FEDERAL COURT OF AUSTRALIA

AIT18 v Australian Information Commissioner [2018] FCAFC 192

ORDERS

THE COURT ORDERS THAT:

1.    The appeal be dismissed.

2.    The applicant pay the second respondent’s costs, as agreed or assessed.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

THE COURT:

1    This appeal is from a decision of the Administrative Appeals Tribunal (AAT) which is reported as TYGJ and Information Commissioner [2017] AATA 1560. The appeal is brought under s 44 of the Administrative Appeals Tribunal Act 1975 (Cth) (the AAT Act).

2    The appeal raises issues concerning the proper construction of the Privacy Act 1988 (Cth) (Privacy Act) and several Information Privacy Principles (IPPs). The appeal involves the Court’s original jurisdiction.

Summary of background facts

3    For the purposes of the appeal, the applicant has been given the pseudonym AIT18. We will refer to him as the applicant.

4    The applicant enlisted in the Royal Australian Air Force (RAAF) in August 2001 and so was a member of the Australian Defence Force (ADF). He was assessed in 2009 as having a superior performance and he was recommended for promotion.

5    The applicant lodged a claim for compensation on 17 June 2011 and then made a further similar claim on 21 June 2011. These claims were made under the Military Rehabilitation and Compensation Act 2004 (Cth). The applicant’s claims for compensation related to injuries he suffered while serving as a member of the RAAF and ADF. The applicant was dissatisfied with the processing of his claims by the Department of Veterans’ Affairs (DVA). He created a website on which he posted strong criticisms of both DVA and the responsible Minister. During the period from late July to late October 2011 the applicant sent a series of emails, phone and SMS text messages to DVA personnel expressing his deep dissatisfaction with DVA’s service. Many of these communications contained vitriolic, threatening and grossly offensive language.

6    In broad terms, various steps taken by DVA in responding to the applicant’s complaints led to the applicant complaining that DVA had breached IPP 11.1 in three ways:

(a)    on 20 October 2011, DVA disclosed his personal information to an ADF Senior Medical Officer (Disclosure 1);

(b)    on 20 October 2011, DVA disclosed his personal information to the Head of Joint Health Command in the Department of Defence (Disclosure 2); and

(c)    on 28 October 2011, DVA disclosed his personal information to the Chief of Air Force (Disclosure 3),

together, the Disclosures.

7    Disclosures 1 and 2 were made orally, while Disclosure 3 was made in writing. These disclosures revealed that the applicant had made compensation claims, that his correspondence with Departmental staff had become increasingly abusive, aggressive, offensive and threatening, and that he had contacted DVA staff outside normal business channels, including by threatening physical harm in a text message sent to the mobile phone number of a DVA employee.

8    The applicant’s complaint was lodged with the Information Commissioner on 21 November 2011. The Information Commissioner found that DVA had breached IPP 11.1. DVA was directed to apologise in writing to the complainant and to undertake a review of DVA’s management of privacy complaints.

9    DVA did not seek a review of the Information Commissioner’s findings and an apology was given. DVA also engaged the services of a private law firm to review its management of privacy complaints.

10    The applicant sought a review in the Administrative Appeals Tribunal (AAT) of the Information Commissioner’s determination. This was done pursuant to s 96(1)(c) of the Privacy Act. The applicant wished for the AAT to confine itself to the question of whether he was entitled to compensation for DVA’s breach of IPP 11.1. The AAT determined, however, that the effect of the application for review was to put in issue all matters arising from the applicant’s complaint to the Information Commissioner, including whether DVA was in breach of IPP 11.1 (see Re TYGJ and Privacy Commissioner and Secretary, Department of Veterans' Affairs (Party Joined) [2015] AATA 112 at [28]).

The AAT proceeding

11    At [10] of its reasons for decision, the AAT identified the following issues raised by the review:

(1)    whether DVA breached IPP11.1 by disclosing TYGJ’s personal information on the three occasions to which each of the three complaints relates:

(a)    Resolution of this issue will require consideration of whether DVA’s disclosures were excluded from the obligation imposed by Principle 11.1 in accordance with one or other of IPP11.1(a), (c), (d) or (e):

(i)    whether TYGJ is reasonably likely to have been aware that information of the kind is usually passed to that person, body or agency: first, second and third disclosures;

(ii)    whether DVA relies on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person: first, second and third disclosures;

(iii)    whether the disclosure is required or authorised under law: first, second and third disclosures; and

(iv)    whether disclosure is reasonably necessary for the enforcement of the criminal law or a law imposing a pecuniary penalty: third disclosure.

(2)    if DVA has breached IPP11.1, whether its declaration made under s 52(1)(b)(ii) to redress the damage suffered by TYGJ was sufficient in the circumstances; and

(3)    if DVA has breached IPP11.1, whether a declaration should be made under s 52(1)(b)(iii) that TYGJ is entitled to a specified amount by way of compensation for loss or damage suffered by reason of the disclosure of DVA.

12    The AAT set aside the decision of the Information Commissioner and substituted a decision which dismissed the applicant’s complaint. It found that the Disclosures came within the exceptions in IPP 11.1(a) and (d). The AAT gave lengthy reasons for its decision (Reasons). Before giving a broad summary of those reasons, it is well to set out or describe several relevant provisions of the Privacy Act, including the Preamble.

(a) The relevant statutory provisions outlined

13    The Preamble to the Privacy Act provides that the legislation is intended to fulfil Australia’s obligation as a party to the International Covenant on Civil and Political Rights (ICCPR) to give effect to the right of persons not to be subjected to arbitrary or unlawful interference with their privacy, family, home or correspondence and to implement the recommendation of the Council of the Organisation for Economic Co-operation and Development (OECD) that domestic legislation take into account the principles in the OECD Guidelines. The Preamble refers to Australia’s undertaking as a party to the ICCPR “to adopt such legislative measures as may be necessary to give effect to the right of persons not to be subjected to arbitrary or unlawful interference with their privacy, family, home or correspondence”.

14    For completeness, it might be noted that, although not in force at the relevant time so as to be material to these proceedings, s 2A of the Privacy Act now expresses a series of statutory objects. Furthermore, the IPPs have now been replaced by the Australian Privacy Principles, with effect from 12 March 2014, following the enactment of the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Cth).

15    Although it was common ground that s 2A of the Privacy Act is not relevant to these proceedings, it is necessary to note s 29 (as in force at the relevant time), which specified matters to which the Information Commissioner had to have “due regard” in the performance of his or her functions:

29    Commissioner to have regard to certain matters

In the performance of his or her functions, and the exercise of his or her powers, under this Act, the Commissioner shall:

(a)    have due regard for the protection of important human rights and social interests that compete with privacy, including the general desirability of a free flow of information (through the media and otherwise) and the recognition of the right of government and business to achieve their objectives in an efficient way;

...

16    The Second Reading Speech to the Privacy Bill (which is referred to in Reasons [218]), emphasised the balance which the legislation strikes between protecting personal privacy and giving effect to the legitimacy of some interferences with that privacy. In particular, it was stated there that:

the legitimate needs of agencies in acquiring personal information and the use made of it must be balanced against the need to sustain personal privacy.

…

The exceptions recognise that any claim for privacy by an individual must be considered against equally justified claims by other individuals and the community.

17    The terms of IPP 11.1, which formed part of s 14 of the Privacy Act, were as follows:

1.    A record-keeper who has possession or control of a record that contains personal information shall not disclose the information to a person, body or agency (other than the individual concerned) unless:

(a)    the individual concerned is reasonably likely to have been aware, or made aware under Principle 2, that information of that kind is usually passed to that person, body or agency;

(b)    the individual concerned has consented to the disclosure;

(c)    the record-keeper believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person;

(d)    the disclosure is required or authorised by or under law; or

(e)    the disclosure is reasonably necessary for the enforcement of the criminal law or of a law imposing a pecuniary penalty, or for the protection of the public revenue.

…

18    It is well to also note the relevant terms of s 6, which defined “personal information”:

personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

(a)    whether the information or opinion is true or not; and

(b)    whether the information or opinion is recorded in a material form or not.

Note:    Section 187LA of the Telecommunications (Interception and Access) Act 1979 extends the meaning of personal information to cover information kept under Part 5-1A of that Act.

(b) A selection of the applicant’s correspondence

19    Before summarising the Reasons, it is appropriate to set out a small selection of the applicant’s communications with DVA and others which preceded the three Disclosures. The communications are set out extensively in the Reasons and need not be repeated in full here.

20    On 19 October 2011, the applicant wrote to several DVA officers, and said:

…

You pricks have fucked me over every which way – including Sunday and sideways – and you have been gutless wonders in doing so, unable to admit (without reservation) to your filthy acts of deception and wrong doing and continually thinking I’m going to let you fuck me over again without so much as a whimper. Again, I’m disgusted to the core just thinking about you – you must rank up there next to paedos in moral fibre.

You better bring on your A game dipshits, because I think you’ll find it’s my turn to fuck you up!

21    On the same day, the applicant emailed another DVA officer in which he sought an answer to a question set out therein. His email concluded with the statement:

A prompt response will avoid hand grenades.

22    On 20 October 2011, the applicant sent an email to the then Minister for Veterans’ Affairs, the Honourable Mr Warren Snowdon MP, which contained the following concluding statements:

It’s problematic when the victim gets the all clear from the headshrink, although I’ll admit it’s an old and sometimes proven tactic, if you are dealing with a dumb fuck (bad luck for you, you’re not – but apparently I am dealing with a dumb fuck with you).

