessment of the likelihood that Mr Norkin's brother would satisfy the Genuine Temporary Entrant test is closely linked with its purpose of providing postgraduate courses to students on campus, which could only occur with respect to Mr Norkin's brother if he obtained a visa. That level of specificity of purpose also enables the University to comply with s 12. For it is clear that there will come a time when the information collected from Mr Norkin must be securely destroyed.
8. One point of the above is to observe that when the legislation is read as a whole, some guidance is given as to the level of generality with which a purpose is to be framed. Legislation is normally to be construed so that it produces a workable result, and since the purpose for collection is used to regulate what is disclosed at the time of collection, and the time when the information must be destroyed, as well as the ways in which it may be used (see s 17), those matters provide some guidance to the way in which purpose is to be formulated.

The conflation of purpose and activity

1. As the amici submitted, given the architecture of s 8 of the Protection Act, one might expect there to be a genuine difference between purpose on the one hand and function or activity on the other. The amici submitted that the Appeal Panel conflated the purpose and the activity. Mr Norkin seems to have made substantially the same point to the primary judge.
2. The Appeal Panel's reasons at [49]-[52] are reproduced in full at [25] of this judgment. In its reasons at [50], the Appeal Panel identified the general and ancillary functions for which s 6(3)(c) of the UNE Act made provision, and then observed that the Senior Member "was not asked to consider whether the purpose of collecting the appellant's personal information directly related to a general or ancillary function". At [51], the Appeal Panel affirmed that there could be little doubt that the University collected the appellant's personal information for a purpose which was directly related to one of its activities ("which could be characterised as undertaking pre-visa assessments or providing the results of those assessments to the Commonwealth"). As was indicated at the outset, the University advised this Court that the words in brackets were wrong in fact, a point to which I shall return. However, they also form part of an analysis which departs from the statute.
3. To reiterate, the collection of personal information is prima facie prohibited unless the University falls within an exception. In order to determine whether the exception in s 8(1) applies, it is necessary (among other things) to identify two things both of which are distinct from the collection of personal information itself. The first is the purpose of collecting the information. The second is the function or activity of the University to which the purpose relates. At no stage in its reasons at [50]-[51], which were dispositive of the application for leave, did the Appeal Panel identify a purpose for collecting Mr Norkin's information. Instead, as the amici submitted, it conflated the purpose of the collection of Mr Norkin's information with the collection itself, and then readily concluded that there was the requisite direct relationship with an ancillary activity of the University.

