The claims against the first and second respondents
51 SAHV submitted that the proceeding against it is vexatious because the Commonwealth enactments pleaded against it do not apply to it in its functions as a residential services provider.
52 SAH submitted that the proceeding against it is vexatious because the statement of claim contains no allegations of discernible conduct by it. That is unsurprising because it does not operate in Victoria.
53 The applicant alleges that SAH and SAHV contravened several Commonwealth (and Victorian) enactments.
54 The applicant alleges breaches of ss 13, 13G, 15, 80Q, 80W and 93 and Schedule 1, Australian Privacy Principles 3-6 and 11 of the Privacy Act 1988 (Cth) (Cth Privacy Act), by SAH disclosing to SAHV an email sent by the applicant to Commissioner Donaldson and various other persons employed by the Salvation Army (see paragraph [20] above) and by the second respondent entering the applicant's premises on 9 November 2022 and taking photographs of the premises.
55 Sections 13, 13G and 15 create obligations on "APP entities" and "entities", for example, in their collection, use of disclosure of personal information. For example, s 13(1) provides:
13 Interferences with privacy
APP entities
(1) An act or practice of an APP entity is an interference with the privacy of an individual if:
(a) the act or practice breaches an Australian Privacy Principle in relation to personal information about the individual; or
(b) the act or practice breaches a registered APP code that binds the entity in relation to personal information about the individual.
56 SAH and SAHV are not "APP entities". Sections 13, 13G and 15 do not apply to the alleged conduct. That is so for these definitional reasons.
57 Sub-section 6(1) defines "APP entity" to mean an "agency or organisation".
58 Sub-section 6(1) in turn defines "agency" to mean:
(a) a Minister; or
(b) a Department; or
(c) a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a Commonwealth law, not being:
(i) an incorporated company, society or association; or
(ii) an organisation that is registered under the Fair Work (Registered Organisations) Act 2009 or a branch of such an organisation; or
(ca) a body (whether incorporated or not), or a tribunal, established for a public purpose by or under a law (other than a law providing for the incorporation of companies, societies or associations) of a State or Territory as in force in an external Territory, other than a body exempted by the Minister under subsection (5A); or
(d) a body established or appointed by the Governor-General, or by a Minister, otherwise than by or under a Commonwealth law; or
(e) a person holding or performing the duties of an office established by or under, or an appointment made under, a Commonwealth law, other than a person who, by virtue of holding that office, is the Secretary of a Department; or
(ea) a person holding or performing the duties of an office established by or under, or an appointment made under, a law of a State or Territory as in force in an external Territory, other than an office or appointment exempted by the Minister under subsection (5A); or
(f) a person holding or performing the duties of an appointment, being an appointment made by the Governor-General, or by a Minister, otherwise than under a Commonwealth law; or
(g) a federal court; or
(h) the Australian Federal Police; or
(ha) a court of Norfolk Island; or
(k) an eligible hearing service provider; or
(l) the service operator under the Healthcare Identifiers Act 2010.
59 Self-evidently, SAH and SAHV are not any such bodies, persons or entities.
60 Sub-section 6(1) provides that "organisation has the meaning given by section 6C".
61 Sub-section 6C(1) relevantly defines organisation to mean "… (b) a body corporate … that is not … a State or Territory authority". (Emphasis added).
62 Sub-section 6C(3) in turn defines "State or Territory authority" to mean:
(a) a State or Territory Minister; or
(b) a Department of State of a State or Territory; or
(c) a body (whether incorporated or not), or a tribunal, established or appointed for a public purpose by or under a law of a State or Territory, other than:
(i) an incorporated company, society or association; or
(ii) an association of employers or employees that is registered or recognised under a law of a State or Territory dealing with the resolution of industrial disputes; or
(d) a body established or appointed, otherwise than by or under a law of a State or Territory, by:
(i) a Governor of a State; or
(ii) the Australian Capital Territory Executive; or
(iii) the Administrator of the Northern Territory; or
(v) a State or Territory Minister; or
(e) a person holding or performing the duties of an office established by or under, or an appointment made under, a law of a State or Territory, other than the office of head of a State or Territory Department (however described); or
(f) a person holding or performing the duties of an appointment made, otherwise than under a law of a State or Territory, by:
(i) a Governor of a State; or
(ii) the Australian Capital Territory Executive; or
(iii) the Administrator of the Northern Territory; or
(v) a State or Territory Minister; or
(g) a State or Territory court.
