CITATION: GQ v NSW Department of Education and Training (No 2) [2008] NSWADT 319 DIVISION: General Division APPLICANT GQ PARTIES: RESPONDENT NSW Department of Education and Training FILE NUMBER: 083163 HEARING DATES: On the papers SUBMISSIONS CLOSED: 13 November 2008 DATE OF DECISION: 2 December 2008 BEFORE: Handley R - Deputy President CATCHWORDS: Disclosure of personal information to a person or body outside NSW LEGISLATION CITED : Interpretation Act 1987 Privacy and Personal Information Protection Act 1998 GQ v NSW Department of Education & Training [2008] NSWADT 212 CASES CITED: Refrigerated Express Lines (A/Asia) Pty Ltd v Australian Meat and Live-stock Corporation (1980) 29 ALR 333 Jumbunna Coal Mine No Liability v Victorian Coal Miners' Association (1908) 6 CLR 309 APPLICANT In person REPRESENTATION: RESPONDENT L Watson, solicitor PRIVACY COMMISSIONER S J Morris, solicitor ORDERS: The Tribunal has no jurisdiction to conduct a review. Consequently, GQ's application to the Tribunal is dismissed. REASONS FOR DECISION 1 This matter involves an application by GQ for the review of a decision of the NSW Department of Education & Training ('the Department') made under the Privacy and Personal Information Protection Act 1998 ('the PPIP Act') concerning the conduct of departmental officers. Background 2 The background to this matter is set out in my earlier preliminary decision: GQ v NSW Department of Education & Training [2008] NSWADT 212: "2 The facts are not in dispute. GQ was employed as a temporary teacher at a NSW High School ('the School') in term 3 of 2006. Due to the slow processing of the required paperwork resulting in a delay in GQ being paid, the School Principal agreed to advance GQ the sum of $2,500 from School funds, to be recovered in instalments from her salary when this was paid. Although GQ was initially promised work at the School in term 4, she was subsequently told at the end of term 3 that she would not be needed in term 4. This placed her in financial difficulties because she had budgeted to repay the $2,500 advanced to her by the School by the end of the School year. 3 GQ is now employed at a Secondary College in Victoria ('the College'). On 26 June 2007, the Secretary of the School where GQ had previously been employed [in NSW] phoned the College [in Victoria] to request GQ's address and home telephone number. When asked by the Principal of the College why the School needed these details, the Secretary said that GQ owed money to the School. The Principal of the College then spoke to the Principal of the School, who stated that GQ owed money to the School, which needed to be repaid. On 28 June 2007, the Principal of the College spoke to GQ and asked her to contact the Principal of the School, noting her concern that she had been informed of a private financial matter. 4 GQ complained to the Department about the use and disclosure of her personal information. In a letter to GQ dated 1 April 2008, P Cribb, a Senior Legal Officer with the Department, acknowledged that there had been a disclosure of GQ's personal information in breach of the PPIP Act, albeit not a serous breach. He found no evidence of any systemic issue within the Department and said that following a discussion with the Principal of the School, he was satisfied that officers of the School would not make the same mistake in the future. Mr Cribb apologised to GQ on behalf of the Department but found that the payment of monetary compensation to GQ was not justified. 5 On 20 May 2008, GQ filed an application for a review of this decision by the Tribunal. On 17 June 2008, I conducted a Planning Meeting with the parties and a representative of the NSW Privacy Commissioner. At that meeting, two preliminary issues were raised by the Department: (1) that GQ's application to the Tribunal was 'out of time', and (2) that the application was frivolous or vexatious and should be dismissed pursuant to section 75(5)(h) of the Administrative Decisions Tribunal Act 1997 ('the ADT Act'). Following some discussion, I set a timetable for the exchange of submissions on these preliminary issues, and it was agreed that I would determine the issues on the basis of these written submissions without conducting a hearing at this stage." 3 In my decision on these preliminary issues, I determined (1) that GQ was not prevented from pursuing her application by reason of the time of the filing of her application for review, and (2) that the Respondent's application for dismissal of these proceedings pursuant to section 73(5)(h) of the ADT Act was refused. 