Civil and Administrative Tribunal New South Wales Medium Neutral Citation: ERS v Registrar of Births, Deaths and Marriages [2021] NSWCATAD 186 Hearing dates: 27 May 2021 Date of orders: 06 July 2021 Decision date: 06 July 2021 Jurisdiction: Administrative and Equal Opportunity Division Before: Naida Isenberg, Senior Member Decision: The decision under review is set aside. Catchwords: CHANGE OF NAME — fourth application — ongoing cyber fraud — whether reason for proposed change of name warrants registration of change of name — effect of failure to inform Registrar of criminal convictions Legislation Cited: Administrative Decisions Review Act 1997 (NSW) Births, Deaths and Marriages Registration Act 1995 (NSW) Births, Deaths and Marriages Registration Regulation 2017 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) Crimes (Sentencing Procedure) Act 1999 (NSW) Cases Cited: DZM v Registrar of Births Deaths and Marriages [2019] NSWCATAD 188 Ezekeil v Registrar of Births, Deaths and Marriages [2011] NSWADT 137 McDonald v Director-General of Social Security (1984) 1 FCR 354; [1984] FCA 59 Nakad v Commissioner of Police, NSW Police Force [2014] NSWCATAP 10 Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355; [1998] HCA 28 Shi v Migration Agents Registration Authority (2008) 235 CLR 286; [2008] HCA 31 Terzic v Registrar of Births, Deaths and Marriages [2013] NSWADT 82 Turkman v Registrar, NSW Registry of Births Deaths & Marriages [2011] NSWADT 258 Texts Cited: None cited Category: Principal judgment Parties: ERS (Applicant) Registrar of Births, Deaths and Marriages (Respondent) Representation: Solicitors: Applicant (self-represented) NSW Department of Customer Service (Respondent) File Number(s): 2021/00036679 Publication restriction: Pursuant to s 64 of the Civil and Administrative Tribunal Act 2013 (NSW): 1. I prohibit the disclosure of the name of the Applicant, ERS, to any person other than the Respondent and the legal advisers to the Respondent. 2. I prohibit the publication or broadcast of any part of a report of proceedings in the Tribunal, where such part discloses any name by which the Applicant was at any time known or applied to be known. 3. I prohibit the publication of evidence given before the Tribunal of matters contained in documents lodged with the Tribunal or received in evidence by the Tribunal to the extent that such evidence discloses any name by which the Applicant was at any time known or applied to be known or could reasonably be identified. 4. It is not a breach of these Orders if the Respondent provides a copy of this decision, including the past, present and new names of the Applicant, to the NSW Commissioner of Police. REASONS FOR DECISION Background 1. The Applicant, ERS, seeks review of the decision of the Respondent, the Registrar of Births, Deaths and Marriages dated 18 December 2020 that refused his request to alter his name for a fourth time. That decision was affirmed on internal review and the Applicant now seeks review by this Tribunal. Legislative Scheme 1. Section 3(c) of the Births, Deaths and Marriages Registration Act 1995 (the Act) provides that one object of the Act is to provide for registration of changes of name. Section 6 of the Act sets out the Respondent's general functions: 6 Registrar's general functions The Registrar's general functions are— (a) to establish and maintain the registers necessary for the purposes of this Act… (a1) to maintain the integrity of the Register and to seek to prevent identity fraud associated with the Register and the information extracted from the Register, and ... (c) to ensure that this Act is administered in the way best calculated to achieve its objects. 1. Section 26 of the Act provides that a person's name may be changed by registration of the change. An adult person may apply to the Registrar for registration of a change of the person's name: s 27(a) of the Act. Under s 29B(b) of the Act though, the Registrar is not to register a change of name where an applicant has already had three of more changes of name. Section 29C(2) however provides exceptions to s 29B(b) that allow, relevantly, for further changes of name exceeding a third name change where: (a) the Registrar is satisfied that the reason for the proposed change of name warrants the registration of the change of name, or (b) without limiting paragraph (a), the Registrar is satisfied that the proposed change of name is sought for the protection of the person, the person's children or anyone else associated with the person, or … 1. Registration of change of name is authorised under s 30 of the Act, which states: 30 Registration of change of name (1) Before registering a change of name under this Part, the Registrar may require the Applicant to provide evidence to establish to the Registrar's