This is an application pursuant to the Privacy and Personal Information Protection Act 1998 (NSW) ("PPIP Act"). The applicant in this matter, David Ward alleges breaches of information protection principles contained in the PPIP Act. The respondent, the Information and Privacy Commission ("IPC" or "Respondent") denies any such breaches. The determination sought by the Applicant is whether such breaches occurred and if so the consequences.
The question of whether the Civil and Administrative Tribunal ("Tribunal") has jurisdiction to hear the Applicant's application for review at the present time, is the question for determination in these proceedings.
[2]
Background
On 13 July 2023, the Applicant made an application under the Government Information (Public Access) Act 2009 (NSW) ("GIPA Act") for access to certain video footage from the Department of Communities and Justice ("Department").
On 27 August 2023, the Department determined the application under s 72(1)(a) of the GIPA Act to provide the Applicant with view only access rather than providing the Applicant with a copy of the video file.
On 1 October 2023, the Applicant applied for external review of the Department's decision by the Information Commissioner pursuant to s 89 of the GIPA Act.
The application included a statement purporting to consent that the IPC will, among other things, provide certain information to the relevant agency. The Applicant did not tick the box referable to that consent.
The Respondent completed a report on 4 December 2023 following its external review. The report, among other things, stated that the Applicant's concerns regarding accessibility of the options being provided to him were outside the remit of the external review and was being dealt with separately as a complaint.
On 27 December 2023, the Applicant wrote a letter to the then Information Commissioner complaining that his personal information had been mishandled in contravention of certain provisions of the PPIP Act.
On 11 January 2024, an officer of the IPC provided the Applicant with a response to his complaint finding that there was no breach of the Applicant's privacy.
Following correspondence dealing with an intention to amend his privacy complaint, the Applicant on 15 July 2024, filed an application for administrative review by the Civil and Administrative Tribunal ("Tribunal"). That application was expressed to be made under s 53(6) and 55 of the PPIP Act. The Applicant sought review of the decision of 11 January 2024.
On 26 August 2024, the Tribunal made orders remitting the Applicant's complaint to the Respondent for internal review.
The internal review was conducted by the Information Commissioner at the time, Rachel McCallum. She was also the CEO of the IPC. That review was completed on 24 September 2024, finding that the Respondent was not in breach of the relevant provisions of the PPIP Act. However, an apology was provided in respect to certain matters concerning the IPC's conduct and handling of the Applicant's complaint.
On 7 October 2024, the Applicant wrote to the Tribunal informing the Tribunal that he was dissatisfied with the outcome of the internal review and that he wished to proceed with his application for administrative review.
On 22 November 2024, the Respondent filed submissions in support of its position that it had not breached the PPIP Act. On the same day, the Applicant filed his legal argument.
On 25 November 2024, the Appeal Panel of the Tribunal handed down its decision in Jeray v Information and Privacy Commission [2024] NSWCATAP 239 ("Jeray").
The Respondent filed supplementary submissions on 9 December 2024, submitting that the Tribunal, having regard to the decision in Jeray, did not have jurisdiction to determine the application for administrative review made by the Applicant. Whether the Tribunal has or does not have jurisdiction is the matter for determination by the Tribunal at the present time.
[3]
Consideration
A preliminary matter for determination was whether the correct party had been made subject to these proceedings as respondent. The proceedings had been recorded as having been commenced against the "Privacy Commissioner" and the "Information Commissioner". The application for review made by the Applicant, however, had recorded the respondent as the IPC. The decision of 11 January 2024, the subject of the application for review in this matter, was on the letterhead of the IPC and signed on its behalf.
Other documents, including correspondence and submissions identified the respondent as the "Information Commissioner", the "Privacy Commissioner" or the "Information and Privacy Commission". The Privacy Commissioner was removed as a party before hearing. It is unclear why these identifications differ from the identity of the decision maker shown on the decision of 11 January 2024 under review and the Applicant's application for review of 15 July 2024.
The Crown Solicitor informed the Tribunal that it was representing the IPC. The Applicant agreed that the IPC was the respondent in accordance with his application for review of 15 July 2024.
While the agreement of the parties are not determinative, I accept that the identity of the respondent is the IPC, relying on who the decision maker named and identified in the decision of 11 January 2024 was. Accordingly, the name of the Respondent needs to be recorded as the "Information and Privacy Commission".
A more fundamental question was whether the Tribunal had jurisdiction to review conduct of the Respondent. That question arises following the decision of the Appeal Panel of the Tribunal in Jeray of 25 November 2024.
The Respondent's submission is that the Tribunal does not have jurisdiction, unless the Applicant has first obtained leave of the Supreme Court of NSW. In the Respondent's submission, this was a consequence of the operation of s 42 of the Government Information (Information Commissioner) Act 2009 (NSW) ("GIIC Act") which allowed certain immunities to the Information Commissioner. No such leave, at the time of the hearing of this matter, had been obtained.
