CITATION: HW v Director of Public Prosecutions (No 2) [2004] NSWADT 73 DIVISION: General Division APPLICANT PARTIES: HW RESPONDENT Director of Public Prosecutions FILE NUMBER: 023217 HEARING DATES: On the papers SUBMISSIONS CLOSED: 12/12/2003 DATE OF DECISION: 04/16/2004 BEFORE: Montgomery S - Judicial Member APPLICATION: Privacy - information protection principle - collection - unlawful MATTER FOR DECISION: Principal matter LEGISLATION CITED : Interpretation Act 1987 Privacy & Personal Information Protection Act 1998 CASES CITED: HW v Commissioner of Police, New South Wales Police Service and Anor [2003] NSWADT 214 APPLICANT REPRESENTATION: In person RESPONDENT S Free, solicitor ORDERS: 1. The Application for review of the conduct of the Director of Public Prosecutions in relation to an alleged contravention of section 11 of the Privacy and Personal Information Act 1998 is dismissed. 1 The applicant lodged two applications for review of the conduct of public sector agencies, filed pursuant to s 55 of the Privacy and Personal Information Protection Act 1998 ("the Privacy Act"). The Director of Public Prosecutions ("the DPP") is the respondent to the second of those applications. The applications involve a common set of circumstances. Those circumstances are detailed in the decision of the President of this Tribunal in HW v Commissioner of Police, New South Wales Police Service and Anor [2003] NSWADT 214. It serves no purpose to repeat them here. 2 In HW v Commissioner of Police the President dismissed the application insofar as it applied to the Commissioner of Police. The application for review of the conduct of the DPP was also dismissed, except with respect to the claim made in relation to an alleged contravention of section 11 of the Privacy Act. That aspect of the claim has been listed before me for further consideration. In dismissing other aspects of the claim the President made certain comments and findings in relation to the alleged contravention of section 11. The relevant parts of the President's decision are as follows: "17 The applicant contends most of the Information Protection Principles (IPPs) in the Privacy Act have been contravened by one or both of the Police and the DPP... (5) The collection went beyond the limitations as to relevance and degree of intrusiveness into personal affairs set by s 11. Alleged contravention of IPP s 11. (2) The DPP Case 37 Section 27 does not cover the DPP. Accordingly the DPP is generally bound by the IPPs in respect of the exercise of its law enforcement functions except to the extent that its conduct is covered by a qualification contained within an IPP or is covered by a specific exemption. 38 The DPP raised the issue of which agency was responsible for the first act of collection of the information…. 40… I am satisfied that there was a degree of independence afforded to the police officer sufficient to support the conclusion that the Police Service not the DPP was engaged in the first collection. 41 The primary importance of this conclusion is that the Police Service has been found to be the 'collector' of the information not the DPP. Therefore it is not open to find that the DPP collected the information by unlawful means, and thereby prima facie contravened IPP s 8(2). 42 The DPP accepted, and it follows, that there was then a collection of the information by the DPP... 43 As to that collection, it is clear in my view that the information (albeit affected by tainted process) was collected in connection with the primary prosecution responsibilities of the DPP, and was therefore 'collected for a lawful purpose that is directly related to a function or activity of the agency', and that it was 'reasonably necessary for that purpose' (IPP s 8(1)). … 49 The next IPP said to be applicable to the present circumstances is IPP 11, which provides: '11. Other requirements relating to collection of personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances (having regard to the purposes for which the information is collected) to ensure that: (a) the information collected is relevant to that purpose, is not excessive, and is accurate, up to date and complete, and (b) the collection of the information does not intrude to an unreasonable extent on the personal affairs of the individual to whom the information relates.' 50 There is also a question of construction as to whether IPP s 11 applies to the present context. The collection in issue is the DPP's collection from the police officer. On one view that is a collection from an 'individual' for the purpose of s 11. There is no definition of 'individual' in the Act. A police officer fits the definition of a 'public sector official', i.e. 'a person who is employed or engaged by: (i) a public sector agency' (see s 3). There are indications in the Privacy Act that the term 'individual' is used in contradistinction to 'public sector official' (see for example s 4(3)(k)). But for the moment I will leave the issue on the table. I will proceed in dealing with this issue on the basis that the collection from the police officer is covered by s 11. 