Frack you, and your little dog too.

23    On the same day, at 6.25 pm, the applicant wrote to more than 20 DVA officers and said:

So are any of you gutless, morally inept and unethical HUNTS going to apologise for trying to smear me at my workplace? Anyone, anyone, Bueller? No. Hmm, I’ve got an idea – why don’t I ring you all personally to find out your opinion, especially since Megan Hunt was so kind to give me all your contact details (Yay Megan, thanks Hunty!).

By the way, I hope you’re not getting Simone from the BNE office to train DVA staff in telephone technique, it’s a little blue for my tastes, but I did learn some new words (very naughty!) – I didn’t think swearing was part of the APS Code of Conduct last time I checked… (at least I’m inventive when I want to be colourful, but then Megan was always an inspiration…)

…

P.S. Could you be a bigger bunch of HUNTS?

P.P.S I’ll ring everybody except you Jenny dear – a smear deserves a smear right back HUNT. Bet you’ll never guess exactly where but someone should talk to you about Information Security (tsk, tsk), enjoy!

P.P.P.S Graham, you HUNT – nice work trying to screw me on access to Dr McNicol’s report – you must be so proud of your attempts to circumvent the law to prevent access before … [DVA officer B] made the determination. Hope you don’t mind me putting you on the website (I’ll be unblanking your details soon).

P.P.P.P.S Shubi, you great waste of space – still a doorstop in the MEL office? Nice work screwing me on every aspect you could, but I guess with your brains this was the best job you could get hey (keeps you out of the parks I guess, hey Genius – in your case you really are as stupid as you seem so you might actually be an honest but dumb as brass tacks one)

P.P.P.P.P.S Scott you fracking HUNT – I see you’re still as full of shit as always. Policy did the right thing in ignoring you, because you don’t have a fracking clue – Policy got it right, you are wrong dipstick, hence why Policy (the informed people) wrote what they did. Maybe you should consider that sometimes you need to think first, before acting you dropkick. You can go back to sticking your own head up your arse now, I’m done with you.”

24    Several days later, the applicant sent an email to another DVA officer and said (omitting footnotes):

... and Hi to the biggest HUNT of them all, Megan – I smell your fishy hands all over this one! Why don’t you go back to playing with your self, you dumb HUNT

…

Sure Hunt – there was no attempt to withhold release – and I’m sure you are a sweet smelling Hunt, not a dirty, smelly, festering one (pigs might fly too).

25    On 21 October 2011, the applicant sent an email to a DVA officer at her personal email address and said:

Are you ready to grow up and answer my question Tantrum or do you want to keep playing until I’m knocking on your front door you moron. Start acting like an adult Tamtrum, or I’ll put you over my knee and smack your backside.

…

26    On 21 October 2011, the applicant wrote to another DVA officer and said:

If you want to make war with me, I will make war with you that will cost me nothing (I’ve already lost, so I have no more to lose) and will see you bled from a thousand cuts.

27    It was shortly after receipt of this email that a decision was made within DVA to allocate the applicant’s file to a single point of contact within DVA with a view to limiting the impact of his behaviour and to protect all DVA staff from further aggressive behaviour by him.

(c) The AAT’s reasons for decision summarised

28    Returning to the Reasons, the AAT found that the personal information passed on by DVA in the three Disclosures reflected DVA’s concern for the applicant’s health and for the wellbeing of its own staff. It described Disclosures 1 and 2 as reflecting DVA’s search for guidance as to whether it should be concerned about the applicant’s behaviour and what it should do in response (Reasons [250]).

29    Having characterised the information as being of that “kind”, the AAT then turned its attention to whether information of that kind is usually passed on to an individual’s medical practitioner and employer, as occurred here. The AAT found that Disclosures 1 and 2 involved information of the kind that is usually passed on to those to whom the disclosures were made. The AAT stated that Disclosure 1 enabled DVA to obtain information regarding the applicant’s psychiatric history and Disclosure 2 led to arrangements being made for the applicant to have a psychiatric evaluation of his current state of mental health (Reasons [261]).

30    The AAT took into account DVA’s responsibilities under the Occupational Health and Safety Act 1991 (Cth) (OHS Act) to its own staff. The Disclosures enabled it to obtain further information which could be passed on to Professor McFarlane for advice. Accordingly, the AAT found that Disclosures 1 and 2 were a necessary part of a process that enabled DVA to fulfil its statutory responsibilities under s 16 of the OHS Act and was information of a kind that is usually passed on to those to whom the Disclosures were made here (Reasons [263]).

31    As to Disclosure 3, the AAT noted that it occurred against the background of an escalation in the tone, irascibility and inappropriateness of the applicant’s correspondence. Having regard to the character of that correspondence and the circumstances in which it occurred, the AAT found that it was reasonable for DVA to form the view that the applicant might be bringing discredit on the ADF within the meaning of s 60(1) of the Defence Force Discipline Act 1982 (Cth) (DFD Act) and so committing an offence (Reasons [266]). Accordingly, it found that Disclosure 3 related to information of a kind that is usually passed on to a person such as the Chief of Air Force.

32    In concluding that the applicant was reasonably likely to have been aware that information of the kind is usually passed to the medical practitioners and the Chief of Air Force, the AAT took into account that the applicant was a serving member of the ADF and held a rank with some seniority in the RAAF, his tertiary qualifications and his status as a recognised expert practitioner in his field. It found that a person with “his experience, education and rank is reasonably likely to have been aware that if he engaged in behaviour of the sort that he did, whether he was injured or not, there would be those who would seek the advice of medical practitioners in the ADF” and that his behaviour would be drawn to the attention of his superiors (Reasons [277]). Accordingly, the AAT concluded that each of the three Disclosures fell within IPP 11.1(a).

33    As to IPP 11.1(d), the AAT’s reasons for concluding that the three Disclosures were “required or authorised by or under law” may be summarised as follows. The AAT found that it was possible for a law, such as the OHS Act, impliedly to authorise a use or disclosure. The AAT said that the power of an employer to release information under that legislation must be implied from the nature of the employer’s obligation under s 16(1) of the OHS Act to “take all reasonably practicable steps” to protect the health and safety at work of its employees. The AAT found that there was a sound basis for DVA being concerned about the health and safety of its staff in view of the applicant’s “escalating behaviour” and that it needed a proper assessment of that behaviour in order to determine what steps it had to take to protect the health and safety of its employees (Reasons [306]). These matters were elaborated upon by the AAT in respect of each of three Disclosures in Reasons [306]-[307].

The appeal

34    In a second amended notice of appeal dated 20 April 2018, the applicant identified the following 14 questions of law raised in his appeal (without alteration).

1.    Whether the Tribunal erred in law in failing to apply the legal principles relevant to the interpretation of remedial or beneficial legislation, and specifically failing to apply those principles in its interpretation of IPPs 11 (1) (a) and 11 (d)?

2.    Whether the Tribunal erred in its interpretation of IPP 11 (1) (a) in determining, finding or holding:

(a)    that there are different “kinds” of personal information for the purposes of the operation of IPP 11.1(a);

(b)    that the first step in determining the operation of IPP 11.1(a) is to consider what kind of information is that information;

(c)    that personal information could be categorised (other than the existing categories within the Privacy Act 1988) with different levels of protective measures applying according to their nature;

(d)    that IPP 11(1)(a) requires an initial categorisation of personal information; and

(e)    that the Tribunal’s interpretation of IPP 11(1)(a), insofar as it related to the categorisation of personal information, was consistent with clause 3 (a) of the Guidelines on the Protection of Privacy and Transborder Flows of Personal Data (“OECD Guidelines”); and

(f)    referring to and relying upon the OECD Guidelines, when there was no ambiguity in IPP 11 (1) (a) that would make the reference to the OECD Guidelines permissible in the interpretation of IPP 11(1)(a)?

3.    Whether the Tribunal erred in its interpretation of IPP 11(1)(a) in:

(a)    determining the meaning, operation and scope of the phrase “usually passed on”;

(b)    interpreting the phrase “usually passed on” without applying the contextual approach to interpretation, which would require:

(i)    as a first step, consideration of what the “individual concerned is reasonably likely to have been aware” was “usually passed on” to a particular person or body; and

(ii)    consideration of the context of the other sections of the Privacy Act 1988, and in particular the remaining IPP’s?

(c)    finding or inferring that the Department of Veteran’s Affairs (“DVA”) responsibilities or potential responsibilities under the:

(i)    Occupational Health and Safety (Commonwealth Employment) Act 1991 (“the OHS Act”); and/or

(ii)    the Defence Force Discipline Act 1982 (“the DFD Act”) were relevant factors or considerations in the interpretation and operation of IPP11.1(a);

4.    Whether there was any evidence or basis upon which the Tribunal was entitled to find that when one Commonwealth Agency comes to a view that an employee of another may be committing offences, it is normal or usual practice to tell the employee’s employing agency?

5.    Whether the Tribunal erred in the interpretation of IPP 11(1)(a), and in particular the awareness of the individual concerned:

(a)    in applying a different standard of knowledge to the individual concerned according to his/her level of education, experience and rank; and

(b)    failing to apply sufficient weight, or any weight on the knowledge or awareness of the individual concerned by reference to objective facts such as the wording on the compensation claim form and DVA’s Privacy Policy?

6.    Whether there was any evidence or basis upon which the Tribunal was entitled to find at [262] that the personal information described in Disclosures 1 and 2 would usually be passed on to the Applicant’s medical practitioner and employer?