The University complied with s 8

1. Teaching postgraduate students is a central function and activity of the University: s 6(2)(c) and (f) of the UNE Act. A substantial aspect of that function and activity occurs face-to-face. To the extent that the students are not citizens or permanent residents of Australia, students cannot be taught face-to-face unless they have a student visa. The University is therefore required, as a matter of legal and practical reality, to engage with whether persons who might become overseas students will obtain a student visa.
2. The SSVF encourages universities to carry out their own inquiries as to the likelihood that applicants who might be made an offer of admission will be granted student visas. Those inquiries cannot take place without collecting personal information of the applicants and their sponsors. The purpose of collecting the personal information, namely, to inquire pursuant to the SSVF whether a potential candidate is likely to obtain a student visa, is closely related to the function or activity of teaching students. That is because it directly relates to an essential precondition of the potential student being able to be taught, namely, obtaining a student visa. I respectfully disagree with the reasons of the Appeal Panel at [45] which hold to the contrary.
3. However, I respectfully agree that the exception in s 8(1)(a) is not satisfied with respect to the function of developing admission policies. As the Appeal Panel rightly said, Mr Norkin's and his brother's personal information was not collected for the purpose of developing an admission policy, but in the application of a policy which had already been developed.
4. It is not necessary to express any concluded view on the metes and bounds of "directly related", and it is probably impossible to do so in the abstract. In any particular case, it will turn on the size and nature of the public sector agency, and the purpose of the collection. In each case a judgment needs to be made whether there is a direct, as opposed to indirect or tangential or incidental, relationship between a lawful purpose and one of the agency's activities or functions.
5. Mr Norkin submitted that the collection was not for a lawful purpose, because there was no legislative authority conferred upon the University to collect information. To that end, he emphasised that part of the SSVF operated without primary or secondary legislative backing, and he pointed to the absence of formal by-rules made by the University. He cited a passage from Wade and Forsyth, Administrative Law (7th ed, 1994) at 43 that "Any administrative act or order which is ultra vires or outside jurisdiction is void in law, ie, deprived of legal effect. This is because in order to be valid it needs statutory authorisation, and if it is not within the powers given by the Act it has no legal leg to stand on".
6. As the High Court observed in Taikato v The Queen (1996) 186 CLR 454 at 460; [1996] HCA 28, the meaning of "lawful purpose" depends on its context, and "[a]s a result, a 'lawful purpose' may mean a purpose not forbidden by law or not unlawful under the statute that enacts the term; or it can mean a purpose that is supported by a positive rule of law" (footnotes omitted). The High Court also said: As a general rule, interpreting "lawful purpose" in a legislative provision to mean a purpose that is not forbidden, rather than positively authorised, by law is the interpretation that best gives effect to the legislative purpose of the enactment. This is because statutes are interpreted in accordance with the presumption that Parliament does not take away existing rights unless it does so expressly or by necessary implication. Nevertheless, the purpose, context or subject matter of a legislative provision may indicate that Parliament has used the term "lawful purpose" to mean a purpose that is positively authorised by law. [footnote omitted]
7. There is no reason to depart from that "general rule" in construing the words "lawful purpose" in the Protection Act. That is for at least two reasons. The first is that s 8(1) is to be read with 8(2), and the latter prohibits collecting personal information "by any unlawful means". "Unlawful means" refers to the method of collection, as opposed to the purpose. Nonetheless, "unlawful" is read naturally as the opposite of "lawful" in the preceding subsection. "Unlawful" in s 8(2) means prohibited, and thus "lawful" is apt to mean something which is not prohibited.
8. The second is that there is no good reason to insist upon a separate statutory mandate to collect personal information, in order to comply with s 8(1). Section 8 is required to be applied to a wide range of public sector agencies. Some may be expected to have an elaborate and detailed statutory regime (such as local government authorities, statutory bodies representing the Crown and the NSW Police Force). However, others may operate with less legislative underpinning (such as "the office of a political office holder" and a Public Service agency).
9. That conclusion aligns with a body of decisions in NCAT: see ALZ v SafeWork NSW [2017] NSWCATAP 51 at [76]-[82] and WL v Randwick City Council [2007] NSWADTAP 58 at [45]-[47].
10. Those reasons resemble those given by the Senior Member. I am satisfied there was a direct relationship between the lawful purpose of determining the likelihood of prospective students obtaining a student visa and the function or activity of teaching overseas students.