satisfaction— (a) the identity and age of the person whose name is to be changed, and (b) that the change of name is not sought for a fraudulent or other improper purpose, and … (d) the reasons for making the application for registration of the change of name if the registration of the change would require the Registrar to exercise his or her discretion under section 29C. … 1. In making an application the approved form requires an applicant to disclose whether he or she has been convicted of a relevant offence pursuant to s 29A of the Act. Section 29A(4) of the Act defines "conviction for an offence" as: (a) includes the making of an order under section 10 of the Crimes (Sentencing Procedure) Act 1999, and (b) does not include a spent conviction within the meaning of Part 2 of the Criminal Records Act 1991 or a conviction that is taken to be quashed within the meaning of Part 4 of that Act. 1. Section 29A(4) of the Act defines "relevant offence" as: (a) an offence in New South Wales that is punishable by imprisonment for 12 months or more, or (b) an offence in a jurisdiction other than New South Wales that, if committed in New South Wales, would be an offence so punishable. Evidence before the Tribunal 1. In addition to the documents filed under s 58 of the Administrative Decisions Review Act 1997 (ADR Act) I had before me a number of documents from financial institutions which, the Applicant said, demonstrated the ongoing effect of cyber fraud as a result of Service NSW (SNSW) being hacked, as discussed below. The Applicant gave evidence and was cross-examined. I also asked him questions. Both parties made helpful written submissions. The Applicant had been assisted by Legal Aid. Tribunal's approach 1. Section 63 of the ADR Act provides that in determining an application for review the Tribunal is to make the correct and preferable decision having regard to the material before it, and any applicable written or unwritten law. It is well established that the Tribunal is not restricted to a consideration of the material that was before the decision-maker, but may have regard to any relevant material before it at the time of the review: Shi v Migration Agents Registration Authority (2008) 235 CLR 286; [2008] HCA 31. Under s 28(2) of the Civil and Administrative Tribunal Act 2013 (CAT Act) the Tribunal is not bound by the rules of evidence and may inquire into and inform itself on any matter in such manner as it thinks fit, subject to the rules of natural justice: s 38(2) of the CAT Act. The Tribunal makes its own decision in place of the Registrar, and there is no presumption that the decision of the Registrar is correct: McDonald v Director-General of Social Security (1984) 1 FCR 353 at 357; [1984] FCA 59. The standard of proof that applies in these proceedings is the civil standard, that is, on the balance of probabilities. There is no onus of proof: Nakad v Commissioner of Police, NSW Police Force [2014] NSWCATAP 10 at [28]‑[34]. Consideration 1. The Applicant submitted that the Respondent had failed to give s 29C of the Act proper consideration, that is, there had been a failure to consider whether, based on his circumstances, there should be an exception to s 29B of the Act so as to allow him to change his name for a fourth time. The Applicant's previous name changes 1. There was no dispute that on 11 December 1981, the Applicant, who was born in Kuwait, was named [Name 1] from birth. The Applicant applied for, and the Respondent granted, three previous changes of name under the Act, as follows: 1. 31 May 2005 to [Name 2] 2. 21 September 2006 to [Name 3] 3. 20 October 2009 to ERS 1. There was no dispute that ERS is the name by which the Applicant is currently known, although he said that his surname is actually hyphenated. 2. I observe that it is only when a person seeks to change their name on a fourth or subsequent occasion that reasons for the application are required to be provided: s 30(1)(d). Nonetheless, in order to provide context to the Applicant's present application, I asked him about the reasons for his various change of name applications. 3. In his submissions and in his evidence the Applicant said that his first name change — to [Name 2] in 2005 — was because he wanted to change his Arabic name to a name that was easier to use in English. 