51 Ultimately, in my view the critical word in determining whether IPP s 11(a) is contravened is 'purpose'. In this instance the intended purpose was to consider the information collected for use in the context to meet a defence in a criminal trial. As it happened the defence was mischaracterised. I am not able to form a view without scrutiny of the collected material as to whether the information collected was, even if relevant to that purpose, 'not excessive, and is accurate, up to date and complete' and whether it did 'not intrude to an unreasonable extent on the personal affairs' of the applicant. 52 This issue will be listed for further consideration." 3 As directed by the President, the matter was listed for further planning meetings. It was agreed that the matter should be determined without the need for further hearing. Accordingly a timetable was set to allow each of the parties to file written submissions on the outstanding issues of (1) whether section 11 applied to the collection of information from Senior Constable Stone by the DPP; and (2) if section 11 did apply, whether the DPP breached section 11 in the circumstances. This decision is made on the basis of those submissions and the other material before me. 4 The Applicant has submitted that on its proper construction section 11 applies to the collection of information by the DPP in the circumstances of this matter. He argues that the DPP collected highly personal and confidential information about him. This information included personal medical records and employment history. He further asserts that the DPP collected personal information about him that was excessive, irrelevant, or intruded to an unreasonable extent on his personal affairs. 5 In support of the argument that the DPP collected personal information about him that was excessive and irrelevant, the Applicant referred to views expressed by Judge Woods in the District Court matter that: "In these circumstances it seems to me that the material has limited or no probative value and I will not permit it to be used in the trial, but as for the four documents to which I have made reference, they may, subject to subsequent rulings, be used in the trial." 6 The Applicant stated that the information that was collected intruded to an absolutely unreasonable extent on his personal affairs, medical history and work. He asserts that it was a breach of the Privacy Act that treated his rights with utter contempt. He further asserts that it is totally untenable that this collection of his personal information should be able to be sanitised by the interposition of a third party. He argues that as the person in charge the DPP must bear responsibility, and that it is repugnant to play semantics in regard to the word "individual". 7 The Applicant submits that the principle of statutory interpretation that statutory words may not be overlooked on the basis that they are superfluous or insignificant can be satisfied in this situation. This can be achieved by the finding that for the purposes of section 11 the relevant "individual" was Senior Constable Stone, the Applicant himself, the various staff members of the Illawarra Area Health Service, relevant hospitals or any intervening proximate person. Ultimately, he argues, the DPP collected personal information from the Applicant himself who is an individual. The Applicant further submits that the circumstances of this matter raises the question of whether or not an exemption can arise where a public sector agency employee acts outside the scope of their employment. In short, could Senior Constable Stone have acted both as an agency employee (a Police Officer) and an individual for the purposes of the Privacy Act? 8 The Applicant asserts that the DPP knowingly looked at the wrongly obtained information; ordered its photocopying; and ordered its distribution without the Applicant's permission. Accordingly, the construction given to section 11 should direct responsibility for these actions to the DPP. 9 The DPP in contrast submits that section 11 did not apply in the circumstances as section 11 is only intended to apply if information is collected directly from the individual to whom the information relates or, in the alternative, if the information is collected from a natural person and not from someone who is acting on behalf of a public sector agency. 10 In relation to the second outstanding issue, the DPP submits that it took such steps as were reasonable in the circumstances to ensure that the requirements of section 11 were satisfied. 11 As noted above, in HW v Commissioner of Police the President found that the first collection of the information was by the Police Service and not by the DPP. For the purposes of the Privacy Act, the only relevant "collection" of personal information by the DPP occurred when the information was collected from Senior Constable Stone. It is not necessary to analyse the earlier collection of information by Senior Constable Stone from various employers, as the DPP was not responsible for these actions. The President stated at paragraph 50: "50 There is also a question of construction as to whether IPP s 11 applies to the present context. The collection in issue is the DPP's collection from the police officer. On one view that is a collection from an 'individual' for the purpose of s 11. There is no definition of 'individual' in the Act. A police officer fits the definition of a 'public sector official', i.e. 'a person who is employed or engaged by: (i) a public sector agency' (see s 3). There are indications in the Privacy Act that the term 'individual' is used in contradistinction to 'public sector official' (see for example s 4(3)(k))." 