Saffari v Australian Information Commissioner

The Privacy Act complaints scheme 6 The centrepiece of the Privacy Act is a set of 13 principles called the Australian Privacy Principles (APPs), set out in Schedule 1. They range from principles concerning the open and transparent management of personal information (APP 1) through to the correction of personal information (APP 13). APP 6 deals with the use or disclosure of personal information. 7 The following provisions are relevant to this proceeding: (a) s 6 provides that APP entity means "an agency or organisation"; (b) s 13(1) provides that: An act or practice of an APP entity is an interference with the privacy of an individual if: (a) the act or practice breaches an Australian Privacy Principle in relation to personal information about the individual; or (b) the act or practice breaches a registered APP code that binds the entity in relation to personal information about the individual. (c) s 36(1) provides that a person may complain to the Commissioner about an "act or practice that may be an interference with" their privacy; (d) s 40(1) provides: Subject to subsection (1A), the Commissioner shall investigate an act or practice if: (a) the act or practice may be an interference with the privacy of an individual; and (b) a complaint about the act or practice has been made under section 36. (e) s 40A(1) provides that if a complaint is made about an act or practice under s 36 and the Commissioner considers it is "reasonably possible that the complaint may be conciliated successfully", the Commissioner must make "a reasonable attempt to conciliate the complaint"; (f) s 52(1) relevantly provides that after investigating a complaint, the Commissioner may, inter alia, per (b)(i) make a declaration that a respondent "has engaged in conduct constituting an interference with the privacy of an individual and must not repeat or continue such conduct" and per (b)(ii) make a declaration that the respondent "must perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant".

Background 8 In June 2017, Mr Saffari published a book written by him in paperback format via an Amazon-owned subsidiary that provided a self-publishing service. That service was eventually migrated into Kindle Direct Publishing (KDP), provided by Amazon (or one of the Amazon group of companies). A short time later, Mr Saffari, via KDP, published his book in eBook format. Upon enrolling for the KDP service, Mr Saffari provided his name and email address, among other personal information. Several months later, Mr Saffari published his book in paperback via KDP. Each of the three iterations of the book were published by Mr Saffari using "Anonymous" as the author name. Mr Saffari can fairly be characterised as an intensely private person, who did not want his identity as the author of his book to be disclosed to anyone. 9 Later that year, a third party person complained to Amazon, alleging that Mr Saffari's book contained defamatory material, as well as material that was in contempt of court, and advised that the matter had been referred to the Australian Federal Police and requested that any future copies of the book delete references to those matters. In the first quarter of 2018, Amazon gathered additional information from the third party and reviewed the book against its content guidelines, determining that the book breached those guidelines. In March 2018, Amazon suspended sales of the book and removed it from its store. It communicated with the third party to advise that it was in the process of removing the KDP eBook from sale on all Amazon sites. In that communication, Amazon also disclosed Mr Saffari's name and email address. 10 The next day, Amazon advised Mr Saffari that it had received a notice from a third party claiming the book contained defamatory information and advised him that it had suspended the book from sales and provided his name and email address to the third party. A few days later, Mr Saffari complained to Amazon. Amazon responded to that complaint later in March 2018 and in early April 2018. Being dissatisfied with Amazon's response, in May 2018 Mr Saffari made a complaint to Office of the Australian Information Commissioner (OAIC). On 26 November 2019, after undertaking preliminary inquiries under s 42(2) of the Privacy Act, a delegate of the Commissioner decided not to investigate the complaint under s 41(1)(a) on the basis that Amazon had not interfered with Mr Saffari's privacy. 11 On 26 November 2019, Mr Saffari applied to this Court for a review of the delegate's decision. On 6 March 2020, I made orders by consent, setting aside the delegate's decision and remitting it back to the Commissioner for reconsideration. For reasons that have never been satisfactorily explained to me, the OAIC did nothing substantive with the remitted complaint by Mr Saffari for over a year. It was only when Mr Saffari sought to bring contempt proceedings in March 2021 that, on 5 May 2021, the remitted complaint was scheduled for a conciliation teleconference. 