4. He wrote that in changing his name to [Name 3] in 2006, his reason was, in part, that his father didn't like the first name. I asked him why, in complying with his father's wishes in changing his first name, he had also chosen to change his surname, but he could not provide a reason for doing so. 5. He changed his name to ERS in 2009, giving the reason that he was getting married. In his evidence he said that the surname is his father's first name and he wanted to give his wife that name. What precipitated the current application for change of name? 1. The Applicant's previous name changes were sought for personal reasons. Currently though, the Applicant seeks to change his name because of the alleged ongoing fraud occurring following a cyber-attack on SNSW. 2. On 15 September 2020 SNSW wrote to the Applicant about a data breach, described as a "PRIVACY DATA INCIDENT". The letter stated, in part: I am writing to advise you that your personal information was exposed in a cyber security attack on the Services NSW technology network… What happened? An unauthorised and unknown third party accessed information contained in 47 Service NSW staff email accounts, using a phising attack from late March 2020, which was detected in April 2020. At this stage of our investigations, we believe that the following personal information relating to you was contained in the information accessed in this phising attack: • Driver Licence Details • Personal particulars • Legal Contract or court documents 1. The letter went on to record that the attack had been reported to the Police, the Australian Centre for Cyber Security, the Information and Privacy Commission of NSW and the Office of the Information Commissioner. 2. Shortly afterwards, the Applicant said he attempted to make a purchase online using Afterpay but it was declined as a previous purchase in his name had been made but not paid. A dispute was lodged, and he provided a screenshot from the Afterpay Fraud Investigation Team dated 22 September 2020. He also learned that a motor vehicle had been purchased in his name in New Zealand; he provided a copy of a certificate of registration for a motor vehicle dated 11 September 2020. As a consequence of the breach, on about 22 October 2020 the Applicant applied to change his name, and referred to the cyber-attack on SNSW. 3. The Applicant said he had sought to change his name as a direct result of the difficulties he has had with persons making unauthorised access to his various accounts and that the problems he has encountered, and continues to encounter, were because of the SNSW cyber-breach. I did not understand the Respondent to challenge that SNSW had been subject to a cyber-attack; indeed, the Respondent annexed to its submissions a copy of a summary of its response to the attack undertaken at the direction of the Privacy Commissioner on 5 August 2020. Further, correspondence in the s 58 documents between the Applicant and a person in the Respondent's office indicates that the Respondent had set up an avenue for assistance to "impacted customers". The Applicant said in his evidence that it was this person who in fact suggested that he change his name. The Applicant also said that he was advised either by her or by the support team to report the matter of the car purchase in New Zealand to Police, which he did. 4. In support of his contention in relation to effects of the cyber-breach at the time of his application to change his name the Applicant provided: 1. copies of Transaction Dispute acknowledgements from NAB dated 23 September 2020 and 20 October 2020 (3). 2. a copy of an email from ANZ Personal Banking dated 21 October 2020 noting an attempt to sign into his account from an unrecognized device. 1. The Applicant wrote in his application that he was advised by his accountant to change his name as that would be more secure and to stop the access to his bank and licence details. At the hearing the Applicant could not recall if it was his "hypercare" case manager or SNSW (or both) who suggested he could be given a new ID number (for the purposes of SNSW) and also suggested he change his surname. He was referred to his application in which he had written that it was his accountant's suggestion that he change his name. He said his accountant had agreed with the suggestion. Ultimately, in my view, nothing turns on whose suggestion brought about his application. 2. When asked why he had chosen the same first name as in [Name 2] again, knowing that his father disapproved of the name, he said he liked the name, and had not actually wanted to change his surname, but that was the advice he received. 3. The Applicant was informed, erroneously as it transpired, that he was a "restricted person" and that his application required approval by the Commissioner for Corrective Services under ss 31B and 31C of the Act. The Applicant took the opportunity to lodge an application in yet another name, the name he now seeks, on 19 November 2020. On 18 December 2020, the Respondent sent a letter to the Applicant advising that the request to change his name had been declined under s 29B(b) of the Act on the basis that the Respondent "cannot" register a change of name for a person who has had three or more registered changes of name and noted that whilst the Act allows exceptions to that section, the Respondent was not satisfied that the reasons provided supported the registration. 