7.    Whether there was any evidence or basis upon which the Tribunal was entitled to find that the Applicant would be reasonably likely to have been aware that the personal information described as Disclosure 3 would usually be passed on to the Australian Defence Force or the Chief of the Air Force?

8.    Whether the Deputy President erred by failing to give adequate reasons for the finding that the Applicant would be reasonably likely to have been aware that the personal information described as Disclosure 3 would usually be passed on to the Australian Defence Force or the Chief of the Air Force?

9.    Whether the Tribunal misdirected itself in finding:

(a)    that the provisions of the OHS Act; and/or

(d)    that the provisions of the DFD Act were relevant factors in consideration of the relevance and operation of IPP11.1(a)?

10.    Whether the Tribunal erred in finding and/or inferring that as a matter of law that the operation of the OHS Act and the DFD Act constituted:

(a)    a requirement; and/or

(b)    authorisation

by or under law for the purpose of IPP11.1(d)?

11.    Alternatively, whether the Tribunal erred in drawing the wrong inference of fact when considering the scope and operation of IPP 11.1(d) namely:

(a)    citing provisions of the OHS Act cited at [295], [298], [300] as constituting a disclosure required or authorised by or under law; and

(b)    at [300] that section 16(1) of the OHS Act:

(i)    constituted a right and power to release information; and/or

(ii)    is a relevant provision in consideration of whether the disclosure is required or authorised by or under law for the purpose of the operation of IPP11.1(a)?

12    Whether the Tribunal misdirected itself:

(a)    in finding at [263] that the provisions of the OHS Act were relevant factors in consideration of the relevance and operation of IPP11.1(d) to the disclosures made by DVA;

(b)    in finding at [275] that the provisions of the DFD Act were relevant factors in consideration of the relevance and operation of IPP11.1(d) to the disclosures made by DVA;

when there was an absence of evidence of that fact, and/or of the fact that these were considerations of DVA in making the disclosures, and/or no legal basis for so finding?

13    Whether the Tribunal erred in:

(a)    making findings or providing observations regarding the Applicant’s mental health;

(b)    finding that the Applicant was quick to complain to a third party; at [253],

(c)    finding that the Applicant exhibited a tendency to return to problems; at [255]

(d)    at [275], concluding there was a basis for DVA coming to the view that the Applicant may have committed an offence as being a reason for Disclosure 3

when:

(e)    there was an absence of evidence in support of those conclusions and findings; and/or

(f)    those findings and conclusions were irrelevant in determining whether there was a breach of IPP11?

14    Whether, having found that given the provenance of the Plain English Guidelines to Information Privacy Principles 8-11 (“IPP Guidelines”) it is to be expected the Commonwealth agencies would apply them unless it was shown that its application would work injustice in a particular case, or that they were contrary to law, the Tribunal erred:

(a)    in ignoring the IPP Guidelines in assessing the conduct of DVA and what the Applicant is reasonably likely to have been aware of;

(b)    finding that the Tribunal’s powers were confined only by the terms of the Privacy Act 1988; and

(c)    failing to refer to, or rely upon, consideration of the IPP Guidelines to assist in the interpretation of IPP 11 in the event of there being any ambiguity.

35    The applicant initially contended that these 14 questions of law gave rise to no less than 23 grounds of appeal, however, his counsel indicated in the course of the hearing that grounds 21 to 23 inclusively were not pressed (without alteration):

1.    The Tribunal erred in law in failing to apply the legal principles relevant to the interpretation of remedial or beneficial legislation, and specifically failing to apply those principles in its interpretation of IPP’s 11 (1) (a) and 11 (d).

2.    The Tribunal ought to have applied the legal principles relevant to the interpretation of remedial or beneficial legislation and interpreted IPP’s 11 (1) (a) and 11 (d) liberally and in a way that would promote the purpose and objects of the Privacy Act 1988, construed so as to give the fullest relief which the fair meaning of its language will allow.

3.    The Tribunal erred in law in failing to apply the contextual approach to interpretation in interpreting the phrase “usually passed on” in IPP 11 (1) (a), and in failing to consider, or properly consider, what the individual concerned was “reasonably likely to have been aware” was usually passed on.

4.    The Tribunal ought to have applied the contextual approach to interpretation and found that what was “usually passed on” was only relevant to what the individual concerned was “reasonably likely to have been aware” was usually passed on: the emphasis being on the knowledge or awareness of the individual concerned.

5.    The Tribunal erred in law in its interpretation of IPP 11 (1) (a) in determining, finding or holding that:

(a)    there are different “kinds” of personal information for the purposes of the operation of IPP 11.1 (a);

(b)    the first step in determining the operation of IPP 11.1 (a) is to consider what kind of information is that information;

(c)    personal information could be categorised (other than the existing categories within the Privacy Act 1988) with different levels of protective measures applying according to their nature;

(d)    IPP 11 (1) (a) requires an initial categorisation of personal information; and

(e)    the Tribunal’s interpretation of IPP 11 (1) (a), insofar as it related to the categorisation of personal information, was consistent with clause 3 (a) of the OECD Guidelines; and

(f)    the OECD Guidelines could be referred to and relied upon even when there was no ambiguity in IPP 11 (1) (a) that would make the reference to them permissible in the interpretation of IPP 11 (1) (a).

6.    The Tribunal should have found that:

(a)    personal information was not to be categorised for the purposes of determining the operations of IPP 11;

(b)    the only categorisation of personal information permissible was that already made by the Privacy Act 1988, that being between personal information and the subcategory of sensitive information;

(c)    all personal information was to be treated in the same way for the purposes of the operation of IPP 11.1 (a), and in particular in relation to what the “individual concerned is likely to have been aware”;

(d)    that clause 3 (a) of the OECD Guidelines was not relevant to the interpretation of IPP 11.1 (a)

7.    The Tribunal erred in its interpretation of IPP 11 (1) (a) in:

(a)    determining the meaning operation and scope of the phrase “usually passed on”; and

(b)    considering DVA’s responsibilities or potential responsibilities under the OHS Act and/or the DFD Act.

8.    The Tribunal ought to have found in interpreting IPP 11 (1) (a) that the relevant consideration was what the “individual concerned is reasonably likely to have been aware” would usually be passed on, and to whom.

9.    The Tribunal erred in:

(a)    finding when one Commonwealth Agency comes to a view that an employee of another may be committing offences, it is normal or usual practice to tell the employee’s employing agency; and

(b)    that there was a proper foundation and/or evidence supporting the making of this finding.

10.    The Tribunal ought to have found that:

(a)    there was no evidence that when one Commonwealth Agency comes to a view that an employee of another may be committing offences, it is normal or usual practice to tell the employee’s employing agency; and

(b)    there was no evidence or objective fact that would lead to the conclusion that the person concerned would be reasonably likely to have been aware that information of the nature the subject of the disclosures would be passed to his employee.

11.    The Tribunal erred in in applying a different, and higher, standard of knowledge to the Applicant as a result of his level of education, experience and rank.

12.    The Tribunal ought to have found that what the Applicant was reasonably likely to have been aware could only be judged by objective matters arising from the actions of DVA, and accordingly there be a finding that for the purposes of APP 11 (1) (a), in the absence of evidence of such objective facts, the Applicant was not reasonably likely to be aware that the disclosures would be made.

13.    The Tribunal erred in finding that the personal information described in Disclosures 1 and 2 would usually be passed on to the Applicant’s medical practitioner and employer.

14.    The Tribunal ought to have found that there was no evidence that personal information contained in Disclosures 1 and 2 would usually be passed on to the Applicant’s medical practitioner and employer, and therefore the Applicant could not be reasonably likely to have been aware that the personal information contained in Disclosures 1 and 2 would usually be so passed.

15.    The Tribunal erred in finding that the Applicant would be reasonably likely to have been aware that the personal information described as Disclosure 3 would usually be passed to the Australian Defence Force or the Chief of the Air Force.

16.    The Tribunal ought to have found that in the absence of evidence that the personal information described as Disclosure 3 would usually be passed on to the Australian Defence Force or the Chief of the Air Force, that the Applicant could not be reasonably likely to have been aware that the personal information contained in Disclosure 3 would be passed on to the Australian Defence Force or the Chief of the Air Force.

17.    The Tribunal erred in finding that the provisions of the OHS Act; and/or the provisions of the DFD Act were relevant factors in consideration of the relevance and operation of IPP 11.1(a).

18.    The Tribunal ought to have found that the provisions of the OHS Act and/or the DFD Act were only relevant to the interpretation and operation of IPP11.1(a) if the Applicant was reasonably likely to have been aware that the provisions of those Acts might require the DVA to pass the kind of personal information contained in Disclosures 1, 2 and/or 3, to the recipients of Disclosures 1, 2 and/or 3, and that the DVA usually passed this type of information to the recipients of Disclosures 1, 2 or 3.

19.    The Tribunal erred in finding that the operation of the OHS Act and the DFD Act constituted a requirement and/or authorisation by or under law for the purpose of IPP 11.1(d).

20.    The Tribunal ought to have found that:

(a)    there was no provision in the OHS Act and the DFD Act that made it a requirement and/or authorisation by or under law for DVA to make Disclosures 1, 2 and/or 3, and therefore that DVA was not entitled to rely on the exemption under IPP 11 (1) (d); and

(b)    There was no evidence that DVA made the disclosures to comply with any obligations it may have considered it had under either the OHS Act or the DFD Act.

