Skiba v Australian Information Commissioner

Legislative context 3 The Privacy Act provides in s 6(1) that: an APP entity means, relevantly, an agency and that an agency means, relevantly, a Department. personal information means: information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not. 4 Next, s 13, which is headed "Interferences with privacy", provides in s 13(1): APP entities (1) An act or practice of an APP entity is an interference with the privacy of an individual if: (a) the act or practice breaches an Australian Privacy Principle in relation to personal information about the individual; or (b) the act or practice breaches a registered APP code that binds the entity in relation to personal information about the individual. 5 Section 14 provides that the APP are set out in clauses of Sch 1. Under s 15, an APP entity, such as the Department, must not do an act, or engage in a practice, that breaches an APP. Relevantly, s 27 provides: (1) The Commissioner has the following functions: (a) the functions that are conferred on the Commissioner by or under: (i) this Act; or (ii) any other law of the Commonwealth; … (e) to do anything incidental or conducive to the performance of any of the above functions. (2) The Commissioner has power to do all things necessary or convenient to be done for, or in connection with, the performance of the Commissioner's functions. 6 An individual may complain to the Commissioner, pursuant to s 36(1), about an act or practice that may be an interference with the privacy of the individual. By force of s 40(1), the Commissioner must investigate an act or practice that may be an interference with the privacy of an individual if a complaint about it has been made under s 36. Importantly, s 41(1)(a) provides: (1) The Commissioner may decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under section 36 if the Commissioner is satisfied that: (a) the act or practice is not an interference with the privacy of an individual; … (emphasis added) 7 APP 12, in Sch 1, relevantly provides: Access 12.1 If an APP entity holds personal information about an individual, the entity must, on request by the individual, give the individual access to the information. … Dealing with requests for access 12.4 The APP entity must: (a) respond to the request for access to the personal information: (i) if the entity is an agency - within 30 days after the request is made; or (ii) if the entity is an organisation - within a reasonable period after the request is made; and (b) give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so. (emphasis added)

Background 8 APM had a contract with the Department to provide services for job seekers. Ms Skiba, a software engineer, received JobSeeker payments. She noted in her affidavit of 4 May 2022 that she was registered with APM and that it, and other service providers, shared personal information about job seekers, such as herself, with the Department. She explained that a service provider provided services to job seekers and administrative services to the Department. These included making purchases in respect of, or for, job seekers. The service providers sought reimbursement from the Department for such expenditures, from a fund specifically constituted to meet those expenses, being the employment fund general account. Ms Skiba said that the sum of such purchases is recorded on each job seeker's government record as the monetary value of help he or she received from the government while service providers received administrative fees from a different fund. She noted that, originally, she had obtained some material under the Freedom of Information Act 1982 (Cth), that indicated money had been paid by the Department in respect of her for a purpose described as: "Type: … monthly StreamB Admin Fee - NonReg & NonSpt". Ms Skiba said that she had not received any payment from the Department or from any service provider and sought to ascertain the purpose of payments so described. 9 Ms Skiba ascertained that payments had been made to APM on an ongoing basis every six months and were recorded on her government file in respect of her JobSeeker payment history. She said that there were government-related identifiers of her that could be exposed to data matching. 10 She also complained to the Commonwealth Ombudsman about what she said were fraudulent transactions on her government record. 11 On 11 June 2020, Ms Skiba had made requests under APP 12.1 in the same terms to both the Department and APM. She was seeking to ascertain the purpose of the payments that APM had received in respect of her. She said that APM had asserted that it provided services to her whereas the Department claimed the payments were made for services that APM provided to it, no doubt, because it had contracted APM to provide those services to or in respect of Ms Skiba or other job seekers. 12 On 18 June 2020, APM located nine tax invoices. Eight of those contained the Department's, APM's and Ms Skiba's names and described the purpose of the payments as being for six-monthly "StreamB Admin Fee-NonReg & NonSPI". The ninth invoice, dated 22 January 2018 (the 22 January invoice), did not refer to Ms Skiba by name or otherwise contain any means to identify her but described the payment as being for "Accredited Training". 13 Ms Skiba had received Freedom of Information Act material that comprised a tax invoice issued to APM by Training Online Australia Pty Ltd, trading under the name of Alffie, naming Ms Skiba as the person to whom Alffie provided payments that related to the 22 January invoice. 