Misapprehension of facts of the case

1. The University made these submissions in advance of the hearing: In Norkin at [8], Leeming JA and Basten AJA stated that the Commonwealth appears to have "delegated information collection powers, which it would otherwise exercise in order to determine visa eligibility", to the University. The Appeal Panel stated that the University's activities "could be characterised as undertaking pre-visa assessments or providing the results of those assessments to the Commonwealth": AP Decision [51]. The primary judge stated that the Appeal Panel "held, and it was not disputed, that one of the University's activities was conducting pre-visa assessments and providing the outcome of those assessments to the Commonwealth", and that determination was correct: J[33]-[34]. The University respectfully submits that this is not an accurate description of the arrangements, to the extent that it suggests the information is collected for the Commonwealth and provided to the Commonwealth. The University acknowledges that this was not a point that was properly clarified before either the Appeal Panel or the Court below. The error regarding the provision of results of assessments to the Commonwealth was also reflected in the internal review decision of the University dated 22 October 2018 which stated at [11]: Given that the assessment made by the Department of Home Affairs is based on the material it is provided with by or on behalf of the education provider and that it is not required to request further information if there are deficiencies in an application, it is imperative that all documentation that could possibly be required in relation to an Applicant is supplied to the Department at the time of lodgement. To the extent that this statement suggests that the University provides information received for the purpose of conducting a pre-visa assessment as part of its admission processes, that statement is incorrect. The University conducts pre-visa assessments as part of its admission processes for international students, as set out in its Postgraduate Admission for International Students - Operating Procedure: Tribunal Decision [111]. The University collects certain information during this process to satisfy itself that a student is likely to get a visa and, on that basis, the student can proceed further in the admission process: see [41]-[43]. The University engages an external consultant to undertake the pre-visa assessment: see Tribunal Decision [69]. However, the arrangements do not provide for the University to provide the outcome of pre-visa assessments to the Commonwealth, or otherwise share the information that it obtains as part of these pre-visa assessments with the Commonwealth. The information provided by an applicant or sponsor to the University as part of the pre-visa assessment, such as the Statement of Purpose, will be information that is also usually submitted to the Commonwealth as part of the separate visa application. However, that information is not supplied by the University to the Commonwealth. It is supplied by the visa applicant: see Tribunal Decision [50], [116]-[117]. Various provisions of the Migration Act, such as ss 45, 46, 52, 54, 55, 56, 57, 495 and 495A, and the Migration Regulations, such as reg 2.07, facilitate the collection of information by the Commonwealth for the purpose of assessing visa applications. Those powers have not been delegated to the University.
2. Mr Norkin did not squarely dispute the University's contention in the written submissions he filed in response, or in his oral submissions. The amici made no submission on the point.
3. Having reviewed the whole of the material, it is not established that the University itself provided any personal information to the Department of Home Affairs, even in the case where the University made a conditional offer to an applicant, and thus it became necessary for the applicant to obtain a student visa. On the facts of the particular case, where the University ended up rejecting the application sponsored by Mr Norkin, it is clear that the personal information was not supplied to the Department of Home Affairs. More importantly, there is nothing to suggest that the personal information was collected for the purpose potentially of supplying it to the Department if an offer had been made.
4. It is a little troubling that the errors in the decision in the Appeal Panel were not sought to be corrected before the primary judge. Mr Norkin sought leave to appeal, as was his right, from the decision of the Appeal Panel to the Supreme Court constituted by a judge sitting in the Common Law Division. The dispositive passage in the reasons of the Appeal Panel has been reproduced above. The reason that the Appeal Panel found that the collection of personal information by the University was "directly related" to a lawful purpose was that it was directly related to its activity of "undertaking pre-visa assessments or providing the results of those assessments to the Commonwealth". That was not contradicted in the lengthy affidavit filed by the University, which was silent on this point. Nor was it contradicted in oral submissions made by junior counsel who then appeared for the University (the written submissions were not included in the materials provided to this Court). In those circumstances, it was not surprising that the same erroneous finding was made by the primary judge.
5. The foregoing is not necessarily by way of criticism of the lawyers who settled the evidence, or junior counsel who appeared in the Common Law Division. The evidence adduced, and the submissions made, may have been a consequence of instructions. But whatever the reason, it is a matter of regret that the litigation has proceeded on what is now said to be (and I accept is) a material factual mistake.
6. The basis upon which Basten AJA and I identified a point of public importance and directed that there be an oral hearing was incorrect. It is a result which has been reached in part because of the way the University's evidence has been presented, and, especially, the stance taken by it before the Appeal Panel and in the Common Law Division. I shall return to this when dealing with orders.

