BQ -v- Commissioner of Police, New South Wales Police Service [2002] NSWADT 64

CITATION: BQ -v- Commissioner of Police, New South Wales Police Service [2002] NSWADT 64 DIVISION: General Division APPLICANT PARTIES: BQ RESPONDENT Commissioner of Police, New South Wales Police Service FILE NUMBER: 013226 HEARING DATES: 17/12/2001 SUBMISSIONS CLOSED: 12/17/2001 DATE OF DECISION: 04/26/2002

BEFORE: Britton A - Judicial Member APPLICATION: Privacy - contravention of information protection principle - Privacy & Personal Information Protection Act - contravention of information protection principle MATTER FOR DECISION: Jurisdiction Administrative Decisions Tribunal Act 1997 LEGISLATION CITED : Freedom of Information Act 1989 Privacy & Personal Information Protection Act 1998 CASES CITED: Y v Department of Education and Training [2001] NSWADT 149 Cheung v Administrative Decisions Tribunal [2000] NSWSC 1062 APPLICANT REPRESENTATION: In Person RESPONDENT J Waters, barrister ORDERS: Application dismissed.

1 This decision concerns an application lodged with the Administrative Decisions Tribunal (the Tribunal) pursuant to s 55 of the Privacy and Personal Information Protection Act 1998 (the Privacy Act). The applicant seeks review of certain conduct by the NSW Police Service (the agency), which, it is alleged, contravenes the information protection principles set out in Part 2 of the Privacy Act. 2 The applicant contends that in or about August 2000 the agency inappropriately accessed and disclosed confidential police reports that related to him. He seeks the following orders: an order that when screening recommended applicants for public sector employment or appointment, the NSW Police Service refrain from accessing confidential police reports which contain unsubstantiated or unproven information (section 55(2)(c) of the Privacy Act); and an order that the NSW Police Service accept his application for internal review under s 53 of the Privacy Act (s 55(2)(c) and s 55(2) of the Privacy Act). 3 The respondent disputes the Tribunal's jurisdiction to entertain this application on the following grounds: first, by reason of s 53(3)(d) it says that the applicant is not a person who has made an application for internal review under s 53 of the Privacy Act and thus the Tribunal does not have jurisdiction to review conduct of the agency; and second, by reason of s 4(3)(j), it asserts that the information referred to in the application is not personal information within the meaning of s 4 of the Privacy Act. 4 The identity of the applicant, who is referred to for the purpose of these proceedings as "BQ", is subject to a suppression order. In these reasons any reference to material that may identify the applicant has been omitted. Background 5 The following facts are not in issue. The applicant applied for an administrative position within the agency ("the advertised position"). Applicants were advised that the recommended applicant would be subjected to a criminal records check. The applicant was interviewed by a selection committee and recommended for appointment. A criminal record check was then carried out. 6 This search revealed a number of entries in police records apparently concerning the applicant. These entries related to three dates in early 2000 in respect of which the notation "Arrest Not Desired" had been recorded. The convenor of the selection committee raised and discussed this information with the applicant. 7 The applicant was offered a permanent position advertised on May 1 2001. Application for internal review 8 In a letter dated 24 July 2001, addressed to the Commissioner of Police, NSW Police Service, the applicant applied for internal review "in respect of the [agency's] use of personal information as part of a recruitment "criminal records check"". The applicant stated that, as he did not have a criminal history, he expected that the check would trigger a nil response. Instead, it revealed various "COPS events" (or computerised file notes kept on the NSW Police computer system accessible to all NSW police officers) in police records, which he understood, contained information of a personal nature. He argues that his "privacy was invaded and my career and reputation adversely affected by personal information which I have never seen and had never been made aware of." 9 In that letter he requested the agency to exercise its discretion pursuant to s 53(3)(d) of the Act to accept his application out-of-time. He submitted that he delayed making the application as "I was only temporarily appointed to the … position and I did not feel comfortable seeking a review of the recruitment "criminal review check" until I was offered a permanent appointment. I was only recently offered a permanent appointment." 10 By letter dated 10 September 2001 the agency replied that it did not agree to the request to accept the application out of time and stated " the reasons you have provided neither justifies nor warrants an extension to be granted…it is clear that you have deliberately and knowingly chose to wait approximately ten months before lodging a request for internal review rather than to lodge a request within the statutory period." 