12 There is a preliminary question of construction as to whether section 11 applied to the DPP in the context of the collection of information from Senior Constable Stone. This question arises because of the opening conditional clause of section 11, which provides that the section applies if the agency "collects personal information from an individual". If the agency collects personal information "from an individual" then it must take the steps required to ensure the matters in paragraphs (a) and (b) of section 11. 13 The DPP submits that there are at least three possible interpretations of the conditional phrase "from an individual" as it appears at the start of section 11: (i) that section 11 applies only when a public sector agency collects personal information about an individual from the individual to whom the information relates; (ii) that section 11 applies when a public sector agency collects personal information from any natural person, whether or not the information relates to the individual from whom it is collected; and (iii) that section 11 applies whenever a public sector agency collects personal information from any individual, even if the individual is a public sector official acting on behalf of a public sector agency (ie the words do not operate as words of limitation, but apply in effect to all forms of collection). 14 The word "individual" is not defined in the Privacy Act however it is defined in the Interpretation Act 1987. Section 21 of that Act, which deals with the meaning of commonly used words and expressions, provides that "individual means a natural person". The DPP submits that the concept of collection of personal information "from an individual" therefore cannot encompass collection from artificial persons, such as corporations. Public sector agencies, as defined in the Privacy Act, would also fall outside the definition of "individual" in that they are not natural persons. 15 It is further submitted that the conditional clause must be understood in the context of the other Information Protection Principles contained in Part 2 Division 1 of the Privacy Act. The clause "If a public sector agency collects personal information from an individual" appears at the start of section 10, as well as section 11. These sections follow on from section 9, which provides that personal information must be collected directly from the individual to whom the information relates unless the individual has authorised collection from someone else or, in the case of a minor, the information has been provided by a parent or guardian. 16 In the absence of a clear reason why these words should be given a different meaning in each of the two sections, the phrase "from an individual" should be understood as having the same meaning in section 11 as it does in section 10. It is therefore necessary to consider the operation and drafting of both sections in order to understand the intended meaning of the phrase. 17 The effect of section 9 is that the Privacy Act contemplates that information must ordinarily be collected directly from the individual to whom the information relates, unless one of the two exceptional circumstances applies or the agency is otherwise exempted from section 9. If the collection principles in sections 10 and 11 were intended to apply only to the standard case of direct collection, the phrase "if a public sector agency collects personal information from an individual" would be read as a shorthand reference to information being collected directly from the individual to whom it relates in accordance with section 9. 18 The DPP submits that this would have the effect that, if an agency is exempted from the requirement of direct collection for any reason under the Privacy Act, it is not subject to the requirements in sections 10 and 11. The DPP is not required to comply with section 9 because of the section 23(2) exemption. In HW v Commissioner of Police the President stated at paragraph 46: "46 It is clear, I consider, that s 23(2) is a complete answer to the question of whether IPP s 9 applies in the present circumstances. The IPP is not applicable to the DPP." Reasons and decision 19 Section 10 provides: "10 Requirements when collecting personal information If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following: (a) the fact that the information is being collected, (b) the purposes for which the information is being collected, (c) the intended recipients of the information, (d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided, (e) the existence of any right of access to, and correction of, the information, (f) the name and address of the agency that is collecting the information and the agency that is to hold the information." 20 Clearly, in section 10 the word "individual" appears in two separate contexts. Firstly, the section provisions apply if a public sector agency "collects personal information from an individual". If that is the case, the agency must take certain steps to ensure that, before the information is collected or as soon as practicable after collection, "the individual to whom the information relates is made aware of" various things. Section 10(d) makes a further unqualified reference to the "individual". The reference to "the individual to whom the information relates" raises the issue of whether this is intended to be a reference to the same "individual" from whom the information is collected. 