4. The Applicant contended that the identity issues associated with the cyber security attack are ongoing. He provided a letter dated 4 January 2021 from SNSW. The letter advised that some of the Applicant's information, namely his "employment ID" was not accessed. Information that was confirmed as compromised was as before, namely the Applicant's "Driver Licence Details, Personal particulars, and Legal Contract or court documents". Consistent with the Applicant's contention of ongoing issues was correspondence from Now Finance dated 3 May 2021 acknowledging that a fraudulent finance application in his name to Pepper Money dated 18 March 2021 (which was declined) was not made by him. He also provided an email from Credit Savvy dated 21 May 2021 informing him that there has been "activity on [his] credit file". 5. The Applicant lodged disputed transactions with the NAB and ANZ banks, but he said in his evidence, the banks "didn't want to know". I observe that the material he supplied included an email from NAB dated 12 May 2021 to the effect that, following the fraud investigation, funds were being reimbursed to his account. The Applicant said in his evidence that he had not brought the bank and credit material to the attention of the NSW Police, other than in relation to the car purchased in New Zealand in his (present) name. The Respondent submitted that the seriousness of the purported identity theft would warrant reports to the NSW Police in relation to the other alleged fraud offences. The Applicant said no-one had suggested that he do so. Further, he said there is so much fraudulent activity he couldn't go to the Police "every second day" to report it. 6. The Respondent submitted that the Applicant's evidence is not substantial and/or provides insufficient connection to the cyber-breach. In submissions it was conceded that the Applicant had raised a "persuasive story" but, it was submitted, there was no substantial probative evidence. In making this submission though, the Respondent did not advance any alternative explanation for the Applicant's application. 7. The Applicant submitted that his name should be changed for his financial protection and also to reduce the distress and inconvenience that the significant number of fraudulent financial applications that are being made in his name are causing him. The Respondent submitted that the precise extent to which he has been impacted is unknown. 8. The Respondent submitted that the notification letter from SNSW did not indicate that banking details were not listed in the categories of information accessed, those being limited to driver's licence details, personal particulars and legal, contract or court documents. This description of what information was accessed is expressed in very broad terms, and is, in its terms, unhelpful to a recipient of the letter to be confident about what information was or was not accessed. 9. The Respondent said that, for privacy reasons, it is unable to ascertain precisely what of the Applicant has been compromised, but it can be obtained from SNSW if requested by the affected customer, namely the Applicant. I observe that the Applicant has been in contact with the "hypercare" team, but it is unclear what level of support is being provided, and if he had in fact been informed that he could enquire further in relation to the breach. The Tribunal's discretion 1. In view of the clear evidence that the Applicant's bank accounts have been acknowledged to have been the subject of fraudulent activity, the car purchased in New Zealand in his name and the false credit applications, I accept that sufficient information was accessed to enable that fraudulent activity. 2. In exercising the discretion in s 29C(2)(a) of the Act, the Registrar, and hence the Tribunal on review, can take into account whether the proposed name is sought for the protection of the person or the person's children or persons associated with the Applicant under the provisions of s 29C(2)(b) of the Act. It is unclear if this extends to the financial protection of a person, but in exercising the Tribunal's discretion, that is a matter that can be taken into account in any event. The Applicant's failure to disclose his criminal record 1. Section 29A(1) of the Act requires an applicant for a change of name to disclose whether they have been convicted of a relevant offence. For the purposes of the section, "convicted" includes being subject to an order under s 10 of the Crimes (Sentencing Procedure) Act 1999. "Relevant offence" means an offence that is punishable by imprisonment for 12 months or more. 2. Sections 29A and 29C must be read together: Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355; [1998] HCA 