Civil and Administrative Tribunal New South Wales Medium Neutral Citation: Bevege v Commissioner of Police, NSW Police Force [2014] NSWCATAD 22 Hearing dates: On the papers Decision date: 03 March 2014 Jurisdiction: Administrative and Equal Opportunity Division Before: P H Molony, Senior Member Decision: 1. The application for review with respect to the alleged disclosure of Ms Bevege's personal information in breach of s 18 of the Privacy and Personal Information Protection Act 1998 is dismissed. 2. With respect to the balance of Ms Bevege's application which concerns conduct alleged to be in breach of s 17 of the Privacy and Personal Information Protection Act 1998: a. the Applicant shall make any application for the issue of a summons within 14 days. b. the Applicant shall file and serve any evidence and materials on which she wishes to rely within 35 days of the publication of these reasons. c. the Respondent shall file and serve any evidence and materials on in reply within 21 days of the service of the Applicant's material. 3. This matter is listed for a planning meeting on 6 May 2014 at 9.30AM (Sydney time). Catchwords: Privacy and Personal Information Protection -extraterritorial disclosure of personal information - jurisdiction Legislation Cited: Privacy and Personal Information Protection Act 1998 Government Information (Public Access) Act 2009 Cases Cited: BY v Director-General Attorney General's Department [2002] NSWADT 79 Department of Education and Communities v VK [2011] NSWADTAP 61 Director General, Department of Education and Training v MT [2005] NSWADTAP 77 GQ v NSW Department of Education and Training (No 2) [2008] NSWADT 319 Project Blue Sky Inc v Australian Broadcasting Authority [1998] HCA 28 Terzic v Registrar if Births Deaths and Marriages [2013] NSWADT 82 Category: Interlocutory applications Parties: Allison Bevege (Applicant) Commissioner of Police, NSW Police Force (Respondent) Representation: A Bevege (Applicant in person) Crown Solicitors Office (Respondent) File Number(s): 133138 reasons for decision Introduction 1Ms Bevege has applied to the Tribunal for administrative review of a decision made by the Commissioner of Police (the Commissioner), on internal review under the Privacy and Personal Information Protection Act 1998 (the PIPPA Act), in relation to alleged breaches of the information protection principles in that Act. 2Ms Bevege is a journalist. The central allegation at the heart of her complaint is that an employee of the NSW Police Force Media Unit rang her employer in the Northern Territory and told him of a request she had made for access to information under the Government Information (Public Access) Act 2009, without her consent. The request has been made by Ms Bevege in her personal capacity, rather than in the course of her employment. The NSW Police Force had not obtained her consent to that information being disclosed to her employer. According to the Commissioner's submissions - "...the officer contacted Ms Bevege's editor at her current place of employment, in relation to the application, believing the application to have been made by Ms Bevege in her capacity as an employee of that publication. The officer was informed that the ... was not intending to publish any story in respect of the information sought." 3Ms Bevege alleged breaches of the disclosure and use information protection principles. The internal review found no breaches of the PIPPA Act. 4On 20 May 2013 Ms Bevege's application came before Deputy President Hennessy. A jurisdictional issue was identified which required determination before the matter could be finally determined. It concerned whether the facts as alleged Ms Bevege by could constitute a disclosure of information in breach of the PIPPA Act because the disclosure was made outside the State of NSW. Similar issues were raised with respect to whether a breach of the use principle in section 17 was demonstrated by the facts as alleged. 5Deputy President Hennessey made directions for the parties to file and serve submissions going to the jurisdiction al issue, which was then to be determined on the papers. 6Submissions have since been filed by the Respondent. These relied on the previous decision of the Tribunal in GQ v NSW Department of Education and Training (No 2) [2008] NSWADT 319 in which Deputy President Handley found that s 18 of the PIPPA Act (the disclosure principle that Ms Bevege says has been breached) - ... does not apply in respect of the disclosure of personal information by a public sector agency in NSW, such as the Department, to any person or body in a jurisdiction outside NSW or to a Commonwealth agency. 7Ms Bevege made extensive submissions in which she acknowledged the force of the decision in GQ, but submitted that it was wrong as a matter of law and of principle, and that "now is the [Tribunal's] chance to correct a very bad wrong." Ms Bevege also made submissions going to the issue of fairness, and the undesirability of the Police being able to take advantage of the loophole created by the decision in GQ to escape the consequences of its conduct. 