21.    The Tribunal erred in finding or concluding, and relying on those findings or conclusions, that the Applicant was quick to complain to a third party and exhibited a tendency to return to problems, when those findings or conclusions were irrelevant in the interpretation of IPP 11 or in determining whether there had been a breach of IPP 11.

22.    The Tribunal erred in ignoring the IPP Guidelines in relation to the assessment of the conduct of DVA and in the interpretation of IPP 11 (1) (a) and (b).

23.    The Tribunal ought to have found that the IPP Guidelines were relevant in assessing the conduct of the DVA, and in assisting in the interpretation of IPP 11 (1) if an ambiguity was revealed.

The applicant’s submissions summarised

36    In his oral address, Mr Rivette (who appeared together with Mr Clarke for the applicant) identified what he described as the following four key issues in the appeal:

(a)    Whether the Privacy Act must be interpreted in a manner consistent with the principles of interpretation of remedial or beneficial legislation, the principles of contextual interpretation and recognising that the legislation is based on the Commonwealth’s commitment to its international obligations under Art 17 of the ICCPR and the OECD Guidelines.

(d)    Whether on its proper construction IPP 11.1(d), which requires that a disclosure be required or authorised by or under law, includes both express and implied requirements or authorisation.

(e)    Whether it was correct for the AAT in relation to IPP 11.1(a) to categorise personal information into sub-categories, or kinds of information, not recognised by the Privacy Act or OECD Guidelines, and in doing so create a two-step test that has the effect of allowing the creation of different categories of personal information that attract different levels of protection. Under the AAT’s approach, it looked at the nature of the information as the first step rather than first focusing on the knowledge of the individual.

(f)    Whether the AAT was correct to create different categories of individuals, who will have greater or lesser levels of protection under the Privacy Act based on their personal characteristics (such as education and employment status) in circumstances where the Privacy Act makes no such distinction, and treats all human individuals in the same manner.

37    The applicant’s submissions on these matters, which were very lengthy, may be summarised as follows.

Remedial legislation – Question 1, Grounds 1-2

38    The applicant submitted that, having correctly referred to Art 17 of the ICCPR (Reasons [238]), the OECD Guidelines (Reasons [237]), and the Preamble of the Privacy Act (Reasons [237]), the AAT then failed to apply the correct legal principles to the interpretation of IPP 11.1 (a) and (d), which allow disclosures to be made in limited instances.

39    Having regard to the character of the Privacy Act as human rights legislation which implements the Commonwealth’s international obligations in relation to privacy, the applicant submitted that it is remedial or beneficial legislation and should, as a matter of construction, be interpreted and applied liberally and in a way that will promote its purpose and objects. The applicant relied heavily on the High Court’s decision in Coco v The Queen [1994] HCA 15; 179 CLR 427 (Coco) at [10] in support of this approach.

40    The applicant submitted that the AAT failed to apply this approach in its construction and application of IPP 11.1(a) and (d).

Contextual interpretation – Question 2, Grounds 3-4

41    The applicant submitted that the proper approach to statutory construction was to commence with a consideration of the text, while having regard to context and purpose, citing SZTAL v Minister for Immigration and Border Protection [2017] HCA 34; 91 ALJR 936 (SZTAL) per Kiefel CJ, Nettle and Gordon JJ and Project Blue Sky Inc v Australian Broadcasting Authority [1998] HCA 28; 194 CLR 355 (Project Blue Sky) at [69]-[71].

42    The applicant acknowledged that the AAT correctly stated the relevant principles of construction but he submitted that it then failed to apply those principles to IPP 11.1(a) and (d) and, in particular, failed to apply a “contextual interpretation”. He submitted that the AAT failed to give effect to the “paramount importance” placed on the protection of privacy in determining any ambiguity in the Privacy Act or the IPPs. The applicant submitted that the AAT “strained” to find purpose in other legislation, such as the OHS Act, without addressing whether the Disclosures were necessary for DVA to fulfil its functions.

Categorisation of information – Question 2, Grounds 5-6

43    The applicant submitted that, in deciding whether any of the three Disclosures was permitted under IPP 11.1(a), the question the AAT was required to determine was whether AIT18 was “reasonably likely to have been aware ... that information of that kind is usually passed to that person, body or agency”.

44    The applicant submitted that, had the AAT applied the correct principles of interpretation, it would properly have placed emphasis on his knowledge or state of awareness. The issue of whether the applicant was “reasonably likely to have been aware” required DVA to “make a difficult judgment about what the person the information is about is reasonably likely to know.” This judgment must be made from an objective analysis of what has occurred and the steps the record-keeper has taken, and to do this before making the Disclosures. Had the decision been made that the applicant may not be reasonably likely to be aware, then it was in the power of DVA to directly inform him of the actions it might take if, for example, his behaviour continued, and therefore act in a way that preserved his privacy. Importantly, this would arm him with the information he needed to determine his future conduct, so the applicant submitted.

45    The applicant contended that, to address the issue of whether he was “reasonably likely to have been aware”, the AAT was also required to undertake an objective analysis of those matters that would have created an awareness in a reasonable person in the place of the applicant. The starting point for the AAT would properly have been a review of those actions of DVA as the collector and disseminator of the personal information which would indicate to a reasonable person in the applicant’s place that:

(a)    information may be passed to that person, body or agency; and

(b)    the information may be of the kind that was passed or proposed to be passed.

However, the AAT failed to do this, so contended the applicant.

46    The applicant submitted that the AAT’s reasoning involves the creation of different categories of personal information, which attracts different levels of protection. Thus, protection could range from information that would attract the full protection offered by the Privacy Act and the IPPs in contrast with some lesser category of information, such as the information in Disclosures 1, 2 and 3, which would have no protection at all against disclosure.

47    The applicant submitted that the Privacy Act recognises no categorisation of personal information, other than a subset of personal information (that being sensitive information, which attracts greater protection for the individual and creates more stringent obligations and restrictions on its collection, use and dissemination).

48    The applicant submitted that the AAT erroneously relied upon cl 3(a) of the OECD Guidelines (Reasons [242]–[243]), even though it failed to identify any ambiguity in the language of IPP 11.1(a) (Reasons [237]) and had not exhausted the application of the ordinary rules of interpretation before erroneously looking at this extrinsic material, contrary to Saeed v Minister for Immigration and Citizenship [2010] HCA 23; 241 CLR 252 (Saeed) at [33] per French CJ, Gummow, Hayne, Crennan and Kiefel JJ.

49    The applicant submitted that the AAT erroneously found that “IPP 11.1(a) has been drafted in light of cl 3(a) in that it requires an additional categorisation of personal information that has been passed by reference to its “kind” and a determination of whether it would usually be passed on” (Reasons [243]). He submitted that this finding was unsupported by authority.

“Usually passed on” – Questions 3-9, Grounds 7-18

50    The applicant submitted that, in construing the phrase “usually passed on”, the AAT correctly referred to guideline 22 of the Plain English Guidelines to Information Privacy Principles 8-11, which were published by the Information Commissioner (IPP Guidelines). He also agreed with the AAT’s view that an agency “usually passes on personal information to another body if it is the agency’s normal practice to disclose some or all of that type of information to that body” (Reasons [234]). The applicant contended that the AAT then failed to apply that approach and erroneously refused at Reasons [235] to look at the “regularity with which personal information is passed on to another body” in deciding what is “usually passed on”.

51    The applicant criticised the AAT’s use of an example of a search warrant in concluding at Reasons [235] that “what is customarily or ordinarily done if personal information is of a particular kind, can be what is customarily or ordinarily done with that kind of personal information even if personal information of that kind rarely comes into the custody of the record-keeper”. The applicant contended that the AAT erred in failing to focus on the individual’s state of knowledge, whether actual or implied, by using an objective analysis.

OHS Act and DFD Act – Question 9, Grounds 7, 17-18.

52    The applicant submitted that, in relation to the OHS Act and the DFD Act, there was no evidence before the AAT that DVA relied upon or used requirements under that legislation to pass on, let alone “usually pass on”, personal information to other parties or agencies.

53    The OHS obligations were internal to DVA and reasonably practicable steps could have been taken within DVA to discharge its duty without making the Disclosures (Reasons [297]). There was no evidence before the AAT which pointed to a process or usual practice whereby it was reasonably likely that a person would be aware that his or her personal information would be disclosed to other parties if there was a possible breach of the DFD Act. DVA’s evidence was that when dealing with a difficult client, staff would seek an Apprehended Violence Order or go to the police.

54    The applicant submitted that the AAT erred in concluding that its interpretation was consistent with the policy of the Privacy Act, in that it balanced the legitimate needs of an agency in acquiring personal information and the use made of it against the need to sustain personal privacy. However, the policy referred to by the AAT was in relation to the collection of information and not the disclosure of personal information to a third party, and is therefore irrelevant to the issue of whether the individual would be aware that information of that kind is usually passed on to that third party.

55    Finally, the AAT was said to be in error in finding that statutory responsibility under the OHS Act can authorise disclosure under IPP11.1(a) (Reasons [263]). Consideration of IPP 11.1 in totality makes clear that disclosure required or authorised by or under law is confined to IPP 11.1(d), and the enforcement of criminal law is confined to IPP 11.1(e). The applicant submitted that the AAT therefore erred in finding that the personal information in Disclosures 1 and 2 would usually be passed to his medical practitioner and employer.