28, at [69]‑[71]. Adopting that approach, it is open to the Tribunal to consider the Applicant's failure to disclose his criminal record and the extent of that record in determining if there are grounds for refusing the change of name. 3. The Respondent submitted that the discretion in s 29C(2) should not be exercised in the Applicant's favour because the Applicant had failed to disclose his criminal convictions in his most recent application; in his change of name application of 19 November 2020 (as well as that of 26 October 2020) the Applicant did not disclose that he had been convicted of offences that were punishable by imprisonment of 12 months or more. 4. The forms for the Applicant's three previous change of name applications appear, from the copies provided in the s 58 documents, to have been in a different form to the present application. Only in the application in respect of the Applicant's present name, was there a necessity to provide information about criminal history. 5. In respect of the present application, the Applicant specifically consented to a police records check. The Applicant said in his evidence that, having provided that consent, he would not be so stupid as to think that his convictions would not become known following the check. He observed that the form advised him to contact LawAccess if he was unsure of the appropriate response, and he said he did that. He said he was advised to answer "no" to the question about whether he had been convicted of any offence that is punishable by imprisonment for 12 months or more. 6. On 17 December 2020, the Respondent obtained a National Police Check (NPC) in relation to the Applicant. According to the NPC, the Applicant has an extensive police record dating from August 2017 — in addition to various driving offences, convictions (or offences found proven) including common assault, contravention of AVO, stalk/intimidate, threats to distribute intimate images, distribute intimate images, possess prohibited drug, possess ammunition, handling of explosives without an authorised licence. Those offences attract maximum penalties as follows: Offence Provision Maximum Penalty Common assault – T2 s 61 of the Crimes Act 1900 Imprisonment – 2 years and/or fine – 50 penalty units Contravene prohibition/restriction in AVO (domestic) s 14(1) of the Crimes (Domestic and Personal Violence) Act 2007 Imprisonment – 2 years and/or fine – 50 penalty units Stalk/intimidate/intend fear physical etc harm (domestic) – T2 s 13(1) of the Crimes (Domestic and Personal Violence) Act 2007 Imprisonment – 5 years and/or fine – 50 penalty units Threaten to distribute intimate image w/o consent (DV) – T2 s 91R(2) of the Crimes Act 1900 Imprisonment – 3 years and/or fine – 100 penalty units Intentionally distribute intimate image w/o consent (DV) – T2 s 91Q(1) of the Crimes Act 1900 Imprisonment – 3 years and/or fine – 100 penalty units Possess prohibited drug s 10(1) of the Drug Misuse and Trafficking Act 1985 Imprisonment – 2 years and/or fine – 20 penalty units Handle explosive/precursor without authorising licence s 6(1) of the Explosives Act 2003 Imprisonment – 12 months and/or fine – 250 penalty units 1. The Applicant submitted that the "NPC does not state that any of the offences could have potentially resulted in a prison sentence of 12 months or more." While the observation is correct, the point is ill-founded. When the Applicant was dealt with in relation to those matters, the relevant penalties, some of which are severe, are highly likely to have been brought to his attention at that time, including when he commenced appeal proceedings on multiple occasions. 2. I observe though that the Applicant does not appear to have a good grasp of written English; he completed his various application forms in fractured English, and his oral evidence and submissions were sometimes hard to follow, especially in the context of a telephone hearing. I accept that this may have given rise to his failure to disclose the offences. 3. The Respondent submitted that the Applicant has domestic violence related offences. As to whether this can be the basis for a negative inference to be formed, the Respondent submitted, is unclear but these may be relevant as to the safety of a person who has sought and been granted a protection order. Under s 29C(2)(b) of the Act I may take into account whether the proposed name is sought for the protection of persons associated with the Applicant. However, I agree with the Respondent that it is entirely unclear how, if at all, the name change might impact upon those persons and I give that matter no weight in my consideration. 