8A central argument raised by Ms Bevege was that because the officer was in NSW when he made the disclosure, the disclosure was made in NSW, albeit communicated by phone with a person interstate. Thus Ms Bevege says the disclosure was made in NSW. Further she says that there were internal disclosures within the NSW Police Force from the Information Access Unit to the Media Unit. 9Ms Bevege also sought leave to issue summonses, which would lead to obtaining evidence relevant to a final determination of this matter, if I find that the Tribunal has jurisdiction. I considered that evidence would be no assistance in dealing with the jurisdictional issues in which I am assuming Ms Bevege can make out her allegations. I declined to authorise the issue of those summonses before I had determined the jurisdictional issues. 10The Privacy Commissioner exercised her right to be heard under s 55(6) of the PIPPA Act and made written submissions in which she urged a different interpretation of the provisions of the Act to that take by Handley DP in GQ, and submitted that a different conclusion should be reached. 11The Commissioner sought and obtained leave from me to file and serve further submissions in response to the submissions from Ms Bevege and the Privacy Commissioner that the Tribunal should reconsider the decision in GQ. I gave that leave as that it was apparent that the Commissioner had not been aware that the correctness, or otherwise, of the decision in GQ would be an issue in the proceedings when it made its original submissions. Given Ms Bevege's and the Privacy Commissioner's submissions with respect to reconsidering GQ, I thought the Commissioner had a right to be heard on that issue. 12Against that background I turn to consider whether the Tribunal has jurisdiction to review the alleged conduct of the Commissioner with respect to the disclosure and use of personal information alleged by Ms Bevege. I do so, accepting for the purposes of this determination only, that Ms Bevege will be able to demonstrate the conduct she alleges. Disclosure 13 Sections 18 and 19 Act of the PIPPA Act provide - 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. 19 Special restrictions on disclosure of personal information (1) A public sector agency must not disclose personal information relating to an individual's ethnic or racial origin, political opinions, religious or philosophical beliefs, trade union membership or sexual activities unless the disclosure is necessary to prevent a serious and imminent threat to the life or health of the individual concerned or another person. (2) A public sector agency that holds personal information must not disclose the information to any person or body who is in a jurisdiction outside New South Wales or to a Commonwealth agency unless: (a) a relevant privacy law that applies to the personal information concerned is in force in that jurisdiction or applies to that Commonwealth agency, or (b) the disclosure is permitted under a privacy code of practice. (3) For the purposes of subsection (2), a relevant privacy law means a law that is determined by the Privacy Commissioner, by notice published in the Gazette, to be a privacy law for the jurisdiction concerned. (4) The Privacy Commissioner is to prepare a code relating to the disclosure of personal information by public sector agencies to persons or bodies outside New South Wales and to Commonwealth agencies. (5) Subsection (2) does not apply: (a) until after the first anniversary of the commencement of this section, or (b) until a code referred to in subsection (4) is made, whichever is the later. 14There is no dispute that at the time of the alleged disclosure and use of Ms Bevege's personal information the Privacy Commissioner had not prepared a code authorised by s 119(4). As a consequence, the effect of the curiously worded ss (5) was that s 119(2) did not apply, because a code relating to extra-territorial disclosure had not yet been made. This absence of a code is a matter that the Privacy Commissioner has now taken steps to address. 15The same situation prevailed at the time the decision in GQ v NSW Department of Education and Training (No 2) [2008] NSWADT 319 was made. There the personal information concerned a debt owed by a teacher to a NSW School, the fact of which had been communicated in a telephone conversation between the principal of that school and the principal of a Victorian school, at which the teacher was then working. Handley DP identified the issue to be determined as whether, "the PPIP Act applies to trans-border disclosures of information." The only submissions before him were those advanced by the Privacy Commissioner, whose submissions, at that time, were substantially accepted by the Tribunal. Those submissions are at odds with those now made by the Privacy Commissioner. 