Rana v Australian Information Commissioner [2023] FCAFC 17 | Case summary

Before the primary judge 7 The primary judge succinctly summarised the nature of the application before her Honour as follows: [1] Part V of the Privacy Act 1988 (Cth) deals with complaints and investigations about acts or practices that may interfere with a person's privacy. A person may complain to the Australian Information Commissioner (Commissioner) about an act or practice that may be an interference with their privacy (s 36), and if a complaint is made, the Commissioner is obliged to investigate it (s 40), except in certain circumstances (s 41). One of those circumstances is where the Commissioner is satisfied that an investigation, or further investigation, of the act or practice is not warranted having regard to all the circumstances (s 41(1)(da)). [2] In this case, the applicant, Mr Rana, made a complaint with the Commissioner relevantly about Yahoo!7 Pty Ltd (Yahoo) on 22 March 2017. Communications between Mr Rana and the office of the Commissioner proceeded for some years, during which time Mr Rana's complaint was augmented by the addition of another complaint about Yahoo. [3] On 29 March 2021 a delegate of the Commissioner declined to investigate the complaint, on the basis that she was satisfied that an investigation was not warranted, having regard to all the circumstances. Written reasons were provided. [4] Mr Rana seeks judicial review in this Court of the 29 March 2021 decision. 8 After reproducing s 41 of the Privacy Act and outlining the nature of judicial review provided for by s 5 of the ADJR Act and s 39B of the Judiciary Act, and referring to r 31.01(3) of the Federal Court Rules 2011 (Cth) dealing with such applications, her Honour set out the history of communications between Mr Rana and the Commissioner in some detail: see J[14]-[47]. 9 That complaint process, commencing with the complaint made by email on 22 March 2017 by Mr Rana to the OAIC about Yahoo, was described in some detail by her Honour, culminating with the decision made under s 41(1)(da) of the Privacy Act by the Commissioner's delegate on 29 March 2021 not to investigate the complaint against Yahoo any further. The final five paragraphs of that part of her Honour's reasons sufficiently identify the point that had been reached by the time of that decision, and illustrate why that decision was made: [43] On 10 December 2020 Carla Wolnizer, also an Investigations Officer with the OAIC, emailed Mr Rana relevantly stating: I write to provide an update regarding your complaint about Yahoo (CP17/00630). The two specific posts you have complained about, as confirmed in your emails to the OAIC of 17 May 2017 and 30 June 2020, are listed below: 1. [Janice Duffy blog URL reference] 2. [Nemesis Again website URL reference] On 21 May 2017, you stated that to resolve this matter, you would like URL 1 to be removed by Yahoo from appearing in its search results. From your correspondence dated 26 June 2020, it is unclear what outcome you are seeking in relation to URL 2. On 21 October 2019, Yahoo advised: Please note that effective from 30 June 2019, Microsoft/Bing provides the search indexing function for the Yahoo Australia search engine at https://au.search.yahoo.com. The mechanism for search (and the fact that we do not have access to the index) remains the same as before. … … The OAIC has conducted searches using the Yahoo search engine, and note that these URLs no longer appear in Yahoo search results. Further information sought and opportunity to withdraw - please respond by 17 December 2020 As URLs 1 and 2 no longer appear in Yahoo search results, please advise if you are comfortable that your complaint against Yahoo has been resolved, and wish to withdraw your complaint on that basis? If this is not the outcome you were seeking in relation to URL 2, please provide further information as to the outcome you seek in relation to URL 2. I would be grateful for a response to this email by 17 December 2020. [44] On 17 February 2021 a delegate of the Commissioner wrote to Mr Rana stating that it had considered his complaint against Yahoo relating to both URL 1 and URL 2 and had decided not to investigate it further because: • An investigation of the act or practice you have complained about is not warranted having regard to all the circumstances • You have not responded, within the period specified by the OAIC, to a request for information in relation to the complaint. [45] The letter included reasons for the decision. The letter also informed Mr Rana that he had an opportunity to comment before the delegate made a final decision. [46] Between 17 February 2021 and 25 February 2021, Mr Rana sent a number of communications to the OAIC. Their contents can be summarised as follows: (a) letter of 17 February 2021 to the