SZWCH v Minister for Immigration and Border Protection

The decision in SZSSJ 9 The factual background to the decision of both the Full Court of this Court in SZSSJ v Minister for Immigration and Border Protection (No 2) [2015] FCAFC 125, (2015) 234 FCR 1, and the decision of the High Court, was the "Data Breach" that had occurred in March 2014. 10 The extent of the "Data Breach" was considerable. It concerned the inadvertent disclosure by the Department of the identities of more than 9,000 people who were in immigration detention. The information disclosed the identities of the detainees, their date of birth, nationality, gender, details about their detention and whether they had family members also in detention. 11 Central to the decisions of the Full Court and the High Court was whether the Minister had decided personally to intervene. The Migration Act confers a number of powers specifically upon the Minister which he alone can exercise. By way of example, s 48A of that Act (in general terms) precludes a non-citizen who has made an unsuccessful application for a protection visa which has been finally determined from making a further application. But s 48B confers power upon the Minister to decide that s 48A is not to apply. Reference may also be made to s 195A (which confers power upon the Minister to grant a visa to a person in detention) and s 417 (which confers power upon the Minister to make a more favourable decision than one made by the Tribunal). 12 On the facts presented, the High Court in SZSSJ concluded that the Minister had made "a personal procedural decision". More fully expressed, the High Court stated: [55] … the question whether the Minister personally has made a procedural decision to consider whether to grant a visa or to lift a bar in a particular case or class of cases is a question of fact. [56] Here, on the unchallenged finding of the Full Court, the Minister has made a personal procedural decision to consider whether to grant a visa under s 195A and s 417 of the Act or to lift the bar under s 48B in the case of each applicant for a protection visa affected by the Data Breach. The ITOA processes have been undertaken by officers of the Department to assist the Minister in that consideration. An ITOA is accordingly properly characterised as a process undertaken by an officer of the Department under and for the purposes of ss 48B, 195A and 417 of the Act. The reference to "ITOA" was a reference to the Departmental "International Treaties Obligations Assessments". 13 The evidential basis upon which the Full Federal Court proceeded was identified as follows in its reasons for decision ([2015] FCAFC 125, (2015) 234 FCR at 22 to 23) as follows: [75] … The relevant evidence is: • the Secretary of the Department wrote to SZSSJ on 12 March 2014 and told him that his claims arising from the Data Breach would be considered as part of its normal processes; • whatever those processes were, they were supervened on 30 September 2014 by the ITOA process; • SZSSJ was informed by letter dated 1 October 2014 that the purpose of the ITOA was "to assess whether the circumstances of your case engage Australia's non-refoulement obligations"; • the ITOA process was governed by a detailed instructional guideline called Procedures Advice Manual 3 ("PAM 3") which was entitled "Refugee and Humanitarian International Treaties Obligations Assessments"; and • there were 9,258 protection visa applicants affected directly by the Data Breach. The letter dated 1 October 2014 stated in part as follows: On 30 September 2014 the Department of Immigration and Border Protection (the department) commenced an International Treaties Obligations Assessment (ITOA) in order to assess whether the circumstances of your case engage Australia's non-refoulement obligations. The reason the department has commenced this ITOA is that you were affected by a routine report released on the department's website unintentionally enabling access to personal information about people who were in immigration detention on 31 January 2014. Any protection claims you may have in relation to this breach of your personal data will be assessed through this ITOA. On 30 June 2014, you were handed a letter requesting you to provide the department with any concerns you may have in regards to the breach of your personal data. On 4 July 2014, you provided a response outlining your concerns. The information you provided in your response will be considered through this ITOA process. 14 Much turned upon whether the Minister had made "a personal procedural decision" to intervene. If he had, it attracted a duty to afford procedural fairness. The High Court referred to its earlier decision in Plaintiff M61/2010E v Commonwealth [2010] HCA 41, (2010) 243 CLR 319 and continued: [43] As to the structure of those powers, the Court stated that "[e]xercise of the powers given by ss 46A and 195A is constituted by two distinct steps: first, the decision to consider exercising the power to lift the bar or grant a visa and secondly, the decision whether to lift the bar or grant a visa". The Court noted that the Minister "is not obliged to take either step". Their Honours continued in SZSSJ: [52] Three principles are to be drawn from Plaintiff M61/2010E and Plaintiff S10/2011 concerning the construction and relevant application of ss 48B, 195A and 417 of the Act. [53] First, each section confers a non-compellable power that is exercised by the Minister personally making two distinct decisions: a procedural decision, to consider whether to make a substantive decision; and a substantive decision, to grant a visa or to lift the bar. The Minister has no obligation to make either decision, and neither the procedural decision nor the substantive decision of the Minister is conditioned by any requirement that the Minister afford procedural fairness. [54] Second, processes undertaken by the Department to assist in the Minister's consideration of the possible exercise of a non-compellable power derive their character from what the Minister personally has or has not done. If the Minister has made a personal procedural decision to consider whether to make a substantive decision, a process undertaken by the Department to assist the Minister's consideration has a statutory basis in that prior procedural decision of the Minister. Having that statutory basis, the process attracts an implied statutory requirement to afford procedural fairness where the process has the effect of prolonging immigration detention. If the Minister has not made a personal procedural decision to consider whether to make a substantive decision, a process undertaken by the Department on the Minister's instructions to assist the Minister to make the procedural decision has no statutory basis and does not attract a requirement to afford procedural fairness. [55] Third, the question whether the Minister personally has made a procedural decision to consider whether to grant a visa or to lift a bar in a particular case or class of cases is a question of fact. In applying these principles, the High Court concluded (inter alia): [56] Here, on the unchallenged finding of the Full Court, the Minister has made a personal procedural decision to consider whether to grant a visa under s 195A and s 417 of the Act or to lift the bar under s 48B in the case of each applicant for a protection visa affected by the Data Breach. The ITOA processes have been undertaken by officers of the Department to assist the Minister in that consideration. An ITOA is accordingly properly characterised as a process undertaken by an officer of the Department under and for the purposes of ss 48B, 195A and 417 of the Act. In concluding that procedural fairness was required, the High Court stated: [74] Characterisation of an ITOA as a process undertaken by an officer of the Department under and for the purposes of ss 48B, 195A and 417 of the Act leads directly to the conclusion that procedural fairness is required in the undertaking of that process. [75] Why that conclusion follows is that it must now be taken to be settled that procedural fairness is implied as a condition of the exercise of a statutory power through the application of a common law principle of statutory interpretation. The common law principle, sufficiently stated for present purposes, is that a statute conferring a power the exercise of which is apt to affect an interest of an individual is presumed to confer that power on condition that the power is exercised in a manner that affords procedural fairness to that individual. The presumption operates unless clearly displaced by the particular statutory scheme.