16 The Tribunal first found that s 18(1) and s 19(2) of the PIPPA Act contained inconsistent provisions - 14 I am satisfied, in this instance, that section 18(1) is a general provision limiting the disclosure of personal information, whereas section 19(2) is a specific provision dealing with disclosure of personal information to a person or body outside NSW. The effect of the application of the generalia specialibus presumption, there being no indication that the presumption should not be applied, is that the specific provision - section 19(2) - prevails to the extent of any repugnancy with the general provision - section 18(1). Thus, section 18(1) does not apply in respect of the disclosure of personal information by a public sector agency in NSW, such as the Department, to any person or body in a jurisdiction outside NSW or to a Commonwealth agency. 15 The fact that pursuant to section 19(5), section 19(2) has not come into operation, as Ms Morris explained, does not, in my view, affect this reasoning. Ms Morris stated that it is open to the Privacy Commissioner to prepare a privacy code of practice regulating the disclosure of personal information by public sector agencies to persons or bodies outside NSW, and permitting disclosures, for example, in circumstances similar to those set out in paragraphs (a) to (c) of section 18(1). I note that section 29(4) specifically recognises that "[a] privacy code of practice may also provide for the disclosure of personal information to persons or bodies outside New South Wales". I also note that section 19(4) appears to impose an obligation on the Privacy Commissioner to prepare such a code. However, the fact that this has not yet happened, despite the passage of over nine years since section 19(1) took effect, does not mean that section 19(5) no longer applies. 16 In support of her submission that section 18(1) does not apply to disclosures of personal information outside NSW, Ms Morris also referred to the presumption that legislation is not intended to have extra-territorial effect. In Jumbunna Coal Mine No Liability v Victorian Coal Miners' Association (1908) 6 CLR 309, at 363, O'Connor J said: "In the interpretation of general words in a Statute there is always a presumption that the legislature does not intend to exceed its jurisdiction. Most Statutes, if their general words were taken literally in their widest sense, would apply to the whole world, but they are always read as being prima facie restricted in their operation within territorial limits." 17 Ms Morris noted that the presumption against extra-territoriality is reflected in section 12(1)(b) Interpretation Act 1987, which states: (1) In any Act or instrument: (a) ... (b) a reference to a locality, jurisdiction or other matter or thing is a reference to such a locality, jurisdiction or other matter or thing in and of New South Wales. 18 As Ms Morris noted, there is nothing to indicate that the NSW Parliament intended to displace the presumption and, indeed, extra-territorial disclosures are specifically addressed in section 19(2). 19 The above leads me to conclude that section 18(1) of the PPIP Act does not apply to disclosures of personal information to a person or body outside NSW. Thus, GQ is unable to pursue a remedy against the Department. Any remedy would have to lie under section 19(2), but that provision is not yet in operation as a result of the Privacy Commissioner not having made the relevant privacy code of practice necessary to bring section 19(2) into operation pursuant to section 19(5). ... 17In this case the Privacy Commissioner has submitted that that there is no inconsistency between the provisions of section 18(1) and 19(2) which prevents them being read consistently with the language and purpose of the PIPPA Act as a whole. In Project Blue Sky Inc v Australian Broadcasting Authority [1998] HCA 28 the majority )McHugh, Gummow, Kirby and Hayne JJ) explained that - "The primary object of statutory construction is to construe the relevant provision so that it is consistent with the language and purpose of all the provisions of the statute. The meaning of the provision must be determined "by reference to the language of the instrument viewed as a whole". In Commissioner for Railways (NSW) v Agalianos. Dixon CJ pointed out that "the context, the general purpose and policy of a provision and its consistency and fairness are surer guides to its meaning than the logic with which it is constructed". Thus, the process of construction must always begin by examining the context of the provision that is being construed. A legislative instrument must be construed on the prima facie basis that its provisions are intended to give effect to harmonious goals. Where conflict appears to arise from the language of particular provisions, the conflict must be alleviated, so far as possible, by adjusting the meaning of the competing provisions to achieve that result which will best give effect to the purpose and language of those provisions while maintaining the unity of all the statutory provisions. Reconciling conflicting provisions will often require the court "to determine which is the leading provision and which the subordinate provision, and which must give way to the other". Only by determining the hierarchy of the provisions will it be possible in many cases to give each provision the meaning which best gives effect to its purpose and language while maintaining the unity of the statutory scheme. Furthermore, a court construing a statutory provision must strive to give meaning to every word of the provision. In The Commonwealth v Baume Griffith CJ cited R v Berchet to support the proposition that it was "a known rule in the interpretation of Statutes that such a sense is to be made upon the whole as that no clause, sentence, or word shall prove superfluous, void, or insignificant, if by any other construction they may all be made useful and pertinent". 