OAIC, apparently in reply to its letter of that date, in which Mr Rana said that Yahoo had been acquired by Microsoft and that: The bottom line was that Yahoo search linked Dr. Janice Duffy's article on me, and Darda's blogs on Automattic Inc owned and operated [blog] WordPress, and Google owned and operated blog platform blogspot, which was again on me. Therefore, your analysis of the facts are not supported by correct facts. (b) email from Mr Rana to Verizon Media, copied to the OAIC dated 18 February 2021. The email is addressed to Verizon Media and does not relate to URL 1 or URL 2 which are the subject of the Yahoo complaint; (c) email from Mr Rana to the OAIC dated 18 February 2021 attaching screenshots of Yahoo search results for the search terms 'Ranjit Rana and Darda Gregurev' and Mr Rana's letter to the OAIC dated 17 February 2021. This correspondence appears to be in response to the OAIC's letter of 17 February 2021; (d) email to Microsoft Customer Support and the OAIC dated 23 February 2021, including various URLs that Mr Rana stated are 'specifically from the screen shots I send you earlier via Yahoo engine (search)', and included URL 1; (e) email to the OAIC and to Microsoft Customer Support dated 25 February 2021, forwarding undated screenshots of Yahoo search results for the search terms 'Ranjt Rana and Darda Gregurev', 'Ranjt Rana and Dr Janice Duffy' [the apparent misspelling of the applicant's name is in the source document search term] and a copy of a purported statement of claim naming respondents Google Inc, Automattic Inc, Dr Janice Duffy, Darda Gregurev and Nina Gregurev. The statement of claim did not extend to Yahoo. The screenshots provided displayed URLs including URL 1 and URL 2; (f) email to Microsoft Customer Support and the OAIC dated 25 February 2021 attaching undated screenshots of Yahoo search results for the search terms 'Ranjit Rana and Darda Gregurev', 'Ranjit Rana and Dr Janice Duffy' and the statement of claim. The screenshots provided displayed URLs including URL 1 and URL 2. [47] On 29 March 2021 the delegate wrote to Mr Rana referring to her letter of 17 February 2021 and Mr Rana's subsequent communications. The delegate said she took those communications into account, but determined not to investigate the complaint against Yahoo any further under s 41(1)(da) of the Privacy Act. 10 The primary judge summarised, and in key parts reproduced, the delegate's decision and reasons as follows (emphasis added to [54]-[55]): [48] The delegate described Mr Rana's privacy complaint against Yahoo as follows: You allege that Yahoo has interfered with your privacy by: • collecting your personal and sensitive information, appearing in a third party blog located at website [URL 1], without your consent • unlawfully using and disclosing this personal information about you, and • failing to take reasonable steps to ensure that the personal information it collected, used and disclosed about you, in this blog, was accurate. [49] The delegate also set out the steps that Mr Rana had indicated he wanted carried out in order to resolve the complaint: To resolve your complaint, you advised that you would like Yahoo to block URL 1 from appearing in Yahoo search results. You further allege that Yahoo has interfered with your privacy by: • collecting your personal and sensitive information, appearing on a third party blog located at website [URL 2], without your consent, and • unlawfully using and disclosing this personal information about you. To resolve your complaint, you advised that you would like this 'publication' to be 'remove'' by Yahoo. [50] The delegate noted that it had conducted preliminary inquiries into the complaint, and that it had also contacted Yahoo and had provided copies of Yahoo's responses to Mr Rana. The delegate set out that process as follows: In its response dated 8 February 2019, Yahoo submitted that: • Yahoo does not collect any personal information following a Yahoo search request, but rather it utilises a third party to provide Yahoo search results. • When a user enters a search term into the Yahoo search box, Yahoo delivers the term directly to the third party, and the third party provides the results to be displayed on Yahoo's search results pages. • Yahoo has no access to the index used by the third party. A copy of Yahoo's response was provided to you on 12 February 2019. On 21 October 2019, Yahoo advised the OAIC that: • Effective from 30 June 2019, Microsoft/Bing provides the search indexing function for the Yahoo Australia search engine at https://au.search.yahoo.com. • The mechanism for search (and the fact that Yahoo does not have access to the index) remains the same as before. A copy of Yahoo's response was provided to you on 10 December 2020 and 17 February 2021. [51] The delegate then set out her decision ('investigation