Rahman v Ashpole [2007] FCA 1067

FEDERAL COURT OF AUSTRALIA

Rahman v Ashpole [2007] FCA 1067 MOHAMMAD TABIBAR RAHMAN v LIN ASHPOLE, MARTIN BARKER AND PRIVACY COMMISSIONER NSD 1196 OF 2007

GRAHAM J

16 JULY 2007

SYDNEY IN THE FEDERAL COURT OF AUSTRALIA

NEW SOUTH WALES DISTRICT REGISTRY NSD 1196 OF 2007

BETWEEN: MOHAMMAD TABIBAR RAHMAN

Applicant

AND: LIN ASHPOLE

First Respondent

MARTIN BARKER

Second Respondent

PRIVACY COMMISSIONER

Third Respondent

JUDGE: GRAHAM J DATE OF ORDER: 16 JULY 2007

WHERE MADE: SYDNEY

THE COURT ORDERS THAT:

1. The application for leave to appeal filed 27 June 2007 be dismissed. 2. The applicant pay the costs of the first and second respondents on an indemnity basis. 3. The applicant pay the costs of the third respondent on a party and party basis. Note: Settlement and entry of orders is dealt with in Order 36 of the Federal Court Rules.

IN THE FEDERAL COURT OF AUSTRALIA

NEW SOUTH WALES DISTRICT REGISTRY NSD 1196 OF 2007

BETWEEN: MOHAMMAD TABIBAR RAHMAN

Applicant

AND: LIN ASHPOLE

First Respondent

MARTIN BARKER

Second Respondent

PRIVACY COMMISSIONER

Third Respondent

JUDGE: GRAHAM J

DATE: 16 JULY 2007

PLACE: SYDNEY

REASONS FOR JUDGMENT 1 Section 31A(2) and (3) of the Federal Court of Australia Act 1976 (Cth) (the 'Federal Court of Australia Act') relevantly provided as follows: '31A(2) The Court may give judgment for one party against another in relation to the whole…of a proceeding if: (a) the first party is defending the proceeding …; and (b) the Court is satisfied that the other party has no reasonable prospect of successfully prosecuting the proceeding…. (3) For the purposes of this section … a proceeding … need not be: (a) hopeless; or (b) bound to fail; for it to have no reasonable prospect of success.' 2 On 5 February 2007, the applicant commenced proceeding NSD 148 of 2007 seeking relief under ss 5, 6 and 7 of the Administrative Decisions (Judicial Review) Act 1977 (Cth) (the 'AD(JR) Act'). The gravamen of the applicant's complaint was that a decision of Anna Dobkin, Assistant Compliance Officer, Compliance Section of the Office of the Privacy Commissioner of 8 January 2007 warranted review under the AD(JR) Act. The applicant pointed out that at the time of the making of his application on 5 February 2007, he was unaware of a further decision of Ms Dobkin of 1 February 2007 and of another decision of Ms Dobkin of 28 February 2007, which was communicated to the applicant on 28 February 2007 and also to a Mr Marshall at 'Commonwealth Bank of Australia Limited' (sic). 3 The respondents named by the applicant in his Application filed 5 February 2007 were two officers of Commonwealth Bank of Australia (the 'Commonwealth Bank') and the Privacy Commissioner. 4 By a Notice of Motion filed 26 March 2007, the first and second respondents applied to have the Application struck out or summarily dismissed. On 27 April 2007, the first and second respondents amended their Notice of Motion to also seek summary judgment under s 31A(2) of the Federal Court of Australia Act and to seek an order for costs on an indemnity basis. Without filing any separate Notice of Motion, the third respondent sought similar relief in respect of the claims made by the applicant against the third respondent. 5 The Amended Notice of Motion filed 27 April 2007 was heard by the primary judge on that day and decided by him on 20 June 2007. The orders made by the primary judge were as follows: 'The Court orders that: 1. Summary judgment under s 31A of the Federal Court of Australia Act 1976 (Cth) be entered in favour of the respondents. 2. The applicant pay the costs of the first and second respondents on an indemnity basis. 3. The applicant pay the costs of the third respondent on a party/party basis. 4. Costs are to be taxed if not agreed.' 6 On 27 June 2007, the applicant filed a Notice of Motion in the current proceedings seeking leave to appeal from the judgment of the primary judge in accordance with ss 24(1)(a) and 24(1A) of the Federal Court of Australia Act. It is that application for leave to appeal which is presently before the Court in accordance with s 25(2)(a) of the Federal Court of Australia Act and Order 52 rules 2AA and 10 of the Federal Court Rules. The questions which arise on such an application are, firstly, whether the decision of the primary judge was attended by a sufficient doubt to warrant its reconsideration and, secondly, whether substantial injustice would result if leave to appeal were refused. 7 The genesis of the applicant's complaint is to be found in a letter of 23 August 2006 from the Commonwealth Bank to Centrelink, providing information which was requested in a letter of 12 August 2006 directed to 'The Public Officer' of the Commonwealth Bank in accordance with ss 192 and 196 of the Social Security (Administration) Act 1999 (Cth) (the 'Social Security (Administration) Act'). 