11 Sometime before 24 July 2001 the applicant made application under the Freedom of Information Act 1989 for access to any personal information concerning him held by the agency. The applicant was granted access to some but not all documents requested. The applicant has made application to the Tribunal to have this decision to refuse certain documents reviewed. This application has not to date been determined. Jurisdiction 12 The threshold issue to be determined is whether the Tribunal is deprived of jurisdiction in circumstances where an internal review has not been conducted because the relevant agency has refused to accept an application for internal review lodged outside the statutory time limit. 13 Before proceeding to discuss the submissions put by the parties it is useful to set out the basis of the Tribunal's jurisdiction in respect of applications made under the Privacy Act. 14 The Tribunal's jurisdiction derives from s 55 (1) of the Act read in conjunction with s 38 of the Administrative Decisions Tribunal Act 1997 (the Tribunal Act). 15 Section 55 of the Privacy Act relevantly provides: (1) If a person who has made an application for internal review under section 53 is not satisfied with: (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Tribunal for a review of the conduct that was the subject of the application under section 53. 16 Section 53 of the Act provides: (1) A person ("the applicant") who is aggrieved by the conduct of a public sector agency is entitled to a review of that conduct. (2) The review is to be undertaken by the public sector agency concerned. (3) An application for such a review must: (a) be in writing, and (b) be addressed to the public sector agency concerned, and (c) specify an address in Australia to which a notice under subsection (8) may be sent, and (d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and (e) comply with such other requirements as may be prescribed by the regulations. (4) Except as provided by section 54 (3), the application must be dealt with by an individual within the public sector agency who is directed by the agency to deal with the application. That individual must be, as far as is practicable, a person: (a) who was not substantially involved in any matter relating to the conduct the subject of the application, and (b) who is an employee or officer of the agency, and (c) who is otherwise suitably qualified to deal with the matters raised by the application. (5) In reviewing the conduct the subject of the application, the individual dealing with the application must consider any relevant material submitted by: (a) the applicant, and (b) the Privacy Commissioner. (6) The review must be completed as soon as is reasonably practicable in the circumstances. However, if the review is not completed within 60 days from the day on which the application was received, the applicant is entitled to make an application under section 55 to the Tribunal for a review of the conduct concerned. (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following: (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again. (8) As soon as practicable (or in any event within 14 days) after the completion of the review, the public sector agency must notify the applicant in writing of: (a) the findings of the review (and the reasons for those findings), and (b) the action proposed to be taken by the agency (and the reasons for taking that action), and (c) the right of the person to have those findings, and the agency's proposed action, reviewed by the Tribunal. 17 In short the Privacy Act provides for a two-step review process. A person aggrieved by certain conduct or alleged conduct, as defined in s 52(1), may apply to the relevant agency for internal review of that conduct within six months of becoming aware of the conduct in question. If the person is not satisfied with "the findings of the review or the action taken by the agency in relation to the application", the applicant may apply to the Tribunal for a review of the conduct the subject of the application for internal review. 18 The Tribunal Act sets out the procedures that apply in respect of applications for internal and external reviews of an administrator's decision. The prima facie rule is that an application for an internal review is to be lodged within 28 days (or such later period as the administrator may allow): s 53(2)(d). A person may apply to the Tribunal for a review of a reviewable decision only if certain conditions are met including that an internal review is taken to be finalised: s 55(1) (b). However the Tribunal may review a decision of an administrator that has not been the subject of an internal review where a late application for an internal review has been made and "the person dealing with the application unreasonably refused to consider the application": s 55(2)(b). 19 Section 52(4) of the Privacy Act provides that s 53 of the Tribunal Act (internal reviews) does not apply to or in respect of conduct to which this Part (Part 5) applies. Part 5 sets out the procedures for internal and external review. 20 No time limits apply in respect of applications to the Tribunal for external review made pursuant to s 55(1) of the Privacy Act. Does an application for internal review lodged outside time meet the conditions of s 53(3) of the Privacy Act? 21 It is not in issue that the application for internal review was made about four months out of time but otherwise complied with all relevant requirements of s 53(3) of the Privacy Act. What is in issue is the consequence of the failure to lodge within time. 22 The applicant submits that a "late" application which otherwise complies with the requirements of s 53(3), may nonetheless constitute an "application" for the purpose of s 53(3) and s 55(1). While he concedes that s 53(3) is couched in mandatory terms he argues that the use of the word "must" in the opening words of s 53(3) should be read down by the word "may" in s 53(3)(d). Given that s 53(3)(d) grants the relevant agency a discretion to accept a late application, it follows it is submitted, that s 53(3)(d) cannot be seen as a mandatory requirement. 