FEDERAL COURT OF AUSTRALIA

Jones v Office of the Australian Information Commissioner [2014] FCA 285

THE COURT ORDERS THAT:

1.    The application is dismissed.

2.    The applicant pay the respondent’s costs of and incidental to the application.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

1    In these proceedings the applicant, Ms Jones, seeks an order of review under the provisions of the Administrative Decisions (Judicial Review) Act 1977 (Cth) (the “ADJR Act”) of a decision of the respondent (described in these reasons as the “Information Commissioner”) made on 21 December 2012 under s 41(1)(a) of the Privacy Act 1988 (Cth) (the “Act”) to cease further investigation of a complaint made by Ms Jones under s 36(1) of the Act.

2    In her complaint to the Information Commissioner, Ms Jones contended that Dr Trevor Lotz had engaged in an act of interference with her privacy in contravention of the Act, by disclosing her medical records to officers of the Queensland Police Service, in particular circumstances.

3    Ms Jones contends that the making of the Information Commissioner’s decision to cease further investigation of her complaint was an improper exercise of the power conferred under s 41(1)(a) of the Act for the purposes of s 5(1)(e) of the ADJR Act, and involved an error of law (s 5(1)(f) of the ADJR Act) in the construction of cl 2.1(h)(i) of the National Privacy Principles contained in Schedule 3 to the Act. In these proceedings, Ms Jones also contends that the Information Commissioner’s reasons do not suggest any consideration of cl 2.2 of the National Privacy Principles.

4    I will return to these matters shortly.

5    The relevant elements of the statutory regime are these.

6    Section 6 of the Privacy Act defines references to the “Commissioner” in that Act as references to the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010 (Cth) (the “AIC Act”). Sections 3 and 3A of the AIC Act provide that the Information Commissioner is the person appointed under s 14 of that Act as the Australian Information Commissioner.

7    Section 13A(1) of the Act provides, for the purposes of the Act, that an act or practice of an organisation is an interference with the privacy of an individual if, relevantly:

(b)    both of the following apply:

(i)    the act or practice breaches a National Privacy Principle in relation to personal information that relates to the individual;

(ii)    the organisation is not bound by an approved privacy code in relation to the personal information …

…

8    There is no issue in these proceedings concerning s 13A(1)(b)(ii).

9    An organisation has the meaning attributed to that term by s 6C of the Act (s 6(1)). Section 6C(1) provides that an organisation means (among other things):

(a)    an individual; …

that is not a small business operator …

10    Section 6D(4) provides that an individual is not a small business operator if he or she:

(b)    provides a health service to another individual and holds any health information except in an employee record; …

11    There is no issue in these proceedings that Dr Trevor Lotz was a person engaged in the provision of a “health service” having regard to the definition of that term in s 6 of the Act or that he held “health information” about Ms Jones having regard to the definition of that term in s 6 of the Act.

12    Section 6 of the Act defines a National Privacy Principle to mean a clause of Schedule 3 to the Act. Schedule 3 has the heading “National Privacy Principles” and contains 10 clauses each of which is a National Privacy Principle. Section 6A(1) provides, for the purposes of the Act, that “an act or practice breaches a National Privacy Principle if, and only if, it is contrary to, or inconsistent with, that National Privacy Principle”. Section 36(1) provides, subject to a qualification presently not relevant, that “an individual may complain to the [Information] Commissioner about an act or practice that may be an interference with the privacy of the individual”.

13    Section 40(1) provides, subject to a qualification not presently relevant, that the Information Commissioner shall investigate an act or practice if the act or practice may be an interference with the privacy of an individual and a complaint about the act or practice has been made under s 36 of the Act. After investigating a complaint, the Information Commissioner may make a determination under s 52 of the Act dismissing the complaint or may find the complaint substantiated and make a determination that includes one or more of the elements of redress contemplated by s 52 of the Act.

