FEDERAL COURT OF AUSTRALIA

SZSSJ v Minister for Immigration and Border Protection [2015] FCAFC 125

THE COURT ORDERS THAT:

1.    The parties are to bring in short minutes of order giving effect to these reasons within 14 days hereof.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

THE COURT ORDERS THAT:

1.    The parties are to bring in short minutes of order giving effect to these reasons within 14 days hereof.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

THE COURT ORDERS THAT:

1.    The appeal will be dismissed.

2.    The appellant is to pay the first respondents’ costs.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

THE COURT

1. Introduction

1    Two of these three appeals from the Federal Circuit Court of Australia (‘the Federal Circuit Court’) arise from an incident in which the names and personal details of 9,258 asylum seekers were made available on publicly accessible areas of the Department of Immigration and Border Protection’s website on 10 February 2014. This incident has come to be known as the ‘the Data Breach’. The release of the information carried with it a risk that authorities and others in countries from which the protection visa applicants had come might have become aware of the fact that they had sought protection in Australia. That possibility potentially means that for some applicants there is a risk of harm if they are returned to their country of origin which is over and above the risks arising from the claims they made in support of their original protection visa applications. The general need to maintain the anonymity of protection visa applicants is a longstanding feature of refugee litigation and is reflected in s 91X of the Migration Act 1958 (Cth) (‘the Act’), which prevents the publication of the name of a protection visa applicant in any Court proceedings. That need is also reflected in the scheme of Div 3 of Pt 4A of the Act and, in particular, s 336E(1) which prohibits the unauthorised disclosure of identifying information concerning, among other matters, the identity of asylum seekers.

2    Clearly enough, the orderly processing of the applications for protection visas made by those who have been affected by the Data Breach has been made more complex. Two of these appeals, SZSSJ and SZTZI arise out of that complexity. The third, AHY15, had nothing to do with the Data Breach and appears to have been brought in error. It will be dismissed. The issues which arise in SZSSJ and SZTZI raise questions about the manner in which the Department of Immigration and Border Protection (‘the Department’) has sought to assess what the consequences of the Data Breach might be for affected individuals. We conclude that those procedures were unfair to a significant degree. These two appeals also raise questions about the nature of the powers actually being exercised, whether the rules of procedural fairness applied to them and whether the jurisdiction of the Federal Circuit Court extended to hearing the claims. We conclude that all those questions should be answered in favour of the appellants, the orders of the Federal Circuit Court vacated and the relief sought by them granted.

2. SZSSJ

2.1 Facts

3    It is the practice of the Department each month to publish on its website, www.immi.gov.au, a document entitled ‘Immigration Detention and Community Statistics Summary’. This document contains statistics about asylum seekers. For accessibility reasons the document is published in both Microsoft Word and Adobe PDF formats. On 10 February 2014, the Department, in line with this practice, published the statistics for January 2014 including the Word version. The Word version was dated 31 January 2014. It incorporated information from a Microsoft Excel spreadsheet which included the private details of 9,258 asylum seekers. This data was embedded in charts and graphs in the Excel spreadsheet. When the charts and graphs were copied across to the Word document that personal information came with it. The consequence was that the information was available in the Word version if one accessed the charts and graphs.

4    This, as we have said, occurred on 10 February 2014. At 9.15 am on 19 February 2014, The Guardian Australia notified the Department of the Data Breach and the Word document was immediately removed from the main part of the website at 10 am. It was, therefore, available there for some eight and a half days. Another copy of it remained available on the internet in the Department's internet archive until 24 February 2014.

5    In total, the information was publicly available for around 14 days.

6    On 24 February 2014 the Department retained KPMG to conduct its own investigation. KPMG produced two reports - a full one dated 5 April 2014 and an abridged version dated 20 May 2014. The complete version has not been provided to SZSSJ. We discuss this in more detail below but, for present purposes, it is useful to know that whilst the abridged version told the reader that the personal information had been accessed 123 times from 104 unique IP addresses it did not reveal an exhaustive or any list of what the accessing IP addresses were.

7    On 7 March 2014 SZSSJ commenced proceedings in the Federal Circuit Court in which he alleged that the Minister had infringed his information privacy by releasing his name and other details on the website. He alleged that this was a breach of principles of refugee law and that if he were now returned to his home country it would breach Australia’s non-refoulement obligation to him arising under art 33 of the Refugee Convention. He also alleged that the Data Breach had rendered him a refugee sur place, i.e., by reason of events happening in Australia.

8    Before the time SZSSJ made these allegations on 7 March 2014, his original application for a protection visa had been refused by the former Refugee Review Tribunal (‘the Tribunal’) on 19 February 2013. Proceedings in the Federal Circuit Court brought by SZSSJ in relation to that decision had been dismissed by that Court on 21 June 2013 (SZSSJ v Minister for Immigration and Anor [2013] FCCA 654) and an appeal from that decision was dismissed by this Court on 21 November 2013 (SZSSJ v Minister for Immigration and Border Protection [2013] FCA 1223). By 7 March 2014, when the current proceedings were commenced, there remained only his unresolved application for special leave to appeal to the High Court.

9    If that application were to have been refused then, in the ordinary course, SZSSJ would have been removed under s 198 of the Act as an unlawful non-citizen. It will be necessary to return to the terms of s 198 in more detail later in these reasons. The evident concern of SZSSJ in commencing his second proceeding in the Federal Circuit Court was that, since his original application had already been processed nearly to finality, he might be removed from Australia without his claims arising from the Data Breach being properly examined.

10    The application he filed sought an injunction restraining his removal from Australia and this declaration:

‘A declaration that section 46A be lifted and the subclass 866.222 be waived, by reason of the ground/s of the application to allow the applicant to make a protection visa application.’

11    Section 46A relates to the power of the Minister, in his discretion, to permit an unauthorised maritime arrival to apply for a protection visa. In fact, SZSSJ arrived on a student visa on 27 May 2005 so he was not such a person. He had been taken into immigration detention on 3 October 2012 when his student visa expired and he has remained there ever since. His initial protection visa application was made on 16 October 2012. He was not, therefore, an unauthorised maritime arrival. Accordingly, the reference to s 46A did not add to the picture.

12    Five days after he commenced his second proceeding in the Federal Circuit Court the Secretary of the Department wrote to him by letter dated 12 March 2014. As will appear later in these reasons, the fact that it was the Secretary who wrote this letter is of some significance when it comes to assessing the Minister’s contention that the processes contemplated in the Secretary’s letter were not shown to be related to any exercise of functions by the Minister. The letter went on to explain the occurrence of the Data Breach, expressed deep regret for it and continued:

‘The department will assess any implications for you personally as part of its normal processes. You may also raise any concerns you have during those processes.’

13    It seems that the Secretary sent a letter in the same terms to the 9,258 affected asylum seekers, including SZSSJ. Many of these persons were in different points along the protection visa process. Consequently, it was submitted by the Minister that the ‘normal processes’ referred to in the letter of 12 March 2014 was a reference to a number of normal processes. For example, where an applicant had made an application for a protection visa which had not yet been determined, the issue of non-refoulement would be looked at in ordinary course of examining the issue of complementary protection. On the other hand, where a decision had already been made on the initial application some other mechanism would be utilised to examine what the effect of the Data Breach was on Australia’s non-refoulement obligations.

14    In this Court the Minister submitted that insofar as SZSSJ was concerned, it was a reference to a process which had been in place for a number of years for a variety of purposes called an International Treaties Obligations Assessment (an ‘ITOA’) which was a process under which an assessment was carried out to see whether Australia owed any non-refoulement (or other) obligations. Whether that process had been engaged at 12 March 2014 may presently be put to one side. It is enough only to observe that there was neither any indication in the Secretary’s letter that such a process had been engaged, nor any explanation of what the normal processes referred to meant to this applicant.

15    On 2 April 2014 the High Court dismissed SZSSJ’s application for special leave (SZSSJ v Minister for Immigration [2014] HCASL 73). From that point SZSSJ’s status in this country was apparently being determined under the normal processes referred to in the letter of 12 March 2014.

16    Whatever they were, these processes were not enough to prevent SZSSJ from having his proceeding in the Federal Circuit Court dismissed at a show cause hearing held on 20 June 2014: SZSSJ v Minister for Immigration & Anor [2014] FCCA 1379. The Court reasoned (at [17]) that SZSSJ had failed to identify any ‘migration decision’ in relation to which the Federal Circuit Court had jurisdiction.

17    The dismissal of his proceedings by the Federal Circuit Court seems to have coincided with a period of activity within the Department. The following week, on 27 June 2014, a fresh letter was sent to the applicant by a departmental official. Pertinently, this letter said:

‘…

You were informed [in the letter of 12 March 2014] that any implications for you personally would be assessed as part of the department’s normal processes.

The department notes that you have filed an application for judicial review in the Federal Court (proceedings SYG557/2014), and that application suggests that you believe you may be adversely affected by the data breach and that you may have claims which engage Australia’s protection obligations. You are now invited to put in writing any concerns you may have regarding the impact of the data breach to you personally.

If you have any particular concerns about the impact of the data breach on your ability to return to your home country or country of usual residence, please provide the department with specific reasons and details for those concerns.

Please provide this information to the department, in writing, 14 days from the receipt of this letter. This information should be provided, preferably in English, to the following mailbox: GM.IMA.Prtotection.Admin@immi.gov.au. If you have any questions about this process then please speak to your case manager or community status resolution officer.

If after 14 days no response is received then it will be assumed that you have no further information to provide to the department regarding the unintentional data breach. The implications for you arising from the unintentional data breach will then be assessed on the basis of the claims you have made in your application for judicial review (proceedings SYG557/2014).

You will be advised of the outcome of the assessment of your claims relating to the unintentional data breach in due course. If the assessment is adverse to you, and you have no ongoing matters before the courts or the department then you will be expected to depart Australia.’

[Emphasis in original]

18    The important aspects of this are its reference, again without explanation, to the Department’s ‘normal processes’, the requirement to explain the personal impact of the Data Breach (without a full explanation of what that breach was or how it actually, or may have, affected SZSSJ) and the imposition of a 14 day deadline after the Department’s own three month delay.

19    SZSSJ wrote to the Department by letter dated 4 July 2014 objecting to the shortness of time. He also wrote to the Minister on 11 July 2014 indicating that he needed more information before he could respond to the Department’s letter about the Data Breach. The Department replied to his letter, indicating that for security reasons it could not comment further about the Data Breach and informing him that his responses of 4 and 11 July 2014 would be considered.

20    Meanwhile, SZSSJ was seeking to appeal from the Federal Circuit Court’s dismissal of his proceeding. His application to extend the time in which to appeal came before this Court on 5 September 2014, which led to Griffiths J making orders on 17 September 2014 fixing it for hearing before a Full Bench on 24 October 2014.

21    This outbreak of litigation again coincided with activity within the Department. On 1 October 2014, the Department wrote to SZSSJ in these terms:

‘On 30 September 2014 the Department of Immigration and Border Protection (the department) commenced an International Treaties Obligations Assessment (ITOA) in order to assess whether the circumstances of your case engage Australia’s non-refoulement obligations.