8 By s 197(1) of the Social Security (Administration) Act, it is an offence for a person to refuse or fail to comply with a requirement to give information or produce a document as required by ss 192 and 196 of the Social Security (Administration) Act. 9 It is unnecessary for present purposes to set out in detail the terms of ss 192 and 196. Suffice it to say that s 196(1) provides for requirements under s 192 to be given by written notice to the person of whom the requirement is made. Section 192 commences as follows: '192 The Secretary may require a person to give information, or produce a document that is in the person's custody or under the person's control, to the Department if the Secretary considers that the information or document may be relevant to one or more of the following: (a) the question whether a person who has made a claim for a social security payment is or was qualified for the payment; …' 10 As I understand the arguments advanced by the applicant, one of his primary submissions is that the words 'a person', where used in the preamble to s 192, must be read down in the manner in which the reference to 'a person' has been qualified in sub-paragraph (a), i.e. the applicant contends that the only person from whom the Secretary may require information to be given or documents to be produced is a person 'who has made a claim for a social security payment.' This submission is plainly untenable. Had the legislature so intended it would have included the words 'who has made a claim for a social security payment' in the preamble after the words 'the Secretary may require a person'. Where used in the preamble, it is clear that 'a person' should be given the meaning contemplated by s 22(1)(a) of the Acts Interpretation Act 1901 (Cth) i.e. 'a person' includes not only natural persons but also bodies politic and bodies corporate such as the Commonwealth Bank. 11 On 23 August 2006 the Commonwealth Bank informed the applicant that Centrelink had approached it seeking information regarding his account(s) and that the Commonwealth Bank had provided the information requested. The applicant contends that by the provision of the information the first and second respondents somehow or other breached the relevant privacy legislation. 12 The evidence before the primary judge was that the information provided to Centrelink was provided for and on behalf of the Commonwealth Bank by a 'Service Manager', Anthony Gattellari. 13 The first respondent's involvement seems to have been that she spoke to the applicant and informed him of the manner in which the Bank had dealt with Centrelink's request for information (see the letter from the Commonwealth Bank to the applicant of 8 September 2006). 14 The second respondent's involvement appears to have been to write a letter to the applicant on 29 November 2006 which he signed as a 'Case Officer Customer Relations' of the Commonwealth Bank informing the applicant that: 'The Bank now considers the matter closed and any further correspondence on this issue will not be answered.' 15 It appears that the applicant wrote to the Office of the Privacy Commissioner on 21 December 2006 alleging that the Commonwealth Bank of Australia Limited (sic) had interfered with his privacy by disclosing his personal information to Centrelink. 16 Section 16A(2) of the Privacy Act 1988 (Cth) (the 'Privacy Act') provided as follows: '16A(2) To the extent (if any) that an organisation is not bound by an approved privacy code, the organisation must not do an act, or engage in a practice, that breaches a National Privacy Principle.' 'Organisation' is defined in s 6C of the Privacy Act to include, amongst other things: '(b) a body corporate; … that is not a small business operator …' 17 Insofar as Mr Gattellari may have had an involvement in the provision of information on behalf of the Commonwealth Bank to Centrelink, it is clear that responsibility for his actions would rest with the Commonwealth Bank rather than himself under s 8 of the Privacy Act. 18 The National Privacy Principles are set out in Schedule 3 to the Privacy Act. Clause 2.1 precludes an organisation such as the Commonwealth Bank from disclosing personal information about an individual such as the applicant for a secondary purpose within the meaning of the Privacy Act unless one of a number of sub-paragraphs relevantly applies to the information in question. For present purposes, it is sufficient to have regard to sub-paragraph (g). Clause 2.1(g) provided as follows: '2.1 An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless: … (g) the use or disclosure is required or authorised by or under law; …' 19 It is abundantly clear that the disclosure by the Commonwealth Bank of the information concerning the applicant's account, which was forwarded by the Bank to Centrelink under cover of the letter of 23 August 2006, which was signed for and on behalf of the Commonwealth Bank by Mr Gattellari, involved a use or disclosure of personal information concerning the applicant which was required or authorised by or under the provisions of the Social Security (Administration) Act to which reference has been made. 20 As I understood the submissions of the applicant he considers that by their involvement in the provision of the relevant information to Centrelink, Ms Ashpole and Mr Barker, the first and second respondents, somehow or other committed an offence under s 203(1) of the Social Security (Administration) Act. Section 203(1) of the Social Security (Administration) Act does not make the provision of information an offence, rather it is concerned with the obtaining of information. Furthermore it only applies where the person obtaining information knows or ought reasonably to know that the information is 'protected information'. 21 Under s 3(2) of the Social Security (Administration) Act expressions used in the Social Security (Administration) Act have the same meaning as those which apply under the Social Security Act 1991 (Cth) (the 'Social Security Act'). 