63 Section 6C was introduced into the Cth Privacy Act by the Privacy Amendment (Private Sector) Act 2000 (Cth). The second reading speech states as follows:
The bill is not intended to cover state and territory public sector agencies, as this is a matter for the states and territories themselves. The bill recognises that state and territory government business enterprises, or GBEs, take many forms and that the dividing line between the public and private sectors is not always clear. In order to ensure certainty, the bill provides that GBEs that are incorporated under the Corporations Law will automatically be covered by the bill unless they are prescribed otherwise by regulation. Those GBEs not incorporated under the Corporations Law, such as statutory corporations, will not be covered by the bill.
To meet the varying requirements of state and territory governments, however, the bill also provides a flexible opt-in opt-out mechanism for prescribing state or territory instrumentalities. This will be achieved by regulation and will be done only at the request of the state or territory government. The policy behind this mechanism is to ensure that state and territory government functions can continue unaffected by the bill, whilst ensuring that state and territory GBEs that are performing substantially commercial functions will be treated on a level playing field with other private sector organisations.
See Commonwealth, Parliamentary Debates, House of Representatives, 12 April 2000, 15751 (Daryl Williams, Attorney-General).
64 An "organisation" to which the Cth Privacy Act may apply, by s 6C(1), does not pick up a State or Territory authority. By s 6C(3)(e), a "State or Territory authority" is defined to include "a person holding or performing the duties of an office established by or under, or an appointment made under, a law of a State or Territory, other than the office of head of a State or Territory Department (however described)". Compare Minister for Home Affairs v Hunt (2019) 269 FCR 292 at 299 [34] (McKerracher, Perry and Banks-Smith JJ).
65 Mr Thrift in his second affidavit affirmed on 23 March 2023 exhibited as Exhibit BT-14 the Service Agreement applicable to SAHV at the time it entered into the Rental Agreement with the applicant. It is between "The State of Victoria as represented by the Department of Health and Human Services and the Director of Housing, Victoria [now the Chief Executive Officer, Homes Victoria]" and SAHV, and provides, among other things, that SAHV will deliver "the Services [as defined] in accordance with this Agreement to the reasonable satisfaction of the Department [which is defined as 'The State of Victoria as represented by the Department of Health and Human Services and the Director of Housing, Victoria [now the Chief Executive Officer, Homes Victoria]']".
66 SAHV is not an "organisation" within the meaning of the Cth Privacy Act because it performs the duties of the office of the Department of Health and Human Services, alternatively, of the office of the Chief Executive Officer, Homes Victoria. It performs those duties pursuant to the Agreement and it performs the duties 'of an office established under … a law of a State'. See Cth Privacy Act s 6C(3)(e).
67 I should also note cl 17 of the Service Agreement, which is headed "Privacy, Data Protection and Protected Disclosures". Clauses 17.1 and 17.2 provide:
17.1 The Organisation acknowledges that it is a Contracted Service Provider and/or an 'organisation' within the meaning of the HR Act and irrespective of whether a federal privacy code applies to the Organisation under the Commonwealth Privacy Act, it agrees to be bound by:
(a) the Information Privacy Principles contained in the PDP Act;
(b) the Health Privacy Principles contained in the HR Act; and
(c) any applicable code of practice made under the PDP Act or the HR Act,
when performing its obligations under this Agreement in the same way and to the same extent that the Department would be bound if the Department were to perform the Organisation's obligations under this Agreement.
17.2 Without limiting clause 17.1 and subject to clause 17.4, the Organisation agrees, in delivering the Services or fulfilling its obligations pursuant to this Agreement, to be bound by:
(a) any applicable standards issued by the Information Commissioner under Part 4 of the PDP Act as if it were a Public Sector Agency;
(b) any provision of a Protective Data Security Plan developed for the Department under the PDP Act that applies to the Organisation or to any Public Sector Data, Personal Information and Health Information; and
(c) any provision of the Commonwealth Privacy Act which applies to:
(i) the Organisation; or
(ii) the Department, in the same way and to the same extent that the Department would be bound if the Department were to perform the Organisation's obligations under this Agreement.
68 I accordingly accept the submission made by SAHV that the proceeding against it is vexatious because the provisions of the Cth Privacy Act relied upon in the statement of claim have no application to it.