14 On 23 June 2020, Jacki, a member of the information law and corporate legal team of the Department, responded by email to Ms Skiba's request, referring to APM's 18 June 2020 email, saying: I note that APM, as one of the department's contracted service providers, has provided you with the relevant information. On this basis, the department will not take any further action in relation to your request. 15 On 20 April 2021, Ms Skiba replied, referring to the Department's refusal to comply with her request and drawing its attention to APP 12.1. She stated that the information she requested was held by the Department and that the Privacy Act required that it give her access to that information. She repeated the request in terms. 16 On 7 May 2021, Jacki responded to Ms Skiba by email noting that she had made two requests, the first, under the Privacy Act on 20 April 2021, to which I have referred, and a second on 23 April 2021 under the Freedom of Information Act. The second of those requests had sought: [A]ll documents, including tax invoices, that include my name and show amounts of admin fees drawn from the Consolidated Revenue Fund, in the period 2018 - 2021. (emphasis added) 17 Jacki's email stated: The department will release the documents relevant to both requests to you through administrative access next week. Administrative access is release of government information outside the processes of the FOI Act and Privacy Act. Further information about administrative access can be found at https://www.oaic.gov.au/freedom-of-information/guidance-and-advice/administrative-access/. (emphasis added) 18 The email asked Ms Skiba to reply as to whether she would agree to withdraw her Freedom of Information Act request, given that the documents relevant to it would be released administratively to her. 19 Ms Skiba was dissatisfied with that response and replied later on 7 May 2021 refusing to agree to be given administrative access to the documents. 20 On 13 May 2021, Jacki replied to Ms Skiba's request of 20 April 2021 saying: There are no tax invoices related to reimbursements received by APM from the Employment Fund General Account that contain your personal information (that is there are no tax invoices that contain your name or any other information which would identify you). Consequently, you would not have received documents had I processed your request under the Privacy Act. However, I am providing you with administrative access to documents that contain references to reimbursements received by APM from the Employment Fund General Account that relate to you. Specifically, a tax invoice for a reimbursement received by APM from the Employment Fund General Account in relation to a service provided to you. (emphasis added) 21 She attached a copy of the 22 January invoice to the response. 22 On 14 May 2021, Ms Skiba wrote to the Department complaining about Jacki's persistent refusal, in particular in the response of 13 May 2021, to process her requests under the Privacy Act. She set out the history of her attempts to obtain documents in accordance with what she claimed were her entitlements under APP 12.1 and the Department's failure to deal with those requests. 23 On 21 May 2021, another officer of the Department's legal team responded to Ms Skiba's email of 14 May 2021 saying: 4. The department conducted searches for documents that fell within the scope of your request for access to "tax invoices that include [your] name …". The department found no tax invoices that contained your name and contained references to reimbursements received by APM from the Employment Fund General Account. However, a tax invoice was found that contained references to reimbursements received by APM from the Employment Fund General Account. The tax invoice relates to you but does not contain your personal information. Consequently, the department was not under an obligation under APP 12 to provide you with access to that information. 5. However, Privacy Officer Jacki made the discretionary decision to provide you with access to the document nonetheless in what is referred to as "administrative access". This is an informal arrangement that the department can use to provide individuals with access to certain documents where the department is not otherwise prohibited from disclosing that information. Importantly, APP 12 operates alongside and does not replace other informal or legal procedures by which an individual can be provided access to information. In fact, the Office of Australian Information Commissioner (OAIC) has stated that providing access to personal information under an administrative arrangement will fulfil an agency's obligation under APP 12 to provide access upon request, provided the arrangement meets the minimum access requirements in APP 12 (see paragraph 12.23 of the Australian Privacy Principles Guidelines). (original emphasis)