4 At a Planning Meeting on 13 August 2008, I made further directions for the filing and exchange of submissions. In those submissions, the Privacy Commissioner's representative, Ms Morris, raised a further preliminary issue, whether the PPIP Act applies to trans-border disclosures of information, in this instance from an agency in NSW to a person or body in Victoria. At a Planning Meeting on 13 November 2008, the parties agreed that I should make a determination on this additional preliminary issue 'on the papers' before proceeding further with the matter. The Relevant Legislation 5 The provisions of the PPIP Act relevant to the preliminary issue under consideration, whether the PPIP Act applies to trans-border disclosures of information, are as follows: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 19 Special restrictions on disclosure of personal information (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person. (2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless: (a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction or applies to that Commonwealth agency, or (b) the disclosure is permitted under a privacy code of practice. (3) For the purposes of subsection (2), a "relevant privacy law" means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned. (4) The Privacy Commissioner is to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales and to Commonwealth agencies. (5) Subsection (2) does not apply: (a) until after the first anniversary of the commencement of this section, or (b) until a code referred to in subsection (4) is made, whichever is the later. 6 The Privacy Commissioner has a right to appear and be heard in these proceedings pursuant to section 55(7) of the PPIP Act. Submissions 7 The only submission on this preliminary issue is that of the Privacy Commissioner. Ms Morris noted that the Department has conceded that it breached section 18(1) of the PPIP Act, and that the only remaining issue in dispute between the parties is the appropriate remedy in respect of that breach, with GQ seeking, amongst other things, an order for the payment of damages. 8 Ms Morris noted that pursuant to section 19(5), section 19(2) does not apply until after the first anniversary of the commencement of this section, or until the Privacy Commissioner has made a code pursuant to section 19(4), whichever is the later. While section 19 commenced on 1 July 1989, the Privacy Commissioner has not made a code pursuant to section 19(4). Ms Morris therefore submitted that as the first anniversary of the commencement of the section has passed but a section 19(4) code has never been made, section 19(2) is not yet operative. 9 Ms Morris referred to the principle of statutory construction that where there is an inconsistency between statutory provisions of a general nature and those of a specific nature, the specific provisions prevail: the generalia specialibus non derogant approach, discussed in Refrigerated Express Lines (A/Asia) Pty Ltd v Australian Meat and Live-stock Corporation (1980) 29 ALR 333, at 347. She submitted that section 19(2), which deals specifically with the disclosure of personal information to a person or body in another jurisdiction or to a Commonwealth agency, prevails over section 18(1), which deals generally with the disclosure of personal information to another person or body. 10 Ms Morris also referred to the presumption that legislation is not intended to have extra-territorial effect, in this case, relevantly, that section 18(1) of the PPIP Act is presumed not to operate outside NSW: see for example, O'Connor J in Jumbunna Coal Mine No Liability v Victorian Coal Miners' Association (1908) 6 CLR 309, at 363; see also section 12(1)(b) Interpretation Act 1987. Indeed, extraterritorial disclosures are addressed in section 19(2). 11 Ms Morris submitted that the fact that section 19(2) does not yet have operative effect does not affect the above reasoning. Pursuant to section 29(4), it is open to the Privacy Commissioner to make a privacy code of practice and determine what restrictions, if any, should govern the disclosure of personal information to a person or body outside NSW or to a Commonwealth agency. On the making of that code, section 19(2) will come into operation. Discussion 12 Where the meaning of legislation is unclear, the courts have developed various aids to interpretation derived from what one could ordinarily expect the person drafting legislation to have intended. Some of these aids take the form of (rebuttable) presumptions about sentence construction, which are often referred to by a Latin tag. The presumption of generalia specialibus non derogant is one such aid. 13 Ms Morris' submission is that the generalia specialibus presumption applies in this instance so that section 19(2) of the PPIP Act prevails over section 18(1). She referred to the decision of the Federal Court in Refrigerated Express Lines (A/Asia) Pty Ltd v Australian Meat and Live-stock Corporation (1980) 29 ALR 333, at 347, where Deane J said: "As a matter of general construction, where there is repugnancy between the general provision of a statute and provisions dealing with a particular subject matter, the latter must prevail and, to the extent of any such repugnancy, the general provisions will be inapplicable to the subject matter of the special provisions. 