23 The applicant submits that were it not for the discretion conferred by s 53(3)(d) an application made out-of-time could not be construed as having met the pre-conditions set out in s 53(3). However the conferral of discretion means that the time limit cannot be seen as arbitrary and a precondition to compliance with s 53(3). I further understand the applicant to argue that it is anomalous that an application made out of time but accepted by the agency constitutes a competent application, while an application made out of time but not accepted by the agency, does not. 24 Accordingly the applicant contends, applications lodged outside time and not accepted by the agency, are reviewable under s 55(1). 25 I do not accept this argument. The wording of the provision is clear and unambiguous "an application for such a review must …be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow)…" The fact that a power is conferred on an agency to waive the time limit does not extinguish the requirement. It merely confers a power on the agency to accept a late application at its discretion. Contrary to the applicant's argument, the granting of power to waive the time limit does not, in effect void the requirement. 26 If the agency decides to accept an application out of time such application constitutes a competent application for the purpose of s 53(1) and as such is a reviewable decision under s 55(1). If however the agency declines to so exercise its discretion, the application does not satisfy s 53(3) and cannot be considered a competent application. 27 Accordingly in my view the application made by the applicant on or around 24 July 2000 does not meet the conditions set out in s 53(3). Can the Tribunal review the agency's refusal to accept the review request as an application under s 53 of the Act? 28 The applicant argues that the agency's decision not to accept his out-of-time application constitutes a reviewable decision under s 55(1) of the Privacy Act. He contends that the words "action taken by the public sector agency" catches a decision by an agency to exercise (or not) its discretion to accept an out-of-time application. The applicant endorses the submissions advanced on behalf of the Privacy Commissioner (the Commissioner) in Y v Department of Education and Training [2001] NSWADT 149. 29 There an application was made to the Tribunal to review certain conduct of the Department of Education and Training. As in this case, an application for internal review had been lodged outside time and the Department declined to exercise its discretion to accept that application. It was submitted for the Commissioner that the application could be saved if it were recast as an application for review of the agency's refusal to extend time. A refusal to accept a late application, constituted in the view of the Commissioner an "action taken…in relation to the application" within the meaning of s 55(1)(b). 30 President O'Connor DCJ rejected the submissions advanced on behalf of the Commissioner. In the view of the President the absence of a competent application for internal review was fatal to any application for external review: In my view, 'an action' taken by an agency 'in relation to an application' can only refer to an action taken in relation to a competent application. There can be no competent application if a time requirement (or other requirement such as a fee requirement) affecting lodgement is not met (cf. Cheung v Administrative Decisions Tribunal [2000] NSWSC 1062 (Dunford J): [at 69]. 31 The President dismissed the Commissioner's argument that if it were the case that the Tribunal had no power to review an agency's exercise of discretion under s 53(3)(d) the result would be that applicants seeking redress under the Privacy Act "would be treated differently and accorded fewer rights than applicants for reviewable decisions under other legislation." The President observed [at 70]: Rather than assisting the Privacy Commissioner's argument, this highlights in my view the difficulty that is faced in discerning any power in the Tribunal to examine a decision by an agency to refuse an application which is out of time. Had the legislature intended that the flexibility found in the general scheme should apply to Privacy Act internal reviews it is to be expected that it would have so provided. 32 President O'Connor observed [at 72] that the word " action" as used in Part 5 of the Act refers to action taken by the agency consequent on the findings of an internal review . This, the President noted, is consistent with the findings/action dichotomy apparent in s 53(7) and s 53(8). 33 The President did not expressly address the argument put by the Commissioner that the reference to "the application" in s 55(1)(b) rather than "the conduct of the review" was indicative of an intention to empower the Tribunal to entertain an application. In this case the applicant joins with the Commissioner in arguing that if "If paragraph (b) is not intended to apply to a refusal to conduct an internal review one would expect it to refer to the conduct of the review rather than to the application.": see Y v Department of Education and Training at [58]. 