56    With reference to Reasons [262], the applicant submitted that the AAT made a finding that, because of the relationship between DVA and the Department of Defence and to his clinical health care, it would be an ordinary and reasonable thing for an agency in the position of DVA to pass on the information to the Department of Defence. However, there was no evidence to support this finding, which the applicant said was “mere speculation”. In observing that “it would be the usual thing to do in the circumstances” the AAT revealed the nature of its own error, in applying its own standard of “concern for a fellow human being”, rather than objectively analysing what was done in practice by DVA, which the applicant contended was the requisite task.

Normal practice to notify employer of offence – Question 4, Grounds 9-10

57    The applicant submitted that the AAT committed the same error in relation to the DFD Act. There was no evidence before the AAT to suggest that DVA had turned its mind to whether the applicant was committing offences that required Disclosure 3 to be made. Rather, the AAT at Reasons [275] again speculated in finding that as a general proposition “when one Commonwealth agency comes to a view that an employee of another may be committing offences, it is normal or usual practice to tell that employee’s employing agency”. The applicant submitted that it was wrong of the AAT to make this finding and apply it to Disclosure 3 in the absence of direct evidence to support that proposition and, specifically, DVA’s usual practice.

58    The applicant submitted that the AAT relied upon a factual finding based upon the content and tone of his emails, noting that he was “quick to complain to a third party” (Reasons [253]) and “exhibited a tendency to return to problems” (Reasons [255]). Based upon this evidence, the AAT found that the response of DVA to be appropriate. Consideration of an individual’s mental state is a subjective inquiry and an irrelevant consideration under IPP 11.1(a), which is concerned with an objective assessment, so he submitted. The applicant submitted that consideration of his behaviour to assess the appropriateness of disclosure involved error, citing Craig v South Australia [1995] HCA 58; 184 CLR 163 (Craig) at [15].

59    The applicant submitted that the AAT consequently failed to make the appropriate inquiry into the kinds of practices and information that DVA would usually pass to the Chief of the Air Force, or any other agency. There was no evidence that such information was frequently passed on by DVA to the Department of Defence. Instead the AAT framed it in terms of the relationship between the agencies, which was contrary to evidence before both the Commissioner and the AAT (Reasons [262]).

Knowledge – Question 5, Grounds 11-12

60    In relation to the issue of knowledge, the AAT found at Reasons [277] that as the holder of an undergraduate degree, two Masters degrees and three graduate certificates, the applicant’s education and rank in the RAAF made it more likely that a person in his shoes would understand that information of the kind would be passed on to others. This finding was said to go to two aspects of the test under IPP 11.1(a):

(a)    the imputed knowledge of the applicant; and

(b)    his knowledge of the type of information that was actually passed in the three Disclosures.

61    The applicant acknowledged that the IPP Guidelines suggest that relationship, occupation and life experience are relevant considerations in determining the state of knowledge, however, he submitted that the AAT’s approach and the IPP Guidelines were erroneous, or alternatively, the manner in which this consideration was applied by the AAT was in error. He said that it was inconsistent with the objects of the Privacy Act and the general context of its provisions to create different categories of individuals.

62    The applicant submitted that the AAT erroneously applied subjective elements to what the term “reasonably” denotes as an objective test. The AAT’s error was said by the applicant to be that it applied a subjective test, based upon the applicant’s personal capacities, experience and education (Reasons [277]), as opposed to an objective standard, as required by IPP 11.1(a).

63    The applicant submitted that, in the absence of evidence of actions or conduct of the collector that would indicate to a learned individual that it could disseminate the information, the level of education of the individual must be irrelevant. That is to say education alone cannot be a determinative fact. The AAT’s approach not only allows the creation of different categories of personal information (as described above), but also creates different categories of individuals, who, perhaps subject to their education, will either have greater or lesser levels of protection under the Privacy Act. The Privacy Act makes no such distinction, and this finding is contrary to concepts of human rights and privacy for all human individuals that underpin the Privacy Act, and the general concepts of human autonomy and dignity, so submitted the applicant.

Required or authorised by or under law – Questions 10-12, Grounds 19-20

64    The applicant submitted that the AAT was correct to find that s 16 of the OHS Act did not expressly require or authorise DVA to make the Disclosures (Reasons [295]). Having decided this, however, the applicant submitted that the AAT should then have found that, in the absence of an express provision, the Disclosures were “not required or authorised by or under law” and made a finding that the exemption under IPP 11.1(d) did not apply to them.

65    The applicant submitted that the AAT erred in finding that, although the Disclosures were not expressly required or authorised by the OHS Act, the requirement or authorisation “could be implied” (Reasons [296]). The applicant submitted that this is contrary to authority concerning the interpretation of such words in other legislation, contrary to the correct principles of interpretation applicable to remedial or beneficial legislation, and contrary to the context and objects of the Privacy Act.

66    As to the phrase “required by law”, the applicant submitted that “required” meant “demands” or “necessitates” (citing Department of Premier and Cabinet v Hulls [1999] 3 VR 331 at [31]) and should not be construed as meaning “need”.

67    The applicant submitted that the use or disclosure of personal information is required only where there are express statutory requirements to report matters to agencies or enforcement bodies, or where legislation specifically requires an organisation to carry out some action, which of necessity involves particular uses or disclosures of personal information. The applicant cited Rahman v Ashpole [2007] FCA 1067 (Rahman), where Graham J held that disclosure of personal information by a bank to Centrelink was required or authorised by or under the provisions of the Social Security (Administration) Act 1999 (Cth). It is an offence under s 197(1) of that Act for a person to refuse or fail to comply with a requirement to give information or produce a document as required by ss 192 and 196 of that Act.

68    As to the phrase “authorised by or under law”, the applicant submitted that “authorised” permits a discretion as to whether the organisation will engage in an act or practice. He submitted that there must be a specific provision that allows a relevant discretion. A use or disclosure under 11.1(d) applies if the law requires or authorises a function or activity that clearly and directly entails the use or disclosure. He maintained that there is no reason to depart from the ordinary meaning of the term “authorised”, which has been found to be “to give someone the power or right to do something” or “to give permission for something”, and “sanction, approve, countenance and permit” or “authorise simply refers to the rule which permits the conduct which is otherwise not permitted.”

69    The applicant submitted that the AAT was wrong to rely upon Minister for Aboriginal Affairs v Peko-Wallsend Ltd [1986] HCA 40; 162 CLR 24 in support of its construction and findings on authorisation, because that case involved a different statutory scheme. He said that the AAT should have adopted an approach which acknowledged that the Privacy Act was remedial or beneficial legislation, citing Coco at [10].

70    The applicant submitted that by finding that a requirement or authorisation was to be implied, the AAT overrode his fundamental right and freedom which was protected by the Privacy Act. The AAT also erroneously relied upon the IPP Guidelines in Reasons [259].

Irrelevant considerations – Question 13, Ground 21

71    The applicant did not press question 13 and ground 21.

Application of IPP Guidelines – Question 14, Grounds 22-23

72    The applicant did not press these matters.

The submissions of dva and information commissioner summarised

73    Both DVA and the Information Commissioner provided detailed written outlines of their submissions. It is unnecessary to set them out in what already are lengthy reasons for judgment. The primary submissions are substantially reflected in the reasons given below for dismissing the appeal. We will also address below the role of the Information Commissioner in the appeal in determining the appropriate orders for costs.

Consideration and disposition of the appeal

(a) The proper approach to construction of the Privacy Act : Grounds 1-2

74    In view of the centrality to the applicant’s appeal of whether or not the AAT erred in its approach to the construction of remedial legislation such as the Privacy Act, it is desirable to address that issue immediately. For the reasons that follow, we are not satisfied that the applicant has established that the AAT adopted an erroneous approach.

75    As noted above, the applicant relied heavily on Coco in support of his challenge to the AAT’s reasoning and findings concerning both IPP 11.1(a) and (d). In particular, he contended that the following passage from Coco at [10] is critical and describes the approach which the AAT should have taken in construing those IPPs (footnote omitted):

10.    The insistence on express authorization of an abrogation or curtailment of a fundamental right, freedom or immunity must be understood as a requirement for some manifestation or indication that the legislature has not only directed its attention to the question of the abrogation or curtailment of such basic rights, freedoms or immunities but has also determined upon abrogation or curtailment of them. The courts should not impute to the legislature an intention to interfere with fundamental rights. Such an intention must be clearly manifested by unmistakable and unambiguous language. General words will rarely be sufficient for that purpose if they do not specifically deal with the question because, in the context in which they appear, they will often be ambiguous on the aspect of interference with fundamental rights (See Chu Kheng Lim v. Minister for Immigration (1992) 176 CLR 1 at 12 per Mason CJ).

76    It is well established that remedial or beneficial legislation should be accorded a “fair, large and liberal interpretation”, as opposed to one which is literal or technical (see, for example, IW v City of Perth [1997] HCA 30; 191 CLR 1 at 12). But the matter is more nuanced than is suggested by either that general proposition or the applicant.

77    Subsequent caselaw has properly emphasised the need for caution in applying this canon of construction. For example, in New South Wales Aboriginal Land Council v Minister Administering The Crown Lands Act [2016] HCA 50; 260 CLR 232 the High Court emphasised the importance of understanding the particular issue to which the task of statutory construction relates in any individual case. Their Honours drew a distinction between a situation where a Court is asked to construe a statute where there are choices available in the statute’s construction, in which case the choice can be guided by taking a broader approach on the basis of the beneficial purpose of the statute, as opposed to a case where the exercise of statutory construction is focused on the meaning of specific words. Importantly, the High Court said at [32] and [33] (footnotes omitted):

32.    It has been said that remedial or beneficial legislation should be accorded a “fair, large and liberal interpretation”, rather than one which is literal or technical. At issue in R v Kearney; Ex parte Jurlama was whether a claim could be made under the Aboriginal Land Rights (Northern Territory) Act 1976 (Cth) with respect to land which could only acquire the necessary character of being “traditionally owned” by reference to land which lay outside that which was available to be claimed. Gibbs CJ (with whom Brennan, Deane and Dawson JJ agreed) said:

If the section is ambiguous it should in my opinion be given a broad construction, so as to effectuate the beneficial purpose which it is intended to serve.