The reason the department has commenced this ITOA is that you were affected by a routine report released on the department’s website unintentionally enabling access to personal information about people who were in immigration detention on 31 January 2014. Any protection claims you may have in relation to this breach of your personal data will be assessed through this ITOA.

On 30 June 2014, you were handed a letter requesting you to provide the department with any concerns you may have in regards to the breach of your personal data. On 4 July 2014, you provided a response outlining your concerns. The information you provided in your response will be considered through this ITOA process.

The department notes that you have filed an application for judicial review in the Federal Circuit Court (proceedings SYG557/2014) and have brought an application for an extension of time and leave to appeal from the judgment in that proceeding in the Federal Court (proceedings NSD 704/2014). In those proceedings you have suggested that you believe you may be adversely affected by the data breach and that you may have claims which engage Australia’s protection obligations. The information you provided in these proceedings will be considered through this ITOA process.

This ITOA will consider Australia’ non-refoulement obligations under the 1951 Convention relating to the Status of Refugees as amended by the 1967 Protocol, the Convention against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment and the International Covenant on Civil and Political Rights and its Second Optional Protocol.

Various provisions of the Migration Act 1958 (the Act) contain concepts relevant to assessing the non-refoulement obligations arising under the above treaties and reflect Australia’s interpretation of those obligations. Therefore, this assessment will use relevant provisions contained in the Act, even though this is not an assessment of a protection visa application.

Protection claims that you have submitted for the purposes of previous assessments undertaken in your case will be considered as part of the ITOA. However, you may also wish to submit further information to be considered in this assessment if you wish to do so.

You have fourteen (14) days from the date you are taken to have received this letter to provide further information which you would like to have taken into consideration in this ITOA. As you have received this letter by hand, you are taken to have received it on the date of the letter.

If you have questions about this process or your current circumstances, please speak with your case manager.’

22    This letter made clear that the Department had commenced an ITOA on 30 September 2014. This raised an immediate puzzle as to what process had been taking place in, at least, the preceding three months. The letter did not give any details of whom the information had been accessed by or of the new (still unexplained) procedure. On the other hand, it did explain that the focus of the inquiry was to be the issue of non-refoulement. A new 14 day deadline was imposed.

23    On 13 October 2014 SZSSJ responded to this letter. He recited the irregular procedure adopted by the Department to that point, claimed the 14 day time limit was unfair and then posed several questions:

‘On top of that, no details whatsoever have been given about the ITOA process which has now been commenced. This includes in relation to the most basic elements of procedural fairness, such as:

•    Who is the decision maker?

•    Will I be entitled to legal representation?

•    Will there be a hearing?

•    Will I be permitted to make arguments?

•    How long the process will take?

•    Will I be given any additional opportunity to present my case beyond making a submission?

•    Will I be given notice of the matters which the decision maker will take into account in making a decision?

•    Will any reasons for decision be given?

•    Will the process be subject to the supervisory jurisdiction of the courts?

It is hard for me to avoid forming the impression that the ITOA process is nothing but a pretext designed to show the Court that there is a process in place while in fact, the Department has already determined to remove me from Australia.

In the circumstances, I request until 14 November 2014 (3 weeks after the court hearing on 24 October 2014) to present further evidence and submissions about the additional risks to me that have arisen form the Data Breach.’

24    The next step was the hearing in the Full Court of SZSSJ’s application for an extension of time within which to appeal. That was heard on 24 October 2014 by a Full Court comprising Perram, Jagot and Griffiths JJ. On 29 October 2014 that Court granted an extension and allowed the appeal: SZSSJ v Minister for Immigration and Border Protection [2014] FCAFC 143. It concluded that the conduct of the Minister since at least 12 March 2014 was preparatory to a decision required to be made under the Act, namely whether SZSSJ was to be removed under s 198(6). That provision is as follows:

‘198 Removal from Australia of unlawful non‑citizens

Removal on request

…

(6)    An officer must remove as soon as reasonably practicable an unlawful non‑citizen if:

(a)    the non‑citizen is a detainee; and

(b)    the non‑citizen made a valid application for a substantive visa that can be granted when the applicant is in the migration zone; and

(c)    one of the following applies:

(i)    the grant of the visa has been refused and the application has been finally determined;

(iii)    the visa cannot be granted; and

(d)    the non‑citizen has not made another valid application for a substantive visa that can be granted when the applicant is in the migration zone.

…’

25    Such conduct preparatory to a decision falls within the extended definition of a decision in s 474(3)(h). The Court ordered that the matter be remitted to the Federal Circuit Court to be determined.

26    By 1 December 2014, SZSSJ had retained solicitors, Gilbert + Tobin, to act on his behalf. On that day they wrote to the Department alleging that SZSSJ could not adequately make submissions without getting access to a full unabridged version of ‘the KPMG report’ and information about all of the IP addresses used to access the data. It also claimed an entitlement to see all relevant information in the possession of the Department relating to the Data Breach. It is reasonable to infer from the request to provide a copy of the unabridged KPMG report that either SZSSJ or his solicitors had by then obtained a copy of the abridged version.

27    On 16 December 2014 there came into force a new s 197C of the Act. It was inserted into the Act by the Migration and Maritime Powers Legislation Amendment (Resolving the Asylum Legacy Caseload) Act 2014 (Cth) (‘the Amending Act’), which received the Royal Assent on 15 December 2014. That section provides:

197C Australia’s non‑refoulement obligations irrelevant to removal of unlawful non‑citizens under section 198

(1)     For the purposes of section 198, it is irrelevant whether Australia has non‑refoulement obligations in respect of an unlawful non‑citizen.

(2)     An officer’s duty to remove as soon as reasonably practicable an unlawful non‑citizen under section 198 arises irrespective of whether there has been an assessment, according to law, of Australia’s non‑refoulement obligations in respect of the non‑citizen

28    On 23 December 2014 the Department wrote to the applicant and his pro bono counsel (although not his solicitors) outlining what it understood his case to be and asking for submissions within a further 14 days. It did not respond to Gilbert + Tobin’s request of 1 December 2014. It did not provide the information which had been sought or a copy of the unabridged version of the KPMG report. Gilbert + Tobin responded to this letter on 20 January 2015, repeating their earlier requests to be provided with information relating to the Data Breach.

29    On 12 February 2015 the Minister’s solicitors replied to Gilbert + Tobin’s letters of 1 December 2014 and 20 January 2015. This letter made a number of points:

    it was not accepted that procedural fairness required that SZSSJ should be given access to the full KPMG report or that he be given all information about the IP addresses used to access the data;

    despite that, the ITOA review would be conducted on the basis that his personal information may have been accessed by the authorities in ‘the receiving country’;

    it enclosed extracts from the Department’s Procedures Advice Manual (PAM) regarding the ITOA procedures;

    it pointed out that the PAM indicated that the Department did not regard him as available for removal while it was assessing his protection claims;

    it accepted that he was entitled to procedural fairness in that process; and

    it suggested that his pending proceedings in the Federal Circuit Court were pointless and invited their discontinuance.

30    On 28 April 2015 the Federal Circuit Court heard the remitted matter. At that time, SZSSJ was unrepresented. On 16 December 2014 his solicitors had, however, filed what was by then a second further amended application. It continued to seek an injunction restraining his removal from Australia and a declaration that by not giving him information about the Data Breach the Department had denied him procedural fairness. Detailed grounds were advanced.

31    The Federal Circuit Court refused declaratory relief because it did not accept that there was an obligation of procedural fairness requiring the Department to give SZSSJ information about the impact of the Data Brach on him: SZSSJ v Minister for Immigration & Ors (No.2) [2015] FCCA 1148 at [20]. In any event, the Court accepted the ITOA process was being conducted in accordance with the rules of procedural fairness and that even now SZSSJ could make submissions in that process: at [21]-[22]. As to the injunction, there was no threat to remove him until the whole ITOA process had run its course. In any event, it also accepted that s 197C made injunctive relief unavailable.

32    On 28 April 2015 SZSSJ appealed to this Court. In his counsel’s submissions in this Court four errors are alleged in the reasoning of the Federal Circuit Court:

(i)    the Court erred in concluding that the Department’s normal procedures were being applied. What had occurred was far from normal;

(ii)    the Court had not grasped correctly the extent of the Minister’s obligation to reveal what he knew about the Data Breach;

(iii)    the Court had erred in thinking s 197C prevented the grant of injunctive relief; and

(iv)    the Court erred in relying on promises by the Department not to deport SZSSJ which were of no comfort to him.

33    These grounds were reflected in a proposed amended notice of appeal. At the hearing of the appeal, leave was granted to rely upon the amended notice of appeal.

34    For his part, the Minister relied upon a notice of contention dated 22 July 2015 by which he contended that the Federal Circuit Court lacked jurisdiction to hear SZSSJ’s claim at all. This argument turned on s 197C of the Act. In response, SZSSJ submitted that the Minister was precluded from asserting that the Federal Circuit Court lacked jurisdiction by virtue of this Court’s earlier decision in his own case to the contrary.

2.2 Issues

35    SZSSJ’s appeal gives rise to a series of questions. These are:

1.    The Proper Construction of Section 197C. On its face, s 197C appears to prevent the officer who is detaining SZSSJ from taking into account any of his non-refoulement rights in considering whether he should be removed from Australia. Both SZSSJ and the Minister submitted that s 197C did not prevent the detaining officer from taking into account the fact the Minister was considering (using, at this stage, a deliberately vague expression) his position, even if the matter being considered was non-refoulement.

2.    Whether s 197C applies to SZSSJ’s case. Section 197C took effect on 16 December 2014, after the Department’s inquiries into non-refoulement had commenced and after SZSSJ had sought an injunction. That section was not expressed to be retrospective in operation. Here the issue is whether s 197C applied to SZSSJ at all.

3.    Whether the Federal Circuit Court had jurisdiction. There were two issues here. First, did s 474(7) have the effect of excising the jurisdiction of the Federal Circuit Court and, secondly, did it have jurisdiction to grant the injunction sought in light of s 197C.

4.    Do the rules of procedural fairness apply to the process currently underway? Here the Minister submitted that the only statutory powers involved were his non-mandatory discretionary powers which permitted him to lift the bar which presently operated to prevent SZSSJ from applying for a protection visa. That bar was imposed by s 48A and arose from the fact that his original protection visa application had already been refused. Nevertheless, he had three non-compellable discretionary powers to lift this bar if he thought it advisable to do so in the public interest. These were contained in ss 48B, 195A and 417. The Minister submitted that when he was considering whether to exercise powers of that kind he was not obliged to afford SZSSJ procedural fairness, citing Plaintiff S10/2011 v Minister for Immigration and Citizenship (2012) 246 CLR 636 at 652-653 [41]-[44] (‘S10’). SZSSJ submitted that the Minister had gone beyond considering whether to exercise the powers and was by then actively considering whether to lift the bar with the consequence that the rules of procedural fairness did apply citing Plaintiff M61/2010E v Commonwealth (2010) 243 CLR 319 (‘M61’). The issue here is, essentially, a factual one.