12 On 25 May 2021, the Commissioner's delegate notified Mr Saffari and Amazon of the view under s 40A(3) of the Privacy Act that there was no reasonable likelihood that the remitted complaint would be resolved by conciliation. On 10 June 2021, by letter dated 8 June 2021, a delegate of the Commissioner provided Mr Saffari and Amazon with notice that the acts and practices alleged in the complaint were to be investigated under s 40(1) of the Privacy Act. 13 On 20 July 2021, the Deputy Commissioner provided to Mr Saffari and to Amazon a detailed written indication of how the complaint might be dealt with by way of a detailed document called a Preliminary View. She made a preliminary finding that Amazon had interfered with Mr Saffari's privacy by disclosing his personal information to the third party in breach of APP 6 and advised of preliminary recommendations, namely to recommend the Commissioner make declarations that Amazon had engaged in conduct constituting an interference with the privacy of Mr Saffari and must not repeat or continue the conduct; and that Amazon must, within 30 days, issue a written apology to the complainant, acknowledging the privacy breach. The Deputy Commissioner was "minded" to allow Amazon the discretion as to the appropriate person to give the apology, and indicated an intention to recommend that the Commissioner not award compensation to Mr Saffari in the circumstances. 14 Following consideration of the Preliminary View, the Commissioner decided to make a determination in this matter because she formed the view that there was evidence to establish an interference with privacy on the balance of probabilities and the Mr Saffari and Amazon could not resolve the matter through conciliation or through settlement discussions. The Commissioner noted that Mr Saffari and Amazon each had the opportunity to comment on the Preliminary View and an opportunity to comment on each other's submissions, finding that there were no evidentiary matters that necessitated oral evidence. 15 The Commissioner found that Amazon interfered with Mr Saffari's privacy as defined in the Privacy Act by disclosing his personal information to a third party in breach of Australian Privacy Principle 6 and declared, under s 52(1)(b)(i)(A) of the Privacy Act, that Amazon had engaged in conduct constituting an interference with the privacy of Mr Saffari and must not repeat or continue that act and must, within 60 days of Mr Saffari notifying it of his banking details, pay him $3,000 for non-economic loss. 16 On the topic of an apology, the Commissioner said in the Decision: Reasonable act of redress - Apology [142] Under s 52(1)(b)(ii), I may make a declaration that the respondent must perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant. [143] The complainant initially asked for an apology. Where a complainant asks for an apology and the respondent is willing to give one, this can be a meaningful I way to provide redress for the privacy breach. A declaration may assist in respect of the timing and means of an apology being provided. [144] The preliminary view expressed the view that an apology appeared to be appropriate and that the respondent may decide upon the most appropriate person from whom the apology may be provided. The complainant took issue with the latter aspect, but did not put forward an appropriate person or appropriate officer.85 The respondent has put forward submissions as to why it does not consider an apology appropriate.86 [145] In these circumstances, I do not consider it appropriate to declare that the respondent provide the complainant with an apology. 85 C5.1 - Letter from the complainant to the OAIC dated 26 July 2021 pp 5-6 [16]. 86 R2.1 - Letter from the respondent to the OAIC dated 10 August 2021 p 4 [2.1]-[2.5]. 17 The letter from Mr Saffari referred to at footnote 85 of the Commissioner's decision dated 26 July 2021 above was his initial response to the Preliminary View. He said in that letter at [16] (verbatim): Your Declaration that Amazon must apologies could have brought a degree of satisfaction, but you even manage to demean the apology by qualifying it; and also how will that forced apology undo the damage? a) Apologies need to be more than mere platitudes. b) In your recommendation you state"/ am minded to allow the Respondent the discretion as to the appropriate person to give an apology'. c) You belittle the apology by giving Amazon the option to issue a meaningless apology by a front desk receptionist, or the night janitor. (i) Something is fundamentally wrong with OAIC culture and attitude. 18 The letter dated 10 August 2021 referred to at footnote 86 of the Commissioner's decision above was from Amazon's solicitors in response to the Preliminary View. A good deal of that letter was directed to an ultimately unsuccessful submission that there had not been any conduct constituting an interference with the privacy of Mr Saffari having regard to the terms of APP 6, a point that is not in issue in this proceeding. The letter then addressed the proposed remedy of an apology. In short, Amazon accepted that as a general rule apologies were important and may in some circumstances be restorative, but argued against that course in this case having regard to the contents of the book. He formed the view that any apology may not necessarily achieve the objective of rectification and restoration, having regard to the terms of [16] of Mr Saffari's submission reproduced in the preceding paragraph, and that a written apology might be used by Mr Saffari for purposes other than rectification or restoration, referring to separate legal proceedings between him and Amazon.com, Inc, the Amazon parent company. The letter concluded by stating: [2.6] Should the Preliminary View remain, notwithstanding the above, Amazon submits that such an apology be limited to the following wording: Amazon acknowledges that in the course responding to a valid third party complaint in relation to your book [title redacted], Amazon provided your email address and name to the third party. Amazon regrets that this disclosure interfered with your expectation of privacy. 