Section 42 provides as follows:
"42 Immunity of Commissioner and others
(1) Neither the Commissioner nor a member of staff of the Commissioner is liable, whether on the ground of want of jurisdiction or on any other ground, to any civil or criminal proceedings in respect of any act, matter or thing done or omitted to be done for the purpose of executing this or any other Act unless the act, matter or thing was done, or omitted to be done, in bad faith.
(2) Civil or criminal proceedings in respect of any act or omission referred to in subsection (1) cannot be brought against the Commissioner or a member of staff of the Commissioner without the leave of the Supreme Court.
(3) The Supreme Court is not to grant leave under subsection (2) unless it is satisfied that there is substantial ground for the contention that the person to be proceeded against has acted, or omitted to act, in bad faith".
The "Commissioner" referred to in s 42 is the "Information Commissioner" (s 3, GIIC Act).
The appellant in Jeray had sought information under the GIPA Act from the IPC. The Appeal Panel, at [91] described the operation of s 42 in the following terms:
" ….. s 42 would prevent (without leave of the Supreme Court) the bringing of proceedings in the Tribunal for an administrative review of the access refusal decision only if all three of the following conditions are satisfied:
(1) the review proceedings are proceedings against the Information Commissioner or a member of staff of the Commissioner.
(2) the review proceedings are civil or criminal proceedings.
(3) the decision was an act, matter or thing done or omitted to be done for the purpose of executing the GIIC Act or any other Act such as the GIPA Act".
The Appeal Panel found that s 42 of the GIIC Act prevented proceedings for an administrative review of the access refusal decision under the GIPA Act being brought in the Tribunal, unless the Supreme Court granted leave. If leave for proceedings had not been granted where required under s 42, the Appeal Panel said that the Tribunal did not have jurisdiction to determine the proceedings.
Whether the outcome will be the same in respect of an application for review by the Tribunal of the conduct and relevant decision of the Respondent under the PPIP Act needs to be considered, having regard to each of the three elements set out in s 42.
[4]
Commissioner or member of staff
The first question is whether the conduct and decision under review were those of the Commissioner or a member of her staff.
The Appeal Panel decided in Jeray that a reference to a "member of staff" of the Information Commissioner in s 42 should be read as including a member of staff of the IPC which the Commissioner headed (at [94]). Section 42 could, in the view of the Appeal Panel, also apply to the IPC as a collective of its staff (at [95]). The Appeal Panel went on to observe that any "artificial entity such as a corporation, can only act through its individual officers. The same observations apply to decisions of the IPC made by its staff". The Appeal Panel referred to s 8(b) of the Interpretation Act 1987 (NSW). That paragraph provided that a reference in an Act to a word or expression in the singular form includes a reference to the word or expression in the plural form. The reference in the singular to "member of staff" in s 42 of the GIIC Act could, therefore, in the view of the Appeal Panel "be read as encompassing members acting collectively as the IPC" (at, [100]). It followed that "whether the access refusal decision is characterised as a decision of the IPC or of a particular member of staff of the IPC, proceedings for an administrative review of the decision are proceedings to which s 42 applies provided they are civil or criminal proceedings" (at [101]).
It follows from the reasoning of the Appeal Panel, that the conduct and decision under review in the current proceedings, being that of a member of staff of the IPC or otherwise the IPC as such, s 42 may apply if these proceedings are "civil or administrative proceedings".
[5]
Civil or Criminal proceedings
In Jeray, the Tribunal at first instance found that the administrative review application brought by the Appellant did not constitute "civil proceedings" because the Tribunal effectively stood in the shoes of the administrator and was not determining a civil claim against the respondent in that case, such as a claim for damages under the PPIP Act.
The Appeal Panel, however, found that "the injunction in s 42 against bringing "civil or criminal proceedings" is best understood as an injunction against bringing proceedings before a third party to quell a legal dispute concerning the conduct of the Information Commissioner or a member of the Commissioner's staff", at [113]. The Appeal Panel said, at [114]-[115]:
"In cases of an administrative review by the Tribunal, care must be taken not to conflate the role of the Tribunal in the review with that of the decision-maker whose decision is under review. The parties to a dispute about the decision of a decision-maker are the decision-maker and the person challenging the decision. The Tribunal is not a party to the dispute even though it is clothed with the same powers as the decision-maker in order to resolve it. The Tribunal's role is to make an independent determination about what is the correct and preferable decision after an initial decision has already been made by one of the parties. Moreover, the Tribunal's jurisdiction is invoked only if an application is made to it by the aggrieved person, with the decision-maker (rather than the Tribunal) being the contradictor. The Tribunal does not act as the judge in its own cause; it acts having regard to the submissions of opposing parties.