The statute in that case left the question open and provided the Court with choices in its approach to the statute's construction. In such a circumstance the Court was clearly justified in adopting a broader approach on the basis of the beneficial purpose of the statute.

33.    That is not the situation which arises with respect to s 36(1) of the ALR Act, where it is the meaning of particular words which is in question. In Victims Compensation Fund Corporation v Brown it was pointed out that to commence the process of construction by posing the type of construction to be afforded – liberal, broad or narrow – may obscure the essential question regarding the meaning of the words used. It is one thing to say that no restricted construction should be given to legislation which confers benefits; but if the focus is on the meaning of specific words, the circumstance for a liberal application may not arise.

78    Observations to similar effect had previously been made by Hayne, Heydon, Crennan and Kiefel JJ in Minister Administering The Crown Lands Act v NSW Aboriginal Land Council [2008] HCA 48; 237 CLR 285 at [47]-[48]. These observations are directly applicable in the circumstances here where the Court is required to construe the meaning of specific words in IPP 11.1(a) and (d).

79    There are additional reasons for caution in applying the statements of principle in Coco at [10] to the different circumstances here. At the heart of that case was a statutory provision which provided, in effect, an immunity from the offence of using a listening device to record or listen to a private conversation (s 43(1) of the Invasion of Privacy Act 1971 (Qld)). The immunity was given to a member of the police force acting in the performance of his or her duty if the member “has been authorised in writing to use a listening device” by various specified persons and subject to an overriding approval by a Judge of the Supreme Court (s 43(2)(c)).

80    The issue was whether s 43(2)(c) of that Act conferred authority on a Supreme Court Judge to authorise entry onto premises to install and maintain a listening device in circumstances where that entry would otherwise constitute an unlawful trespass. At [8], the High Court plurality (Mason CJ, Brennan, Gaudron and McHugh JJ) described the right of a person in possession of premises to exclude others from the premises as “a fundamental common law right”. Their Honours then added, with reference to caselaw, that statutory authority to engage in what otherwise would be tortious conduct “must be clearly expressed in unmistakable and unambiguous language”.

81    It is in that context that the plurality in Coco then stated the general principles at [10] which are set out at [75] above.

82    It may be accepted that the Privacy Act is remedial or beneficial legislation and should, in general, be construed liberally but with close attention to the relevant statutory terms which require interpretation. We reject the applicant’s submission, however, that the statutory context and relevant circumstances here are similar to those in Coco. That is for the following reasons.

83    First, as the applicant’s counsel acknowledged in oral address, there is no common law right to privacy in Australia.

84    Secondly, the personal information which is the subject of these proceedings was not obtained or collected by DVA in circumstances which otherwise would have constituted a trespass or given rise to some other cause of action in tort.

85    Thirdly, the Privacy Act itself reflects the Parliament’s concern to recognise and protect individual privacy within the framework of a complex statutory regime. It does so by a series of statutory provisions which protect the privacy of individuals from unlawful or arbitrary interference but also by specifying circumstances (or “exceptions”) which reflect the Parliament’s concern to strike an appropriate balance between competing community interests. We accept the Information Commissioner’s submission that, in those circumstances, the exceptions should be interpreted carefully so as to preserve the balance which the legislation strikes between the competing community interests, noting also the relevance of the fact that Art 17(1) ICCPR is not expressed in unqualified terms. It does not confer an absolute “right to privacy”, but rather creates a right not to be subjected to arbitrary or unlawful interference with one’s privacy. The exceptions in the Privacy Act reflect the Parliament’s identification of circumstances in which interference with a person’s privacy is not arbitrary or unlawful.

86    In our respectful view, further helpful guidance as to the correct approach in construing IPP 11.1(a) and (d) is reflected in the following observations of Burchett J in Commonwealth of Australia v Human Rights and Equal Opportunity Commission [1998] FCA 3; 76 FCR 513 (HREOC Case) at 520 to 521 in respect of the proper construction of disability discrimination legislation (emphasis in original):

The Commissioner and the judge at first instance sought support for narrow readings of the exemption contained in s 15(4) in the rule that remedial legislation should be liberally construed, a rule which does apply to human rights legislation and reinforces the statutory objects “to eliminate, as far as possible, discrimination” in the respects mentioned in s 3 of the Disability Discrimination Act: IW v City of Perth (1997) 71 ALJR 943; 146 ALR 696 at 948; 702; Waters v Public Transport Corporation (1991) 173 CLR 349 at 359, 394; and see s 15AA(1) of the Acts Interpretation Act 1901 (Cth). But such a rule, as Cardozo J pointed out in Burnet, Commissioner of Internal Revenue v Guggenheim (1933) 288 US 280 at 286, must be applied with a watchful eye. Sometimes the construction which is liberal to one person may be illiberal to others. Where remedial legislation contains exemptions designed to strike a careful and practical balance between competing community interests, a Court which distorts that balance in the name of furthering the remedy risks usurping a political role, and in doing so, frustrating the will of Parliament. The Disability Discrimination Act was intended to relieve the deprivation and humiliation that too often accompany misfortune, but not at the cost of creating further misfortune. A line was drawn at s 15(4) to protect, at least, employers and fellow employees who might be affected by a disabled person’s inability to carry out the inherent requirements of an employment. The legislative choice as regards where that line was to be drawn must be respected: cf Arnold v Queensland (1987) 6 AAR 463; 73 ALR 607 at 464; 608, 481-483; 626-627.

87    A similar approach was adopted by Sackville J in Taciak v Commissioner of Australian Federal Police [1995] FCA 650; 59 FCR 285 (Taciak) at 299 when his Honour made the following obiter remarks concerning the proper construction of Telecommunications (Interception) Act 1979 (Cth) which established statutory safeguards which were designed to ensure that intercept information could be used only for specified permitted purposes:

The recognition and protection of privacy in the Interception Act, in my view, justifies a restrictive approach to the construction of the statutory exceptions to the prohibitions on the interception of telecommunications and on the use of lawfully obtained intercept information. There is room for argument as to whether the principle of construction articulated in Coco v The Queen should be applied, with all its rigour, to the definition of "permitted purpose" in the Interception Act. But where there is genuine doubt as to whether the statutory language authorises the use of intercept information for a particular purpose, that doubt should be resolved in favour of a narrow, rather than a broad construction of the statutory authorisation. It is perhaps unnecessary to add that, should a policy judgment be made that the ability to use intercept information for appointments or reappointments to the AFP outweigh the value of privacy, it is open to Parliament to amend the legislation to give effect to that judgment.

88    It may be accepted that, as a statement of general principle, legislation such as the Privacy Act should, as far as the statutory language permits, be construed so as to give effect to Australia’s international obligations (see, for example, NBGM v Minister for Immigration and Multicultural Affairs [2006] HCA 54; 231 CLR 52 at [61] per Callinan, Heydon and Crennan JJ and Minister for Immigration and Multicultural and Indigenous Affairs v QAAH of 2004 [2006] HCA 53; 231 CLR 1 at [34] per Gummow ACJ, Callinan, Heydon and Crennan JJ). But the words of qualification which are set out immediately above are critical.

89    As will shortly emerge with reference to each of the remaining grounds of appeal which are pressed by the applicant, we do not consider that the AAT erred in its construction of any of the relevant provisions of the Privacy Act. For the reasons given above, we reject grounds 1 and 2, which relate specifically to the correctness of the AAT’s approach to statutory construction. In particular, the AAT did not err when it stated in the Reasons at [287] that the exceptions in the IPPs “should be given their ordinary meaning and neither read restrictively nor expansively”. The legislation itself reflects the Parliament’s balancing of competing interests. The AAT also correctly noted that the legislation did not confer a right to privacy as such.

90    It is true that the AAT did not descend into a more detailed analysis of caselaw of the kind set out above concerning the construction of remedial or beneficial legislation. The applicant has not demonstrated, however, that the AAT erred by not applying the approach in Coco. Incidentally, it is notable that the AAT made no express reference to Coco in its reasons for decision. It is unclear whether or not the AAT’s attention was drawn to that case. In any event, for the reasons given above, Coco is distinguishable.

91    We turn now to consider each of the more specific grounds of appeal while noting that some of them overlap with grounds 1 and 2. It is convenient to group some of the grounds more broadly than in the section of the reasons for judgment above in which the applicant’s submissions are summarised. It is also convenient to deal separately with the grounds of appeal relating to IPP 11.1(a) from those relating to IPP 11.1(d).

(b) IPP 11.1(a): Grounds 3-10 and 11-18

(i) Contextual interpretation (Grounds 3-4)

92    The applicant’s contention that the AAT erred in failing properly to consider “the paramount importance placed on the protection of the individual’s privacy by the provisions of the Act” must be rejected. While accepting the remedial character of the Privacy Act, it is wrong to suggest that the legislation gives “paramount importance” to protecting the individual’s privacy. Rather, as emphasised above, the legislation strikes a balance, as drawn by the Parliament, between protecting privacy and authorising conduct in the broader community interest as exceptions to protection of individual interests.