19 Mr Saffari responded to Amazon's submission above by a letter dated 16 August 2021. The date at the top of the first page in error had the month "July", but the conclusion had the August date beneath Mr Saffari's signature, and it was attached to an email sent by him on 16 August 2021. That letter said on the topic of an apology: [12] Amazon has accepted "the importance of apologies as potentially assisting in rectifying a complainant's feelings of embarrassment and distress". That, in this case, is understated. [13] Amazon is also trying to build on the Preliminary View that "anyone" at Amazon can apologize to me, by asking OAIC to further water down the apology while dictating its contents verbatim. a) That I may use the apology in any future legal action is irrelevant to this proceeding. [14] Therefore, I place on record that I will end all matters with the OAIC if one (1) of the following decisions is made, a Sincere Apology or Appropriate Compensation: a) An Official Admission of Guilt and Apology directly from Jeffrey Bezos (Amazon Chief Executive and the entity ultimately vicariously liable at relevant time). Or b) Compensation in the amount of $9,000 for Pecuniary Loss, $45,000 for Non-Pecuniary Loss and $120,000 for Aggravated Damages. [15] Amazon's dictated apology is as follows: "Amazon acknowledges that in the course (sic) responding to a valid third party complaint in relation to your book [name redacted], Amazon provided your email address and name to the third party. Amazon regrets that this disclosure interfered with your expectation of privacy." [16] My suggestion for an apology is as follows: ...... for myself and on behalf of Amazon please accept my apology. Amazon acknowledges that in the course of responding to a third party complaint in relation to certain facts stated in your self-published Book sold by Amazon, Amazon provided your private information to the third party. Amazon apologizes that this disclosure interfered with your privacy in contravention of the Australian Privacy Act 1988. Jeffrey Preston Bezos 20 While the 16 August 2021 letter from Mr Saffari was not referred to in the part of the Decision at [142]-[145] dealing with the issue of an apology (reproduced above), or in the footnotes to those paragraphs, earlier in the Decision in the first sentence of [112] it was stated "The complainant seeks compensation in the amount of $9,000 for economic loss, $45,000 for non-economic loss and $120,000 for aggravated damages." That sentence had a footnote "C6.1 p 3 [14]". As reproduced above, [14(b)] of the 16 August 2021 letter reproduced above states "Compensation in the amount of $9,000 for Pecuniary Loss, $45,000 for Non-Pecuniary Loss and $120,000 for Aggravated Damages." While Mr Saffari had also referred to these amounts in an earlier letter dated 19 July 2021 by stating at [23] "I ask the OAIC to order Amazon to pay compensation of $9,000 for expenses incurred, $45,000 for non-economical loss and $120,000 for aggravated damages". 21 I am comfortably satisfied that it is the later repetition of those amounts in the 16 August 2021 letter that is being referred to by the Commissioner at [112] of the Decision, rather than the earlier reference in the 19 July 2021 letter. That is because: (a) the paragraph reference [14] is correct for the 16 August 2021 letter, rather than [23] for the 19 July 2021 letter; (b) the 19 July 2021 letter is listed in Attachment B to the Preliminary View as "C4" as the last document provided by Mr Saffari before the 20 July 2021 date of that document, whereas both the 26 July 2021 letter and the 16 August 2021 post-date the Preliminary view, so would have been given a designation greater than "C4"; and (c) Mr Saffari's 26 July 2021 letter is expressly referred to by the footnote to [112] as "C5.1", enabling me to infer that Mr Saffari's 16 August 2021 letter was "C6.1", making the 16 August 2021 letter the one that was referenced by the footnote to [112] of the Decision. 22 It follows that Mr Saffari's 16 August 2021 letter was expressly referred to in relation to the damages he was seeking, but was not expressly referred to in relation to the apology he was seeking. An important issue is whether, despite the absence of that express reference at the late point, the 16 August 2021 letter was nonetheless considered in relation to the issue of the apology, and if it was not, whether such a failure constitutes an error of law on the part of the Commissioner as Mr Saffari alleges. 23 The hearing was largely conducted by reference to the Commissioner's written submissions to which Mr Saffari directed his oral submissions, and the contents of parts of the FAOA, which in parts were expressed more in the manner of a submission than a pleading.