The chronology of events in the present appeal 15 The abbreviated chronology of events in the present appeal is relevantly as follows: Application for a protection visa 22 January 2014 Delegate's decision 6 February 2014 Letter advising of "Data Breach" 12 March 2014 Date of hearing before Tribunal 10 April 2014 Date of Tribunal's decision 27 May 2014 Date of Federal Circuit Court's decisions 1 May 2015 Date of High Court's decision in SZSSJ 27 July 2016

16 The Department's letter to the Appellant dated 12 March 2014 stated: Unauthorised access to personal information In February 2014 a routine report released on the department's website unintentionally enabled access to some personal information about people who were in immigration detention on 31 January 2014. This information was accessible online for a short period of time before it was removed from the department's website. The information was not visible as part of the report, and was not easily accessible. As you were in immigration detention on 31 January 2014, I am informing you that some of your personal information may have been accessed through the report for that short time. We deeply regret inadvertently allowing potential unauthorised access to your personal information. The department takes privacy very seriously, and has in place a range of policies and procedures to ensure that personal information is managed properly. The information was never intended to be in the public domain, and the department has taken a number of steps to ensure that this sort of incident does not happen again. The information that it was possible to access was your name, date of birth, nationality, gender, details about your detention (when you were detained, reason and where) and if you have other family members in detention. The information did not include your address (or any former address), phone numbers or any other contact information. It also did not include any information about protection claims that you or any other person may have made, and did not include any other information such as health information. The department will access any implications for you personally as part of its normal processes. You may also raise any concerns you have during those processes. If you would like to seek more information about the incident, talk to your case manager. That letter was a "pro forma" letter which had apparently been sent to those persons the subject of the "Data Breach". 17 This letter, it will be noted, pre-dated the hearing and decision of the Tribunal.