5.    Did an obligation of procedural fairness arise from the Department’s statements that it would be applying those rules? The Minister denied these statements could have that effect, citing Re Minister for Immigration and Multicultural and Indigenous Affairs; ex parte Lam (2003) 214 CLR 1 (‘Lam’).

6.    If the rules or procedural fairness did apply, what was their content in this case? The Minister submitted that the persons conducting the ITOA process would not have access to the unabridged version of the KMPG report and had been instructed to assume in SZSSJ’s favour that his information may have been accessed by the authorities in his home State. Consequently, it was said that there was no need for him to be given any further information about the Data Breach. SZSSJ submitted that he could not make meaningful submissions about the Data Breach without knowing what it was and who had accessed the information. He also submitted that he was denied procedural fairness by the Department’s failure to throw any light on what the decision making process being undertaken was.

7.    Relief. The Minister denied that there was any threat to deport SZSSJ pending the outcome of the ITOA. In relation to the declaratory relief, he submitted that no decision had been made in SZSSJ’s case and he could still make submissions. Declaratory relief was, therefore, said to be premature.

2.3 First Issue: The Proper Construction of s 197C

36    Section 189(1) requires an officer of the Department to detain a person he or she reasonably suspects to be an unlawful non-citizen. As has been frequently explained, this obligation is self-executing and awaits no curial determination before the detention is affected. It is sufficient that the officer in question holds the reasonable suspicion. The detention thus provided for is limited by the terms of the Act rather than any particular decision and, in turn, these are themselves circumscribed by the constitutional limitations imposed on the legislative power in s 51(xix) of the Constitution. The relevant limitations in the Act are, in this case, set by s 198(6) which is set out above at para [24].

37    In terms, s 198 is addressed to ‘an officer’ and this will include those having custody of SZSSJ. It erects a requirement of deportation from Australia ‘as soon as reasonably practicable.

38    It has been held that these words are to be read as permitting detention while steps are taken to determine whether a person in detention who is barred from making a visa application should be permitted by the Minister exercising his powers to lift that bar to make an application for a visa: M61 at 338 [25]. At the moment, the effect of s 48A is that SZSSJ, as a person who does not hold a substantive visa and who has been refused a visa, is not permitted to apply for a visa. That prohibition is subject to ss 48B, 195A or 417 which give to the Minister a non-compellable discretionary power to lift the bar erected by s 48A to permit a visa application to be made.

39    In this case, M61 has the consequence that the officer referred to in s 198(6) is not obliged to remove SZSSJ if steps are being taken to ascertain whether the Minister’s powers in ss 48B, 195A or 417 should be exercised. Section 48B(1) provides:

‘48B Minister may determine that section 48A does not apply to non‑citizen

(1)    If the Minister thinks that it is in the public interest to do so, the Minister may, by written notice given to a particular non‑citizen, determine that section 48A does not apply to prevent an application for a protection visa made by the non‑citizen in the period starting when the notice is given and ending at the end of the seventh working day after the day on which the notice is given.’

40    Section 195A(1) to (5) provides:

‘195A Minister may grant detainee visa (whether or not on application)

Persons to whom section applies

(1)    This section applies to a person who is in detention under section 189.

Minister may grant visa

(2)    If the Minister thinks that it is in the public interest to do so, the Minister may grant a person to whom this section applies a visa of a particular class (whether or not the person has applied for the visa).

(3)    In exercising the power under subsection (2), the Minister is not bound by Subdivision AA, AC or AF of Division 3 of this Part or by the regulations, but is bound by all other provisions of this Act.

Minister not under duty to consider whether to exercise power

(4)    The Minister does not have a duty to consider whether to exercise the power under subsection (2), whether he or she is requested to do so by any person, or in any other circumstances.

Minister to exercise power personally

(5)    The power under subsection (2) may only be exercised by the Minister personally.

…’

41    Section 417(1) to (3) provides:

‘417 Minister may substitute more favourable decision

(1)    If the Minister thinks that it is in the public interest to do so, the Minister may substitute for a decision of the Tribunal under section 415 another decision, being a decision that is more favourable to the applicant, whether or not the Tribunal had the power to make that other decision.

(2)    In exercising the power under subsection (1) on or after 1 September 1994, the Minister is not bound by Subdivision AA or AC of Division 3 of Part 2 or by the regulations, but is bound by all other provisions of this Act.

(3)    The power under subsection (1) may only be exercised by the Minister personally.

…’

42    In this Court, both SZSSJ and the Minister agreed that he was presently being lawfully detained under s 198, although for different reasons. For SZSSJ it was said that the fact that his non-refoulement entitlement was being examined by the Department could only relate to the exercise of the power in ss 48B, 195A or 417. The Minister’s submission was that it related not to the exercise of those powers but instead to the anterior question of whether he should consider exercising those powers.

43    That raises a factual question which at para [75] below we answer in favour of SZSSJ. The Minister has decided to consider the exercise of these powers. For that reason, s 198 of the Act does not presently require SZSSJ’s removal.

44    Prior to the introduction of s 197C there were a number of provisions in the Act which had referred to Australia’s non-refoulement obligations. This had led the High Court to conclude in M61 at 341 [34] that the Act, as it then was, reflected a legislative intention to adhere to Australia’s international obligations. Those obligations include an obligation not to refoule a person where there were substantial grounds for believing that, as a necessary and foreseeable consequence of the person being removed from Australia to the receiving country, there was a real risk that the person would suffer significant harm. This obligation emerges, inter alia, from arts 2.1 and 7 of the International Covenant on Civil and Political Rights (‘the ICCPR’). These provide:

‘Article 7

No one shall be subjected to torture or to cruel, inhuman or degrading treatment or punishment. In particular, no one shall be subjected without his free consent to medical or scientific experimentation.

Article 2

1.    Each State Party to the present Covenant undertakes to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights recognized in the present Covenant, without distinction of any kind, such as race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status.’

45    It is orthodox that these articles create a non-refoulement obligation: Human Rights Committee, General Comment No 31: The Nature of the General Legal Obligation Imposed on States Parties to the Covenant (26 May 2004, UN Doc CCPR/C/21/Rev.1/Add.13) at [12]. The operation of the obligation has been fleshed out in various decisions of the UN Human Rights Committee, most recently in Pillai v Canada (Human Rights Committee Communication No 1763/2008, 25 March 2011, UN Doc CCPR/C/101/D/1763/2008). There are also two other non-refoulement obligations arising from treaties to which Australia has acceded. The first is the non-refoulement obligation generated by art 33(1) of the Refugee Convention and the second a non-refoulement obligation deriving from art 3 of the Convention against Torture. In practice, officials dealing with these various non-refoulement obligations have tended to treat them compendiously.

46    Subsequent to the High Court’s decision in M61, the Full Court of this Court concluded in Minister for Immigration and Citizenship v SZQRB (2013) 210 FCR 505 (‘SZQRB’) at 544-546 [200] and 546 [204] that the power of removal in s 198 could not be exercised whilst a person in detention had made claims for protection (including by way of non-refoulement) until those claims had been assessed by a process which accorded an applicant procedural fairness and which addressed the correct questions according to Australian law.

47    The immediate consequence of SZSSJ’s claim that the Data Breach gives him a right not to be refouled, and this Court’s decision in SZQRB, is that he was entitled to restrain his deportation from Australia until such time as those claims were considered in a procedurally fair way.

48    It is against that backdrop that s 197C falls to be considered. The Amending Act stripped out of the Act many references to Australia’s international obligations at the same time that it inserted s 197C. The provision bears two possible constructions:

(a)    it prevents the officer referred to in s 198 from considering the issue of non-refoulement but does not prevent the officer from taking into account the fact that the Minister is considering whether to lift the bar under ss 48B, 195A or 417. This is so even if the subject matter of the Minister’s consideration is itself the issue of non-refoulement; or

(b)    it prevents the officer having any regard to the Minister’s activities under ss 48B, 195A or 417 if those activities relate to, or are concerned with, non-refoulement.

49    The former construction is to be preferred for three reasons. First, the text of s 197C suggests a focus on the assessment of the non-refoulement issue by the detaining officer personally. It does not, in terms, say that it is seeking to undercut the ability of the Minister to exercise his personal powers in ss 48B, 195A or 417. The effect of SZQRB was that s 198(2) prevented deportation until non-refoulement claims had been considered in a procedurally fair way. Section 197C now simply says that the officer is not to consider that matter. It says nothing about the Minister’s entitlement to do so if he wishes.

50    Secondly, the alternate reading of s 197C would put Australia in breach of the non-refoulement obligations arising from ICCPR, the Refugee Convention and the Convention against Torture. This is because it would require the removal of persons who had undetermined non-refoulement claims without the possibility of them being considered by the Minister. Unless the language of s 197C is intractable, an interpretation which would put the Commonwealth in breach of international law is not to be embraced: Jumbunna Coal Mine NL v Victorian Coal Miners’ Association (1908) 6 CLR 309 at 363; Chu Kheng Lim v Minister for Immigration, Local Government and Ethnic Affairs (1992) 176 CLR 1 at 38; Minister of State for Immigration and Ethnic Affairs v Teoh (1995) 183 CLR 273 at 287.

51    Thirdly, it is apparent from the explanatory memorandum for the Bill that introduced what became s 197C that the latter reading was not intended:

‘1140.    The amendments are intended to put it beyond doubt that the purpose of section 198 is not to respond to international protection obligations, but to provide officers with the duty to remove unlawful non-citizens from Australia in the circumstances as set out in section 198 of the Migration act.

1141    This means that the duty to remove in section 198 of the Migration Act arises irrespective of whether or not there has been an assessment, according to law or procedural fairness, of Australia’s non-refoulement obligations in respect of the non-citizen.

1142.    Australia will continue to meet its non-refoulement obligations through other mechanisms and not through the removal powers in section 198 of the Migration Act. For example, Australian’s non-refoulement obligations will be met through the protection visa application process or the use of the Minister’s personal powers in the Migration Act, including those under sections 46A, 195A or 417 of the Migration Act.’

52    For those reasons, s 197C does not prevent the officer referred to in s 198 from detaining a person whilst the Minister decides to consider assessing whether to lift the bar under ss 48B, 195A and 417.

2.4 Second Issue: Does s 197C apply to SZSSJ’s case?

53    As mentioned above at para [27], s 197C was inserted with effect from 16 December 2014. Until then the Act was in the same form that had led to the Full Court’s conclusions in SZQRB. The claim by SZSSJ for the injunction had been on foot since 7 March 2014. The matter was heard and decided in the Federal Circuit Court on 28 April 2015. In the Court below, the primary judge reasoned that s 197C prevented that Court from granting SZSSJ injunctive relief.