18The Privacy Commissioner argues that s 19 can be read as imposing restrictions, which are additional to those imposed by s 18(1), that apply in the special circumstances when s 19(1) and (2) apply. The Commissioner on the other hand argued that there are clear and recognised inconsistencies between the provisions in s 18(1) and s 19, citing the Appeal Panel decision in Director General, Department of Education and Training v MT [2005] NSWADTAP 77. There the Tribunal found that s 19 "overrides if one of the categories in s 18(1)(c) is in issue" and that different defences are available depending upon which of those sections applies. The Commissioner went on to embark on a detailed consideration of the operation of the two provisions in an effort to demonstrate inconsistency. 19The Commissioner and the Privacy Commissioner are in agreement that s 19(2) has the effect of displacing the application of s 12(1) of the Interpretation Act 1987 in respect of disclosure. The Privacy Commissioner however, suggests that s 12(1) does not confine disclosures to which section 18(1) and 19(1) to ones within NSW only. If it did so, she submits, a number of provisions in the Act would be made redundant, particularly s 23(5). This exempts public service agencies (including law enforcement agencies which s 4 defines to broadly include Federal and State Police Forces among others) from complying with s 18(1) in defined circumstances. Such as interpretation, she submits, would undermine the purposes of the PIPPA Act. 20In response the Commissioner pointed out that s 23(5) is capable of applying to the disclosure of personal information to Federal and State Police Forces in NSW. The definition of Law enforcement agency was said not to evince an intention that the Act generally apply extraterritorially. 21The Commissioner adopted as a primary argument that the Tribunal had previously decided that s 118(1) did not apply in circumstances involving a disclosure of personal information via telephone to an interstate person or agency, and that the Tribunal, at first instance level, should exercise judicial comity and follow the decision GQ. The Commissioner referred to BY v Director-General Attorney General's Department [2002] NSWADT 79 and Terzic v Registrar if Births Deaths and Marriages [2013] NSWADT 82. In the former President O'Connor said at [21- 23] - 21 The threshold question that arises before considering any further these contentions is whether the present Tribunal should revisit the prior considered rulings. Counsel for the Administering Minister acknowledged the importance of different panels of a Division of the Tribunal being seen to deal consistently with the same or like questions. He acknowledged that the view might be taken that it would not be appropriate to revisit the previous, considered rulings. 22 In my view, a later Tribunal should exercise caution in reopening prior, considered rulings of an earlier Tribunal. Ordinarily a later Tribunal should adopt the ruling of the earlier Tribunal; and leave these questions to be finally determined within the Tribunal at the Appeal Panel level. Notably in the earlier cases where the Administering Minister's submissions have been rejected, there was no appeal; but that may have been, as counsel for the Administering Minister suggested at hearing, because ultimately following full substantive consideration the determinations in issue were affirmed. 23 Normally a prior considered Tribunal ruling should only be reopened if a new, significant argument is raised before the later Tribunal. This is not such a case. Nonetheless, I consider that some discretion should be allowed to a Divisional Head sitting at first instance to revisit prior rulings, where the Divisional Head has doubts about the prior rulings or the questions involved are of great significance, such as ones raising important issues of power or jurisdiction. (Such a ruling may itself be appealed to the Appeal Panel. In that event, the Divisional Head, who would customarily preside, is ineligible. Where there is an appeal in relation to such a ruling, the Appeal Panel should, in my view, give consideration, if it regards the ruling as doubtful, to referring the controversial question to the Supreme Court for determination.) 