93    Insofar as the applicant’s complaint that the AAT failed to apply a contextual approach relates to the AAT’s construction of the phrases in IPP 11.1(a) concerning whether information is “usually passed on” and the individual’s awareness of that matter, this is addressed under sub-headings (iii) and (iv) respectively below.

(ii) Characterisation of the “kind” of information disclosed (Grounds 5-6)

94    Contrary to the applicant’s submission, we do not consider that the AAT erred in first characterising the “kind” of information that was disclosed by DVA and then considering whether information of that kind was usually passed on to the entities to which it was passed. This approach is supported by the text of IPP 11.1(a), which directs attention to the question whether the complainant (i.e. “the individual concerned”) is reasonably likely to have been aware, or has been made aware under IPP 2, that “information of that kind” (being information of the kind that was actually disclosed), is usually passed on to that other entity.

95    The chapeau to IPP 11.1 makes express reference to “personal information” which is in the possession or control of a record-keeper and prohibits the record-keeper from disclosing that information to anyone other than the individual to whom the personal information relates unless one of the exceptions applies. One of those exceptions is that which is contained in IPP 11.1(a). That exception operates by reference to whether the individual concerned is reasonably likely to have been aware, or made aware under IPP 2, that information of the kind is usually passed to that other person or entity. It makes obvious sense to first identify and determine whether the relevant information is information of the “kind”, before focusing upon the individual’s state of awareness. That is the approach which was taken by the AAT and the applicant has failed to demonstrate that it was wrong. The applicant’s submission that it is impermissible to categorise personal information other than into existing categories recognised by the Privacy Act (that being personal information and the subcategory of sensitive information) is at odds with the clear words of IPP 11.1(a), which requires a determination of whether information is of the “kind” which is usually passed to those to whom the disclosure was made.

96    The AAT did not err when it gave the ordinary meaning to the word “usually” in IPP 11.1(a) as meaning the kind of personal information that would customarily or ordinarily be passed on and that this test may be satisfied even if personal information of that kind only rarely comes into the custody of the record-keeper.

97    It is difficult to understand the applicant’s criticism of the AAT for referring to cl 3(a) of the OECD Guidelines in its construction of IPP 11.1(a). As the AAT stated in Reasons [237], both the ICCPR and the OECD Guidelines are referred to in the Preamble to the Privacy Act. Accordingly, those materials form part of the context within which the legislation is to be construed. That is the case even if there is no ambiguity in the legislation. As Brennan CJ, Dawson, Toohey and Gummow JJ stated in CIC Insurance Ltd v Bankstown Football Club Ltd [1997] HCA 2; 187 CLR 384 at 408, the modern approach to statutory interpretation “insists that the context be considered in the first instance, not merely at some later stage when ambiguity might be thought to arise”. The applicant’s reliance on Saeed at [33] is misconceived. That passage addresses a different issue and, in any event, their Honours made clear in [34] that extrinsic materials may be relied upon to ascertain the context within which a particular provision was enacted.

98    The applicant seizes upon the fact that in Reasons [237] the AAT stated that it was at liberty to have regard to those materials “to resolve any ambiguity I find”, citing Yager v The Queen [1977] HCA 10; 139 CLR 28 at 43-44 per Mason J (with whom Stephen J agreed).

99    Despite the AAT’s express reference to the term “ambiguity” in Reasons [237], it is evident from surrounding paragraphs in the Reasons that the AAT was addressing the tension which it found between the legitimate use which could be made of personal information and the objective of protecting personal privacy. That is made clear in Reasons [238].

100    It is in the context of resolving that identified tension that the AAT referred inter alia to cl 3 of the OECD Guidelines. That particular provision is set out in Reasons [242]. In defining the scope of the OECD Guidelines, cl 3(a) provides that the Guidelines should not be interpreted as preventing “the application, to different categories of personal data, of different protective measures depending upon their nature and the context in which they are collected, stored, processed or disseminated”.

101    The AAT described cl 3(a) of the OECD Guidelines as being consistent with a construction of IPP 11.1(a) which requires “an initial categorisation” of personal information that has been passed by reference to its “kind” and a determination as to whether it “would usually be passed on”. In particular, the AAT found that there is nothing in cl 3(a) (and the OECD Guidelines more generally) which suggests that categorisation of personal information is limited to that which is “regularly passed on”, as opposed to what is “customarily or ordinarily passed on”, whether that event occurs frequently or infrequently. The AAT did not fall into appealable error in referring to the OECD Guidelines in this way. The OECD Guidelines formed part of the relevant historical context, as is made explicitly clear in the Preamble to the Privacy Act.

(iii) Whether information of that kind is “usually” passed on (Grounds 7-10, 13-14, 16)

102    The applicant challenges the AAT’s conclusion that the term “usually” means “ordinarily” or “normally”, and not “frequently”.

103    As noted above, no error has been established in the AAT’s view that the term “usually” should be given its ordinary meaning and that this means “customarily” or “ordinarily”. This conclusion was supported by dictionary definitions which are set out in Reasons [233], the provisions as a whole, and the purpose of the Privacy Act as informed by relevant extrinsic materials which are referred to in the Preamble. We accept the submission by DVA that the AAT’s preferred construction better accords with the objects of the legislation and strikes an appropriate balance between protecting individual privacy while allowing the business of government to continue by creating exceptions which reflect broader community interests.

104    As is made clear in Reasons [236], the AAT plainly appreciated that even if this preferred construction was given to the phrase “usually passed to”, this would not have the effect of giving an unduly wide construction to IPP 11.1(a), because its operation also turned on a second step, namely that the individual concerned is reasonably likely to have been aware that information of that kind is usually passed on.

105    The AAT added that relevant evidence bearing upon this matter may relate to considerations such as the ways in which an individual could have become aware that information of that kind is usually passed on or might relate to the particular knowledge possessed by the relevant individual. It was not incorrect of the AAT to note at the end of Reasons [236] that it may be more difficult to satisfy this second step if the case involved personal information of a kind that is passed to another person or entity only occasionally.

106    We read the relevant parts of the AAT’s reasons for decision, including its references to and reliance upon extrinsic materials in Reasons [237], as justifying a construction of IPP 11.1(a) which permits some flexibility in categorising personal information so as to give effect to the balance which is struck between protecting individual privacy and not preventing disclosure as authorised by the exceptions.

107    The AAT’s construction is supported not only by considerations of text, context and purpose, but also by common sense. That includes the fact that some kinds of information will be regularly or routinely collected by agencies and frequently passed on. But there will be other kinds of personal information which only comes into an agency’s possession occasionally or rarely but that information may still customarily or ordinarily be passed on.

108    We reject the applicant’s submission that there was no evidence to support the AAT’s finding that disclosure of the information in Disclosures 1, 2 and 3 was customary or ordinary practice. As the AAT stated at Reasons [262], after noting the relationship between DVA and the Department of Defence and the ADF’s role in the applicant’s clinical healthcare, it would be “a normal or ordinary thing for a Commonwealth agency in the position of DVA to pass information to those engaged in, or responsible for, [the applicant’s] medical care and treatment”. This finding was reasonably open to be made by reference to that relationship and the ADF’s role.

109    No further evidence was required to support the AAT’s finding that the first two Disclosures were of information of a kind that is usually passed on to a person such as the ADF Senior Medical Officer and the Head of Joint Health Command in the Department of Defence.

110    Nor did the AAT err in finding at Reasons [263] that these disclosures were a necessary part of a process that enabled DVA to fulfil its statutory responsibilities under s 16 of the OHS Act and that, accordingly, the Disclosures involved information of a kind that is usually passed on to the persons who received that information here. There was ample evidence to support the AAT’s findings with regard to s 16 of the OHS Act, not the least being the multiple communications emanating from the applicant which gave rise to concerns about the health and safety of DVA employees (as well as the applicant himself).

111    No appealable error has been demonstrated in the AAT’s reasoning to the effect that, putting s 16 of the OHS Act to one side, and focusing upon the information which was the subject of Disclosures 1 and 2 by reference to a concern regarding the applicant’s own healthcare, it was usual for an agency such as DVA who had such concerns to convey them to the Department of Defence as the body with responsibility for the applicant’s wellbeing and healthcare. The AAT’s finding was sufficiently supported by the materials to which it referred, namely:

(a)    the relationship between DVA and the Department of Defence;

(b)    the uncontested fact that the ADF was providing the applicant’s clinical healthcare; and

(c)    the ordinary concern for another fellow human being by relevant personnel within DVA which suggested that, in the circumstances of this case, it was usual to pass on information of the relevant kind as an aspect of ordinary common sense and experience.

112    As to Disclosure 3, we consider that it was also reasonably open to the AAT to find that it was usual for an entity, such as DVA, which had good reason to believe that a member of the ADF was behaving irresponsibly, and possibly criminally, to draw the attention of the Chief of Air Force to that conduct. The applicant’s multiple emails and other communications provided ample justification for a concern that he may have contravened s 60 of the DFD Act. Having regard to the content of the applicant’s communications, a sample of which is summarised in [20]-[26] above, it was well open to the AAT to conclude at Reasons [265] and [266] that it was reasonable for DVA to consider that the applicant was bringing discredit on the ADF within the meaning of s 60 of the DFD Act and so possibly committing an offence. The AAT made express reference to some of those communications in Reasons [273]. No further evidence was required to support the AAT’s finding that Disclosure 3 related to information of a kind that is usually passed on to a person such as the Chief of Air Force.