34 The respondent contends that it is clear that the power conferred on the Tribunal by s 55(1)(b) in respect of action taken by an agency does not relate to procedural matters concerning "the conduct of the review" but rather its scope is limited to the agency's response to its findings, namely the orders. If the construction advanced by the Commissioner in Y v Department of Education and Training were to prevail, argues the respondent, the Tribunal would effectively be deprived of power to review the consequences of the agency's review. In addition if this interpretation were correct it would be open to the Tribunal to review all aspects of the agency's procedure in respect of internal reviews. 35 I am not entirely convinced that the words "in relation to the application" should be restricted in meaning, as submitted by the respondent, exclusively to the remedies or orders made following an internal review. While, as noted by the President there exists in Part 5 an apparent distinction between the words "action" and "findings", the words, "in relation to the application" appear to me to be capable of broad interpretation and may embrace other action taken by the agency in relation to the application, not just the orders made as consequence of findings. 36 However s 55 makes clear that to trigger a review by the Tribunal it is first necessary to establish that a person …has made an application for internal review under s 53. Section 53(3) prescribes certain conditions in respect of internal applications. Here these conditions have not been met in full. Even if the words "in relation to an application" are not intended to be given the narrow meaning suggested by the respondent, in the absence of a competent application for an internal review this application must fail irrespective of what steps the respondent took in respect of the purported application. 37 The discretion conferred on the agency by s 53(3) is broad. The legislation provides no guidance as to what factors if any are to be taken into account by the agency in the exercise of this discretion. Relevantly the Privacy Act contains no equivalent to s 55(2)(b) of the Tribunal Act, which expressly grants the Tribunal power to review an internal application made out of time. I agree with the conclusion of the President in Y v Department of Education and Training [at 73] that "where it is found, or there is no dispute, that the application for internal review is out of time, the agency has, I consider, a discretion to refuse to accept the application which is not amenable to reconsideration by the Tribunal." 38 As the application made by the applicant on 24 July 2001 cannot be re-cast as an application for review of the agency's decision not to accept a late application, the applicant cannot be considered to be "a person who has made an application for internal review under s 53" and accordingly the Tribunal does not have jurisdiction to determine this application. Can the Tribunal exercise its powers under s 55(5) of the Privacy Act? 39 The applicant contends that s 55(5) is applicable in this case. That section provides: If, in the course of a review under this section, the Tribunal is of the opinion that the chief executive officer or an employee of the public sector agency concerned has failed to exercise in good faith a function conferred or imposed on the officer or employee by or under this Act (including by or under a privacy code of practice), the Tribunal may take such measures as it considers appropriate to bring the matter to the attention of the responsible Minister (if any) for the public sector agency. 40 I understand the applicant to argue that the respondent failed to exercise in good faith the power conferred on it by s 53(3)(d) and accordingly the Tribunal should bring the matter to the attention of the Minister. 41 The applicant argues that prior to his appointment as a permanent employee (some ten months after he learned of the respondent's offending conduct) it was not a viable option for him to make an application for internal review, to the respondent who, after all, was his prospective employer. I understand the applicant to argue that, given that this was explained to the respondent, in all the circumstances the decision to refuse to accept his application was unreasonable and capricious. 42 I accept that job applicants would be concerned that lodging internal review applications with a prospective employer may jeopardise their job prospects with that employer. Further I accept that in certain circumstances a decision by an agency not to exercise a conferred discretion may amount to a failure to exercise a power conferred on it in good faith. 43 But in any event the provisions of s 55(5) can only be triggered where the Tribunal has power to conduct an external review. This is made clear from the opening words of the provision: "If in the course of a review under this section [s 55] the Tribunal is of the opinion…" As the Tribunal does not have jurisdiction to determine this application s 55(5) does not apply. Ground 2: The information referred to in the application is not personal information 44 Given my finding that the Tribunal does not have jurisdiction to determine this application it is not necessary for me to determine whether the information referred to by the applicant falls within the definition of "personal information" as defined by s 4 of the Act. Orders Application dismissed.