22In the present case the arguments being agitated with respect to the extraterritorial application of the PIPPA Act are the same as those that that were the subject of a considered ruling in GQ, albeit there the Tribunal did not have the benefit of a clear contradictor as is the case here. No new argument is raised here, although the competing arguments with respect to the issue have been well enunciated. 23In those circumstances, and given the guidance in BY, I think it incumbent upon me to follow the decision Handley DP made in GQ v NSW Department of Education and Training (No 2) [2008] NSWADT 319 in order to ensure consistency in decision making by the Tribunal. 24I also think that Ms Bevege's argument that a disclosure made in NSW over the phone to an interstate person does not withstand the weight of analyses. I accept the Commissioner's submission that the "essence of disclosure is making known to a person information that the person to whom the disclosure is made did not previously know": see Nasr v State of NSW (2007) 170 A Crim R 78 at 106. Disclosure occurs when information is revealed to the recipient and is dependent on the recipient's knowledge. Were I to accept Ms Bevege's submission, given the decision in GQ, the provisions of a 19(2) - once a code is issued - could be easily avoided by the device of making a phone call. I do not consider such a result consistent with the purposes of the Act. 25Finally, I note that Ms Bevege's argument that there has been internal disclosures of her personal information between units of the New South Wales Police Force does not evidence a breach of s 18. This is so because it is well established that the internal use of information within an agency does not amount to disclosure. 26I appreciate that this result will be a severe disappointment to Ms Bevege who considers she has been a victim of a real injustice. The issue however is one of law, in which there is already a considered decision determinative of the issue. The appropriate forum to seek a reconsideration of that authority is at appeal level. Use 27Section 17 of the PIPPA Act provides - A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless: (a) the individual to whom the information relates has consented to the use of the information for that other purpose, or (b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or (c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person. 28The Commissioner submits that there is no separate use of Ms Bevege's personal information in breach of s 17 demonstrated in the facts as alleged by her. The Privacy Commissioner does not address this issue. 29Ms Bevege argues that 'use' is a word of ordinary and common meaning. As I understand it, she argues that by using information she had provided in support of her application for access to information for the purposes of the media unit, the Commissioner used the information for a purpose other than that which it was collected without her consent. 30The Appeal Panel in Department of Education and Communities v VK [2011] NSWADTAP 61 pointed to the questions of degree concerning the overlap between issues of use and disclosure. The Appeal Panel said - 27 Each case will depend on its facts. There will, we expect, be circumstances where there is an identifiable internal "use" transaction and an identifiable external "disclosure" transaction in the one sequence of events. ...The internal action would attract the "use" data quality principle. 28 But there will be other circumstances where the situation does not involve any parallel internal action. 31In Ms Bevege's case my view is that the matters she alleges may, on a full hearing of the matter and a consideration of all the facts, give rise to a conclusion that there are separate and distinct internal uses of her personal information in the Commissioner's handling of that information leading to its disclosure. It is certainly not an argument that at this stage of proceedings I am prepared to find has no basis in fact. 32 As a consequence I propose to make directions for the filing of further evidence in relation to that issue, leading to a planning meeting at which a hearing date will be fixed to determine the use issue. Orders 33The Tribunal makes the following orders: 1. The application for review with respect to the alleged disclosure of Ms Bevege's personal information in breach of s 18 of the Privacy and Personal Information Protection Act 1998 is dismissed. 2. With respect to the balance of Ms Bevege's application which concerns conduct alleged to be in breach of s 17 of the Privacy and Personal Information Protection Act 1998: a. the Applicant shall make any application for the issue of a summons within 14 days. b. the Applicant shall file and serve any evidence and materials on which she wishes to rely within 35 days of the publication of these reasons. c. the Respondent shall file and serve any evidence and materials on in reply within 21 days of the service of the Applicant's material. 3. This matter is listed for a planning meeting on 6 May 2014 at 9.30AM (Sydney time). ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 03 March 2014