14    Section 41 of the Act, however, provides that the Commissioner:

(1)    … may decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under section 36, … if the Commissioner is satisfied that:

(a)    the act or practice is not an interference with the privacy of an individual …

                                [emphasis added]

15    Clause 2 of the National Privacy Principles is relevantly in these terms:

2    Use and disclosure

2.1    An organisation must not use or disclose personal information about an individual for a purpose (the secondary purpose) other than the primary purpose of collection unless:

…

(h)    the organisation reasonably believes that the use or disclosure is reasonably necessary for one or more of the following by or on behalf of an enforcement body:

(i)    the prevention, detection, investigation, prosecution or punishment of criminal offences, breaches of a law imposing a penalty or sanction or breaches of a prescribed law;

…

Note 1:    It is not intended to deter organisations from lawfully co-operating with agencies performing law enforcement functions in the performance of their functions.

Note 2:    Subclause 2.1 does not override any existing legal obligations not to disclose personal information. Nothing in subclause 2.1 requires an organisation to disclose personal information; an organisation is always entitled not to disclose personal information in the absence of a legal obligation to disclose it.

Note 3:    An organisation is also subject to the requirements of National Privacy Principle 9 if it transfers personal information to a person in a foreign country.

2.2    If an organisation uses or discloses personal information under paragraph 2.1(h), it must make a written note of the use or disclosure.

16    The conjunction of s 41(1)(a) of the Act and cl 2.1(h)(i) of the National Privacy Principles is that the Information Commissioner may decide (that is to say, exercise an administrative discretion) not to investigate further an act about which Ms Jones has made a s 36 complaint if the Information Commissioner is satisfied that Dr Lotz, in disclosing Ms Jones’s medical records in his possession, reasonably believed that the disclosure was reasonably necessary for the detection, investigation, prosecution or punishment of a criminal offence, breach of a law imposing a penalty or sanction, or breach of a prescribed law, by an enforcement body (in this case the Queensland Police Service).

17    The statute by s 41(1)(a) therefore confers an administrative discretion that operates upon the decision-maker’s state of satisfaction as to the reasonable belief of the disclosing organisation (in this case Dr Lotz) that disclosure is reasonably necessary for one of the stated activities of the enforcement body.

18    Ms Jones contends, in effect, that the state of satisfaction of the decision-maker must be reached “reasonably” on the material before the decision-maker as to the statutory factors of whether Dr Lotz held a reasonable belief at the relevant time that disclosure of Ms Jones’s medical records was reasonably necessary for, in this case, the investigation by the Queensland Police Service of the commission of a criminal offence by Ms Jones.

19    As to the s 41(1)(a) discretion, every statutory discretion, or discretionary power, is confined by the subject matter, scope and purpose of the legislation under which it is conferred (FAI Insurances Ltd v Winneke (1982) 151 CLR 342 at 368 per Mason J; Project Blue Sky Inc v Australian Broadcasting Authority (1998) 194 CLR 355) and every statutory discretion has to be exercised according to “the rules of reason” (R v Anderson; Ex parte Ipec-Air Pty Limited (1965) 113 CLR 177 at 189 per Kitto J; Minister for Immigration and Citizenship v Li (“Li”) [2013] HCA 18; 297 ALR 225; (2013) 87 ALJR 618 at [23] and [24] per French CJ). The rationality required by “the rules of reason” is an essential element in the lawfulness or legality of administrative decision-making (Li, per French CJ at [26]). The legislature is taken to intend that a discretionary power, statutorily conferred, will be exercised reasonably (Attorney-General (NSW) v Quin (1990) 170 CLR 1 at 36; Kruger v Commonwealth (1997) 190 CLR 1 at 36; Minister for Immigration and Citizenship v SZIAI [2009] HCA 39; 259 ALR 429; 83 ALJR 1123 at [15]; Li, per Hayne, Kiefel and Bell JJ at [63]).

20    The exercise of an administrative discretion by the Information Commissioner, not to further investigate a complaint, conditioned on the Information Commissioner’s state of satisfaction (that the complained of act is not an interference with the privacy of the individual on the footing that he or she is satisfied that a relevant organisation reasonably believed that disclosure was reasonably necessary for the investigation of a criminal offence by an enforcement body), requires the Information Commissioner to be satisfied, according to the rules of reason, that the “specific requirements” of the “express statutory conditions” are established by the material upon which he or she relies. A decision made that fails to reflect a state of satisfaction taking the express statutory conditions into account, according to the rules of reason, is beyond power because it “falls outside the framework of rationality provided by the statute” (Li, per French CJ at [26]).