The delegate's preliminary view 24 On 24 May 2021, Ms Skiba lodged her complaint with the Commissioner. 25 On 4 March 2022, the delegate responded by email, apologising for the lengthy delay. The email summarised Ms Skiba's allegations, set out the delegate's understanding of the law and expressed the preliminary view that on the available information the Department had not interfered with Ms Skiba's privacy as defined under the Privacy Act. The delegate said that the Department was not required to make a decision under APP 12.1, but, rather, was required to provide access to the personal information that it holds that she had requested, unless an exception applied. The email noted that the Department claimed that it did not hold her personal information in the tax invoices to which she had requested access. The email discussed the tax invoice from Alffie, noting that while it showed Ms Skiba's name and referenced a reimbursement, that was not a reimbursement received by APM from the employment fund general account. 26 The delegate considered that Alffie's tax invoice was a request to APM for payment but that it did not show any reimbursement from the Department to APM and, thus, was not embraced within Ms Skiba's request of 11 June 2020, and repeated on 20 April 2021, for tax invoices of the precise description that she specified. 27 The delegate concluded that, based on the information before her, the Department had not interfered with Ms Skiba's privacy as it did not hold personal information in the form of the information Ms Skiba requested. The delegate drew attention to s 41(1)(a) of the Privacy Act and offered Ms Skiba an opportunity to address why the delegate should not make a decision on her complaint under that provision. 28 On 27 March 2022, Ms Skiba responded. She emphasised that, from the findings the delegate had made, it was clear that her request had not been processed by the Department under the Privacy Act, but, rather, the Department had processed it as a request "under an administrative arrangement" and noted that it had done so in accordance with paragraph 12.23 of the Australian Privacy Principles Guidelines, as stated in the passage from Jacki's email of 7 May 2021 quoted above. Ms Skiba endorsed, as correct, the delegate's statement that administrative access was not a concept under the Privacy Act. She accepted that the Department was not required to provide administrative access under APP 12 and that the Commissioner could not review any administrative access process. However, Ms Skiba contended that the provisions of APP 12.1 and 12.4 demonstrated that the Department had not performed any action under the Privacy Act in processing her request as she had sought, but, rather, it had processed the request under an administrative arrangement. 29 She complained that the delegate had assessed the Department's actions as having been performed under an administrative arrangement but had failed to deal with what, she claimed, the delegate was required to consider, namely, the performance of the Department's response to her request for information under the Privacy Act. She said that the delegate's approach to her complaint under s 36 of the Act was not in accordance with law because the delegate should have addressed the Department's treatment of her request under APP 12.1 and its adequacy.

The delegate's decision 30 On 12 April 2022, the delegate made the decision under s 41(1)(a) of the Privacy Act not to investigate Ms Skiba's complaint because she was satisfied that the act or practice complained about was not an interference with Ms Skiba's privacy. The delegate referred to the preliminary view she had expressed on 4 March 2022 and Ms Skiba's response. The delegate said that, based on the available information, the Department had not interfered with Ms Skiba's privacy as defined in the Act. She stated: The 4 March 2022 email was the OAIC's view of the complaint and intention to investigate the matter, and the OAIC will now make a decision under the Privacy Act in relation to your allegations and [the Department's] obligations under APP 12. Please note that there is no requirement for [the Department] to make a decision under the Privacy Act, and we are assessing its compliance with APP 12. (emphasis added) 31 The delegate found that the Department had advised the Commissioner that it had conducted a search of its records for the information that Ms Skiba had requested "and found no tax invoices which had both your name and contained references to reimbursements received by APM from the employment fund general account". The delegate referred to the invoice created by Alffie but found that the Department did not have to provide Ms Skiba with a copy of it in response to her access request, as it did not fall within the specific description of invoices Ms Skiba had sought. 32 The delegate found that the Department did not hold the personal information that Ms Skiba had requested to access and, therefore, was not required to provide her with information in relation to her access request, nor did it have any obligations under APP 12.1 to do so. The delegate was satisfied that the Department had met the requirements of APP 12, as it "has not refused you access to the personal information it holds that you requested, as it does not hold the personal information you requested". 33 The delegate found that the Department had responded to Ms Skiba's request within 30 days, as required by APP 12.4, as construed in the decision of Snaden J in Knowles v Secretary, Department of Defence [2020] FCA 1328. She noted that because the Department did not hold the personal information Ms Skiba sought access, it was not required to provide her with it. The delegate found that the Department had no obligations in those circumstances under APP 12.4(b) and thus "cannot have interfered with your privacy by failing to provide you with access to information in the manner requested". The delegate was satisfied that the Department had met the requirements of APP 12.4 for those reasons and concluded that she would not further investigate the complaint because she was satisfied that the act or practice complained about was not an interference with Ms Skiba's privacy as defined in the Act.