The taking of a personal procedural decision - a fact specific inquiry 18 Unlike the facts that were presented unchallenged to the High Court, the facts of the present case relevantly ceased with the provision of the letter dated 12 March 2014. There was no further evidential support for reaching a finding that the Minister had made a "personal procedural decision" by reference (for example) to either the terms of that letter or any subsequent correspondence - as was the case in SZSSJ. 19 The 12 March 2014 letter, it is respectfully considered, does not of itself evidence any such decision having been made by the Respondent Minister. In circumstances where those affected by the "Data Breach" were being proffered an assurance to address the consequences of that breach, it ill behoves the Minister to construe the terms of that letter in a way inconsistent with the assurance being proffered. But the fact remains that that letter: refers to the Department "assess[ing] any implications" - and, more importantly, stops short of any assurance that the Minister will intervene if necessary. The letter also contains no indication that: the Minister had made any decision in respect to the present Appellant. It is also relevant to note that: the Appellant did not seek to respond to that letter by (for example) requesting Ministerial intervention, especially in circumstances where he was later represented by both Counsel and a solicitor. When confining attention to the terms of the 12 March 2014 letter, Barker J in DZAEH v Minister for Immigration and Border Protection [2016] FCA 54 at [33] concluded that "any contention that the 12 March 2014 letter could support a claim of breach of a duty of procedural fairness must be considered very weak". 20 Probably in recognition of the absence of such further evidence as there was available in SZSSJ, reliance was sought to be placed by the Appellant upon para [56] of the reasons for decision of the High Court in SZSSJ as evidence of the fact that the Minister had made such a decision. But such reliance was misplaced because: the High Court was proceeding upon the basis of the "unchallenged finding" of the Full Federal Court, which was in turn based upon very different evidence to that now before this Court; the factual basis upon which the Respondent Minister sought to have the High Court resolve the issues presented in that case cannot be taken as a "finding of fact" that must be accepted in all other cases; and findings of fact made by one court cannot bind a subsequent court. 21 Nor is it open to the Appellant to contend that a decision of the Federal Circuit Court published in May 2015 should have proceeded upon the basis of some purported "finding of fact" made by the High Court in July 2016. Nor is it realistically open to the Appellant now to tender in this Court on the hearing of an appeal "fresh evidence" as to the fact finding processes of the Minister in the present case. 22 Whether or not the Minister made a "personal procedural decision" is obviously a question of fact to be resolved by reference to the evidence in any given case: SZSSJ [2015] FCAFC 125 at [75], (2015) 234 FCR at 22 to 23; [2016] HCA 29 at [55], (2016) 90 ALJR at 911. As the High Court emphasised, "the question whether the Minister has made a procedural decision to consider whether to grant a visa or to lift a bar in a particular case or class of cases is a question of fact": [2016] HCA 29 at [55], (2016) 90 ALJR at 911. 23 On the need to consider the factual context in which SZSSJ was invoked, Griffiths J in SZWAJ v Minister for Immigration and Border Protection [2016] FCA 1173 observed: [24] I accept the Minister's central submission that, at the time of the Data Breach, the appellant was in a very different and earlier stage in the consideration of any non-refoulement obligation Australia owed to her. In contrast with the position in the other proceedings, there was no evidence that the Minister had commenced considering the exercise of his dispensing powers under any of the non-compellable powers identified above. Significantly, apart from the two letters dated 12 March 2014 and 19 June 2014 which did not in terms refer to those powers, there was no evidence before the primary judge which indicated that the Minister had made "a personal procedural decision" to consider whether or not to exercise any of those dispensing powers (see SZSSJ High Court at [83]). That is to be contrasted with the evidence which supported the finding in SZSSJ Full Court at [75] relating to the commencement of the ITOA process. The letter dated 12 March 2014 was in the same terms as that received by the present Appellant. The letter dated 19 June 2014, to which Griffiths J referred, was a letter inviting the appellant in that case to put in writing any concerns she had about the effect of the "Data Breach". His Honour continued: [25] I accept the Minister's submission that the findings as to the lack of procedural unfairness in SZSSJ High Court were all directed to the ITOA process in circumstances where a factual finding had been made by the Full Court, which was not challenged on appeal, to the effect that consideration of the exercise of those dispensing powers had commenced. The application for judicial review in the case of SZWAJ was unsuccessful. 24 In the absence of any decision having been made by the Minister to intervene, the decision in SZSSJ is readily distinguishable and does not dictate any conclusion different to that reached by the Federal Circuit Court.