21    Importantly, however, a requirement of legality in decision-making that a decision be reached according to the rules of reason or, put another way for present purposes, reached reasonably, or not unreasonably reached, is not a vehicle for challenging a decision made in contended error of law and beyond power simply because “disagreement” is found with the “evaluative judgment” of the administrative decision-maker. Challenging an administrative decision-maker’s reasoning as illogical or unreasonable may simply be an emphatic way of expressing disagreement with the decision or the merits, and such emphatic disagreement may have “no particular legal consequence” (Minister for Immigration and Multicultural Affairs v Eshetu (1999) 197 CLR 611 at [40] per Gleeson CJ and McHugh J).

22    Properly applied, a standard of legal reasonableness does not involve substituting a Court’s view as to how the discretion should be exercised for that of the decision-maker. Accepting then, that there are limits on the Court’s supervisory jurisdiction and that a “standard of reasonableness” is not applied as a mechanism for merits review (or a vehicle for the Court substituting its own view of the manner of exercise of the discretion), but rather a feature of legality in decision-making, leaves open the question of how the standard “is to be applied and how it is to be tested” (Li, per Hayne, Kiefel and Bell JJ at [66]).

23    The legal standard of reasonableness must be the standard indicated by the proper construction of the statute which identifies the express statutory conditions and specific requirements upon which the exercise of the discretion rests in determining whether the statutory power has been abused, as falling short of the statutory standard, as a matter of legality in decision-making (Li, per Hayne, Kiefel and Bell JJ at [67]). The legal standard of unreasonableness should not be considered as “limited to what is in effect an irrational, if not bizarre, decision – which is to say one that is so unreasonable that no reasonable person could have arrived at it” (Li, per Hayne, Kiefel and Bell JJ at [68]).

24    In some cases, an inference of unreasonableness may be objectively drawn even where a particular error in reasoning cannot be identified and in that sense the supervisory review of the exercise of an administrative discretion is to be approached in an analogous way to the principles governing the review of the exercise of a judicial discretion in terms of the well-known principles identified in House v The King (1936) 55 CLR 499. Unreasonableness will be demonstrated where “no sensible authority acting with due appreciation of its responsibilities” (Secretary of State for Education and Science v Tameside Metropolitan Borough Council [1977] AC 1014 per Lord Diplock at 1064) would have so decided. Lord Diplock’s observation reflects the requirement of the law that a decision-maker “understand his or her statutory powers and obligations” (Li, per Hayne, Kiefel and Bell JJ at [71]).

25    In this case, the decision-maker was required to understand the obligation to have proper regard to the express statutory conditions upon which the exercise of the discretion rested. The more specific errors in decision-making to which Courts often have regard in the exercise of jurisdiction under, for example, the ADJR Act and the jurisdiction conferred on the Court by the Judiciary Act 1903 (Cth) are ultimately all encompassed by the notion of unreasonableness, measured and applied according to a legal standard indicated by the “true construction of the statute”, in determining whether the statutory power has been abused (Li, per Hayne, Kiefel and Bell JJ at [67] and [72]). Unreasonableness is a conclusion which may be applied to a decision “which lacks an evident and intelligible justification” (Li, per Hayne, Kiefel and Bell JJ at [76]).

26    The question then is, what circumstances informed the Information Commissioner’s state of satisfaction as to the reasonable belief of Dr Lotz as to the reasonable necessity of disclosure for the contended cl 2.2(h)(i) activity by the Queensland Police Service?

27    On 11 November 2011, the Information Commissioner sent a letter to Ms Jones advising that her complaint would be investigated under the Act and on that day a request was made of Dr Lotz to produce particular documents and to answer particular questions put to him by the Information Commissioner.

28    References in these reasons to steps taken by the Information Commissioner include, of course, steps taken by the Information Commissioner’s delegate and by relevant officers acting on behalf of the Information Commissioner.