Ms Skiba's submissions 34 Ms Skiba complained in the originating application that the Commissioner erred within the meaning of s 5(1)(b) of the AD(JR) Act or committed a jurisdictional error by assessing the Department's acts "outside" the requirements of the Privacy Act. Ms Skiba asserted that this followed because of the Department's references to the provision of information to her by administrative access, rather than, as she claimed, in the manner that the Privacy Act required it to follow in accordance with her right to access under APP 12.1. In essence, Ms Skiba argued that the Commissioner: acted unlawfully assessing actions performed under an administrative arrangement against the APP 12 requirements. Accordingly, [the Commissioner] reached an unlawful decision regarding the Department's compliance with the Privacy Act. 35 Ms Skiba argued that the Commissioner's error was a failure to determine that the Department had not followed the procedures under APP 12.1 and 12.4 when processing her request for the tax invoices as she had specified in her letter of 20 April 2021 to the Department. Ms Skiba contended that the Commissioner erroneously approached the investigation of her complaint on the basis that the Department was not required to make a decision under the Privacy Act but, rather, was entitled to proceed, as the delegate's decision of 12 April 2022 recorded, on the basis that the Department had conducted a search of its records for the information Ms Skiba had requested and found no tax invoices that matched the request so that it was not required to provide her with any documents under APP 12.1 or 12.4. 36 Ms Skiba complained that the Commissioner did not take into account, first, how the Department had approached its search for the records that she had requested, secondly, that it had not done so under the Privacy Act and, thirdly, that the delegate, by reviewing the Department's conduct under what Ms Skiba characterised as "administrative arrangements", had gone beyond her functions under s 27(1) of the Privacy Act.

Consideration 37 In Minister for Immigration and Ethnic Affairs v Wu Shan Liang (1996) 185 CLR 259 at 272, Brennan CJ, Toohey, McHugh and Gummow JJ said of persons such as the Departmental officers and the delegate: a court should not be "concerned with looseness in the language … nor with unhappy phrasing" of the reasons of an administrative decision-maker. The Court continued [Collector of Customs v Pozzolanic Enterprises Pty Ltd (1993) 43 FCR 280 at 287]: "The reasons for the decision under review are not to be construed minutely and finely with an eye keenly attuned to the perception of error." These propositions are well settled. They recognise the reality that the reasons of an administrative decision-maker are meant to inform and not to be scrutinised upon over-zealous judicial review by seeking to discern whether some inadequacy may be gleaned from the way in which the reasons are expressed. In the present context, any court reviewing a decision upon refugee status must beware of turning a review of the reasons of the decision-maker upon proper principles into a reconsideration of the merits of the decision. This has been made clear many times in this Court. For example, it was said by Brennan J in Attorney-General (NSW) v Quin: "The duty and jurisdiction of the court to review administrative action do not go beyond the declaration and enforcing of the law which determines the limits and governs the exercise of the repository's power. If, in so doing, the court avoids administrative injustice or error, so be it; but the court has no jurisdiction simply to cure administrative injustice or error. The merits of administrative action, to the extent that they can be distinguished from legality, are for the repository of the relevant power and, subject to political control, for the repository alone." (emphasis added, footnotes omitted) 38 In Knowles v Secretary, Department of Defence (2021) 287 FCR 348 at 357-358 [52]-[53], Collier, Logan and Charlesworth JJ, in affirming the decision of Snaden J, held that under APP 12, an APP entity, such as the Department, had to respond to requests within 30 days but did not have to provide the information sought within that time period. Nonetheless, they held that any request had to be dealt with within a reasonable time. 39 In Privacy Commissioner v Telstra Corporation Ltd (2017) 249 FCR 24 at 36 [63]-[64], Kenny and Edelman JJ, with whom Dowsett J agreed, held that "in every case it is necessary to consider whether each item of personal information requested, individually or in combination with other items, is about an individual". They said that this was an evaluative exercise that depended upon the facts of each individual case. 40 Here, the delegate referred to the Department's finding that it had conducted a search for the information that Ms Skiba had requested, namely, any tax invoices that met her particular description, and that the search had resulted in no such documents being found. In other words, the delegate concluded, based on the Department's statement about the search that it had conducted for the documents described in Ms Skiba's request of 11 June 2020, that it had no documents that met that description. On that basis, the delegate concluded, logically and clearly, that there was nothing in the Department's failure to produce any document that answered her request which could be characterised as an act or practice that interfered with Ms Skiba's privacy. The delegate's conclusion was simply that the Department had searched for, and been unable to find, any such document. 