not warranted having regard to all the circumstances'), and provided reasons as follows: According to Yahoo's submissions (outlined above), Microsoft/Bing provides the search indexing function for the Yahoo Australia search engine, and Yahoo does not have access to the search index. The OAIC has confirmed that your complaint against Microsoft (CP17/00631), which has been resolved, included both URL 1 and URL 2 from your complaint against Yahoo. As of today's date, the OAIC has conducted searches using the Yahoo search engine, and notes that URL 1 and URL 2 do not appear in Yahoo search results. URL 1 I note that: • In your email of 23 February 2021, you referred to a link to URL 1. • In your emails of 25 February 2021, you provided a screenshot of Yahoo search results for 'Ranjit Rana and Dr Janice Duffy,' which includes URL 1 in the search results. However, as mentioned above, the OAIC has today confirmed that URL 1 does not appear in Yahoo search results. Accordingly, in my view you have obtained the outcome you seek in relation to URL l. URL 2 In respect of URL 2, you stated that you would like this 'publication' to be 'removed' by Yahoo. As previously advised by the OAIC, the outcome you seek in relation to URL 2 is unclear. Your correspondence following the OAIC's letter dated 17 February 2021, including your letter dated 17 February 2021, did not respond to the OAIC's request for clarification. In your emails of 25 February 2021, you provided a screenshot of Yahoo search results for 'Ranjit Rana and Darda Gregurev,' which included URL 2 in the search results. However, as mentioned above, the OAIC has today confirmed that URL 2 does not appear in Yahoo search results. On that basis, if you were requesting that Yahoo take down URL 2 from Yahoo search results, then I consider that this outcome has been achieved. If you were requesting that Yahoo take down the publication accessible through URL 2, then I note that the publication accessible through URL 2 is held on a blogging platform, Wordpress, which is owned and hosted by a private company, Automattic. There is no evidence that Yahoo owns or operates the Wordpress blogging platform, or that it should be responsible for the collection, use or disclosure of personal information appearing in that blog. Other URLs and screenshots in your correspondence since the OAIC's letter dated 17 February 2021. The OAIC has reviewed your correspondence since the OAIC's letter dated 17 February 2021. In this correspondence, you provided several URLs and screenshots showing Yahoo search results. As stated above, and in the OAIC's correspondence to you dated 10 December 2020 and 17 February 2021, this complaint pertains to your allegations in relation to URL 1 and URL 2 only. The other URLs referred to in your correspondence, including in the screenshots of Yahoo search results you provided, are outside the scope of this complaint. Accordingly, I have not considered these other URLs in finalising this complaint. I suggest that you first complain to Yahoo in relation to these other URLs. [52] The reasons include attachments A and B. Attachment A lists relevant correspondence between 10 December 2020 and 25 February 2021. Attachment B provides more detailed comment as to the correspondence and attachments referred to at [46(b) to (f)] above. [53] In particular, the delegate noted that: (a) as to the 18 February 2021 email, the email was to Verizon and was not relevant to the complaint against Yahoo; (b) as to the 18 February 2021 email attaching undated Yahoo screenshots, the search terms 'Ranjit Rana and Darda Gregurev' had been utilised (rather than URL 1 and URL 2) and the correspondence also referred to different URLs, as addressed in the body of the reasons and that were outside the scope of the complaint; (c) as to the 23 February 2021 email to Microsoft Customer Support, there was a reference to URL 1, but that was addressed in the reasons (which noted URL 1 did not appear in searches of Yahoo as at the date of the decision and further, the complaint against Microsoft had been resolved, including by addressing URL 1 and URL 2); (d) as to the 25 February 2021 email forwarding documents to the OAIC and Microsoft Customer Support with undated screenshots and a statement of claim, again the searches were of terms not the subject of the complaint, and the statement of claim did not relate to Yahoo and so was not considered relevant, but were addressed in the reasons (which noted that neither URL 1 nor URL 2 appeared in the searches undertaken by the OAIC as at the date of the decision); (e) as to the 25 February 2021 email to Microsoft Customer Support and attached undated screenshots, again the searches were of terms not the subject of the complaint, and the statement of claim did not relate to Yahoo and so was not considered