69 As for SAH, the claim against it is vexatious because, as counsel put it in her written submissions, there is no discernible conduct pleaded against it.
70 The applicant also alleges breaches of s 80Q. It is contained in Part IVA of the Cth Privacy Act, which is headed "Dealing with personal information in emergencies and disasters".
71 Section 80F is headed "Object" and provides that "[t]he object of [Part IVA] is to make special provision for the collection, use and disclosure of personal information in emergencies and disasters".
72 Section 80Q provides as follows:
80Q Disclosure of information - offence
(1) A person (the first person) commits an offence if:
(a) personal information that relates to an individual is disclosed to the first person because of the operation of this Part; and
(b) the first person subsequently discloses the personal information; and
(c) the first person is not a responsible person for the individual.
Penalty: 60 penalty units or imprisonment for 1 year, or both.
(2) Subsection (1) does not apply to the following disclosures:
(a) if the first person is an APP entity - a disclosure permitted under an Australian Privacy Principle or a registered APP code that binds the person;
(c) a disclosure permitted under section 80P;
(d) a disclosure made with the consent of the individual to whom the personal information relates;
(e) a disclosure to the individual to whom the personal information relates;
(f) a disclosure to a court;
(g) a disclosure prescribed by the regulations.
Note: A defendant bears an evidential burden in relation to a matter in subsection (2) (see subsection 13.3(3) of the Criminal Code).
(3) If a disclosure of personal information is covered by subsection (2), the disclosure is authorised by this section.
(4) For the purposes of paragraph (2)(f), court includes any tribunal, authority or person having power to require the production of documents or the answering of questions.
73 Section 80Q has no conceivable application to the circumstances of this case, because it only applies to information disclosed during times of declared emergencies or disaster, where, for example, the use, collection or disclosure relates to that emergency or disaster.
74 It follows that the claim based on that provision against SAH and SAHV is bound to fail.
75 The applicant also alleges breaches of ss 80W and 93 of the Cth Privacy Act, but those provisions are of no assistance to the applicant. Section 80W confers power on this court and the Federal Circuit and Family Court of Australia (Division 2) to enforce provisions of the Act and s 93 permits a "confider" to recover damages from a confidant in respect of a breach of an obligation of confidence with respect to personal information. The references to the Australian Privacy Principles contained in Schedule 1 to the Act likewise do not assist the applicant.
76 The applicant also alleges breaches by SAH of ss 26 and 27 of the Healthcare Identifiers Act 2010 (Cth) (HI Act) "by reason of unauthorised use or disclosure of healthcare identifier of the applicant as a healthcare recipient under the Healthcare Act". That is apparently a reference to the allegation in the particulars to [44] of the statement of claim, alleging that an employee of SAH provided such information to "Monash Community Health" without his consent.
77 The purpose of the HI Act is "to provide a way of ensuring that an entity that provides, or an individual who receives, healthcare is correctly matched to health information that is created when healthcare is provided". That purpose is to be achieved by "assigning a unique identifying number to each healthcare provider and healthcare recipient". See HI Act s 3.
78 Sections 26 and 27 of the HI Act apply to the use, disclosure and protection of information, and "healthcare identifiers", in circumstances prescribed by the HI Act. The statement of claim does not articulate a coherent case as to how any of those circumstances apply in this case.
79 The applicant also alleges breaches by SAH and SAHV of s 471.12 the Criminal Code Act 1995 (Cth) by using a carriage service "to menace or harass the applicant", by serving on the applicant the notice to vacate under the RTA set out at paragraph [29] above. That claim is self-evidently absurd. See Monis v The Queen (2013) 249 CLR 92 at 203 [310], where with particular reference to the offence of using a postal or similar service to menace, harass or cause offence in s 471.12 of the Criminal Code, Crennan, Kiefel and Bell JJ said: "The words 'menacing' and 'harassing' imply a serious potential effect upon an addressee, one which causes apprehension, if not a fear, for that person's safety. For consistency, to be 'offensive', a communication must be likely to have a serious effect upon the emotional well-being of an addressee" (Footnotes references omitted).
80 Otherwise, the claims made in the statement of claim against SAH and SAHV under the Housing Act 1983 (Vic) (Housing Act) and the RTA are not within the jurisdiction of this court.