Proposed ground 4: alleged error of law by failing to consider various matters
74 By proposed ground 4 Mr Sayed wishes to argue that the primary judge erred by failing to consider (properly or at all):
(1) whether express representations made in various policies gave rise to "a legitimate expectation" that SAHV and SAH were required to comply with the Privacy Act;
(2) whether the alleged privacy breaches, also amounted to a breach of contract and/or a breach of express public representations;
(3) whether on account of such representations, SAHV and SAH were precluded from raising a "defence" that the Privacy Act did not apply to their respective activities;
(4) whether "the primary proceeding gave rise to an underlying cause of action, including breach of confidence in equity" which he might successfully prosecute at the trial; and
(5) whether, once he had pointed to specific factual or evidentiary disputes, a trial was necessary, without a clear basis for concluding that the alleged facts were "extremely fanciful or entirely without substance".
75 I will deal with each of these matters in order.
76 The first matter was not raised in the originating application or in argument below. That explains why his Honour did not consider the point. The mere mention of the policies is not enough. There can be no appealable error in failing to consider a point that is not raised.
77 Mr Sayed submitted that evidence in his affidavits in support of the leave application establish that:
(1) The Salvation Army's Privacy Policy and Complaint Handling Policy, along with the information published in the Annual Report 2022 of The Salvation Army Australia (Social Fund) ("TSA"), provides that both SAHV and SAH were at all relevant times subject to the privacy obligations under the Privacy Act; and
(2) TSA and SAHV officers, employees and trustees have made express representations (which amount to admissions) to the effect that any personal information disclosed in relation to provision of housing and homelessness services was subject to the protections and obligations under the Privacy Act.
78 Mr Sayed pointed to several statements made in 2019, 2020 and 2021 that "The Salvation Army … is committed to upholding its obligations under the Privacy Act 1988" and an email from an SAHV Housing Coordinator in relation to a suspected data breach, "in accordance with the relevant section of our Privacy Policies and Procedures which implement the Notifiable Data Breach Scheme of the Privacy Act 1988 (Cth)".
79 Statements of this nature cannot have any bearing on the question of whether the Privacy Act applies to the respondents or does so in relevant respects. Whether or not the Act applies is a matter of statutory construction. The statements to which Mr Sayed referred are therefore incapable of demonstrating error on the part of the primary judge.
80 As to the second and third matters, Mr Sayed did not allege that any of the respondents breached any contract they had with him or made representations that they were bound by the Privacy Act. Nor are such allegations discernible in the originating process. Again, there is no error in not considering an allegation that is not made.
81 In argument on the leave application, Mr Sayed submitted that, by signing the service agreement between the State of Victoria and SAHV, a copy of which was annexed to an affidavit of Mr Thrift filed and read in support of the application for summary dismissal, SAHV became subject to the Privacy Act, even if it is not an APP entity within the meaning of that Act. He criticised the respondents' lawyers for failing to draw the attention of the primary judge to cl 17 of the agreement which, he submitted, demonstrated that, contrary to the arguments they had put below and maintained on the present application, the Privacy Act applies to SAHV. Mr Sayed referred to cl 17.2, which relevantly reads:
Without limiting clause 17.1 and subject to clause 17.4, the Organisation agrees, in delivering the Services or fulfilling its obligations pursuant to this Agreement, to be bound by:
…
(c) any provision of the Commonwealth Privacy Act which applies to:
(i) the Organisation; or
(ii) the Department, in the same way and to the same extent that the Department would be bound if the Department were to perform the Organisation's obligations under this Agreement.
82 He also referred to cl 17.3(a) which reads:
In delivering the Services under the Agreement, the Organisation will:
(a) collect, hold, use, manage, disclose, and transfer Public Sector Data, Personal Information and Health Information, only for this Agreement and in accordance with the [Privacy and Data Protection Act 2014 (Vic)], [Health Records Act 2001 (Vic)] and (to the extent applicable) the Commonwealth Privacy Act[.]