SZSSJ & the opportunity to make submissions 25 Separate from any finding of fact as to whether the Minister in the present case had made a "personal procedural decision" is the question as to whether the decision in SZSSJ was purporting to lay down a general principle applicable to all those persons affected by the "Data Breach". 26 Counsel for the Appellant repeatedly emphasised the proposition that the statement at para [56] of the High Court's reasons in SZSSJ was not expressed to be subject to any qualification. 27 It is respectfully considered that the High Court's decision in SZSSJ is not to be understood as laying down any general principle or finding that the Minister has made a "personal procedural decision" in all cases or in those cases where a person has applied (or may later apply) for a protection visa and who has received a letter in the terms of the 12 March 2014 letter. 28 The concern of the High Court was to ensure that a person who had been affected by the "Data Breach" was given an opportunity to make submissions as to the implications of that breach upon his own circumstances. 29 On the facts of the present case, the Appellant had an opportunity to make submissions as to the implications upon his personal circumstances of the "Data Breach" when he participated in the hearing before the Refugee Review Tribunal which occurred after the date of the breach. 30 In addition to emphasising the need to consider the facts of a particular case before unquestioningly invoking SZSSJ, Griffiths J in SZWAJ also emphasised the fact that the "Data Breach" on the facts before his Honour had occurred at a point of time prior to the application for the protection visa. His Honour regarded this factual difference to be "critical". His Honour's reasons thus continue: [26] It is critical to note that, in the proceeding here, the Data Breach occurred prior to the appellant applying for a protection visa. The processes which then ensued before both the Minister's delegate and the Tribunal provided the appellant with an opportunity to say whatever she wished to say concerning the implications of the Data Breach for her entitlement to protection. Subject to relevant provisions in the Migration Act the statutory processes of considering and determining her application for a protection visa, both by the delegate and on review by the Tribunal, attracted procedural fairness obligations. The appellant did not point to any aspect of those processes which involved procedural unfairness to her. Nor is her case strengthened by her reliance on SZSSJ High Court because of the findings made there concerning the different process which had commenced in respect of the aggrieved persons in those proceedings. [27] The significance of the fact that a person affected by the Data Breach has had an opportunity to make submissions and adduce evidence as to its significance to the particular person through the processes for considering and determining a visa application is highlighted in other decisions of this Court in SZVEY v Minister for Immigration and Border Protection [2015] FCA 394 at [14] per Bennett J and DZAEH v Minister for Immigration and Border Protection [2016] FCA 54 at [31]-[33] per Barker J, both of which support the approach taken by the primary judge here. 31 On the facts of the present appeal, the Appellant made no real attempt (if any) to make submissions to the Tribunal as to the significance to be placed upon the "Data Breach" when considering his application for review of the delegate's decision refusing a protection visa. But that matters not. What matters is the fact that he had the opportunity to do so.

CONCLUSIONS 32 The manner in which submissions were advanced on behalf of the Appellant in this Court departed considerably from the manner in which the case was advanced before the Federal Circuit Court. But Counsel for the Minister raised no obstacle to the resolution of the submissions now made. 33 The Appellant is unable to bring himself within the reach of the decision of the High Court in SZSSJ either because, on the facts presented: the Appellant was unable to establish that the Minister had made a "personal procedural decision"; and/or the decision in SZSSJ did not apply because he had the opportunity to make submissions in respect to the "Data Breach" when he was advised of the breach on 12 March 2014 and when he thereafter appeared before the Tribunal in April 2014. 34 Although the reasons now given depart considerably from those given by the Federal Circuit Court Judge, the appropriate order is that the appeal should be dismissed with costs.

THE ORDERS OF THE COURT ARE:

1. The appeal is dismissed.
2. The Appellant is to pay the costs of the Respondents. I certify that the preceding thirty-four (34) numbered paragraphs are a true copy of the Reasons for Judgment herein of the Honourable Justice Flick.