DVT v Commissioner of Police [2021] NSWCATAD 108

Read the decision here: DVT v Commissioner of Police [2021] NSWCATAD 108

Summary

The NSW Police Force’s (NSWPF) (the Respondent) Privacy Management Plan (PMP) contains information regarding the person/business unit and address where access requests should be directed and posted. DVT (the Applicant) sent six access requests to the Respondent. Instead of directing and posting the access requests to the person/business unit specified in the PMP, the Applicant sent three emails to the incorrect business unit within the NSWPF, two emails to a senior lawyer at the Office of the General Counsel (OGC) and one email to the InfoLink Command of the NSWPF. The Respondent only actioned the email sent to InfoLink Command.

The Applicant lodged two internal review requests with the Respondent. The first request referred to five emails (Emails 1-5) sent by the Applicant to the Respondent requesting access to their personal information and requested an internal review by the Respondent on the basis that the Respondent failed to provide the Applicant with access to their personal information in breach of IPP 7. The second request referred to a sixth email (Email 6) sent by the Applicant to the Respondent requesting access to their personal information and requested an internal review by the Respondent on the basis that the Respondent failed to provide the Applicant with access to their personal information without excessive delay in breach of IPP 7.

In relation to the access requests in Emails 1-5, the Tribunal determined that the access requests were received by the Respondent and the Respondent held the personal information of the Applicant which was the subject of the access requests, some of which was not exempted from access and to which access should have been granted without excessive delay. The Tribunal found that the time elapsed in relation to each of these access requests amounted to excessive delay in breach of IPP 7.

The Tribunal accepted that the Respondent did not receive the Applicant’s access request in Email 6 until it received the second internal review request.

What you need to know

Section 14 of the PPIP Act (IPP 7) does not include in its wording any qualifications, requirements or conditions to (or contemplate the ability to impose such on) an individual's exercise of their right to access their personal information held by an agency.

There can be no fetter on the means of making or to whom or which part of an agency an individual may apply pursuant to section 14 for access to their personal information held by that agency.

As long as, as in this case, the email address is a valid email address of an agency or an employee, function or area of the agency and the email was received by that addressee (e.g. with no bounce back or delivery failure notice sent to the individual) then the agency has received the access request for the purposes of the PPIP Act. It is up to the agency to have in place appropriate measures to ensure that all such access requests are appropriately referred internally, dealt with and responded to (i.e. access is provided) in a timely manner and without excessive delay.

Certain circumstances may come into play in determining whether there has been excessive delay in a specific case (i.e. the time permitted for an agency to provide access), which may allow a longer period than in other circumstances in which to provide access. While it may be in the circumstances that some additional small amount of time is allowed for granting of access (i.e. before it is considered excessive delay) where the request is made to an area/person other than the area/person specified, this does not allow for either undue delay or an unlimited time for the agency to provide access (i.e. until an individual requests an internal review for example).

It is the agency's obligation to implement appropriate processes, escalation procedures and training of all its personnel to ensure that, no matter who of or how the agency receives a personal information access request under section 14, all requests will be directed to the appropriate person within the agency to deal with such access requests “without excessive delay”.

It is not required under section 14 of the PPIP Act for, or incumbent upon, an individual who has applied to an agency under section 14 to follow up or chase that agency in relation to their access request (in the absence of a delivery failure notice, for example) if the agency has not responded to that request within any specified time. It is the agency's obligation to comply with section 14, irrespective of any lack of follow‑up or additional action taken by the individual.

In complying with a section 14 access request, the agency may apply any exemptions to access and therefore limit the personal information to which the applicant is provided access. However, simply because a broad access request is made under section 14 that may otherwise include some exempt information or information for which non-compliance by the agency is excused, it is not sufficient grounds to deny access to all personal information the subject of the access request (i.e. to not provide the other personal information not exempted or excused from access). That is, the access request must be fulfilled by the agency by withholding only that personal information exempted from access.

In summary, unless non‑compliance is excused or compliance is otherwise exempted by other provisions of the PPIP Act (or other legislation) then providing access without excessive delay is a legislative obligation imposed on an agency which, apart from any such legislative exemptions or excuses, cannot be made subject to any qualifications imposed by the agency.

Where access is denied by an agency based on any lawful excuse or exemption, that agency should notify the individual of this without excessive delay in order to enable that individual to pursue, if they wish, an internal review of that decision.

Legislative background

PPIP Act

• Section 4 definition of “personal information”
• Section 14 access to personal information held by agencies
• Section 24 exemptions relating to investigative agencies
• Section 25 exemptions where non-compliance is lawfully authorised or required
• Section 27 specific exemptions (ICAC, ICAC Inspector and Inspector’s staff, NSW Police Force, LECC, Inspector of LECC and Inspector’s staff and NSW Crime Commission)
• Section 53 internal review by public sector agencies
• Section 55 administrative review of conduct by Tribunal

Review requirements and jurisdiction

• Civil and Administrative Tribunal Act 2013 (NSW)
• Section 30 administrative review jurisdiction
• Administrative Decisions Review Act 1997 (NSW)
• Section 63 operation and implementation of decisions pending applications for administrative review

Factual background

The first internal review request lodged by the Applicant referred to five emails sent by the Applicant to the Respondent requesting access to their personal information and requested an internal review by the Respondent on the basis that the Respondent failed to provide the Applicant with access to their personal information in breach of IPP 7. The first internal review decision found that the Respondent had not breached IPP 7 as:

• Emails 1-3: The Applicant’s first three access requests were not directed and posted to the person/business unit and address specified in NSWPF’s PMP and were emailed to the incorrect business unit within the NSWPF;
• Email 4: The Applicant’s fourth access request was not directed and posted to the person/business unit and address specified in the PMP. Instead, the request was emailed directly to a senior lawyer at the OGC while she was on maternity leave. An out of office advised the Applicant that the lawyer was away, that emails to that email address would not be actioned in her absence and provided the contact details of those persons to whom enquiries could be directed in the meantime;
• Email 5: The Applicant’s fifth access request was not directed and posted to the person/business unit address specified in the PMP. Instead, the request was emailed directly to the InfoLink Command of the NSWPF who, despite not having responsibility under the PMP for any function related to the PPIP Act, actioned the request.

In the second internal review request, the Applicant referred to an email dated 20 December 2018 sent by the Applicant to the same senior lawyer at the OGC requesting access to copies of all emails, file notes and memorandums arising out of their application for ex-gratia legal assistance. The Applicant requested an internal review by the Respondent on the basis that the Respondent failed to provide the Applicant with access to their personal information without excessive delay in breach of IPP 7. The second internal review decision found that the Respondent had not failed to comply with IPP 7 because the Applicant sent their access request in an email to the senior lawyer at the OGC instead of directing and posting the request to the officer specified in the PMP. The senior lawyer remained on leave and ultimately resigned without returning to work. The lawyer’s email was not monitored so the Respondent was not aware of the Applicant’s access request in Email 6 until receipt of the second internal review request.

The internal reviewer in the second internal review decision noted that searches for information falling within the scope of the Applicant’s access request in Email 6 had located a large amount of information. The internal reviewer concluded that further searches would be necessary to identify the Applicant’s personal information and such searches would be an unreasonable and substantial diversion of the Respondent’s resources.

The Applicant lodged an application for administrative review of the conduct that was the subject of the first internal review, followed by a second application for administrative review of the conduct that was the subject of the second internal review. With the consent of the parties, the proceedings for the first and second administrative review applications were consolidated by the Tribunal.

Before the hearing of the substantive matter, there were several directions hearings, interlocutory and interim matters raised on which submissions were made and, in some cases, on which the Tribunal made orders, in particular in respect of a Summons Application by the Applicant. In relation to the Summons Application, the Respondent gave an Undertaking to the Applicant to not run the Deed argument at the breach stage. In November 2011, the Applicant and their legal representatives attended a meeting to settle a number workers compensation claims and other claims by the Applicant against the NSWPF. As a result of that meeting, a deed of release (Deed) was executed. The Respondent sought to withdraw from the Undertaking in writing by a letter dated 30 April 2020 to the Applicant.

In this matter, the issues for determination by the Tribunal were:

1. whether the purported withdrawal of the Undertaking by the letter dated 30 April 2020 was valid and therefore whether the Undertaking was in force at the date of the Hearing;
2. the consequences of the decision in relation to (1) above on the scope of the Tribunal’s inquiry in relation to the alleged breach by the Respondent of IPP 7 (i.e. could the Respondent rely on certain terms of the Deed to argue that IPP 7 had not been breached by the conduct the subject of the first internal review, the conduct of the second internal review or that any such breach was excused); and
3. applying the decision in relation to (2) above, whether the Respondent’s conduct breached IPP 7.

Tribunal findings

Was the Undertaking in force at the date of the Hearing?

The Tribunal noted that the Undertaking was “to not run the Deed argument at the breach stage".  The Tribunal interpreted this to mean that, while the Undertaking remained effective, the Respondent could not use or rely on the existence of the Deed or any of the terms of the Deed in relation to its submissions on or relating to the section 14 (PPIP Act) breach issue. The Undertaking was made during the Summons Application hearing in order to persuade the Applicant to not include a number of documents which had originally been requested by the Applicant to be included in the Summons, which the Applicant did. The Tribunal determined that the Respondent’s solicitor could not unilaterally withdraw from the Undertaking. Therefore, given that the Applicant had not released the Respondent’s solicitor from the Undertaking and wished that it be enforced, the purported withdrawal of the Undertaking by the letter dated 30 April 2020 was not valid and the Undertaking remained effective at the date of the Hearing.

The scope of the Tribunal’s inquiry in relation to the alleged breach by the Respondent of IPP 7

In relation to IPP 7, the Tribunal stated the following:

• “IPP 7/s14 PPIP Act does not include in its wording any qualifications, requirements or conditions to (or contemplate the ability to impose such on) an individual's exercise of their right to access their personal information held by an agency.”
• “There can be no fetter on the means of making or to whom or which part of an agency an individual may apply pursuant to IPP 7 for access to their personal information held by that agency.”
• “As long as, as in this case, the email address is a valid email address of the Respondent or an employee, function or area of the Respondent and the email was received by that addressee (e.g. with no bounce back or delivery failure notice sent to the individual) then the Respondent has received the access request for the purposes of the PPIP Act. It is up to the Respondent to have in place appropriate measures to ensure that all such access requests are appropriately referred internally, dealt with and responded to (i.e. access is provided) in a timely manner and "without excessive delay".”
• “Certain circumstances may come into play in determining whether there has been excessive delay in a specific case (i.e. the time permitted for an agency to provide access), which may allow a longer period than in other circumstances in which to provide access… While it may be in the circumstances that some additional small amount of time is allowed for granting of access (i.e. before it is considered excessive delay) where the request is made to other than the area/person specified in the PMP (in this case), this does not allow for either undue delay or an unlimited time for the Respondent to provide access (i.e. until an individual requests an internal review for example). In the Respondent’s case, where the request is made in person to a police officer in a police station in remote New South Wales, for example, the additional time granted in which to comply with IPP 7 may likely be a little longer than if the request was emailed to an employee, area or function in a main or the head office of the Respondent.”
• “It is the Respondent's (in this case) obligation to implement appropriate processes, escalation procedures and training of all its personnel to ensure that, no matter who of or how the Respondent receives a personal information access request under IPP 7, all requests so received will be directed by them to the appropriate person (as far as the Respondent is concerned) within the Respondent to deal with such access requests “without excessive delay”.”
• “… it is not required under IPP7/s14 PPIP Act for, or incumbent upon, an individual who has applied to an agency under IPP 7 to follow up or chase that agency in relation to their access request (in the absence of a delivery failure notice, for example) if the agency has not responded to that request within any specified time. It is the agency's obligation to comply with IPP 7, irrespective of any lack of follow‑up or additional action taken by the individual.”
• “… in complying with an IPP 7 access request the Respondent may apply any exemptions to access and thus limit the personal information to which the Applicant is provided access. However, simply because a broad access request is made under IPP 7 that may otherwise include some exempt information or information for which non-compliance by the Respondent (in this case) is excused, it is not sufficient grounds to deny access to all personal information the subject of the access request (i.e. to not provide the other personal information not exempted or excused from access). That is, the access request must be fulfilled by the Respondent by withholding only that personal information exempted from access.”
• “… while subject to possible excuses or exemptions in other sections of the PPIP Act, the wording of s14 PPIP Act/IPP 7 is clear and unconditional. In this case access to personal information of the Applicant held by the Respondent must, at the request of the Applicant and without excessive delay or expense, be provided to the Applicant. In summary, unless non‑compliance is excused or compliance is otherwise exempted by other provisions of the PPIP Act (or other legislation) then providing access without excessive delay is a legislative obligation imposed on the Respondent which, apart from any such legislative exemptions or excuses, cannot be made subject to any qualifications imposed by the Respondent.”
• “Where access is denied by an agency based on any lawful excuse or exemption then, in the spirit of IPP 7, that agency should notify the individual of this without excessive delay in order to enable that individual to pursue, if they wish, an internal review of that decision.”

Did the Respondent’s conduct breach IPP 7?

In relation to the access requests in Emails 1-5, the Tribunal determined that the access requests were received by the Respondent and the Respondent held the personal information of the Applicant which was the subject of the access requests, some of which was not exempted from access and to which access should have been granted without excessive delay. The Tribunal found that the time elapsed in relation to each of these access requests amounted to excessive delay in breach of IPP 7.

The Tribunal accepted that the Respondent did not receive the Applicant’s access request in Email 6 until it received the second internal review request.

Tribunal outcome

The Tribunal made the following orders:

1. The purported unilateral withdrawal of the Undertaking made by the Respondent's solicitor is not valid and the Undertaking remains in place and is effective as against the Respondent.
2. The Respondent has breached s14 PIPP Act/IPP 7 in respect of the Applicant’s requests in Emails 1-5 to access their personal information held by the Respondent.
3. The Respondent did not breach s14 PPIP Act/IPP 7 in respect of the Applicant’s request in Email 6 to access their personal information held by the Respondent.
4. The Applicant is to file and serve submissions as to remedy, not exceeding five (5) pages, within 14 days of the date of these Reasons for Decision.
5. The Respondent is to file and serve submissions as to remedy, not exceeding five (5) pages, within 14 days after receipt of the Applicant's submissions as to remedy.
6. The matter is to be relisted for directions before Senior Member Christie as to remedy on 1 June 2021 at 9:30am.
7. I direct the Principal Registrar of the Tribunal to forward a copy of these Reasons for Decision to the NSW Legal Services Commissioner for such action as the Commissioner may consider appropriate.