113    At Reasons [275], the AAT stated that it was appropriate for a Commonwealth agency to tell another agency that an employee of the latter agency may be committing an offence as long as there were sound reasons for coming to the view that the person may have engaged in criminal conduct. No appealable error has been established in respect of the AAT’s reasoning in relation to this aspect of Disclosure 3.

114    The applicant was critical of the fact that the AAT took into account his own evidence on these matters in circumstances where there was, for example, no evidence before DVA concerning his level of education. This criticism fundamentally misconceives the nature of the AAT’s review under s 96(1)(c) of the Privacy Act. In determining what was the correct or preferable decision, the AAT was not confined to the material which was before DVA. The AAT was entitled to take into account the material which was before it in discharging its statutory review function. The applicant’s misconception is evident, for example, in [48] and [49] of his written reply submissions.

(iv) What the individual concerned is “reasonably likely to have been aware” of (Grounds 11-12, 14-18)

115    We reject the applicant’s contention that the AAT erred, in applying IPP 11.1(a) with reference to the applicant’s subjective knowledge, education and other personal characteristics. As noted above, the applicant’s contention was that the AAT was required to apply an objective standard.

116    The applicant’s position is inconsistent with the plain text of IPP 11.1(a), which explicitly focuses upon what “the individual concerned” is reasonably likely to be aware of. In the circumstances of this particular case, this can only be a reference to the applicant himself. This exception turns on what the applicant was reasonably likely to be aware of and not what a hypothetical reasonable person was likely to be aware of. The relevant circumstances include the particular characteristics of the individual concerned insofar as they were known to DVA.

117    As to the meaning of the phrase “reasonably likely” in the context of this exception, the AAT correctly appreciated that this required a judgment “as to whether it is reasonable, as distinct from something that is irrational, absurd or ridiculous” to expect that the applicant would probably have been aware that the relevant information is usually passed on. The applicant did not contend that the AAT fell into error in the meaning it gave to the phrase “reasonably likely”. Rather, he challenged the matters which the AAT took into account in concluding at Reasons [277] that it was reasonably likely that a person in the applicant’s circumstances would have been aware that DVA would pass on the information in the Disclosures and to the persons to whom that information was passed.

118    In our view, the AAT did not err in taking into account the applicant’s education, background, experience and own behaviour in concluding that a person in his position would be reasonably likely to be aware that it was usual (in the relevant sense) for information of the kind contained in the Disclosures here to be passed on to the people to whom the Disclosures were made in the particular circumstances here. Not only were those findings consistent with common sense, they were amply supported by the evidence before the AAT. This included material in the affidavit dated 23 April 2015 of Ms Jennifer Collins, as well as other evidence before the AAT concerning the applicant’s personal qualifications and characteristics, including the applicant’s own evidence on these matters. It was open to the AAT to draw reasonable inferences from these matters, which it did.

119    We further reject the applicant’s claim that OHS Act and DFD Act are only relevant if the applicant was reasonably likely to have been aware that provisions in those Acts might require DVA to make the Disclosures. As stated at [110] and [112] and above, the AAT did not err in finding that the OHS Act and DFD Act were relevant to determining whether information of the kind was “usually” disclosed to the relevant recipient. On the proper construction of IPP 11.1(a), that exception is satisfied if the applicant is reasonably likely to have been aware that, in the ordinary course of events, information of that kind is usually disclosed to the relevant recipient. There is no additional requirement that the applicant be reasonably likely to have been aware of specific statutory provisions.

120    We accept DVA’s submission that the AAT’s approach was correct. In substance, this involved taking into account the relevant personal characteristics of the individual concerned which were known to the decision-maker and then asking what that individual, as a matter of reason and awareness, was reasonably likely to have been aware of or had been made aware of by operation of IPP 2.

121    For these reasons, as well as those stated at [108]-[109] and [112] above, we reject the applicant’s submission that the AAT should have found that there was no evidence that information contained in the Disclosures were usually passed to the relevant recipients of the information here.

(c) IPP 11.1(d): Grounds 19-20

122    The applicant’s challenges to the AAT’s approach and findings in respect of IPP 11.1(d) should also be rejected.

123    In particular, we reject his submission that this exception should be read narrowly so as to apply only to disclosures which are explicitly required or authorised by law. This construction is inconsistent with the text of the provision, which includes the phrase “by or under”. Such language indicates that there is scope for disclosures to be directly provided for by a law, as well as those which are done under a law.

124    Furthermore, the applicant’s preferred construction is not supported by his reliance on Coco or the principle of legality. That is because the exception contained in IPP 11.1(d) is an express carve-out from the general protection created by IPP 11.1. In addition, the exception in IPP 11.1(d) does not encroach upon an established common law right so as to attract the principle of legality. Rather, as emphasised above, it constitutes a statutory exception to a statutory right created by the Privacy Act itself.

125    It is also important not to lose sight of the fact that the Privacy Act has a breadth of operation which potentially covers a wide spectrum of laws. They include laws which, in their terms, require or authorise the production of records or the provision of information, such as compliance with a subpoena or other statutory requirements to provide information in response to a statutory notice, such as in ss 192 and 196 of the Social Security (Administration) Act 1999 (Cth), as considered in Rahman. But a requirement or authorisation to divulge personal information may also arise by necessary implication from a law that is directed to a purpose other than the disclosure of records or information.

126    The AAT found that s 16 of the OHS Act implicitly required or authorised disclosure. Its reasoning in Reasons [300], [301] and [308] is to the effect that it was necessary to draw such an implication in order to give effect to the statutory scheme of that legislation or, to put it another way, where the inability to disclose personal information would frustrate the operation of that scheme. An employer’s obligation under that provision involves a mandatory command that the employer take all reasonably practicable steps to protect the health and safety at work of the employer’s employees. As DVA pointed out, it is easy to imagine circumstances where such “reasonably practicable steps” would include the disclosure of personal information, including disclosing an employee’s allergies or food intolerances to the convenor of a course which the employee will attend as part of his or her work duties. Similarly, here, disclosure of the relevant information was a “reasonably practicable step” in protecting the health and safety of DVA’s employees as part of a process which involved advice being sought which would inform an appropriate assessment of the risk to those employees.

127    We reject the applicant’s submission that reliance on s 16 must take into account the availability of other measures which were available to DVA. That submission is inconsistent with the text of s 16, which imposes a statutory obligation on an employer to take all reasonably practicable steps.

128    We also reject the applicant’s submission that the AAT erred in its view that s 16 of the OHS Act authorised Disclosures 1 and 2 where there was a perceived risk of harm to DVA’s employees in circumstances where there is an express exception in IPP 11.1(c) which deals with disclosure being necessary “to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or of another person” (see [17] above). The applicant’s contention appeared to assume that the five exceptions in IPP 11.1 were mutually exclusive. We reject that submission. The exceptions could overlap. In any event, the circumstances which might require an employer to make a disclosure under s 16 of the OHS Act may go beyond the more limited circumstances which underpin the exception in IPP 11.1(c). For example, the obligation under s 16 may be enlivened even if there is a threat to the health of an employee notwithstanding that the employer may not believe on reasonable grounds that the disclosure is necessary to prevent or lessen “a serious and imminent threat” to the life or health of one of its employees.

129    We accept the submission of the Information Commissioner that the exception in IPP 11.1(d) does not extend to authorise any disclosure that is merely incidental, convenient or conducive to the fulfilment of some other statutory obligation. Such an approach would give rise to an unduly wide exception. The critical factor is the necessity of drawing the relevant implication in order to give effect to the statutory scheme or, alternatively, to avoid frustrating the statutory scheme.

Costs

130    The applicant has failed to establish any of the grounds of appeal. Of course, costs ordinarily follow the event but we do not consider that it is appropriate that the applicant has to pay the costs of both DVA and the Information Commissioner. DVA is the proper contradictor. The Information Commissioner determined that it was appropriate to make submissions, both in writing and orally, concerning inter alia the proper construction of relevant provisions of the Privacy Act and IPP 11.1(a) and (d). They included lengthy submissions concerning the proper construction of remedial or beneficial legislation, which was also addressed by DVA. We do not accept the Information Commissioner’s submission that his participation did not add significantly to the applicant’s costs. The Information Commissioner’s outline of written submissions totalled 15 pages and his oral address took up more time than that of DVA.

131    We acknowledge that the Information Commissioner was joined as a party in the AAT proceeding, as well as in the appeal. It was a matter for the Information Commissioner to decide what role he would play in the appeal, having regard to the well-known relevant observations in R v Australian Broadcasting Tribunal; Ex parte Hardiman [1980] HCA 13; 144 CLR 13. That does not mean, however, that the applicant should bear the costs of both respondents in the particular circumstances here. At a case management hearing on 26 April 2018, the Information Commissioner’s then counsel said that, while the Commissioner intended to make submissions which “may be generally more directed at matters for policy and procedure”, he did not “expect to take a more active role than the department…”. In fact, as noted above, the Information Commissioner took up as much, if not more, time in his submissions than did DVA. Furthermore, the Information Commissioner went beyond making submissions on “policy and procedure”. For example, he made detailed submissions on the proper construction of s 16 of the OHS Act.

132    In our respectful view, the Information Commissioner should bear his own costs, however, the applicant should pay DVA’s costs, as agreed or assessed.

Conclusion

133    For these reasons the appeal should be dismissed. The applicant must pay the second respondent’s costs, as agreed or assessed.

Associate:

Dated:    13 November 2018