The decision not to require Amazon to apologise 24 Mr Saffari challenges the aspect of the Decision by which the Commissioner decided not to order Amazon to apologise upon the basis that she: (a) failed to consider his submission on this topic contained in his 16 August 2021 letter at [12]-[16], reproduced above, which he characterises as a mandatory relevant consideration; and (b) took into account Amazon's submission contained in its 10 August 2021 in relation to the aspect referring to separate litigation between him and the Amazon parent company as being a reason not to order an apology, characterising that as forbidden irrelevant consideration. 25 Mr Saffari did not advance any substantive argument as to why considering his submission in his 16 August 2021 letter was mandated by necessary implication from the terms of the Privacy Act going beyond the general obligation to consider a submission of substance. The Commissioner was not under any mandatory obligation to consider the 16 August 2021 letter. She only needed to consider it to the extent that it was a submission of substance on a determinative issue. 26 Nor did Mr Saffari advance any substantive arguments as to why considering the Amazon's 10 August 2021 letter was forbidden by the Privacy Act going beyond outer limit concepts such as legal unreasonableness. The Commissioner was not prohibited from considering Amazon's 10 August 2021 letter. 27 The Commissioner's primary argument is that: (a) the submission as to the apology in the 16 August 2021 letter from Mr Saffari was taken into account; and (b) the arguments as to the apology referring to the separate litigation between Mr Saffari and the Amazon parent company referred to in the 10 August 2021 letter from Amazon's solicitors was not taken into account in the sense of being shown to have formed any part of the reason for the decision not to order an apology. 28 The Commissioner's alternative arguments are to the effect that the even if the 16 August 2021 letter was not taken into account, the submission that the letter was not of such significance that it was required to be taken into account. Accordingly, there was nothing wrong with taking into account the submission in the 10 August 2021 letter. 29 Mr Saffari's argument as to why his 16 August 2021 submission on the apology was not taken into account is that the parts of the Decision dealing with this issue at [142]-[145] make no express reference to it, such that it must have been overlooked. In the copy of his speaking notes furnished after the hearing to assist the Court, he supports this argument by referring to the reasons as a whole and the absence of any express reference to his letter (qualified only by the reference in the footnote to the first sentence of [112] of the Decision). He submits that there is a realistic possibility that the Commissioner could have made a different decision had the 16 August 2021 submission on the apology been taken into account. 30 The Commissioner counters as follows: (a) The Determinations Assistant at the OAIC provided a copy of the 16 August 2021 submission to Amazon by email on 18 August 2021, advising that the matter would now proceed to determination. (b) The Commissioner at [31] of the Decision states that in making the determination, she had considered the information and submissions provided by the parties. I note that this general reference may clearly be taken to include the 16 August 2021 submission because the letter was given an identifier, "C6.1", as cited in the footnote to the first sentence of [112] of the Decision. (c) The letter was expressly referred to at [112] of the Decision in terms that meant that the Commissioner must have considered one of the paragraphs that Mr Saffari says was not considered, namely [14] of the letter, albeit at a part of the Decision that was addressing the issue of damages. (d) In any event, the 16 August 2021 submission did not meet the threshold of being of substance in the sense described in DNA17 v Minister for Immigration and Border Protection [2019] FCAFC 146 at [54]. The Full Court in DNA17 said that an argument is only substantial if it is it is capable of altering the decision. This observation followed the Court quoting Applicant WAEE v Minister for Immigration and Multicultural and Indigenous Affairs [2003] FCAFC 184; 236 FCR 593 at [46] and [47] about there being no need to refer to every piece of evidence and every contention in the reasons given, that it may not be necessary to make a finding on an issue if it is subsumed in another finding, and it not being too readily inferred that something not being expressly referred to meant it was not addressed. The Court quoted like authority on the need for a submission to be substantial and clearly articulated before it had to be considered. The Commissioner submits that the additional aspects of the submission in the 16 August 2021 letter were not capable of altering the decision not to require Amazon to give an