83 These clauses only held SAHV to obligations it may have under the Privacy Act. That is evident from the first line of cl 17.1(c) and the words in parentheses in cl 17.3(a). None of the provisions of the Privacy Act upon which Mr Sayed relied applied to SAHV. In the circumstances it would have been unsurprising if these clauses were not drawn to the attention of the primary judge. As it happens, however, contrary to Mr Sayed's assertion, the respondents did draw them to his Honour's attention as the transcript of the hearing below demonstrates. Indeed, his Honour referred to cl 17 in his reasons (at [67]). The long and the short of the matter, as Ms Knowles (counsel for SAH and SAHV) submitted on the present application, is that the service agreement created a contractual obligation to comply with the law. As I have already observed, whether or not the Privacy Act imposed obligations on SAHV was a question of statutory construction. As Mr Sayed was not a party to the service agreement, he had no legal rights arising from a breach of any of its terms.
84 I turn now to the fourth matter.
85 In oral argument before the primary judge, Mr Sayed identified his "first claim" as an equitable claim for breach of confidence (at T42), although he did not explain where it arose from his pleading. Earlier (at T37), he said this:
Now, last I remember, negligence of common law and lost equity is part of Federal law. Whilst section 93(1) does not give you an independent or new right to claim breach of confidence, that is a claim which exists independently in - within common law. And I will take you through ABC v Lenah, what the court said in relation to that, and then later judgments, which have granted significant damages for breach of confidence. One recently was up to $50,000 for emotional distress in equity. And then that is why it's such a powerful claim, in equity, as opposed to some people who want to start a new tort or privacy based on the Privacy Act. But that's a different discussion. 93(1) claim was made in the first originating application, in the amended application and the one that is currently before the court, because that is the principal claim. Privacy was breached. Okay?
I've - it was breached because of their own admission that information that was disclosed in relation to complaint policy or pursuant to their complaint - internal complaint policy to their directors. That was then used to have me evicted …
86 The only potentially relevant part of the originating process is para 37 of the statement of claim which reads:
In addition SAH committed an offence under ss. 80Q and 90 as well as breach[ed] their obligation of confidence by unauthorised disclosure of applicant's complaint and contents therein, for an undisclosed purpose and without making any reasonable attempt to obtain informed and voluntary consent from the applicant.
(Emphasis added.)
87 No such claim was made against SAHV or any of the other respondents.
88 At [75] of the primary judge's reasons, his Honour wrote:
The applicant also alleges breaches of ss 80W and 93 of the Cth Privacy Act, but those provisions are of no assistance to the applicant. Section 80W confers power on this court and the Federal Circuit and Family Court of Australia (Division 2) to enforce provisions of the Act and s 93 permits a "confider" to recover damages from a confidant in respect of a breach of an obligation of confidence with respect to personal information. The references to the Australian Privacy Principles [which, I interpolate, only apply to an "APP entity"] contained in Schedule 1 to the Act likewise do not assist the applicant.
89 His Honour did not refer to Mr Sayed's oral submission that he was making a claim for breach of confidence in equity and it was common ground that he did not consider whether the primary proceeding gave rise to an underlying cause of action, including breach of confidence in equity. Mr Sayed alleged, in effect, that this was because his Honour applied the wrong test by determining, instead, whether a reasonable cause of action was available on his case as pleaded.
90 In Fortron Automotive Treatments Pty Ltd v Jones (No 2) [2006] FCA 1401 at [19]-[21] French J said:
The question which has to be answered in an application for judgment under s 31A is whether the party against whom the application is made has any "reasonable prospect" of successfully prosecuting or defending "the proceeding" or the "part of the proceeding" in issue. That question is not to be answered by a finding that a party's statement of claim or defence fails to disclose a reasonable cause of action or defence. A pleading may be rectified by amendment so as to raise a reasonable cause of action or defence. It follows that a finding that a pleading should be struck out … does not mean there must be judgment against the party whose pleading it is. There may yet, by amendment, be a reasonable prospect of successfully prosecuting or defending that proceeding.