relevant, and were addressed in the reasons (which noted that neither URL 1 nor URL 2 appeared in the searches undertaken by the OAIC). [54] It can be said, therefore, that the delegate in considering the complaint against Yahoo distinguished between complaints against other entities, and also distinguished between searches of URL 1 and URL 2 and searches by way of other URLs and search terms. The delegate also took into account the undated screenshots that had been provided and accepted that some of those included references to URL 1 and URL 2, but observed that current searches by the OAIC using the Yahoo search engine did not reveal those URLs in the searches. [55] Importantly, therefore, the delegate reasoned on the materials before her at the date of the decision that Mr Rana had achieved the objective of his complaint, being to stop Yahoo searches of URL 1 and URL 2. The delegate also noted that Yahoo could not address some of Mr Rana's remaining concerns - for example, it was for the owners of the blogging platform website that was accessible via URL 2 to remove its content. Yahoo could not achieve that outcome. [56] These were the essential matters upon which the delegate's decision was based. 11 On appeal, Mr Rana takes issue with J[43] and J[51]-[56] reproduced above insofar as they refer to searches made by the OAIC using the Yahoo search engine producing the result that URL 2 no longer appears in Yahoo search results. In substance he takes issue with the adequacy of the searches that were conducted and contends that URL 2 could still be found using the Yahoo search engine both at the time of the delegate's decision and subsequently. At the appeal hearing, Mr Rana indicated that his concern was now confined to URL 2, because the webpage previously locatable using URL 1 had been deleted and was therefore no longer accessible online using Yahoo's search engine. 12 The primary judge characterised Mr Rana's judicial review application as relying upon two grounds, which her Honour paraphrased (at J[60]) as being allegations of: (a) an improper exercise of power because the delegate was said to have failed to take into account what were said to be the relevant considerations of his complaint about the Bing search engine, the agreement between him and Microsoft made in July 2020 that involved the "delisting" of certain websites and the improper implementation of the Microsoft agreement according to law, leading to an exercise of power in a way that was uncertain as URL 1 and URL 2 still appeared in Yahoo, MSN and Bing search engines; and (b) there being no evidence or other material that justified the making of the decision to decline further investigation into his complaint, that he had not been properly informed regarding developments between Yahoo and Bing, and that some websites remained active. 13 Immediately prior to the above summary of the grounds of review, the primary judge described the applicable principles raised by those grounds as follows: Where decision maker must be satisfied [57] Pursuant to s 41(1)(da), it was open to the delegate, as the decision maker, to decide not to investigate, or not to investigate further, the act or practice the subject of Mr Rana's complaint if she was satisfied that an investigation, or further investigation, of the act or practice was not warranted having regard to all the circumstances. [58] The statute does not purport to prescribe the matters to which the decision maker must have regard in assessing whether the state of satisfaction is reached. The reference to 'all the circumstances' indicates the breadth of the matters which a decision maker may take into account. The question whether the decision maker is required to take specific considerations into account is determined by implication from the subject matter, scope and purpose of the Act. However, if there are errors in the process by which a state of satisfaction is reached, such as by considering extraneous or irrelevant considerations or by excluding relevant considerations, it may be that the state of mind has not been reached in the manner required by the statute. The requisite state of mind should be one which has been formed logically and rationally upon findings of fact. Further, even if it cannot be detected that an error has occurred in the application of law or consideration of the relevant matters, if the conclusion is one which is wholly unreasonable, it can, nevertheless, be inferred that error has occurred. Such principles are well recognised: Minister for Aboriginal Affairs v Peko-Wallsend Ltd (1986) 162 CLR 24 at 39-40 (Mason J); and Avon Downs Pty Ltd v Commissioner of Taxation (1949) 78 CLR 353 at 360 (Dixon J). Failure to take into account 'relevant consideration' [59] Having regard to the nature of some of Mr Rana's grounds in this review application (particularly ground 1(a)), in addition to Peko-Wallsend can usefully be added the observations of McColl JA in Wattie v Industrial Relations Secretary on behalf of the Secretary of the Department of Justice (No 2) [2018] NSWCA 124 at [138] (Emmett AJA to similar effect and Macfarlan JA agreeing): [138] … [T]he fact that failure to take a relevant consideration into account in the exercise of a power is a ground of judicial review, does not, however, mean 'that a party affected by a decision is entitled to make an exhaustive list of all the matters which the decision maker might conceivably regard as relevant and then attack the decision on the ground that a particular one of them was not specifically taken into account.' 'The fact that [a party] chooses to refer to particular matters does not convert them into relevant considerations in the administrative law sense from which other consequences might flow. That is determined by reference to the statute.' [139] That does not mean parties may not point to matters they contend were required to be taken into consideration. Nevertheless, even taking such submissions into account, where relevant considerations are not specified, 'it is largely for the decision maker … to determine which matters the decision maker regards as relevant and the comparative importance to be accorded to such matters.' (citations omitted) 14 On appeal, Mr Rana originally alleged that the principles identified above by the primary judge were not the correct principles to apply on the facts he asserts in relation to the aspects of the delegate's decision identified at [12(a)] above, as summarised below at [16(a)-(c)], being the burden of his first appeal ground. However, that point and that appeal ground was not pressed because that appeal ground related only to URL 1, and as noted above, at the appeal hearing, Mr Rana indicated that his concern was now confined to URL 2. 15 Before turning to those grounds of review, the primary judge, at J[61]-[68], made preliminary observations concerning the decision that the delegate was called upon to make, including that the complaint in question was made against Yahoo, not against any other entity, as is apparent from the terms of s 36(5) of the Privacy Act which, as noted above, obliges a complainant to specify the respondent to the complaint. Her Honour's reasons reveal that the Commissioner's Office had, entirely sensibly and properly, given separate complaint numbers to the complaint made against each separate entity, and that Mr Rana had made complaints against 26 separate entities, with separate explanations having been given as to why each had been declined or closed. 16 The primary judge considered each ground of review, and rejected them. Her Honour: (a) was not persuaded that the delegate was obliged to have regard to the complaint against Bing in considering the complaint against Yahoo, and accordingly was not satisfied that the delegate erred in this regard: J[69]-[73]; (b) was not satisfied that the delegate failed to have regard to the July 2020 agreement between him and Microsoft: see J[74]-[80]; (c) did not consider the delegate was obliged to take into account or refer to compliance by Microsoft with that agreement in determining the complaint with respect to Yahoo, finding this was not materially relevant to Yahoo's own conduct, and separately Mr Rana had courses open to him against Microsoft as a party to the Microsoft agreement in the event of non-compliance: J[81]-[82]; (d) found there was no uncertainty about the delegate's decision, noting that the fact that there may be other courses open that reveal the relevant URLs in internet searches does not mean that the decision relating to Yahoo was relevantly uncertain: J[83]-[87]; (e) was not satisfied that there was an absence of relevant and probative evidence upon which the delegate could logically reach the requisite state of satisfaction for the purposes of s 41(1)(da) of the Privacy Act, further noting that this was not in the rare and exceptional category of cases in which any further inquiry was required. 17 The primary judge also recorded the assistance given to her Honour by the Commissioner, given Mr Rana was unrepresented, in trying to identify any other possible error that Mr Rana might have been intending to advance. Her Honour concluded that the evidence did not establish any denial of procedural fairness or any failure to comply with procedures applicable to the exercise of the power exercised by the delegate: J[97]-[103]. 18 Finally, the primary judge considered Mr Rana's submissions in a holistic way, addressing the themes that had been raised in his five sets of submissions, and finding that nothing in them persuaded her Honour that any of the errors asserted in the grounds of review had been established: J[104]-[106].