54    The immediate issue is whether s 197C could apply to proceedings which were already on foot. The answer is that it could not. On the day before the Act was reworked by the Amending Act, the form of the Act as it then was, together with this Court’s reasoning in SQZRB, gave SZSSJ a right not to be removed until a procedurally fair assessment of his non-refoulement claims was conducted. Further, the mechanics of this reasoning attached to the exercise of the power in s 198, that is to say, the removal power.

55    Section 7(2) of the Acts Interpretation Act 1901 (Cth) provides:

‘7 Effect of repeal or amendment of Act

…

No effect on previous operation of Act or part

(2)    If an Act, or an instrument under an Act, repeals or amends an Act (the affected Act) or a part of an Act, then the repeal or amendment does not:

(a)    revive anything not in force or existing at the time at which the repeal or amendment takes effect; or

(b)    affect the previous operation of the affected Act or part (including any amendment made by the affected Act or part), or anything duly done or suffered under the affected Act or part; or

(c)    affect any right, privilege, obligation or liability acquired, accrued or incurred under the affected Act or part; or

(d)     affect any penalty, forfeiture or punishment incurred in respect of any offence committed against the affected Act or part; or

(e)     affect any investigation, legal proceeding or remedy in respect of any such right, privilege, obligation, liability, penalty, forfeiture or punishment.

Any such investigation, legal proceeding or remedy may be instituted, continued or enforced, and any such penalty, forfeiture or punishment may be imposed, as if the affected Act or part had not been repealed or amended.

Note: The Act that makes the repeal or amendment, or provides for the instrument to make the repeal or amendment, may be different from, or the same as, the affected Act or the Act containing the part repealed or amended.

…’

56    The effect of paras (2)(c) and (e) is that SZSSJ’s right arising under s 198 as the Act then stood not to be removed by an officer until his non-refoulement claim was determined is preserved in any ‘legal proceeding’ or ‘investigation’, which would include SZSSJ’s proceeding in the Federal Circuit Court and the Departmental investigation into whether he was owed non-refoulement obligations.

57    The Minister’s answer to this was that s 197C did not operate that way. It was instead to be viewed simply as altering the relevant criteria attaching to the exercise of the power in s 198(6). Another way of putting this is to say that s 197C was not about SZSSJ’s rights but instead about the relevant officer’s powers. We think it is probably correct to say that s 197C can be characterised as a statement about the exercise of the officer’s power under s 198. The difficulty for the argument, however, is that that characterisation does not have the consequence that what SZSSJ had on the day before the provision’s introduction was not also a right under the former legislation. The two concepts are not mutually exclusive.

58    We can see no way, in those circumstances, in which SZSSJ’s right not to be removed by an officer under s 198 until any non-refoulement obligations concerning him were assessed in a procedurally fair way may be described other than as a ‘right…accrued… under the affected Act’ within the meaning of s 7(2)(c). The right accrued at the moment he made his claim for non-refoulement.

59    The consequence is that the Federal Circuit Court erred in concluding that SZSSJ’s claim for an injunction was defeated by s 197C. That provision did not apply to him. In fairness to the Federal Circuit Court, this argument was not advanced to it.

2.5 Third Issue: Did the Federal Circuit Court have jurisdiction?

60    The Federal Circuit Court did not determine in the case of SZSSJ that it did not have jurisdiction (although it did so in SZTZI with which we deal below). In this Court the Minister did, however, advance an argument by way of a notice of contention that the Federal Circuit Court did not have jurisdiction by reason of s 476(2)(d) of the Act. That section provides that the Federal Circuit Court has no jurisdiction in relation to:

‘(d)    a privative clause decision or purported privative clause decision mentioned in s 474(7).’

61    Section 474(7) provides:

‘474 Decisions under Act are final

…

(7)    To avoid doubt, the following decisions are privative clause decisions within the meaning of subsection 474(2):

(a)    a decision of the Minister not to exercise, or not to consider the exercise, of the Minister’s power under subsection 37A(2) or (3), section 48B, paragraph 72(1)(c), section 91F, 91L, 91Q, 195A, 197AB, 197AD, 198AE, 351 or 417 or subsection 503A(3);

(d)     a decision of the Minister under Division 13A of Part 2 to order that a thing is not to be condemned as forfeited.’

62    The three Ministerial powers with which this appeal is concerned – ss 48B, 195A and 417 – all appear in s 474(7)(a). The expression ‘privative clause decision’ is defined in s 474(2) to mean:

‘(2) In this section:

privative clause decision means a decision of an administrative character made, proposed to be made, or required to be made, as the case may be, under this Act or under a regulation or other instrument made under this Act (whether in the exercise of a discretion or not), other than a decision referred to in subsection (4) or (5).’

63    This Court decided in SZSSJ’s previous appeal from the Federal Circuit Court’s determination that it had no jurisdiction that that conclusion was erroneous and that that Court did have jurisdiction. It did so on the basis of s 474(3)(h) which provides as follows:

‘(3)    A reference in this section to a decision includes a reference to the following:

…

(h)    conduct preparatory to the making of a decision, including the taking of evidence or the holding of an inquiry or investigation;

…’

64    At the time of the first appeal, no argument was advanced by the Minister based upon s 474(7). Assuming in the Minister’s favour that it is now open to him to argue the point, we do not accept that s 474(7) has any operation in this case. This is so for three reasons. First, the injunction sought does not relate to a decision not to exercise, or consider the exercise of, the powers in ss 48B, 195A or 417 which, in terms, is what s 474(7)(a) requires. It relates instead to an anticipated decision under s 198. Secondly, whilst the declaratory relief sought concerns the process which may lead to a decision under ss 48B, 195A or 417, it cannot be said in terms of s 474(7) that there is yet present a decision not to exercise those powers.

65    It follows that the Federal Circuit Court had jurisdiction to determine both the injunction application and the claims for declaratory relief.

2.6 Fourth Issue: Do the rules of procedural fairness apply to the ITOA process?

66    Insofar as the non-compellable discretionary powers in ss 48B, 195A and 417 are concerned, it is clear that each potentially involves a two-stage process:

(a)    a decision whether to consider exercising the power; and

(b)    if an affirmative decision is made, a consideration of how the power should be exercised.

67    This is apparent from reflection upon the concepts involved and is also recognised in the Act itself. For example, s 474(7) (above) refers not only to decisions not to exercise these kinds of powers but also to decisions not to consider exercising them.

68    The High Court has concluded that where a decision of the kind referred to in [66(b)] is concerned then the rules of procedural fairness apply to any process leading to that decision: M61 at 353-354 [78]. Further those rights may be vindicated by declaration although not by certiorari or mandamus: M61 at 358 [99] and 359-360 [101]-[103].

69    At first blush, the Court appeared to reach the opposite conclusion in S10. However, a critical factual difference between the two cases concerned the points at which the Minister had arrived in the exercise of his powers under ss 48B, 195A and 417. In M61 the Court found as a fact that the Minister had progressed from merely considering whether to exercise these powers and was now engaged in their actual exercise. This was made clear at 349 [66]:

‘66    In these cases, that foundation is revealed by recognising the significance of the second matter that has been identified: that the inquiries that are made for the purposes of both the RSA and IMR processes are made in consequence of the decision announced in July 2008. There would otherwise appear to be an irreducible tension between the exercise of a statutory power to detain in a way that prolongs detention, because inquiries are being made, and those inquiries having no statutory foundation. This tension does not arise if the decision to establish and implement the RSA and IMR procedures, announced by the Minister, is understood not just as a direction to provide the Minister with advice about whether power under s 46A or s 195A can or should be exercised, but as a decision by the Minister to consider whether to exercise either of those powers in respect of any offshore entry person who makes a claim that Australia owes the claimant protection obligations.’

[Emphasis added]

70    This then formed the foundation for the conclusion in M61 at 353-354 [78] that once the Minister had decided to enliven the powers, then the rules of procedural fairness attached:

‘78    The Minister having decided to consider the exercise of power under either or both of ss 46A and 195A, the steps that are taken to inform that consideration are steps towards the exercise of those statutory powers. That the steps taken to inform the consideration of exercise of power may lead at some point to the result that further consideration of exercise of the power is stopped does not deny that the steps that were taken were taken towards the possible exercise of those powers. Nor does it deny that taking the steps that were taken directly affected the claimant's liberty. There being no exclusion by plain words of necessary intendment, the statutory conferral of the powers given by ss 46A and 195A, including the power to decide to consider the exercise of power, is to be understood as "conditioned on the observance of the principles of natural justice" [Kioa v West (1985) 159 CLR 550 at 615 per Brennan J]. Consideration of the exercise of the power must be procedurally fair to the persons in respect of whom that consideration is being given. And likewise, the consideration must proceed by reference to correct legal principles, correctly applied.’

71    The situation is quite otherwise where the Minister has not yet reached the first stage. Before any decision to consider whether to exercise the powers, there is no right or interest which an applicant has to which an obligation of procedural fairness may attach. In S10 at 652-653 [43]-[44] French CJ and Kiefel J explained this aspect of M61 and then went on to demonstrate why S10 was different at 353 [45]-[46]:

‘45    As the Minister and the Secretary pointed out, there has not been, in relation to the cases presently before the Court, any ministerial announcement of the kind which applied to the assessment and review processes considered in the Offshore Processing Case. The function of the guidelines in issue in these cases was significantly different from the function of the assessment and review procedures under consideration in the Offshore Processing Case [i.e. M61]. Those were procedures which were undertaken as an incident of the exercise of a statutory power which the Minister had effectively announced was to be undertaken, namely, the power to consider whether to exercise the substantive powers conferred by ss 46A and 195A of the Act.

46    In this case the Minister has taken no statutory step equivalent to that taken in the Offshore Processing Case. It was submitted for the Minister and the Secretary that, properly understood, each of the guidelines in this case does no more than facilitate the provision of advice to the Minister in particular cases and otherwise operate as a screening mechanism in relation to any requests which the Minister has decided are not to be brought to his or her attention. The issue of the guidelines itself did not involve a decision on the part of the Minister, acting under the relevant section, to consider the exercise of the power conferred by it. That submission should be accepted.’

72    The joint judgment of Gummow, Hayne, Crennan and Bell JJ did not bring this out directly. Having recited a number of qualities of the powers in question their Honours recorded their conclusion at 668 [100] as follows:

‘100    The cumulative significance of the matters referred to above in (i)-(ix) is to disclose a situation akin to that identified by Brennan J in South Australia v O’Shea, namely where a senior official standing at the peak of the administration of the statute is not required to give an opportunity for a hearing in every case affecting an individual who has had an opportunity of a merits review in the course of the administrative process. Upon their proper construction and in their application to the present cases, the dispensing provisions are not conditioned on observance of the principles of procedural fairness. In particular, there was no requirement to provide to the plaintiffs the opportunities to be heard which they assert in their submissions. The use in the provisions of the Act in question here of language emphatic both of the distinctive nature of the powers conferred upon the Minister (as personal, non-compellable, “public interest” powers), and of the availability of access to the exercise of those powers only to persons who have sought or could have sought, but have not established their right to, a visa is of determinative significance. It reveals the “necessary intendment” referred to in the Offshore Processing Case that the provisions are not attended by a requirement for the observance of procedural fairness.’

[Emphasis added and references omitted]

73    We do not, by any means, think their Honours were overruling M61; they were merely highlighting the same factual matter to which French CJ and Kiefel J had referred. Heydon J explained the same point at 673-674 [120]-[121]. Indeed, as indicated in the last sentence of [100] quoted above, their Honours applied and distinguished M61.

74    The Minister submitted that this was a case governed by S10, whilst SZSSJ argued it was covered by M61.

75    SZSSJ’s submission is to be preferred. What is involved is a factual question. In this case the Court below did not attempt any analysis of the decision, or rather, the nature and stage of the process that it was reviewing and therefore did not ascertain that its inquiry was related, at least insofar as declaratory relief was being sought, to conduct preparatory to decisions by the Minister involving ss 48B, 195A and 417: SZSSJ v Minister for Immigration & Ors (No.2) [2015] FCCA 1148 at [19]-[23]. This was despite the Full Court having explained that matter in allowing the appeal from the Federal Circuit Court’s decision in SZSSJ’s earlier case. Not having identified the question of what the decision actually under review was, the Federal Circuit Court failed to appreciate the significance of M61 and S10 and necessarily, therefore, the distinction between them. Not appreciating this, it failed to make the critical factual finding which needed to be made, viz, whether the Minister was merely considering whether to exercise these powers (S10) or was in fact in the process of considering whether to exercise them (M61). It is necessary, therefore, for this Court to make that finding. The relevant evidence is:

    the Secretary of the Department wrote to SZSSJ on 12 March 2014 and told him that his claims arising from the Data Breach would be considered as part of its normal processes;

    whatever those processes were, they were supervened on 30 September 2014 by the ITOA process;

    SZSSJ was informed by letter dated 1 October 2014 that the purpose of the ITOA was ‘to assess whether the circumstances of your case engage Australia’s non-refoulement obligations’;

    the ITOA process was governed by a detailed instructional guideline called Procedures Advice Manual 3 (‘PAM 3’) which was entitled ‘Refugee and Humanitarian International Treaties Obligations Assessments’; and

    there were 9,258 protection visa applicants affected directly by the Data Breach.

76    There are two possible characterisations of these facts:

(a)    the Minister had decided to consider whether to exercise the powers in ss 48B, 195A and 417 in relation to SZSSJ and the ITOA was being conducted by the Department to assist him in that process (M61 at 349 [66]); or

(b)    the Minister had not decided to consider, at that stage, whether to exercise the dispensing powers or not. On this view, it is not clear why the ITOA process is being conducted or on whose instructions or how the continued immigration detention of persons involved in that process is lawful.

77    It is useful to start with the PAM3 manual. The High Court closely examined similar manuals to PAM3 in M61 to determine which of these was the correct characterisation in the case before it. In the present case the relevant portion of PAM 3 is Section 10.1 which describes the uses to which ITOA may be put:

‘10.1 Informing decision making

The findings of the ITOA may be used to inform decision making when, for example:

•    considering whether to cancel a Protection visa under s 109, s 116, s 128 or s 140(2) of the Act, or to revoke a cancellation under s 131

or

•    considering whether to refuse or cancel a Protection visa under s 501 of the Act

or

•    advising the Minister about the possible exercise of ministerial intervention powers

or

•    considering the person’s availability for removal.

However, as explained in section 3 What is an ITOA, an officer conducting a subsequent assessment of whether a person engages Australia’s non-refoulement obligations, for example, through the protection visa process, is not bound by the findings of the ITOA.

If the assessing officer finds that non-refoulement obligations are engaged, the appropriate option for status resolution is to be decided on a case by case basis by the officer who requested the ITOA. If a decision or other action following the assessment results in refusal or cancellation of a visa, options for subsequently resolving the person’s status may include:

•    notifying the person of their options in relation to applying for a Protection visa (if there are no application bars applicable in their case)

or

•    referring the case to the Ministerial Intervention Unit (MIU) for assessment against the s 48B guidelines for referral to the Minister, or referring the case to Complex Case and Human Trafficking Section (via the complex.case.resolution.section@immi.gov.au mailbox) for assessment against the Guidelines on Minister’s detention intervention power (s 195A of the Migration Act) in PAM3: Act – Compliance and Case Resolution – Case resolution – Minister’s powers – Minister’s detention intervention power for referral to the Minister

or

•    considering whether to refer the case to the Minister for a decision under one of the other ministerial intervention powers – for details of other powers that may be used and guidelines for assessing whether to refer cases to the Minister for consideration under these powers, see PAM3: Act – Ministerial powers – Minister’s guidelines on ministerial powers (s 345, s 351, s 417, s 454 and s 501J)

or

•    considering other appropriate visa options such as a Temporary Humanitarian Stay (UJ-449) visa or a Temporary Humanitarian Concern (UO-786) visa.

Officers seeking to resolve the status of a person who has been found to engage Australia’s non-refoulement obligations but whose visa has been refused or cancelled should consult with their supervisor if they are unsure how to proceed.

If the officer who conducted the ITOA found that Australia’s non-refoulement obligations are not engaged and there are no other matters before the department, such as an unfinalised visa application, consideration should be given to progressing the person’s removal from Australia.’

78    Read in isolation this reveals a process which is likely to be anterior to any exercise by the Minister of a dispensing power. This may flow from the third bullet point at the start and it certainly follows from the last paragraph. Plainly enough, the ITOA process is something which it is intended may start outside the Minister’s office and about which he may never be personally aware if the conclusion of the ITOA is that non-refoulement obligations are not owed. Whether such an arrangement can truly work that way is a matter we discuss below.

79    In any event, it is a mistake to view the PAM3 in isolation. The context in this case includes two other matters, one specific and one general.

80    The specific matter is that in this case the Secretary of the Department has written to the 9,258 people affected by the Data Breach to tell them that their position will be reviewed. Given the magnitude of the event from an administrative perspective, the Secretary’s decision, as stated in his letter of 12 March 2014, to have the Department assess any implications for each of those people personally ‘as part of its normal processes’, the very considerable budgetary expense in conducting 9,258 such reviews, their continuing detention for a period of six months until the making of the decision to use an ITOA process to conduct those reviews, the significance of Australia’s international obligations in respect of the 9,258 persons affected by the Data Breach and the ITOA processes which were then instigated, we consider it unlikely that the Minister is not personally aware of the Data Breach and the processes contemplated in the Secretary’s 12 March 2014 letter.

81    This, then, is not one of those cases where an ITOA has been commenced under PAM 3 in circumstances of which the Minister is personally ignorant.

82    Granted that the Minister is personally aware of the ITOAs, it seems an unavoidable inference that he has already decided to consider these 9,258 matters under his dispensing powers. If he has not decided to consider the non-refoulement claims, why has he suffered the ITOA process to be carried out on his behalf? Further, given that, in a case such as the present, Australia’s international obligations relating to non-refoulement can only be given expression under domestic law through the exercise of the Minster’s own personal powers in ss 48B, 195A and 417, we would hesitate to conclude that the Minister has put in place a structure in which persons making claims relating to non-refoulement were not given the opportunity to have the only officer of the Commonwealth who can vindicate those claims under Australian law consider them. It seems to us that such a state of affairs would be a breach by Australia of its non-refoulement obligations.

83    A second, more general, consideration supports the same conclusion. The dispensing powers are made personal to the Minister. Yet the Minister’s argument was that somehow the ITOA process appears directed at an endpoint in which the Minister is not to be informed of negative ITOA outcomes with the hoped for consequence that no refusal decision is ever made by him which could render the ITOA process reviewable. This administrative vision rests on the idea that decision-making by a Department can be juristically separated from decision-making by its Minster. That vision is inconsistent, however, with the model of ministerial responsibility upon which Chapter II of the Constitution rests. Section 64 of the Constitution provides:

‘64 Ministers of State

The Governor-General may appoint officers to administer such departments of State of the Commonwealth as the Governor-General in Council may establish.

Such officers shall hold office during the pleasure of the Governor-General. They shall be members of the Federal Executive Council, and shall be the Queen’s Ministers of State for the Commonwealth.

Ministers to sit in Parliament

After the first general election no Minister of State shall hold office for a longer period than three months unless he is or becomes a senator or a member of the House of Representatives.’

84    This reflects the orthodoxy that a Minister administers his or her Department and is responsible to the Parliament for it. Underlying the Minister’s submissions in this case is an unconstitutional aspiration that administrative activity can take place within a Minister’s Department for which the Minister is not to be held responsible. This is not correct. If, in any given case, an officer commences an ITOA it will be because some administrative procedure or guideline within the Department requires that it should be conducted or because the officer has been lawfully directed by a superior to do so. We do not accept, therefore, that ITOAs were commenced within the Department without authority ultimately deriving from the Minister.

85    Viewed through that wider lens, it will be seen that, in the circumstances of these appeals, there can be no such thing as an ITOA which has been prepared to assist the Minister in considering whether to lift the bar under his discretionary powers which does not proceed from an exercise of his own authority. The more this must be so because of the impact of the conduct of the ITOAs on the personal liberty of those who continue to be held in immigration detention in order that that process can be completed. If an ITOA is being conducted, it is because lawful instructions have been given that it should be. That state of affairs both implies, but also reveals, a decision by the Minister that the non-refoulement question in SZSSJ’s case is to be examined, that is to say, that the second stage identified in M61 has been reached: Plaintiff S4/2014 v Minister for Immigration and Border Protection (2014) 253 CLR 219 at 232 [27]-[29].

86    Indeed, it is difficult to discern how the Minister would be able to remain at the first stage in a non-refoulement case without, first, breaching Australia’s international obligations to assess claims of this kind and, secondly, at the very least in an accessorial capacity the imperative command of s 198. He either considers the claims, so that international law is complied with (and the ITOA process is reviewable because he has arrived at the second stage), or the decision is not reviewable (because he has not considered the claim at all), in which case Australia will be in breach of its international legal obligation to assess non-refoulement claims and every officer who detains one of the 9,258 persons affected by the Data Breach does so in contravention of s 198. Unless the Minister is personally willing to swear that, as the only official in the country with the power to consider SZSSJ’s non-refoulement claims, he is not considering doing so and that Departmental officials apparently doing so under the ITOA process are doing so without his authority, it is impossible to conclude that he has not arrived at the second stage.

87    For these reasons then this is a case where the Minister has arrived at the second stage of the process of exercising his dispensing powers. It follows that this is a case governed by M61 rather than S10 and that the rules of procedural fairness, therefore, apply to the ITOA process.

2.7 Fifth Issue: Did an obligation of procedural fairness independently arise from the Department’s statement that procedural fairness would be afforded?

88    In light of our answer to the fourth issue it is not strictly necessary to answer this question. However, it provides an independent basis to arrive at the same conclusion.