4. It is noted that the Applicant, at the time of the hearing, was still subject to the terms of a Community Corrections Order which expired on 11 June 2021. I do not consider that adversely affects the exercise of the Tribunal's discretion in the circumstances of this matter. Conclusion 1. In DZM v Registrar of Births Deaths and Marriages [2019] NSWCATAD 188, to which I was referred, NS Isenberg RFD Senior Member reviewed at [21]–[25] previous Tribunal cases in relation to change of name applications: e.g. Ezekeil v Registrar of Births, Deaths and Marriages [2011] NSWADT 137 (Ezekeil); Turkman v Registrar, NSW Registry of Births Deaths & Marriages [2011] NSWADT 258. In summary, before exercising the discretion to allow a further change the Registrar, and hence the Tribunal on review, must be satisfied that an applicant who has already changed his or her name three times has some good reason for warranting a further change to the register; there must be some ground or circumstance over and above personal preference justifying a change: per Ezekeil. There is no evidence that to register the Applicant's proposed name posed a risk of fraud or abuse of the change of name system. Neither was there any evidence of any nefarious goal in the proposed name change. 2. The Tribunal has consistently said that "personal preference, likes or dislikes" are insufficient to enliven the discretion in respect of a fourth or subsequent change of name. Each matter must be considered on its merits: see for example, Terzic v Registrar of Births, Deaths and Marriages [2013] NSWADT 82. Personal preference was not, in any event, what gave rise to the application. 3. For the reasons given above, I am satisfied that the Applicant has advanced a sufficient reason to warrant changing his name and having the register altered. Accordingly, the Respondent's decision to refuse to register the Applicant's fourth change of name is set aside. Application for confidentiality order 1. At the outset of the hearing the Applicant sought an application under s 64 of the CAT Act, which provides: 64 Tribunal may restrict disclosures concerning proceedings (1) If the Tribunal is satisfied that it is desirable to do so by reason of the confidential nature of any evidence or matter or for any other reason, it may … make any one or more of the following orders— (a) an order prohibiting or restricting the disclosure of the name of any person …, (b) an order prohibiting or restricting the publication or broadcast of any report of proceedings in the Tribunal, (c) an order prohibiting or restricting the publication of evidence given before the Tribunal, whether in public or in private, or of matters contained in documents lodged with the Tribunal or received in evidence by the Tribunal, (d) an order prohibiting or restricting the disclosure to some or all of the parties to the proceedings of evidence given before the Tribunal, or of the contents of a document lodged with the Tribunal or received in evidence by the Tribunal, in relation to the proceedings. ... 1. I was satisfied that it was desirable to make non-publication and non-disclosure orders under s 64 of the CAT Act. This was because the evidence revealed names by which the Applicant has been previously known, and the name by which the Applicant is presently known and which has been the subject of fraudulent impersonation. Significantly, the evidence also refers to the name by which he seeks to be known, and which, as a result of this decision, will be his registered name. 2. Having said that, it is appropriate that his new name is made available to NSW Police so that the record of his criminal history can remain accurate. For that reason, it will not be a breach of the non-publication conditions I have imposed if the Respondent provides a copy of this decision, including the past, present and new names of the Applicant, to the NSW Commissioner of Police. Decision 1. The decision under review is set aside. Orders 1. Pursuant to s 64 of the Civil and Administrative Tribunal Act 2013: 1. I prohibit the disclosure of the name of the Applicant, ERS, to any person other than the Respondent and the legal advisers to the Respondent. 2. I prohibit the publication or broadcast of any part of a report of proceedings in the Tribunal, where such part discloses any name by which the Applicant was at any time known or applied to be known. 3. I prohibit the publication of evidence given before the Tribunal of matters contained in documents lodged with the Tribunal or received in evidence by the Tribunal to the extent that such evidence discloses any name by which the Applicant was at any time known or applied to be known or could reasonably be identified. 4. It is not a breach of these Orders if the Respondent provides a copy of this decision, including the past, present and new names of the Applicant, to the NSW Commissioner of Police. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 06 July 2021