Remaining submissions

1. Although that is sufficient to dispose of the appeal, I shall for completeness deal with three miscellaneous points, upon which Mr Norkin placed considerable emphasis in oral submissions, and an issue left unresolved by this appeal.
2. First, Mr Norkin was critical of a document on University letterhead described as "Postgraduate Admission for International Students: Operating Procedure". In particular paragraph 4 provided: Genuine Temporary Entrant (GTE) Assessment under Simplified Student Visa Framework (SSVF) UNE is required to ensure that all international students applying for a Student Visa under SSVF have the greatest chance of a successful visa grant. International applicants for a postgraduate program that present with a high risk Student Visa Profile must undergo additional assessment to determine they meet Ministerial Direction 69 - Genuine Temporary Entrant (GTE) (Migration Act 1958 - Section 499, Dated 2016) and have adequate evidence to show they have the financial capacity to fund their studies and living in Australia. Where an applicant meets academic and English language requirements but has a high risk Student Visa Profile, they will be issued with an Offer of Admission conditional upon undergoing additional GTE assessment. Where an applicant is working towards meeting either or both the academic and English requirements for admission, they will be issued with an Offer of Admission conditional upon meeting academic, English and GTE assessment requirements.
3. Mr Norkin submitted that the document was a rule, not a procedure, and that it was invalid because it had not been made in accordance with the UNE Act. The submission is only relevant because of Mr Norkin's submission that "lawful purpose" for the purposes of s 8 of the Protection Act is confined to a purpose which is authorised by primary or secondary legislation. That submission has been rejected above at [57]-[61]. The document is expressed to be an Operating Procedure. Mr Norkin is right that it has not been made so as to be a rule or by-law under the UNE Act but nothing turns on that.
4. Secondly, Mr Norkin submitted that the information collected from him occurred pursuant to procedures and guidelines which were in addition to the ordinary rules governing postgraduate admission to the University. That is undoubtedly true. His further submission was that the ordinary rules were exhaustive, and further that the procedures and guidelines were inconsistent with the entitlements created by the rules. I do not accept the submission, which turns on the proposition that the University's rules are an exhaustive statement of the prerequisites to admission. Plainly they are not. In particular, in the case of a foreign student it will also be necessary to obtain a student visa.
5. Thirdly, the Court reserved on the admissibility of a document titled "Ministerial submission", signed by the Minister for Immigration and Border Protection in November 2015, the subject of which was "Policy approval to amend the Migration Regulations 1994 to simplify the student visa framework". The document had not been tendered before the primary judge, however, Mr Norkin said that it had only recently been released following an application under the Freedom of Information Act 1982 (Cth). Mr Norkin's point was that part of the document stated that the SSVF was "intended to operate in policy rather than be formally legislated", and that that was wrong: The problem with this approach is if Minister has … right to issue an instrument, it should be under the act, the Migration Act give such right for the Minister, it should be done in form of delegated legislation and all these steps, that it went into Parliament, consultations and the sun setting and so forth, shall be [observed], but the Minister make a shortcut, they make secret policy and previously transparent or more or less transparent legislative regime been just repealed and changed to policy, and I submit it's illegal.
6. It is plain that the framework operates largely by policy. However, once again, there is no need to identify primary or secondary legislation in order for the University to fall within the "lawful purpose" exception in s 8(1) of the Protection Act. It follows that the document is not relevant, and therefore is not admissible: Evidence Act 1995 (NSW), s 56(2).
7. Finally, I have not overlooked the fact that Mr Norkin's personal information was supplied to the third party contractor, whose identity was not disclosed in the record. However, this was outside the scope of the appeal. Even Mr Norkin's amended notice of appeal with 12 proposed grounds makes no complaint about this. The materials make it plain that Mr Norkin was aware that the personal information was being provided to a third party contractor, although they do not state his, her or its identity. When the point was raised during the hearing, senior counsel said that the identity was not an issue in this proceeding, and Mr Norkin made no submission to the contrary. For that reason, the materials were not directed to establishing whether there had been compliance with s 10(c), or how the University complied with the obligations in s 12 to ensure that the information is kept no longer than necessary, is disposed of securely, and that "everything reasonably with the power of the agency" be done to prevent unauthorised use or disclosure of personal information provided to the third party. As it happened, Mr Norkin has brought separate proceedings directed to this: see Norkin v University of New England [2022] NSWCATAP 146, and nothing more need be said of these issues.

Orders

1. For those reasons, the decision made by Davies J was correct. Further, the matter identified as warranting a separate hearing, and the appointment of amici, does not arise. The application for leave to appeal should be dismissed.
2. The parties will have an opportunity to be heard as to costs, which will be determined on the papers. However, my present view is that this is a case to depart from the usual rule in r 42.1 of the Uniform Civil Procedure Rules 2005 (NSW), with the result that the University ought not obtain a favourable costs order. This hearing was brought about by an uncorrected error for which the University or its lawyers were responsible. If Mr Norkin had himself incurred recoverable costs, I would have been minded to consider an order that the University pay the costs of the hearing. However, as an unrepresented litigant, even one with a law degree, Mr Norkin is not entitled to recover any professional costs: Bell Lawyers Pty Ltd v Pentelow (2019) 269 CLR 333; [2019] HCA 29. Both parties may if they wish be heard further as to the exercise of the discretion as to costs (including as to the proper order for costs of the proceedings in the Common Law Division), by application made within the period specified by r 36.16 of the Uniform Civil Procedure Rules.
3. BASTEN AJA: I agree that the application for leave should be dismissed, for the reasons given by Leeming JA. My tentative view is that there should be no order as to costs in this Court. I would also entertain submissions as to the proper order in the Division, where Mr Norkin was ordered to pay the University's costs.
4. GRIFFITHS AJA: I agree with Leeming JA's reasons and with the orders he proposes.

DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 22 August 2023