89    On several occasions the Department indicated that it would give SZSSJ the opportunity to make submissions during ‘the process’. The PAM3 manual went somewhat further, indicating that the ITOA process was subject to the rules of procedural fairness. A letter dated 12 February 2015 written by the Minister’s solicitors to Gilbert + Tobin also said SZSSJ would be afforded procedural fairness. Further, in this Court the Minister submitted that the process would be procedurally fair.

90    There is a considerable pedigree for the proposition that decision-makers may, in some circumstances, generate an obligation of procedural fairness by its own conduct. The Privy Council’s decision in Attorney-General (Hong Kong) v Ng Yuen Shiu [1983] 2 AC 629 is a notable example. In that case, the immigration authorities had announced a policy in relation to illegal immigrants who had become settled in urban areas to the effect that they would not be removed without being interviewed and that each case would be ‘treated on its merits’. The Privy Council concluded that those words were sufficient to generate an obligation on the State to allow time to make representations. There, an illegal immigrant had been interviewed, but had not been asked why he believed he should be permitted to remain in Hong Kong and this failure was sufficient to constitute a denial of procedural fairness. A similar result was soon arrived at in Australia: Haoucher v Minister for Immigration and Ethnic Affairs (1990) 169 CLR 648.

91    The reasoning in Ng Yuen Shiu was premised on the concept of legitimate expectation. The High Court moved away from that doctrine as a useful tool of analysis in Lam. By indicating that, however, the Court was not suggesting that representations or conduct by decision-makers could have no effect on the rules of procedural fairness. Rather the focus has now shifted instead to whether departure from a representation might render the process unfair. In a well-known passage, Gleeson CJ at 12-13 [34] put it this way:

‘…what must be demonstrated is unfairness, not merely departure from a representation. Not every departure from a stated intention necessarily involves unfairness, even if it defeats an expectation… In a context such as the present, where there is already an obligation to extend procedural fairness, the creation of an expectation may bear upon the practical content of that obligation. But it does not supplant the obligation. The ultimate question remains whether there has been unfairness; not whether an expectation has been disappointed.’

[References omitted]

92    That statements made by a decision maker might result in procedural unfairness was reaffirmed in Applicant NAFF of 2002 v Minister for Immigration and Multicultural Affairs (2004) 221 CLR 1 (‘NAFF’). There the Tribunal had informed an applicant that it would write to him about inconsistencies in his evidence before deciding the matter but then failed to do so: see also WZARH v Minister for Immigration and Border Protection (2014) 316 ALR 389 at 395-398 [17]-[22]. We reject, therefore, the Minister’s submission that Lam has the consequence that the statements made on his behalf could not generate a duty to afford procedural fairness. Lam does not reverse decisions such as Ng Yuen Shiu, Annetts v McCann (1990) 170 CLR 596 or Haoucher, as NAFF shows. It simply pivots the underlying analytical jurisprudence away from a doctrinal reliance upon legitimate expectation towards an examination of the fairness of the process.

93    The three letters from the Department suggested that it would hear from SZSSJ prior to making a decision. They were sufficient to suggest to him that he was going to be given a fair hearing, a conclusion consistent with the statements in PAM3 and the solicitors’ letter of 12 February 2015 that the rules of procedural fairness would be applied. Having intimated to SZSSJ that he would be heard as part of this process it would now be procedurally unfair to depart from that stated position, at least without giving SZSSJ the opportunity to be heard on any such proposal. Whilst it is not clear that SZSSJ would have acted any differently if the statements had not been made, we do not consider that this is an obstacle in this case. There will be cases, we accept, where it can be seen that the implication of a duty of procedural fairness could have no impact on the decision-making process. But in assessing that issue it is important to focus on the fact that the ability to make a submission may itself impact upon the very outcome of the decision-making process. Thus in NAFF whilst it was true that if the Tribunal had not told the applicant that he would be able to make submissions there was nothing he could have said or done, nevertheless the failure to give him the promised opportunity to comment on the inconsistencies in his evidence meant that the Tribunal’s own decision-making was potentially adversely affected. This may be contrasted with Lam, where the Tribunal’s failure to contact the children’s carers (as it had said it would do) was not shown to have any consequences when no evidence was led as to what those carers would have said.

94    This suggests that a departure by an official from a representation about future procedure will be unfair in at least two circumstances:

(a)    where, but for the statement, the claimant for judicial review would have taken a different course, that is to say, situations of actual reliance by the claimant; or

(b)    where if the procedure had been adhered to a different result might have been obtained.

95    As we will shortly discuss, if provided with the information he had sought there is much by way of useful submission SZSSJ might have said. This case is, therefore, governed by NAFF as well as Lam. Moreover, as Hayne, Crennan, Kiefel and Bell JJ said in Assistant Commissioner Condon v Pompano Pty Ltd (2013) 252 CLR 38 at 99 [156] (and see too Eastman v Director of Public Prosecutions (No 2) (2014) 9 ACTLR 178 at 231 [166] per Rares, Wigney JJ and Cowdroy AJ):

‘The rules of procedural fairness do not have immutably fixed content. As Gleeson CJ rightly observed [Re Minister for Immigration and Multicultural and Indigenous Affairs; Ex parte Lam (2003) 214 CLR 1 at 14 [37]] in the context of administrative decision-making but in terms which have more general and immediate application, “[f]airness is not an abstract concept. It is essentially practical. Whether one talks in terms of procedural fairness or natural justice, the concern of the law is to avoid practical injustice”.’

96    The conduct of the Department was sufficient in itself to trigger an obligation of procedural fairness. The Federal Circuit Court therefore erred in concluding that no obligations of procedural fairness arose in SZSSJ’s case.

2.8 Sixth Issue: What did the rules of procedural fairness require in this case?

97    SZSSJ’s first argument is that throughout the process which has been conducted thus far (noting that the process has not yet culminated in a decision) there had not been any clear indication of what the decision-making process actually was.

98    We are satisfied that this argument was correct in the past but that the evidence in these proceedings has now lifted the shroud to enable us to identify that process. That process is as follows:

(a)    the Minister has decided to consider the exercise of his dispensing powers under ss 48B, 195A or 417;

(b)    Departmental officials acting under the ultimate direction of the Minister have commenced an ITOA process to assist him in making that decision, which process is directed to gauging Australia’s non-refoulement obligations; and

(c)    the relevant criteria for the Minister’s decision under each provision is the public interest.

99    It is difficult to see how SZSSJ could have made meaningful submissions in this process without having been informed of these matters. In particular, without knowledge of (a) he was denied information concerning the identity of the decision-maker, the personal nature of the decision-making power, its reposal in a Constitutional officeholder responsible to the Parliament or the complicated nature of the decision-making power in play; without knowledge of (b) he could not sensibly have understood what he was being required to make submissions about; and, without knowledge of (c) he was denied any information concerning the ultimate criteria by which the decision in his case was to be made. Procedural fairness is not satisfied by giving a person a hearing if the person does not know why he is being heard, about what or by whom.

100    The processes adopted by the Minister, until finally flushed out in this appeal, failed to satisfy these basic elements of regular decision-making.

101    Starting with the letter of 12 March 2014, the Secretary himself informed SZSSJ of the Data Breach and then said only that ‘The Department will assess any implication for you personally as part of its normal processes. You may also raise any concerns you have during those processes’. In the absence of further information, this was procedurally unfair because it did not tell SZSSJ anything as to the precise content of those processes, more than that some unidentified activity would occur in which he could express concerns. In particular, how could SZSSJ explain his concerns if he did not know what the Department was looking at with its as yet unspecified ‘processes’.

102    The letter of 27 June 2014 was no better. It called for submissions on the Data Breach within 14 days without identifying any of the matters in (a) to (c) above. It invited submissions on an unidentified subject of inquiry, through an unidentified process by an unidentified decision-maker.

103    The letter of 1 October 2014 indicated for the first time that an ITOA had been commenced on 30 September 2014 which would be looking at non-refoulement. It did not identify the matters in (a) and (c). Even though it said the process was an ITOA process, it did not explain what that process was. Further, even if SZSSJ had had access to PAM3 he could not have understood the procedural gavotte being performed by the Department to keep the Minister away from the decision-making process so far as was possible.

104    Finally, the letter of 12 February 2015 again identified the ITOA process, this time including a description of it. For the reasons just given, it still failed to identify the matters in (a) to (c), particularly in relation to (b), and the obscure, and obscured, role of the Minister.

105    Pausing there, it is clear that the process adopted to this point was procedurally unfair to SZSSJ. Although by 12 February 2015 he was aware that what was sought were his views on any non-refoulement obligations arising from the Data Breach, he still did not know the identity of his decision-maker, the function being exercised by that decision-maker, the relevance of the ITOA process to that function or the criteria by which it would be decided.

106    However, these reasons have now identified these matters and, further, the decision-making process has not yet concluded. Whilst what has happened to date has been procedurally unfair for the above reasons, it is still possible that these matters can be addressed in a procedurally fair manner. Nevertheless, it is appropriate that the Court make declarations to reflect that what has happened to date has not been procedurally fair. Now that what is taking place is clear, SZSSJ must be given a reasonable time to address these matters.

107    SZSSJ’s second argument was that it was a denial of procedural fairness to call for him to make submissions about the impact of the Data Breach on him without providing him with more detailed information about how the Data Breach related to him. In particular, he argued that he was entitled to the unabridged version of the KPMG report.

108    Of that report it is now necessary to say more. As we have said, it appears that the Data Breach occurred on 10 February 2014.

109    Although a copy of the abridged report was not in the appeal papers for SZSSJ it was in the appeal papers for SZTZI which was heard at the same time. The appeal was conducted on the basis that SZSSJ had had access to the abridged version. We will proceed on the same basis.

110    The abridged report contained this explanation of the earlier report in its Executive Summary:

‘The ‘Immigration Detention and Community Statistics Summary’ (the Document), a Microsoft Word document dated 31 January 2014, which was published on the DIBP’s website, allowed access to source data containing personal information of approximately 10,000 detainees. KPMG was appointed to undertake a Management Initiated Review (MIR) into the matter.

The review has been undertaken through two work streams. One focussed on establishing the chronology of events leading to the disclosure and the second a technical examination of the data associated with the disclosure and the potential extent of access to that data. Our report on the review was issued to the DIBP on 5 April 2014, following which the DIBP requested a report which may be appropriate for public release.

In providing this report (“the abridged report”), as requested by the DIBP, we have had regard to the DIBP’s responsibility to manage the risk of potential further privacy breaches in relation to this incident, by not disclosing information which may alert potential recipients of their possession of, or ability to access, the personal information, or identifying how access to personal information was gained by unauthorized person/s. We understand the DIBP also wishes to manage the risk of future data compromises by not disclosing the detailed workings of the DIBP and any potential system weaknesses, which could be exploited, whilst they are being rectified.’

111    Although the report did not identify precisely what the personal information was, it is apparent that SZSSJ was informed of this in the Department’s letter of 12 March 2014. It was his name, date of birth, nationality, gender, details of detention (when, why and where) and family members in detention (if any). It is apparent that this information was such as readily to identify with precision individuals who had applied for protection visas.