'Protected information' is defined in s 23 of the Social Security Act as follows: '23(1) In this Act, unless the contrary intention appears: ... "protected information" means: (a) information about a person that is or was held in the records of the Department or of the Agency; or (b) information about a person obtained by an officer under the family assistance law that is or was held in the records of the Australia Taxation Office or Medicare Australia; or (ba) information about a person obtained by an officer under the family assistance law that was held in the records of the Health Insurance Commission; or: (c) information to the effect that there is no information about a person held in the records of one or more of the following: (i) the Department; (ii) the Agency; (iii) the Australian Taxation Office; (iv) Medicare Australia.' 22 It is, with great respect to the applicant, impossible to conceive how s 203(1) of the Social Security (Administration) Act can have any application whatsoever to the obtaining by Centrelink of information which is held by the Commonwealth Bank. 23 In response to the complaints raised by the applicant with the Office of the Privacy Commissioner, Ms Dobkin wrote to the applicant on 8 January 2007 stating, amongst other things: 'I refer to your correspondence received on 21 December 2006 in which you allege that Commonwealth Bank Of Australia Limited (CBA) (sic) has interfered with your privacy by disclosing your personal information to Centrelink. I have treated your letter as a complaint under section 36 of the Privacy Act 1988 (Cth) (the Act). … … If CBA was issued with a valid Centrelink notice to produce the documents containing your personal information, then disclosure in accordance with such a notice would likely by authorised by NPP 2.1(g). This means that your complaint does not appear to constitute a breach of the privacy principles and I am therefore declining to investigate your complaint. …' 24 It would appear that the applicant responded to Ms Dobkin's letter on 15 January 2007 whereupon Ms Dobkin wrote again to the applicant on 1 February 2007 stating, amongst other things: 'Thank you for your letter of complaint received on 21 December 2006 and for your further correspondence received 15 January 2007 regarding the above matter. I am writing to acknowledge that we have received your correspondence and to advise you that we have reassessed your complaint and have decided to make preliminary enquiries into your allegations. We will advise you as to the progress of these preliminary inquiries. …' 25 On 28 February 2007 Ms Dobkin again wrote to the applicant. On this occasion she said, amongst other things: … As you are aware from my letter to you dated 8 January 2007, I have treated your letter as a complaint under section 36 of the Privacy Act 1988 (Cth) (the Act). … Subsequent to further correspondence received from you on 15 January 2007, I advised you in my letter dated 1 February 2007 that this Office had reassessed your complaint and decided to make preliminary enquiries into your allegations. In the course of conducting preliminary enquiries, I obtained a copy of the Centrelink notice which was issued on 12 August 2006 and sent to CBA. … It appears that sections 192 and 196 of the Social Security (Administration) Act 1999 (Cth) set out Centrelink's powers to require CBA to produce … information. Therefore, it appears that in this instance NPP 2.1(g) permits CBA to disclose the specified personal information to Centrelink. I therefore take the view that since the aforementioned disclosure was required by law, there does not appear to have been an interference with your privacy as defined by the Act. It is for this reason that I am declining to investigate your complaint against CBA under section 41(1)(a) of the Act. My file in this matter is now closed. …' 26 A letter was also sent by Ms Dobkin to Mr Marshall, a case manager at the Commonwealth Bank, on the same day advising of her decision as communicated to the applicant. 27 Section 5 of the AD(JR) Act provides for persons who are aggrieved by 'a decision to which this Act applies' to apply to the Court for an order of review in respect of the decision on one of a number of grounds. 28 Section 6 of the AD(JR) Act allows a person who is aggrieved by conduct for the purpose of making a decision to which the AD(JR) Act applies to apply to the Court for an order of review in respect of the conduct in which the relevant person has engaged or is engaging or proposes to engage on one or more of a number of grounds. 29 Section 7 of the AD(JR) Act makes provision for a person who is aggrieved by the failure of a relevant person to make a decision to which the AD(JR) Act applies to apply to the Court for an order of review in respect of the failure to make the decision on the ground that there has been an unreasonable delay in making the decision. As I understand the applicant's submissions, he concedes that s 7 of the AD(JR) Act is irrelevant for present purposes. 30 The expression 'decision to which this Act applies' is relevantly defined in s 3(1) of the AD(JR) Act as follows: '3(1) In this Act, unless the contrary intention appears: … "decision to which this Act applies" means a decision of an administrative character made, proposed to be made, or required to be made (whether in the exercise of a discretion or not and whether before or after the commencement of this definition): (a) under an enactment referred to in paragraph (a), (b), (c) or (d) of the definition of enactment; or (b) by a Commonwealth authority or an officer of the Commonwealth under an enactment referred to in paragraph (ca) or (cb) of the definition of enactment: other than …'