29    By letter dated 21 November 2011, Dr Lotz provided the Information Commissioner with a copy of a search warrant issued on 23 June 2011 by a Justice of the Peace on the application of Constable Page. The warrant recites that the Justice of the Peace is satisfied on the material in support of Constable Page’s application that “there are reasonable grounds for suspecting” that “warrant evidence or property” (defined as “Medical Records for Lynette Joyce Jones”) is at a place, namely, “Runaway Bay Doctors – Runaway Bay Shopping Village, Lae Drive, Runaway Bay”). The warrant recites that it is issued to obtain evidence of the commission of an offence. It is not necessary to recite the content of the contended offence in these reasons. It is sufficient for the purposes of these exposed reasons to identify that the contended offence engages conduct on the part of Ms Jones at a particular place on 5 March 2010.

30    The warrant recites that it authorises a police officer to enter the recited place and “exercise search warrant powers” at the place. Those powers are recited at paras (a) to (k) of the warrant. The powers include the power to search the relevant place for the medical records of Ms Jones (transposing the defined “details” of “warrant evidence or property” into para (c); the power to open anything in the relevant place that is locked (para (d)); the power to seize a thing found at the relevant place (para (h)); and the power to photograph anything the police officer reasonably suspects may provide details of Ms Jones’s medical records (para (j)).

31    The warrant contains an endorsement by Sergeant Zanco who executed the warrant that it was executed by him on Dr Trevor Lotz at 8.45am on 24 June 2011. Dr Lotz is described in the warrant endorsement as the “occupier of the place”.

32    The address recited in the warrant as “the place” at which Dr Lotz might have held medical records of Ms Jones is not the place from which Dr Lotz conducted his practice as a consultant psychiatrist. The place recited in the warrant is the premises of Ms Jones’s general medical practitioner (“GP”).

33    Dr Lotz’s letter to the Information Commissioner of 21 November 2011 also referred to enclosed “personal notes, WorkCover correspondence and emails to Ms Jones and Ms Jones’s solicitor as requested”. The affidavits in these proceedings contain three exchanges between Dr Lotz and Ms Jones’s solicitor, Mr Dorozario, on 15 July 2011, 1 August 2011 and 2 August 2011 ultimately leading to the Information Commissioner’s letter to Dr Lotz requesting documents and information on 11 November 2011.

34    In Dr Lotz’s letter dated 21 November 2011 in response, he tells the Information Commissioner this:

2.    I have fulfilled all the requirements of the Queensland Police Search Warrant, and gave copies of my notes to the Police Officer in charge as requested.

35    Dr Lotz tells the Information Commissioner that he has retained the “original notes” and holds a copy of the warrant. At Point 6 of the letter, Dr Lotz expresses the opinion that he held concerns that Ms Jones had developed a particular behavioural condition and at Point 7 he said this:

7.    I do believe I have complied with all reasonable requests by Ms Jones and her solicitor and that there is nothing further I have to add. I supplied copies of Ms Jones’s notes to the Queensland Police Service as requested in the search warrant.

36    By letter dated 9 February 2012, the Information Commissioner provided Ms Jones with a copy of Dr Lotz’s response of 21 November 2011. By a four page letter (plus enclosures) dated 14 March 2012, Ms Jones put further propositions to the Information Commissioner in light of Dr Lotz’s response.

37    In an email of 22 May 2012, the Information Commissioner sought further information from Dr Lotz. Dr Lotz responded by letter dated 1 June 2012. In that letter, Dr Lotz addresses and explains the circumstances and events surrounding the execution of the warrant and his disclosure of Ms Jones’s medical records to officers of the Queensland Police Service.

38    His letter is in these terms:

Attention: David Jordan

Merit Review and Investigations Officer

Compliance Section

Office of the Australian Information Commissioner

Dear Mr Jordan

RE [Ms Jones]

I am in receipt of your email dated 22nd May 2012 requesting clarification regarding a search warrant served on me on 24th June 2011, requesting copies of all my notes pertaining to Ms Lynette Jones.

Three uniformed Police Officers appeared in my surgery, pointed out the paragraph on page one of the warrant, demonstrating that they had the right to seize copies of the medical records of Ms Jones, and then pointed to my name on page two, declaring that I was this person and that they had the right to serve the warrant on me for those medical records.