112    Most of the abridged report is devoted to detailing how this significant administrative failure occurred. KPMG identified systemic failures and was specific that it was not the result of malicious or deliberate conduct. It dealt with the details of what constituted the breach at Section 4.3 in these terms:

‘4.3. Forensic examination of the data disclosure

Our observations with respect to the forensic examination of the data disclosure are summarised as follows:

•    123 accesses via 104 unique internet protocol (IP) addresses attempted to retrieve the file at least once. Analysis of available data has provided the DIBP with some indication of the likelihood of each IP address having access to the personal information of detainees;

•    It is not in the interests of detainees affected by this incident to disclose further information in respect of entities to have accessed the Document, other than to acknowledge that access originated from a range of sources, including media organisations, various Australian Government agencies, internet proxies, TOR network and web crawlers;

•    Attempts were made by KPMG Forensic, as instructed by the DIBP, to reduce the risk of republication of material contained in the Document where a high likelihood of this occurring was identified. Any such efforts were considered in the context of the DIBP wanting to avoid disclosing any information which may alert potential recipients of their possession of, or ability to access, the personal information;

•    We have not identified any indications that the disclosure of the underlying data was intentional or malicious; and

•    The DIBP provided us with earlier versions of the publication, which it had released in prior months. Our review did not identify the same issue, so it appears isolated to the version dated 31 January 2014.’

113    This is what SZSSJ presently knows. It is apparent that the unabridged version of the report described in the Executive Summary deals with, inter alia, the ‘technical examination of the data associated with the disclosure and the potential extent of access to that data’. The statement in the second bullet point under Section 4.3 is opaque. It is not in the interests of SZSSJ – if the statement is taken at face value – to know further information about who accessed the information, other than that such access originated from the sources there identified. We do not understand how this can be so. The inferences which can be drawn are:

    104 separate IP addresses accessed the information, some more than once;

    the identity of the accessors included the identified entities but this was not exhaustive; and

    there is ‘further information’ which is not being disclosed because it would not be in the detainees’ interests to do so.

114    A further inference is available: the ‘further information’ is set out in the unabridged report. One has then the situation that SZSSJ has not been told who accessed his information and that there is further information about which he is not to be informed because, although it affects him, it would not be in his interests to know it.

115    The Minister submitted that this gave rise to no denial of procedural fairness for two reasons. The first was that it was not established that anything in the unabridged version of the report was adverse or corroborative of any case SZSSJ would wish to put. His obligations were only to disclose adverse materials, citing Gondarra v Minister for Families, Housing, Community Services and Indigenous Affairs (2014) 220 FCR 202 at 249-250 [145]-[149].

116    SZSSJ contended that he was entitled to be shown adverse information which was credible, relevant and significant, but he went further and submitted that in certain circumstances that obligation extended beyond disclosure of adverse information to include situations where a decision-maker has exclusive access to information which a claimant would otherwise be unable to take account of in his or her natural justice responses.

117    We are by no means certain, in light of the second bullet point in [112] above, that the information in question here is not adverse to SZSSJ in the sense, at least, that KPMG believed that he would better off not knowing it. However, as this was not the subject of argument it would not be appropriate to decide the case on that basis.

118    What we will say is this. The Department is requiring affected individuals to make submissions to it about the consequence of its own wrongful actions in disclosing their information to third parties without revealing to them all that it knows about its own disclosures. Whilst it is certainly true that the obligation of a decision-maker is generally only to disclose information which is adverse to a claimant, the requirements of natural justice fluctuate with the circumstances of each case: Russell v Duke of Norfolk [1949] 1 All ER 109 at 118; Lam at 14 [37]. The particular circumstances of this case take it far outside the realm of the ordinary.

119    The Parliament enacted Pt 4A of the Act to prevent any unauthorised disclosure of information identifying, amongst others, persons who had sought protection visas. Indeed, a person who accessed such information without authority (s 336C(1)) or whose conduct caused its unpermitted disclosure (s 336E(1)) might commit a criminal offence and could be imprisoned for up to two years and/or or fined up to 120 penalty units (i.e. at the time of the Data Breach $20,400). The Secretary’s letter of 12 March 2014 recognised the seriousness of the Data Breach when it stated that:

‘We deeply regret inadvertently allowing potential unauthorised access to your personal information … The information was never intended to be in the public domain.’

120    The Data Breach occurred in the Department on or through its computer equipment. The individuals, such as SZSSJ, affected by the Department’s conduct could not know or ascertain anything as to its potential to affect their interests which the Department did not disclose to them. In those circumstances, the Department’s assertion that it has disclosed what, it considered, might adversely affect the relevant individual(s), cannot be evaluated by that individual or those individuals because they do not have, and cannot access, the full picture in the presently limited disclosure in the process that the Department has afforded. In cases, such as these, involving persons whose claims for protection have failed, the public revelation of their identities that could have been accessed by the very person(s) from whom the failed protection seeker feared harm, conceivably might have some potential to expose him or her, on refoulement, to what he or she feared.

121    Rare is the case where a decision-maker asks a claimant to make submissions about what should happen in consequence of a failure to adhere to statutory safeguards of confidentiality committed by the decision-maker affecting the claimant. In such a case, it is inevitable that the decision-maker must show its full hand subject to any proper (and curially supervisable) consideration of confidentiality. This is not because of any presumption that all of the information held by the decision-maker is adverse in the sense discussed in Applicant VEAL of 2002 v Minister for Immigration and Multicultural and Indigenous Affairs (2005) 225 CLR 88 or because it is corroborative (see Coutts v Close [2014] FCA 19 at [116] per Griffiths J; cf Gondarra v Minister for Families, Housing, Community Services and Indigenous Affairs (2014) 220 FCR 202 at 249-250 [145]-[149] per Kenny J). It is because the Department is conflicted in its role in assessing what the non-refoulement obligations are which arise from its own wrongful conduct. No argument was addressed to us that the bias rule had the effect of wholly barring the Department from addressing that issue, but at the very least, in a practical way, it undermines fairness to suggest that in such an unusual situation the Department does not have to reveal the full circumstances so that the person affected can assess, with full information, whether some adverse impact occurred or may have occurred on which he or she wishes to be heard (absent some good reason not to do so, such as confidentiality).

122    The Minister’s second argument was that under the process currently being conducted (we would add, on his behalf) the reviewers in the ITOA process will not have access to the unabridged version of the report either. Further, those reviewers had been provided with the following instruction:

‘When assessing protection claims in relation to the privacy data breach, case officers are instructed to accept that the claimant’s personal information released on the department’s website may have been accessed by the authorities in the receiving country. The reason for this approach is that, although the KPMG privacy breach review found that there were relatively few internet users who accessed this document, it is not possible to discount the possibility that the authorities in another country may have accessed this document. Accordingly, an assessment of protection claims in relation to the privacy data breach should be undertaken on the assumption that this information may have been accessed by the authorities in the receiving country.’

123    We assume this direction emanates from, or with the authority of, the Minister. The question of international law for the reviewer will be whether, as a necessary and foreseeable consequence of SZSSJ being removed from Australia to the receiving country, there is a real risk that he will suffer significant harm. Setting the bounds of the debate so that all that will be known is that the authorities in the receiving country ‘may’ have accessed the information means that this test will necessarily be failed. SZSSJ will need to show that the information was accessed and by whom and why access by those people poses such a significant risk. Far from ameliorating the want of procedural fairness, this instruction erects a process guaranteeing the claim will fail. It is not fair.

124    Quite apart from that, the instruction ignores the possibility of gradations in the risk to the claimant associated with those who have or may have accessed the data. There may be a world of difference between access by the tax authorities of the receiving country and access by the security services. Further, the access may have been by a person or entity who is or is not a governmental authority in respect of whom or which SZSSJ may be able to identify a particular risk. The principles surrounding non-refoulement are not confined to fear of harm from just ‘the authorities’ in the receiving country. In any event, these matters cannot presently be taken further as it is unknown what information has been withheld in the unabridged KPMG report.

125    In those circumstances, the procedure contemplated on the present evidence is procedurally unfair. For completeness, we reject the Minister’s submission that the statement appearing at the end of most of the Department’s correspondence that if SZSSJ had any queries he should contact his case officer, can operate as a discharge of any obligation of procedural fairness. It is quite clear that any such request would not have brought forth either the unabridged version of the KPMG report or an accurate description of the administrative processes in play.

2.9 Seventh Issue: Relief

126    SZSSJ is entitled to declarations that the process conducted to date has been procedurally unfair in that he was not informed of the decision-maker, the power being exercised or the matters relevant to the exercise of that power and he has been denied procedural fairness by not being informed of the full circumstances of the Data Breach, including by not being provided with the unabridged KPMG report.

127    In relation to the injunction to restrain SZSSJ’s removal from Australia pending the outcome of the ITOA process, the Minister submitted that he would not be removed from Australia until the process of assessing the non-refoulement obligations had been completed. Further, he argued, that the removal protocols of the Department revealed that such a deportation would not occur before, at least, that process had been completed.

128    There are two aspects of this case which cause us to have doubts about whether the Minister’s submissions about this should be accepted:

    the Department’s insistence until 1 October 2014 that it was conducting its ‘normal’ review processes. On 1 October 2014 whatever those processes were they were supplanted by an ITOA process without explanation. There was no evidence and it is not evident to us what the Department was doing in that earlier period and that was not clarified to any degree by the assertion that the processes were ‘normal’; and

    the processes adopted in SZSSJ’s case are sufficiently unfair as to raise in our minds a real question as to whether he can now be expected to trust, on the present evidence, the reliability of the Department’s own assessment of what is fair. This is particularly so where the Department is, in effect, investigating itself despite the inherent conflict that this unusual process potentially generates. SZSSJ should not be required to run the risk that the Department can navigate the perils thrown up by this conflict without further mishap.

129    In the somewhat unusual circumstances of this case we propose to grant a final injunction restraining the Minister and Secretary from removing SZSSJ until 14 days after the determination of the process currently being conducted by him under his personal dispensing powers.

130    There is no basis upon which SZSSJ can be denied his costs in this Court or below.

3. SZTZI

131    SZTZI is a Chinese national who arrived in Australia in April 2013 as an authorised air arrival on a visitor’s visa of three months’ duration. Following the expiry of that visa she was taken into immigration detention in September 2013. In October 2013 she made an application for a protection visa which was refused on 14 November 2013. The Tribunal affirmed that decision on 10 January 2014.

132    On 10 February 2014 SZTZI’s personal information was disclosed on the Departmental website and she received the same letter as SZSSJ on 12 March 2014. On 27 June 2014 she received an identical letter to the letter sent to SZSSJ on the same day. On 30 June 2014 her solicitors wrote to the Department claiming that it was possible her personal information had been received by various people, including the Chinese authorities. SZTZI wrote to the Department herself at around the same time asserting the same matters. There was other, not presently relevant, correspondence in 2014.