The role of the Tribunal in an administrative review of decision is closer to the role of a court in a judicial review of a decision……
We consider that s 42 applies to proceedings for an administrative review by the Tribunal of a decision, regardless of whether it is exercising judicial or administrative power to determine the proceedings, provided the decision is an act, matter or thing done or omitted to be done for the purpose of executing the GIIC Act or any other Act such as the GIPA Act. Section 42 therefore covers proceedings for an administrative review under the GIPA Act like those brought by the Appellant".
The Applicant's application in this matter has been made under s 53(6) and 55 of the PPIP Act, seeking administrative review of the Respondent's conduct in issue. The particular question the Applicant seeks determination of is whether the Respondent's conduct has placed it in breach of relevant provisions of the PPIP Act. What is in dispute is whether such a breach or breaches have occurred.
In carrying out its review, the Tribunal is not assuming the role of a new party to the dispute. The Tribunal is asked to "quell a dispute" arising out of the conduct of the Respondent. As under the GIPA Act, the Tribunal is called upon to make an independent decision upon application by an aggrieved person, having received the evidence and heard the submissions of both parties.
The administrative decision maker may adhere to its policies and practices in making decisions. The Tribunal, however, does not, in this regard, act as the administrator might act. The Tribunal is required to make its independent decision, including the exercise of any discretion, in accordance with applicable principles of law. In doing so, it is not bound by administrative policies and practices not having force of law.
Having regard to the considerations set out above, I am of the opinion that whether or not the proceedings brought by the Applicant are for administrative or judicial review, these proceedings answer the description of "civil" proceedings within the meaning of s 42.
[6]
matter or thing done or omitted to be done
Section 42 applies to proceedings for an administrative review by the Tribunal of a relevant matter, regardless of whether it is exercising judicial or administrative power to determine the proceedings, provided what is under review is an "act, matter or thing done or omitted to be done for the purpose of executing" the GIIC Act or "any other Act", such as the PPIP Act.
An act, matter or thing done or omitted to be done may not be for "the purpose of executing the GIIC Act or any other Act" unless done in the exercise of a statutory function. Acts done in the nature of internal administration may not answer this description (Jeray, at [118]-[120]).
Section 42 closely follows s 35A of the Ombudsman Act 1974 (NSW). The Appeal Panel, considering the reach of s 35A, said at [122]:
"The cases on s 35A draw a distinction between the functions of persons protected by the section that concern internal administration and functions with an external effect. An exercise of a function concerns a matter of internal administration if it involves the non-public relationship of a statutory agency to matters of an administrative kind that are common to all statutory agencies such as administration of employment responsibilities and installation and operation of computer systems: QQ v NSW Ombudsman (EOD) [2012] NSWADTAP 34 (QQ) at [26]. However, an exercise of a function will have an external effect if it is connected to an important function with a public impact that is assigned under a statute to the protected persons: QQ at [26]; Laughton at [26].
Given the wording of s 42 of the GIIC Act closely follows the wording of s 35A, we see no reason why the distinction between kinds of functions drawn by the cases for 35A should not also be drawn for s 42".
The Appeal Panel went on to find that the access refusal decision under consideration in Jeray was an act, matter or thing done or omitted to be done for the purpose of executing the GIPA Act. The denial of access to government information to a member of the public who had duly requested it was not a decision about the internal administration of the IPC.
The matter in issue in these proceedings arises out of certain conduct of the IPC and an administratively reviewable decision made on 11 January 2024 that no relevant privacy breaches had occurred. A subsequent review of that decision was not completed within the required time, resulting in the Applicant applying to the Tribunal for administrative review under s 53(6) and 55 of the PPIP Act. The conduct and decision about that conduct the subject of these proceedings, do not go to matters of internal administration of the Respondent. They go to the proper execution by the Respondent of its statutory functions under the PPIP Act.
To the extent that I am required to consider actions under the GIIC Act and under Part 5, Div 3 of the GIPA Act, these are also not matters of internal administration.
Accordingly, I find that the matters under review fall within the description of an act, matter or thing done or omitted to be done for the purpose of executing the PPIP Act (and the GIIC Act and GIPA Act to the extent that review by the Tribunal of matters under these Acts is sought).
[7]
Conclusion
I find for the reasons set out above that the Tribunal does not have jurisdiction to hear the matter before it in these proceedings without the leave of the Supreme Court. As the Supreme Court has not granted leave, it follows that the Tribunal does not have administrative review jurisdiction with respect to the conduct and decision of the Respondent the subject of the Applicant's application.
[8]
Orders
1. The name of the Respondent is amended to "Information and Privacy Commission".
2. The Applicant's application for review is dismissed.
[9]
I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.
Registrar
[10]
Amendments
15 January 2025 - Paragraph 3: correction of date from "2024" to "2023".
23 January 2025 - Paragraph 19: Month amended from 'June' to 'July'.
DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.
Decision last updated: 23 January 2025