In order to secure judgment under s 31A it must be shown that the party prosecuting or defending the proceeding has no reasonable prospect of success. This judgment can be made, by reference to pleadings, where there is a defect in the pleadings which cannot be cured. Alternatively, it may be a judgment made by reference to evidence put on in support of an application under s 31A which reasonably excludes the possibility that facts essential to the success of the claim or defence will be able to be established. ...
Section 31A is not a vehicle for simply striking out parts of pleadings that are deficient. Section 31A allows for "judgment" or nothing. Alternative remedies with respect to deficient pleadings must be found in the rules of Court. ...
91 It is tolerably clear from the reasons of the primary judge that he did not summarily dismiss the proceeding merely because of a defect in the pleadings.
92 Mr Sayed submitted that the primary judge's finding that SAH and SAHV are not APP entities did not address why his claim "for breach of confidence and resulting injunctive relief and damages sought under ss 80W and 93 of the Privacy Act 1988, 'were of no assistance to the applicant'". He submitted that the Privacy Act creates an entitlement to damages where there is an existing duty of confidence, whether sourced in general law or equity. He identified the confidential information as the information contained in his complaint on 28 October 2022 to Commissioner Donaldson of The Salvation Army. He submitted that the information was provided in confidence because "they are [his] case workers", "they advocate for [him]", and "they have a fiduciary duty". He alleged that The Salvation Army and SAHV engaged in unauthorised use and disclosure of his complaint email and that this constituted a "clear breach of confidence and therefore presented a reasonable and winnable cause of action". He appeared to identify the breach as the confidential information being "given to people specifically represented to [him] as trustees or … directors of the Salvation Army, separate from Salvation Army Housing".
93 Mr Sayed went on submit:
If their claim is the trustee of the Salvation Army on the board of Salvation Army, who my complaint went to after lodged with the Salvation Army on their website, being the director of Salvation Army Housing Victoria, alerted the property people, and on that account, they sent out an inspection notice, then that is straight away breach of trust, breach of confidence. They've dug themselves in a hole.
94 If this was the basis of the claim that there had been an equitable breach of confidence, as I understood it to be, there are several problems with it.
95 First, no claim for equitable breach of confidence was made against SAHV; it was only made against SAH. Second, the claim appears to be based purely on speculation. Third, Mr Sayed did not explain how such a claim could possibly succeed and in oral argument conceded that he had sued the wrong respondent (for which he blamed the respondents).
96 Sections 90 and 93 of the Privacy Act appear in Pt VIII, entitled "Obligations of confidence". They have a limited application as s 89 makes clear. Section 89 provides:
Obligations of confidence to which Part applies
Unless the contrary intention appears, a reference in this Part to an obligation of confidence is a reference to an obligation of confidence:
(a) to which an agency or a Commonwealth officer is subject, however obligation arose; or
(b) that arises under or by virtue of the law in force in the Australian Capital Territory; or
(c) that arises under or by virtue of a law in force in an external Territory.
97 Mr Sayed did not argue that the contrary intention is apparent.
98 Obligations of confidence either SAH or SAHV may owe do not come within the scope of s 89. Mr Sayed contended that each was an "agency". But "agency" is a defined term and the definition does not apply to SAH or SAHV.
99 "Agency" is defined in s 6. Mr Sayed relied on para (ca) of the definition:
a body (whether incorporated or not), or a tribunal, established for a public purpose by or under a law (other than a law providing for the incorporation of companies, societies or associations) of a State or Territory as in force in an external Territory, other than a body exempted by the Minister under subsection (5A)[.]
100 When I asked Mr Sayed under what law or laws SAH and SAHV were established, he said they were incorporated under the Corporations Act, which is a law providing for the incorporation of companies and in any event is not a law of a State or Territory. Mr Sayed accepted that he should not have named SAH as a party. He wanted to substitute The Salvation Army, without explaining why The Salvation Army would satisfy the definition.