No Evidence Ground 21 Mr Rana appeared on the face of this appeal ground to be contending that the delegate had an obligation to disclose the key search words used by the OAIC when using the Yahoo search engine and to raise issues about how more effective use might have been made of any search terms that were used. If the complaint was confined in this way, it had a problem with him being on notice of the searches that had been carried out on 17 February 2021, and not having sought those search terms before they were used again on 29 March 2021 as a final check before deciding not to continue the investigation against Yahoo on the basis that he had obtained the remedy he was seeking by the complaint. However, with the assistance of counsel for the Commissioner, especially by reference to the grounds of review and the numerous written submissions furnished by Mr Rana to her Honour (no oral hearing having taken place at his election), it became apparent that his real complaint was that the conclusion reached that (relevantly) URL 2 was not able to be accessed using the Yahoo search engine was not supported by evidence because searches carried out by the OAIC on 29 March 2021, the date of the decision, were inadequate and because, Mr Rana contended, URL 2 could in fact still be found using the Yahoo search engine. 22 Mr Rana apparently accepted that this ground of appeal was accurately articulated by the Commissioner, whether characterised as a true no evidence ground, or as some kind of denial of procedural fairness in relation to the searches that had been done, or otherwise. That is, the substance of the complaint is that the delegate's conclusion that URL 2 no longer appeared in Yahoo search results as being the essential reason for finding that the continuation of the investigation of the complaint made against Yahoo was not warranted, was vitiated in some way because URL 2 continued to appear in such Yahoo search results. 23 Mr Rana contended that Yahoo had not prevented URL 2 being accessed using its search engine, so that Mr Rana's complaint still needed to be investigated. Mr Rana endeavoured to demonstrate that the searches conducted by the OAIC on 29 March 2021 could not have been adequate for the conclusion reached about the Yahoo search engine not giving access to URL 2 by reference to material that was in the appeal book and before the primary judge, without success. He was able to point to a few such searches prior to 29 March 2021 (noting that the actions of Yahoo in removing access to a given URL usually take up to 30 days to take effect), and numerous URLs that were similar to, but not the same as, URL 2 after 29 March 2021. However, he was not able to prove accessibility to URL 2 via the Yahoo search engine at any time on or after 29 March 2021 on the evidence that was before the primary judge and before this Court on appeal. 24 The material before the primary judge did show that the webpage locatable at URL2 was also locatable by use of different URLs which were included in Yahoo search results conducted before and after the delegate's decision. However, it was not to the point that the offending information might be accessed via another URL, because Mr Rana's complaint to the OAIC was confined to URL 2. Mr Rana was therefore unable to demonstrate, on the way he advanced his case, and before considering whether this would in any event amount to a vitiating error (which is doubtful), that additional or different searches using the Yahoo search engine on or after 29 March 2021, and in evidence before her Honour, proved that any use of the Yahoo search engine at or after that time would specifically include URL 2 among the search results. 25 Mr Rana therefore was unable to demonstrate that URL 2 would have been found by the use of the Yahoo search engine on 29 March 2021 had other search terms been used by the OAIC, including those he had suggested in correspondence. It therefore followed that he was unable to show the first step he relied upon to establish error on the part of the delegate and thereby on the part of the primary judge, by showing that there was no evidence for the conclusion reached by the delegate that, as of the date of the decision not to continue investigating the complaint against Yahoo, URL 2 did not appear in Yahoo search results. It follows that Mr Rana was also unable to show any related denial of procedural fairness or any other vitiating error on the part of the delegate. For completeness, it should be noted that additional searches apparently conducted by Mr Rana and annexed to his written submissions, even if admissible and admitted on the appeal despite not having been before the primary judge, would not have supported any different conclusion. 26 There was no error on the part of the primary judge in noting at [54] that the delegate observed that current searches by the OAIC using the Yahoo search engine did not reveal URL 2, nor in noting at [55] that the delegate reasoned on the materials before her on 29 March 2021 that Mr Rana had achieved the objective of his complaint of stopping Yahoo search results that included URL 2. Her Honour also correctly observed that the delegate had noted that Yahoo could not address some of Mr Rana's remaining concerns, such as that it was for the owners of the blogging platform website that was accessible via URL 2 to remove its content and Yahoo could not achieve that outcome. 27 No error on the part of the primary judge has been established. It follows that this ground of appeal must fail.

Rana v Australian Information Commissioner

At a glance

Court

Decision date

Before

Source

Judgment (8 paragraphs)

Parties

Legislation Cited (4)

Cases Cited (4)

Cited By (1)