'The rule is, that wherever there is a particular enactment and a general enactment in the same statute, and the latter, taken in its most comprehensive sense, would overrule the former, the particular enactment must be taken to be operative . . .' (per Romilly M.R., Pretty v. Solly (1859) 26 Beav. 606 at p. 610)." 14 I am satisfied, in this instance, that section 18(1) is a general provision limiting the disclosure of personal information, whereas section 19(2) is a specific provision dealing with disclosure of personal information to a person or body outside NSW. The effect of the application of the generalia specialibus presumption, there being no indication that the presumption should not be applied, is that the specific provision – section 19(2) – prevails to the extent of any repugnancy with the general provision – section 18(1). Thus, section 18(1) does not apply in respect of the disclosure of personal information by a public sector agency in NSW, such as the Department, to any person or body in a jurisdiction outside NSW or to a Commonwealth agency. 15 The fact that pursuant to section 19(5), section 19(2) has not come into operation, as Ms Morris explained, does not, in my view, affect this reasoning. Ms Morris stated that it is open to the Privacy Commissioner to prepare a privacy code of practice regulating the disclosure of personal information by public sector agencies to persons or bodies outside NSW, and permitting disclosures, for example, in circumstances similar to those set out in paragraphs (a) to (c) of section 18(1). I note that section 29(4) specifically recognises that "[a] privacy code of practice may also provide for the disclosure of personal information to persons or bodies outside New South Wales". I also note that section 19(4) appears to impose an obligation on the Privacy Commissioner to prepare such a code. However, the fact that this has not yet happened, despite the passage of over nine years since section 19(1) took effect, does not mean that section 19(5) no longer applies. 16 In support of her submission that section 18(1) does not apply to disclosures of personal information outside NSW, Ms Morris also referred to the presumption that legislation is not intended to have extra-territorial effect. In Jumbunna Coal Mine No Liability v Victorian Coal Miners' Association (1908) 6 CLR 309, at 363, O'Connor J said: "In the interpretation of general words in a Statute there is always a presumption that the legislature does not intend to exceed its jurisdiction. Most Statutes, if their general words were taken literally in their widest sense, would apply to the whole world, but they are always read as being prima facie restricted in their operation within territorial limits." 17 Ms Morris noted that the presumption against extra-territoriality is reflected in section 12(1)(b) Interpretation Act 1987, which states: (1) In any Act or instrument: (a) ... (b) a reference to a locality, jurisdiction or other matter or thing is a reference to such a locality, jurisdiction or other matter or thing in and of New South Wales. 18 As Ms Morris noted, there is nothing to indicate that the NSW Parliament intended to displace the presumption and, indeed, extra-territorial disclosures are specifically addressed in section 19(2). 19 The above leads me to conclude that section 18(1) of the PPIP Act does not apply to disclosures of personal information to a person or body outside NSW. Thus, GQ is unable to pursue a remedy against the Department. Any remedy would have to lie under section 19(2), but that provision is not yet in operation as a result of the Privacy Commissioner not having made the relevant privacy code of practice necessary to bring section 19(2) into operation pursuant to section 19(5). I appreciate that for GQ this will be a very disappointing result, especially in view of the fact that the Department has already admitted to what would otherwise be a breach of section 18(1). Decision 20 Since the Department's conduct in disclosing information to the College Principal in Victoria could not have breached section 18(1) of the PPIP Act, GQ has no cause of action against the Department and, consequently, the Tribunal has no jurisdiction to conduct a review. GQ's application to the Tribunal must therefore be dismissed. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.