101 Mr Sayed argued that SAHV was "registered under the Housing Act". That much was common ground. But registration is not establishment. Mr Sayed then asserted that SAHV "is specifically established for providing community housing" under the Housing Act but did not explain where or how. In any case, as I have already observed, his claim that there was an equitable breach of confidence was not made against SAHV, it was made against SAH.
102 Section 90 of the Privacy Act provides:
Application of Part
(1) This Part applies where a person (in this Part called a confidant) is subject to an obligation of confidence to another person (in this Part called a confider) in respect of personal information, whether the information relates to the confider or to a third person, being an obligation in respect of a breach of which relief may be obtained (whether in the exercise of a discretion or not) in legal proceedings.
(2) This Part does not apply where a criminal penalty only may be imposed in respect of the breach.
103 Section 93 provides:
Relief for breach etc. of certain obligations of confidence
(1) A confider may recover damages from a confidant in respect of a breach of an obligation of confidence with respect to personal information.
(2) Subsection (1) does not limit or restrict any other right that the confider has to relief in respect of the breach.
(3) Where an obligation of confidence exists with respect to personal information about a person other than the confider, whether the obligation arose under a contract or otherwise, the person to whom the information relates has the same rights against the confidant in respect of a breach or threatened breach of the obligation as the confider has.
104 "Personal information" is defined in s 6 to mean:
information or an opinion about an identified individual, or an individual who is reasonably identifiable:
a. whether the information or opinion is true or not; and
b. whether the information or opinion is recorded in a material form or not.
105 While some of the material in his complaint would fall within the definition, Mr Sayed did not explain how his opinion about the state of the premises or the photographs proffered to support it would do so.
106 Even if relief under s 93 or in equity were available, his position would still be fraught.
107 There are four elements to a cause of action for an equitable breach of confidence. They are thatthe information in question must be identified with specificity; it must have the necessary quality of confidence; it must have been received in circumstances importing an obligation of confidence; and there must be an actual or threatened misuse of the information without consent: Optus Networks Pty Ltd v Telstra Corporation Ltd [2010] FCAFC 21; 265 ALR 281 (Finn, Sundberg, Jacobson JJ) at [39].
108 As between the various Salvation Army organisations, it seems to me that such a claim would be bound to fail not least because Mr Sayed authorised the use of the information for the purposes he alleges it was used. The consent form he signed just before he entered into the lease with SAHV relevantly stated:
We collect personal information we believe is reasonably necessary to provide you with the services we offer. This includes information you provide to us on this form, any additional information you provide to our staff verbally or otherwise, and any information we may need to collect about you from third parties on your behalf (if applicable).
By providing us with this personal information you also consent to our use or disclosure of this personal information for purposes related to the services we provide. Unless permitted or required by law, we will not use this information for any other purpose without your consent.
(Emphasis added.)
109 If the information in Mr Sayed's 28 October 2022 email was used by SAHV for the purpose of inspecting the property, it was with Mr Sayed's consent. By signing the consent form he expressly acknowledged that he read and understood the document; the reasons for the collection of his personal information and the ways in which it might be used and disclosed; and agreed to its use and disclosure.
110 As Ms Knowles submitted, where the breach said to have occurred is the use of photographs sent by a tenant to his landlord and the taking of photographs of a property in order to make decisions about that property and, where Mr Sayed sent his complaint and his photographs to a director of SAHV, it is difficult to see how an action for breach of confidence could possibly succeed. Moreover, as Mr Sayed acknowledged in an email sent to Winsome Merrett on 7 November 2022 (copying in various other Salvation Army personnel), which was annexed to his amended originating application and statement of claim, he had repeatedly requested caseworkers to advise SAHV about the state of the property and the need for "urgent trauma cleaning".
111 In oral argument Mr Sayed contended that his "central complaint" was against The Salvation Army and the real culprit was his caseworker. But this was not the claim the subject of the proceeding.
112 As to the fifth matter, the primary judge effectively concluded that the applicant's claims were "entirely without substance", though he may not have used those very words.