133    On 16 December 2014 s 197C of the Act commenced. At that time there was no indication to SZTZI that the unidentified process referred to in the letter of 27 June 2014 had stopped.

134    That process was an ‘investigation’ within the meaning of s 7 of the Acts Interpretation Act 1901 (Cth). For the reasons we have given in relation to SZSSJ, its effect in SZTZI’s case was that her rights under the Act not to be removed under s 198 without a hearing on the issue of non-refoulement continued to apply.

135    On 13 January 2015 the Department informed SZTZI that it was then considering ‘information relevant to [her] International Treaties Obligation Assessment (ITOA)’. It called for submissions within 14 days.

136    An accompanying letter of the same date indicated to her that the ITOA would be directed at non-refoulement. On 5 February 2015 the Department provided SZTZI with reasons why it thought there was no non-refoulement obligation. On the issue of the Data Breach it said this:

‘Procedural Fairness

In the letter dated 14 January 2015, your representative commented that unless the department discloses all information related to the data breach, then you would be denied procedural fairness.

When assessing protection claims in relation to the privacy data breach, case officers are instructed to assume that the authorities in the claimant’s receiving country may have accessed personal information released on the department’s website. Case officers will refer to the claimant’s personal circumstances and country information to determine whether the privacy data breach will affect the individual if he or she is returned to his or her country of origin.

The reason for this approach is that, although the KPMG review found that there were relatively few internet users who accessed the document, it is not possible to discount the possibility that the authorities in another country may have accessed this document. Accordingly, releasing the IP addresses, the unabridged KPMG report, or other information related to the privacy data breach, is not required for a claimant to participate in this process.’

[Footnote omitted]

137    Because this appeal is concerned with procedural fairness it is not necessary to comment on whether this letter made any sense, although the last sentence is certainly a non-sequitur. In effect, the Department asserted to SZTZI that any claim that could be made about who accessed the information could be ignored because the ITOA process was not going to examine that issue. On 11 February 2015 a submission was made on SZTZI’s behalf which included this statement:

‘Without access to the information held by the department, all assumptions and claims made are speculation only. To assume that only the home country has accessed the information is casting too narrow field in speculation [sic] as to who has accessed, saved, copied and sent on and received the information and as to who could harm the applicant. The understanding on how TOR Networks function and who is running them is very limited. Therefore, I respectfully submit that the assumption that case officers are to accept that the home county [sic] has had access to the information then assess the applicant’s claims against the country information is a flawed assumption to make, particularly as the country information does not deal with the scenario of a foreign government placing the names and details of asylum seekers held in it [sic] immigration detention facilities on the world wide web, breaching the Migration Act, asylum seekers’ confidentiality and international human rights obligations. Such a situation is unprecedented and shameful. The department cannot effectively assess the real chance of serious or significant harm that it has placed the applicant in and should find that the applicant is now a refugee sur place.’

138    For reasons we have already given, this submission correctly exposed the procedural unfairness in proceeding without information about what had actually happened.

139    Nonetheless, on 23 March 2015 the Department concluded that Australia did not owe SZTZI any non-refoulement obligations. In relation to the Data Breach it repeated word for word what it had set out in its earlier letter. It made no attempt to respond to the submission which had been made to it. No argument was advanced before the Federal Circuit Court or this Court that this itself involved a breach of the rules of procedural fairness: cf. Dranichnikov v Minister for Immigration and Multicultural Affairs (2003) 197 ALR 389 at 394 [24] and 408 [95].

140    On 30 March 2015 SZTZI commenced proceedings in the Federal Circuit Court. She sought an injunction restraining her removal from Australia together with a number of declarations, one of which was that the ‘decision’ had not been made according to law. On 8 May 2015, probably on the erroneous view that s 197C of the Act applied to SZTZI’s case, this claim for an injunction was narrowed by her solicitor to one which, if made, would merely prevent the Minister relying upon the ITOA decision. On 12 May 2015 the matter was heard in the Federal Circuit Court which dismissed it on that day, giving reasons ex tempore.

141    The Federal Circuit Court’s reasons (SZTZI v Secretary of the Department of Immigration & Anor [2015] FCCA 1271) may be summarised as follows:

1.    the ITOA report was not a decision under the Migration Act and had no legal consequences (at [6]);

2.    section 197C meant that no argument could be advanced about the ITOA insofar as s 198 was concerned (at [8]);

3.    SZTZI was not applying for an injunction to prevent her removal (at [4]);

4.    the attempt to seek the injunction which his Honour said was not sought at [4] was a colourable attempt to attract jurisdiction (at [12]);

5.    there was no obligation to afford procedural fairness because of s 197C (at [14]); and

6.    in any event, there was no denial of procedural fairness because SZTZI had been given an opportunity to comment on the disclosure: [15].

142    His Honour said:

‘15.    The applicant was clearly informed of the nature of the material that was disclosed and had an opportunity of being able to articulate how that limited disclosure could impact on alleged fears of persecution or alleged fears of serious [sic] or alleged fears of serious harm. The claimant was provided with the opportunity to comment on the information and did so by response dated 11 February 2015, and it is clear that the applicant was in a position to address any concern by reason of the applicant being an over stayer. There is no conduct identified in respect of the allegation of alleged bias other than the adverse decision itself.’

143    Without repeating in detail what we have said in SZSSJ’s case, it is apparent that each of these steps involved error.

144    As to (1), this was erroneous. The recommendation was conduct preparatory to the making of a decision and hence fell within the extended definition of a privative clause decision under s 474(3)(h) as this Court had directly held in the case of this very process in SZSSJ v Minister for Immigration and Border Protection [2014] FCAFC 143. This departure from directly binding authority emerged from a failure in the Court below to grapple with, or even identify, the complex decision-making process in play and hence to have any bearings with which it might ascertain the relevant principles to be applied.

145    As to (2), for the reasons we have already given this is wrong for two reasons. First, even if s 197C had applied to this case (which it did not), it did not have the consequence of sidestepping the reasoning in M61. The trial judge did not advert himself to M61 because he did not apprehend that the powers involved were the Minister’s personal dispensing powers. For the above reasons in respect of SZSSJ’s case, the Minister had decided that the exercise of those powers should be considered and the Department was conducting the ITOA process under directions for which he was responsible, as an aspect of his own personal decision-making processes. Secondly, in any event, because of s 7 of the Acts Interpretation Act 1901 (Cth), s 197C simply did not apply. However, his Honour had not been referred to s 7.

146    As to (3), this is correct: SZTZI was no longer applying for such an injunction by the time of the trial. The transcript of the hearing shows that the trial judge raised this with SZTZI’s lawyer and that the lawyer confirmed that no injunction was sought.

147    As to (4), the trial judge inferred from the abandonment of the claim for the injunction at the hearing, that the original making of the claim had been a colourable attempt to attract jurisdiction. The relevance of that conclusion would be that the Court would not retain jurisdiction thereafter to grant declaratory relief. However, his Honour did not go on to dismiss the claims for declaratory relief on the basis that they were not within jurisdiction. However, as we have explained, the claim for an injunction was within jurisdiction because s 197C did not apply at all.

148    As to (5), even if s 197C had applied it had no relevance to procedural fairness in light of M61.

149    As to (6), we are bound here to observe that the trial judge does not appear to have grasped the argument being put to him. Paragraph [15] above reveals several misconceptions. It is true that SZTZI was afforded the opportunity to comment on the information which had been disclosed but she was not told to whom that information was disclosed. She could not meaningfully make any submissions about Australia’s non-refoulement obligations arising from the disclosure of her personal information if she did not know to whom it had been disclosed.

150    Further, it was wrong to say, as his Honour did at [13], that ‘only very limited information was the subject of release’ or that the disclosure was ‘very limited’. That is not what the abridged version of the KPMG report said. The information was sufficiently precise to identify the persons involved. In our opinion, no more information was necessary to generate the risks with which non-refoulement claims are concerned. Further, once the information was released on the internet the extent of its distribution was unknowable.

151    During the course of the proceedings in SZTZI it appears that a notice to produce was issued calling for the production in Court of the unabridged version of the KPMG report. The notice to produce was not called upon. In this Court it was submitted that there could be, in that circumstance, no valid complaint about the failure of the Department to produce the unabridged version. We do not agree. The abridged version of the report provides sufficient evidence, as we have already observed, to draw inferences about what was contained in the unabridged version. In that regard, as a matter of evidentiary principle, SZTZI has proved that the contents of the unabridged KPMG report were such as to require disclosure. If the Minister wished to prove to the Court that the contents of the unabridged report could dispel what the evidence already proved, that was a matter for him.

152    For the reasons we have given in SZSSJ (including in relation to the notice of contention) the Department’s procedure adopted in this case was procedurally unfair. A declaration to that effect should be made. There is no reason to issue the injunction sought as no decision by the Minister to act on a report declared by this Court to have resulted in procedural unfairness could itself be valid. No injunction is sought to restrain SZTZI’s removal pending the outcome. The Minister must pay SZTZI’s costs in this Court and the Court below.

4. AHY15

153    The Federal Circuit Court dismissed this case on the basis that it did not have jurisdiction for the reasons it had given three days before in SZTZI. As we have just explained, those reasons were erroneous. It emerged in this Court, however, that AHY15 had not even been affected by the Data Breach. The transcript of the hearing in the Court below reveals that the Court did not hear from the Minister’s solicitor before embarking upon judgment. This is a pity. Rather, his Honour announced that the case was the same as SZTZI and, for reasons which we do not grasp, declined counsel for AHY15 the opportunity to put on submissions explaining why SZTZI might be distinguished (the reasons in SZTZI not then being available).

154    One very good reason for distinguishing AHY15’s case from that of SZTZI was that the former case was not touched by the Data Breach, since AHY15 was not in immigration detention when it occurred and his personal details were never revealed. This was the precise reasoning of the ITOA report which we can only infer the trial judge did not read:

‘Breach of privacy – data breach

In the written response to the commencement letter of the ITOA, it was submitted that the claimant was affected by the department’s breach of privacy. In February 2014, a routine report released on the department’s website unintentionally enabled access to some personal information about people who were in immigration detention on 31 January 2014.

However, it was put to the claimant that according to departmental records he was not in immigration detention on 31 January 2014. The claimant initially stated he was in community detention at that time. It was then clarified that he was living in the community but without a bridging visa at that time. The claimant sated that he had a bridging visa when he was released from held detention (on 24 April 2012).

It was put to the claimant that, as he was not in immigration detention on 31 January 2014, his personal information was not released on the department’s website, and so he is not affected by the data breach.

The representative, in consultation with the claimant, then stated that the claim of being affected by the data breach of personal information was now withdrawn as he was not technically in detention at the time of the data breach.’

155    In those circumstances while the hearing below was conducted in a manner which was procedurally unfair the result arrived at was serendipitously correct. In those circumstances, the appropriate order is that the appeal be dismissed with costs.

5. Orders

156    The parties in SZSSJ’s and SZTZI’s appeals are to bring in short minutes of order to give effect to these reasons within 14 days hereof.

Associate:

Dated:    2 September 2015