apology when regard is had to the reasoning deployed by the Commissioner at [143]-[145] because it is clear that the determinative reasoning turned on the unwillingness of Amazon to give an apology, not the reasons for that unwillingness. (e) The Decision at [143] in any event suggests that the Commissioner was not prepared to go further than to facilitate an apology that Amazon was willing to give. (f) The conclusion at [144] of the Decision, that Mr Saffari had not put forward an appropriate person or appropriate officer to give the apology, was consistent with him maintaining in his 16 August 2021 letter that the then CEO of the Amazon parent company, Mr Jeffrey Bezos, personally make an official admission of guilt and apology (or alternatively Amazon pay compensation totalling $174,000). (g) Even if there was any error in stating that Mr Saffari did not put forward an appropriate person or appropriate officer to give the apology, that was an ordinary error in fact finding, and did not go to jurisdiction or amount to any legal error. (h) Even if there had been a legal error, it was not reviewable because it was not material, because the basis for the Commissioner's decision was the unwillingness of Amazon to give an apology, such that the error could not have made any difference. 31 I am satisfied that the Commissioner did have regard to Mr Saffari's 16 August 2021 letter, having expressly referred to it, and in particular, to the portion dealing with the apology. The fact that the Commissioner did not refer to the letter in the apology portion of the reasons reflects the unwillingness of Amazon to give an apology being regarded by the Commissioner as being determinative. It is not to the point that this opposition was tempered in the 10 August 2021 letter from Amazon's solicitors by words that it suggested might be deployed if its opposition was overridden in the Commissioner's decision. A decision-maker is not obliged to refer expressly in the reasons that are given to material that was not considered to be of assistance in resolving the issue at hand. The submissions as to the making of an apology at most had to be considered, not necessarily deployed. 32 I am in any event satisfied that the submission as to an apology in the 16 August 2021 letter was not of substance in the sense that it was capable of making any difference. Fairly read, the Commissioner was not willing to impose a requirement on Amazon to give an apology if it was not willing to do so. This was not cast as any universal proposition, but rather a view taken in these particular circumstances. It follows that the further demands and suggestions contained in the 16 August 2021 letter on this topic could not have made a difference. 33 For the same reasons, even if, contrary to my primary finding, there had been an oversight and the submissions on the apology contained in the 16 August 2021 letter had not been taken into account, and even if this was capable of amounting to an improper exercise of power or an error of law, which seems doubtful, there would be strong discretionary reasons for not granting relief because of the virtual certainty that revisiting the question of an apology would not produce any different result in light of Amazon's unwillingness to participate. 34 For completeness, it should be noted that Mr Saffari submits that the reason why he nominated Mr Jeffrey Bazos, the then CEO of the Amazon parent company, as the appropriate person to give the apology was that by reason of the ownership structure, he was a shadow director of the local subsidiary company, and therefore vicariously liable for its decisions.. This argument was not substantiated by any evidence or authority to make good such a novel proposition and had it been necessary to do so, I would have rejected it. 35 It follows that Mr Saffari's arguments about vitiating error arising from the treatment of his submissions about an apology contained in his 16 August 2021 letter must fail. 36 Turning to the consideration given to the submission by Amazon on the topic of an apology contained in the 10 August 2021 letter from its solicitors, I am not satisfied that the additional or alternative reason given for Amazon being unwilling to give an apology, namely the possibility of it being deployed in the separate litigation between Mr Saffari and the Amazon parent company, was taken into consideration by the Commissioner in any determinative way, except as to the bare fact of it being unwilling to do so. The bare last sentence at [144] of the Decision, namely that Amazon had "put forward submissions as to why it does not consider an apology appropriate", even with a footnote referring to the letter, falls short of demonstrating that anything more than the fact of unwillingness to give an apology was taken into account. It follows that Mr Saffari's arguments about vitiating error arising from the treatment of Amazon's submissions about an apology contained in its 10 August 2021 letter must fail.