21 In my opinion, this is the preferred construction. If it were otherwise, section 10(d) would impose the peculiar requirement that the individual to whom the information relates must be informed of whether a third party was compelled to provide the information. This is a strained construction. Further, if the requirements in section 10 were to apply to collection from third parties, public sector agencies would be subject to an obligation to locate every individual about whom they are collecting information in order to inform them of the various things listed in section 10. This would be the case even if the agency were excepted or exempted from the requirement of direct collection in section 9. 22 If the definition of "individual" that is provided for in the Interpretation Act 1987 is applied, the problem of this construction becomes even more apparent. If section 10 is not limited to cases of direct collection, the section will be triggered when information is collected from "individuals" other than the individual to whom the information relates. However, because the definition of "individuals" cannot encompass artificial persons, if personal information is collected from a corporation then section 10 will not be triggered. This would lead to the result that a public sector agency must comply with the requirements of section 10 when collecting information about a third party from natural persons but not when collecting the same information from corporations. This result strongly suggests that the word "individual" as used in the expression "from an individual" is intended to refer not to any natural person but to the individual to whom the information relates. 23 One of the purposes of section 10 is to enable an individual to be fully informed of the relevant factors before deciding whether to provide the information to the agency. This would not be a relevant consideration if the information is collected from a third party, and the individual to whom the information relates is separately informed of the collection. 24 If, however, the individual from whom the information is collected is also the individual to whom the information relates, no strained construction is necessary. Section 10(d) requires that the individual to whom the information relates must be made aware of whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided. This is likely to be a crucial factor in the individual determining whether to provide the information. 25 In my view, the construction to be given to section 10 is that proffered by the DPP i.e. the reference to "the individual to whom the information relates" is intended to be a reference to the same "individual" from whom the information is collected. I see no reason why these words should be given a different meaning in each of sections 10 and 11. I agree with the DPP's argument that a similar approach should be adopted to the construction of sections 10 and 11. On this analysis, sections 10 and 11 were intended to apply only to the standard case of direct collection. An agency that is not engaged in direct collection is not subject to the requirements in sections 10 and 11 of the Privacy Act. 26 In the present matter, the collection in issue is the DPP's collection from Senior Constable Stone. Clearly there is no direct collection form the Applicant, "the individual to whom the information relates". It follows in my view, that the DPP is not required to answer the alleged contravention of the IPP raised by the Applicant. 27 In light of these conclusions it is unnecessary to deal with a number of further submissions made by the DPP addressed to the issue of whether, if section 11 did apply, the DPP breached section 11 in the circumstances. 28 In HW v Commissioner of Police the President stated at paragraph 65 that "The events identified by this application for review do not reflect well on the agencies concerned." I reiterate that comment. The Applicant is understandably upset that highly personal and confidential information about him has been collected. He is equally understandably concerned that responsibility be accepted for this collection. I appreciate that my findings will offer him no comfort in this respect. 29 In HW v Commissioner of Police the Police Service was found to be the 'collector' of the information not the DPP. As the President observed in HW v Commissioner of Police, the Police Service enjoys a substantial immunity from the application of the IPPs. The President also found that that the DPP is immune from the application of IPP sections 9 and 10 because of the operation of section 23(3) of the Privacy Act. In my view, the DPP is also immune from the application of IPP section 11 in the present circumstances because it was not responsible for any direct collection from the Applicant. Accordingly, for the reasons given, the application for review as it relates to the DPP must be dismissed. Order 1. The Application for review of the conduct of the Director of Public Prosecutions in relation to an alleged contravention of section 11 of the Privacy and Personal Information Protection Act 1998 is dismissed. DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated.