Epifano and Privacy Commissioner [2010] AATA 489 (1 July 2010)

Last Updated: 2 July 2010

CATCHWORDS – PRIVACY - jurisdiction – decision not to investigate complaint further – no jurisdiction.

Privacy Act 1988 (Cth), ss 36, 40(1), 40(1A), 40(1B), 41(2), 42, 43, 44, 45, 46, 47, 52(1), 52(3), 59, 61(1), 62(1), 62(2), 62(5), 95(1), 95(5), 95A(7) and 95AA(3)
Safety, Rehabilitation and Compensation Act 1988, s 53(1)
Administrative Appeals Tribunal Act 1975, ss 25(1), 25(3) and 25(4)

Abrahams v Comcare [2006] FCA 1829

DECISION AND REASONS FOR DECISION [2010] AATA 489

ADMINISTRATIVE APPEALS TRIBUNAL )
) 2010/1616
GENERAL ADMINISTRATIVE DIVISION )

Re: SANDRO EPIFANO

Applicant

And: PRIVACY COMMISSIONER

Respondent

DECISION

Tribunal: Deputy President S A Forgie

Place: Melbourne

Date: 1 July 2010

Decision: The Tribunal decides that it does not have jurisdiction to review the decision made on 16 April 2010 by the respondent under s 41(2) of the Privacy Act 1988 not to investigate further a complaint lodged by the applicant in October 2005.

S A FORGIE

Deputy President

REASONS FOR DECISION

Mr Epifano has asked the Tribunal to review a decision of a delegate of the Privacy Commissioner (Commissioner) dated 16 April 2010 to cease the investigation into his complaint against the Department of Veterans’ Affairs (DVA). He made his complaint in 2005. The delegate made the decision after inquiries and an investigation undertaken deciding that DVA had investigated Mr Epifano’s allegations, offered him a written apology, credited his leave entitlements and indicated it would provide further privacy awareness training for all staff in his previous team or section. In addition, DVA had offered him an amount of compensation for non-economic loss and for loss of professional lifestyle allowance in 2006. The Commissioner’s decision was made under s 41(2)(a) of the Privacy Act 1988 (Privacy Act).

2. By making that decision, the Commissioner chose not to complete the investigation begun in March 2006 and so did not give herself the opportunity to use her powers under s 52 to decide whether or not to make a determination and, if so, to make a declaration of the amount of compensation that should be paid to Mr Epifano. I have examined the facts but am unable to find that, despite the delegate’s statement that the decision was made under s 41(2) to end the investigation, the decision was actually made under s 52. As a consequence, I am unable to find that the Tribunal has power to review the decision that has been made for the Privacy Act does not give it power to review a decision made under s 41(2). I understand that Mr Epifano is frustrated by the Commissioner’s decision. A decision of that sort after four years is within the Commissioner’s power to make but is difficult for a complainant to understand. It is particularly difficult to understand that an investigation has not been completed after four years and Mr Epifano has been assured in the letter dated 16 April 2010 advising him of the decision that his “... complaint was being progressed by this Office at all times.”

CONSIDERATION

The task

3. I must take four distinct steps when asked to decide whether the Tribunal has jurisdiction, and so the power or authority, to review a decision on its merits:

1. work out the decision that it is being asked to review;
2. work out if that is the decision that was actually made or a part of the decision that was actually made;
3. work out the types of decisions that the Tribunal has power to review; and
4. work out whether:

(1) the decision that it is asked to review is one of the decisions that it has power to review; and/or

(2) the decision that was actually made or part of that decision it is being asked to review is:

(a) a decision that it has power to review; and

(b) the applicant wants that decision reviewed.

4. Although the steps are distinct, each of the first two must be carried out with an eye on the other. That is particularly so when an unrepresented applicant is asking for review of a decision. An unrepresented applicant may, for example, seek review of a finding of fact that a decision maker makes as part of the process leading to a decision rather than seeking review of the decision that the decision maker makes and that is adverse to him or her. He or she may do so in the belief that a different finding of fact would automatically lead to a decision that is different from the first and one that is not adverse to him or her. That belief leads him or her to seek review of the finding of fact rather than of the decision that the Tribunal has jurisdiction to review.

5. An application made in such circumstances should not be read narrowly. Instead, it should be read with an eye to the essence or substance of what it is that dissatisfies a person and not simply to the form in which it is expressed. The form in which the person chooses to frame the application will be relevant in seeking that essence or substance but so too will the reasons that the he or she gives for seeking review. The application should be read with an understanding of the decision that has been made and the basis on which it was made. If the issue, in relation to which the person seeks review, was irrelevant on any view to the decision that was made and that affects that person, then it may be difficult to do anything other than read the application narrowly.

6. This approach is consistent with that taken by Madgwick J in Abrahams v Comcare[1] when considering whether Mr Abrahams had given a “notice in writing of the injury ... to the relevant authority ... as soon as practicable after the employee becomes aware of the injury” as required by s 53(1)(a) of the Safety, Rehabilitation and Compensation Act 1988. The context is a little different from that which I must consider but the principles are equally applicable. A notice was essential to the Tribunal’s having jurisdiction just as it is also essential to its having jurisdiction that the person seek review of a decision that it has power to review. Madgwick J set out a number of propositions including the proposition that:

“1. In construing a document purporting to be a notice of injury under the Act, a broad, generous and practical interpretation should be made, consistent with both the beneficial purposes of the Act and the likelihood that laypeople of differing levels of education, differing levels of medical advice and differing levels of legal advice (indeed in most cases they would not have any) will be giving the notice.”[2]

7. The same approach cannot be taken for the second step. There will always be circumstances that make us want “to do something” but we can only “do something” in terms of reviewing a decision if Parliament permits us. The words that Parliament uses to give us jurisdiction or power to review decisions must be read according to the rules of statutory interpretation as they are understood and applied by the courts. They cannot be interpreted according to the dictates of our heart strings.

Step 1: work out the decision that the Tribunal is being asked to review

8. In his application to the Tribunal lodged on 20 April 2010, Mr Epifano referred to the letter dated 16 April 2010 that he had received from the Office of the Privacy Commissioner (OPC). That letter is written to Mr Epifano by an Assistant

Privacy Commissioner and contains a paragraph reading:

“... I have decided under section 41(2)(a) of the Act to cease our investigation on the grounds that in my view, the DVA has adequately dealt with the matter. Our file is now closed.”

9. Section 41(2)(a) of the Privacy Act provides:

“The Commissioner may decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under section 36, or accepted by the Commissioner under subsection 40(1B), if the Commissioner is satisfied that the complainant has complained to the respondent about the act or practice and either:

(a) the respondent has dealt, or is dealing, adequately with the complainant; or

(b) the respondent has not yet had an adequate opportunity to deal with the complaint.”

10. When asked for reasons for his application, Mr Epifano wrote:

“The decision by the Privacy refusal to declare I am entitled to adequate compensation under section 52.”

11. Section 52(1) of the Privacy Act provides:

“After investigating a complaint, the Commissioner may:

(a) make a determination dismissing the complaint; or
(b) find the complaint substantiated and make a determination that includes one or more of the following:

• (i) a declaration:

(A) where the principal executive of an agency is the respondent – that the agency has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct; or

(B) in any other case – that the respondent has engaged in conduct constituting an interference with the privacy of an individual and should not repeat or continue such conduct;

(ii) a declaration that the respondent should perform any reasonable act or course of conduct to redress any loss or damage suffered by the complainant;

(iii) a declaration that the complainant is entitled to a specified amount by way of compensation for any loss or damage suffered by reason of the act or practice the subject of the complaint;

(iv) a declaration that it would be inappropriate for any further action to be taken in the matter.”

12. The provisions of s 52(1) are qualified by further provisions of s 52 but, apart from s 52(3), are not relevant in this case. Section 52(3) provides that, where a determination is made under ss 52(1)(a) or (b), the Commissioner may include a declaration that the complainant is entitled to a specified amount as reimbursement for expenses reasonably incurred in connection with the making of the complaint and the investigation.

Step 2: is the decision of which Mr Epifano seeks review, the decision that was actually made?

13. Mr Epifano seeks review of a decision made under s 52 on the basis that the Commissioner has investigated the matter and she has made a determination refusing to make a declaration.

14. I can understand why Mr Epifano feels that there has been an investigation of his complaint. Considerable time has passed since he first lodged his complaint with the Commissioner in October 2005 and there has been considerable activity undertaken by the OPC, himself and the DVA in relation to it.[3] These matters were outlined in the OPC’s letter to him dated 16 April 2010.

15. In that letter, the OPC advised Mr Epifano that, due to an increase in the Commissioner’s workload as a result of the extension of the Act’s application to the private sector, the Commissioner had not been able to allocate an investigation officer to Mr Epifano’s complaint when it had been received. A decision was then made to expedite his complaint and an investigation officer was allocated to it in March 2006.[4] Mr Epifano was told that the following steps had been taken with regard to resolving his complaint:

“In May 2006, this Office formed the preliminary view that the DVA had not interfered with your privacy. However, in December 2006, this view was changed to find that, on balance, we considered that the DVA had interfered with your privacy. The DVA disagreed with this subsequent view. However, in July 2008 it decided to enter into a conciliation process with you, through this Office, with the aim of resolving the complaint. Your complaint remained in conciliation until January 2010, when it reached an impasse. At which time Ms Ramsay formed the view that the steps the DVA had taken to resolve your complaint adequately dealt with the matter.

I apologise if the process used to investigate and conciliate your complaint was longer than you would have expected. However, your complaint was being progressed by this Office at all times.”

16. The OPC advised Mr Epifano that he could contact the Ombudsman if he wished to complain about the length of time taken to investigate and conciliate his complaint. Finally, the OPC’s letter dealt with Mr Epifano’s complaint about the way it had closed the investigation:

“You have referred to section 52 of the Act, and asserted that the Office has ‘taken the easy way out’, by accepting the DVA’s offer of financial compensation, rather than awarding you compensation under section 52.

While I appreciate your views on this matter, I do not agree. The power to issue a determination under section 52 of the Act is at the Privacy Commissioner’s discretion. In this instance, I consider that a determination is neither necessary nor appropriate as I am satisfied that the DVA’s offer adequately deals with your complaint. For this reason, I will not be referring your complaint to the Privacy Commissioner for consideration under section 52 of the Act. As stated above, your complaint has been closed.”

17. As I said, I can understand that Mr Epifano sees the OPC as having conducted and completed an investigation of his complaint. I can understand that he regards the Privacy Commissioner as having then decided not to make a determination under s 52. As a consequence of not having made a determination, she has not made a declaration. Looked at from a practical point of view that is indeed what has happened but, when taken from a legal point of view, I do not consider that this is how I can properly characterise it. In the OPC’s letter, it has made clear that the decision has been made under s 41(2)(a) and not under s 52. A decision-maker’s statement is not necessarily determinative of the proper characterisation of its decision although, in this case, I think that it is. I will explain why.

18. In order to find that the Commissioner has made a declaration under
s 52(1) or that the Commissioner has refused to include a declaration in a determination, I must first find that there has been an investigation and then find that the Commissioner has made a determination under that section. The Commissioner’s powers are predicated upon those two matters for s 52(1) opens with the words “After investigating” before then providing that the Commissioner “may” make a determination that either dismisses the complaint or a determination that includes a declaration.
19. The Privacy Act does not define the word “investigation” but investigations are the subject of Division 1 of Part V. In broad outline, the Commissioner is required to investigate an act or practice if “the act or practice may be an interference with the privacy of an individual”, a complaint about the act or practice has been made under s 36[5] and, in most instances, the person has first complained to the agency concerned.[6] It is clear that the obligation to investigate does not arise simply from the fact of the making of the complaint. The obligation does not arise unless “the act or practice may be an interference with the privacy of an individual”.

20. In deciding whether the obligation arises, the Commissioner may make enquiries of the agency using the powers give by s 42. That section provides:

“Where a complaint has been made to the Commissioner, or the Commissioner accepts a complaint under subsection 40(1B), the Commissioner may, for the purpose of determining:

(a) whether the Commissioner has power to investigate the matter to which the complaint relates; or

(b) whether the Commissioner may, in his or her own discretion, decide not to investigate the matter;

make inquiries of the respondent.”

21. There is a distinction, therefore, drawn in the Privacy Act between inquiries and investigations. An “inquiry” is “... an act or the process of asking for information. ...”[7] whereas an “investigation” refers to a “... thorough, detailed and often official inquiry into, or examination of, something or someone. ...”.[8] Section 43 deals with the conduct of investigations. Before commencing an investigation, the Commissioner must take certain steps and the investigation must meet the requirements of s 43. The Commissioner is given power to obtain information and documents under s 44, the power to examine witnesses under s 45 and, under s 46, may direct persons to attend a compulsory conference conducted according to s 47.

22. Section 41 sets out the circumstances in which the Commissioner may decide not to investigate a complaint or not to investigate it further or may decide to defer an investigation. I have already set out s 41(2).[9] Apart from that, there is nothing in Division 1 of Part V that prescribes when an investigation ends or how it is brought to an end. Its conclusion or deferral is dependent solely upon the Commissioner’s exercise of discretion in the circumstances set out in s 41.

23. That is how the investigation came to an end in this case. The Commissioner, or her delegate, exercised the power to do so given by s 41(2).
I cannot come to a different decision even though on the face of the letter dated 16 April 2010, the investigation appears complete. Nothing in the Privacy Act prevents the Commissioner from taking this course and it is the course that I have decided has been taken. That is the only decision that has been made and I must decide whether the Tribunal may review it.

Step 3: types of decisions the Tribunal has power to review under the Act

A. The AAT Act provides for the conferral of power to review decisions

24. Unlike a court of general jurisdiction which may consider all matters that come before it for trial, the Tribunal’s jurisdiction is limited. As it has been created by statute, the extent and limits of its powers must be found in statute whether expressly or implicitly. The obvious statute is the AAT Act. That Act does not itself confer power on the Tribunal to review decisions. Instead, it makes provision for other statutes to confer power to do so on the Tribunal. What it does do is to establish the framework within which the Tribunal deals with applications for review of decisions and for their review. In particular, it gives the Tribunal all of the tools that it needs, or may need, in order to review decisions when it is given jurisdiction or power to review decisions and to deal with applications seeking review of those decisions. It also sets out the circumstances in which the Tribunal may use those tools. When it confers power on the Tribunal to review a decision, it may decide to alter the tools it has given the Tribunal or the circumstances for their use but, in most cases, it does not.

25. The AAT Act makes provision for other statutes to confer power to do so on the Tribunal by providing in s 25(1) that:

“An enactment may provide that applications may be made to the Tribunal:

(a) for review of decisions made in the exercise of powers conferred by that enactment;

(b) for the review of decisions made in the exercise of powers conferred, or that may be conferred, by another enactment having effect under that enactment.”

The enactment referred to in s 25(1) must specify the person or persons whose decisions may be reviewed and must specify whether all of the person’s decisions may be reviewed and, if not, the classes of decisions that may be reviewed. The enactment may specify conditions on which a person may apply for review of those decisions. That is the effect of s 25(3). Section 25(4) provides the necessary corollary to ss 25(1) and (3) by providing that the “... Tribunal has power to review any decision in respect of which application is made to it under any enactment.”

B. Conferral of power by the Privacy Act

26. The upshot is that I must look to the Privacy Act to decide whether it has provided that a person may apply to the Tribunal for review of a decision made under s 41(2)(a) of the Privacy Act. The only provisions in the Privacy Act that mention the Tribunal are ss 61, 62, 95, 95A and 95AA.

27. Sections 95, 95A and 95AA are concerned with Medical research guidelines, Guidelines for National Privacy Principles about health information and Guidelines for National Privacy Principles about genetic respectively. Provision is made for an application to be made to the Tribunal for review of the Commissioner’s decision to refuse to approve the issue of guidelines under s 95(1),[10] to refuse to approve guidelines or revoke the approval of guidelines under s 95A[11] and to refuse to approve guidelines under s 95AA.[12] None is relevant to the type of decision made in this case.

28. Section 61 (1) provides:

“Application may be made to the Administrative Appeals Tribunal for review of:

(a) a declaration of the kind referred to in subparagraph 52(1)(b)(iii) or subsection 52(3) that is included in a determination to which this Division applies; or

(b) a decision of the Commissioner refusing to include such a declaration in a determination to which this Division applies.”

An agency’s right to apply is qualified by the requirement that it first obtain the permission of the Minister. The right of a principal executive of an agency is similarly qualified.[13]

29. Section 62(1) permits an application to be made to the Federal Court or the Federal Magistrates Court if an agency fails to comply with its obligations under
s 58 not to repeat or continue conduct covered by a declaration included in a determination under s 52(1)(b)(i) or to perform the act or course of conduct covered by a declaration included in a determination under s 52(1)(b)(ii). Section 62(2) permits an application to be made if a principal executive of an agency fails to comply with s 59. The obligations in s 59 are to ensure that the terms of a determination are brought to the notice of the members, employees and officers of the agency whose duties are such that they may engage in conduct of a kind to which the determination relates. They are also to ensure that none of those members, officers or employees repeats or continues the conduct covered by a declaration included in a determination under s 52(1)(b)(i).

30. Section 62(5) provides that an application cannot be made under s 62 until either the time has passed for making an application under s 61 to the Tribunal for review of a determination or, if such an application has been made, the Tribunal has made its decision and its decision has come into operation. There is nothing in
s 62 that authorises an application to be made to the Tribunal for review of a determination, a declaration in a determination or a refusal to make a determination. The reference in s 62(5) simply qualifies a person’s right to apply to the Federal Court or the Federal Magistrates Court. The only right to apply to the Tribunal is found in
s 61.

Step 4: Is the decision that was made reviewable and, if so does Mr Epifano want it reviewed?

31. The decision made by the delegate of the Commissioner under s 41(2) does not match any of the decisions that the Tribunal has been given power or jurisdiction to review under the Privacy Act. Therefore, I must decide that the Tribunal does not have jurisdiction to review the decision of a delegate of the Privacy Commissioner dated 16 April 2010.

I certify that the thirty one paragraphs are a true copy of the reasons for the decision herein of

Deputy President S A Forgie,

Signed: ....................................................................

Kate Conners Associate

Date of Hearing 16 June 2010

Date of Decision 1 July 2010

Solicitor for the Applicant Unrepresented

Solicitor for the Respondent Ms Elena Arduca

Australian Government Solicitor

---

[1] [2006] FCA 1829
[2] [2006] FCA 1829 at [18]
[3] OPC’s letter dated 16 April 2010
[4] OPC’s letter dated 16 April 2010
[5] Privacy Act, ss 40(1) and 40(1A)
[6] Privacy Act, s 40(1A)
[7] Chambers 21st Century Dictionary, 1999, reprinted 2004, Chambers
[8] Chambers 21st Century Dictionary, 1999, reprinted 2004, Chambers
[9] See [9] above
[10] Privacy Act, s 95(5)
[11] Privacy Act, s 95A(7)
[12] Privacy Act, s 95AA(3)
[13] Privacy Act, s 62(2)