The characterisation of the compensable harm suffered by Mr Saffari 37 The final issue concerns Mr Saffari's complaint about the way in which the damage to him was characterised in the Decision at [123]: On the information before me, I am satisfied that the privacy breach, namely, the disclosure of the complainant's personal information to the third party, has caused the complainant non-economic loss in the form of hurt feelings and that it has caused them to seek counselling. 38 It is important to note that this was not all that the Commissioner said on this topic. The Commissioner also said at [127] of the Decision: Having regard to the non-economic damage the complainant has established, namely, hurt feelings including stress, humiliation and feelings of anxiety with attendance at counselling, I consider this matter warrants an award of $3,000. 39 Thus, the Commissioner was using the phrase "hurt feelings" to mean more than it might otherwise be understood in isolation. It was used to cover "stress, humiliation and feelings of anxiety with attendance at counselling". It follows that it is not sound to consider [123] of the Decision on its own, as Mr Saffari's argument tends to do. 40 Mr Saffari submits that if the damage to his psyche was just hurt feelings, he would not have needed counselling. He characterises this as illogical and unreasonable, citing a number of the leading authorities on legal unreasonableness. The Commissioner refers to the same body of authority as to the unusually high threshold to be reached before an administrative decision-maker will be found to have transgressed. In the circumstances, it is not necessary to consider any of that authority in any detail. Nor is it necessary to consider concepts of hurt feelings arising from defamation cases, which is a very different body of law directed to publications damaging reputation, being a public aspect of a person's life, not really in issue in this case. 41 The substance of the complaint giving rise to this ground of review is no more than the choice of words deployed by the Commissioner to explain why she had decided that the privacy breach found to have taken place should, contrary to the Preliminary View expressed by the Deputy Commissioner, result in a modest award of damages. The objection taken by Mr Saffari is not to the quantum of damages or to the reasons why some aspects of the claim failed, with all the challenges to be overcome in establishing vitiating error, but rather to the overall conclusion reached in Mr Saffari's favour, albeit for considerably less in the way of damages than he had been seeking. It is no part of legal unreasonableness to challenge mere word choice, even if, as I accept, Mr Saffari takes strong exception to them and his view that this amounted to underplaying the impact of the wrong upon him. It follows that this challenge must also fail. 42 As none of the grounds of review advanced by Mr Saffari have succeeded, strictly speaking there is no need to consider either his claim for damages, or the relief sought by way of peremptory mandamus. However for completeness, I should indicate that even if any of those grounds had succeeded, I would not have considered that any case for damages was properly before me: see Giddings v Australian Information Commissioner [2017] FCAFC 225 at [39]-[40]. 43 As to mandamus, the most I would have been prepared to do would have been to give the Commissioner a distinctly finite time in which to make a fresh decision, with perhaps a provision being made for the Commissioner to show cause as to why mandamus should not issue if that was not complied with. Even that was only in contemplation because it took the Commissioner over 12 months to reconsider that complaint after the first decision was set aside by consent.

Conclusion 44 The further amended originating application must be dismissed with costs. I certify that the preceding forty-four (44) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Bromwich.