41 Ms Skiba sought to characterise the Department as somehow having to ask itself whether in searching for documents that answered the description in her request it was doing so under, or in accordance with, APP 12 or in accordance with what she characterised was "an administrative arrangement". She reasoned that, because the Department released information to her under an administrative arrangement and not in response to her request under APP 12.1 made on 11 June 2020, it had failed to respond to that request in accordance with APP 12.1. 42 The difficulty with Ms Skiba's argument is that it ignores the reality that the Department conducted a search for the documents that she had described in her request and responded that the result of its search was that it was not able to locate any document that met her description. But, the Department had found another document, being the 22 January invoice, that did not meet her request, but which the Department was willing to provide to her under the administrative arrangements. 43 In my opinion, reading the delegate's reasons fairly and also reading the earlier reasons of the Departmental officers, it is obvious that the delegate was satisfied that the Department had conducted a search with the purpose of ascertaining whether it could find documents that met the precise description in Ms Skiba's request of 11 June 2020, but was unable to locate any. 44 While the tax invoices produced by APM on 18 June 2020 in response to Ms Skiba's request, other than the 22 January invoice, would allow an inference to be drawn, in the ordinary course, that the Department must have received some such documents, there is nothing in the material before me to show that the Department did otherwise than what the delegate was satisfied it did; namely to conduct a search for the documents that she requested. 45 Ms Skiba's insistence on labelling the search as being "under the Privacy Act", "under APP 12.1" or "under an administrative arrangement" involves an irrelevancy. The question is whether the Department in fact searched for the documents that met the description in her request that she made under APP 12.1. If the answer to a properly conducted search for any documents that met the description in her request was that no such document was located, then it follows that, first, the request has been complied with but failed to locate any of the information sought and, secondly, the delegate was entitled to be satisfied, for the purposes of s 41(1)(a), that there was no act or practice capable of being characterised as an interference with Ms Skiba's privacy. 46 Nor is there any substance in Ms Skiba's argument that the delegate made an error in stating that the Department was not required to make a decision under the Privacy Act. The evaluation of whether a particular piece of information meets the description in a request under APP 12.1 may require consideration about whether information is "about an individual", as Kenny and Edelman JJ discussed in Telstra 249 FCR at 36 [63]-[64]. Here, Ms Skiba's request for documents was pellucid and easily capable of objective evaluation. Either, the Department had or did not have tax invoices that included her name and contained references to reimbursements received by APM from the employment fund general account. If, as a matter of objective fact, the Department found after its search no such invoices, as so described, there was nothing that the Department had to produce in answer to Ms Skiba's request under APP 12.1. 47 What APP 12.1 requires is for the APP entity to give the individual access to the personal information about him or her that it holds. If the APP entity does not "hold" that personal information, there is nothing further for it to do. In particular, once the result of the search fails to produce information matching the terms of the request under APP 12.1, it is inconceivable that any decision under the Privacy Act needs to be made about the request. The APP entity has fulfilled its obligation to ascertain whether or not it holds the information. If it transpires, after a reasonable and proper search, that it is unable to locate such information, that is the end of the matter.

Conclusion 48 I am unable to discern any error in what the Commissioner, by her delegate, did in dismissing the complaint under s 41(1)(a) of the Privacy Act in her decision of 12 April 2022, or any error in approach by the Department in its search, as referred to in the findings of the delegate. For these reasons, I am of opinion that the application must be dismissed with costs. I certify that the preceding forty-eight (48) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Rares.