The Police had the courtesy of telephoning me on 23 June 2011, advising me of their intentions in relation to the warrant to seize clinical records, and noting a time they expected to attend on me with the warrant. I was pleased to receive the phone call, as it would minimise the disruption to my busy patient appointment schedule, and minimise disruption to the waiting room of patients. My practice is a psychiatric practice, and the presence of 3 armed uniformed Police Officers in itself is intimidating and unsettling to many of my patients. The phone call from the Police also enabled me to prepare a response to the warrant, in the event the warrant was as described by Police, that is, directing me to hand over the records of Ms Jones.

It has only been brought to my attention since, that the address on the warrant was not the address of my rooms. My name appeared correctly on the warrant, so I expect the incorrect address was inadvertence, given the Police attended at my rooms on 24 June 2011.

In the spirit of the law, I therefore handed over the documents as requested by the Queensland Police Service. Later in the proceedings of the various complaints by Ms Lynette Jones, was it noted that the address was the address of the general practitioner. The OAIC can be assured that I am acutely aware of patient confidentiality and privacy issues, and if I considered the warrant was not as it purported to be, I would have sought clarifying legal advice, before handing over patient records to the Police. The warrant was directed to me, as a treating medical practitioner of Ms Jones, and I responded to the Police in good faith.

Hoping this clarifies this issue.

Yours sincerely

TREVOR LOTZ

Psychiatrist

39    The important elements of that letter are these.

40    First, on 23 June 2011, a police officer made a telephone call to Dr Lotz to advise him of “their intentions” to execute a warrant to seize clinical records. Plainly, the clinical records related to the medical records of Ms Jones and the police officer was telling Dr Lotz that the warrant would be executed upon him at his place of professional practice. In that conversation, the police officer nominated “a time they expected to attend on me with the warrant”.

41    Second, Dr Lotz was pleased to receive the telephone call about the intentions of the relevant police officers as the subsequent execution of the warrant would likely disrupt his “busy patient appointment schedule”. Forewarning Dr Lotz of the execution of a warrant upon him, at his place of professional practice, under which the police officer asserted a right to “seize clinical records” (and therefore, inferentially, search out the relevant records) would likely “minimise disruption to the waiting room of patients”. Moreover, Dr Lotz was concerned that the presence of uniformed police officers at his place of psychiatric practice would itself be unsettling to his patients.

42    Third, the telephone call from the police officer enabled Dr Lotz to prepare a response to the warrant on a particular assumption, namely, that the warrant “was as described by Police, that is, directing me to hand over the records of Ms Jones”.

43    Fourth, when executing the warrant three uniformed police officers attended Dr Lotz’s surgery. They directed Dr Lotz’s attention to page 1 of the warrant “demonstrating that they had the right to seize copies of the medical records of Ms Jones”. That reference by Dr Lotz may fairly be regarded as a reference to the “details” of the “warrant evidence or property” on page 1 and para (h) of the warrant, and also, a general reference to the effect of the collection of powers recited in the warrant. Dr Lotz says the police officers then pointed to his name on page 2 of the warrant and “declared” that he was the person referred to in the warrant and that they “had the right to serve the warrant on me for those medical records [as recited in the warrant]”.

44    Fifth, at the time of execution of the warrant, Dr Lotz did not notice on the warrant or otherwise know that the address recited in the warrant as the relevant place was not the address of his rooms.

45    Sixth, Dr Lotz says in the letter that he “handed over” the medical records (that is, copies of those records) “in the spirit of the law”, as requested by the Queensland Police Service. This statement taken in the context of his other observations in the letter is entirely consistent with Dr Lotz having formed the view that the warrant was as the police officer had said it was, on the day before. In the spirit of conformity with the law, as he understood the effect of the warrant as put to him on the day of execution, he produced medical records called for by the warrant. Plainly enough, the factual position put by Dr Lotz in the letter is that he believed that the warrant was as it had been represented to be by the police officers on the day of execution (and in the conversation the day before), conferring the powers to seize Ms Jones’s medical records.

46    Seventh, Dr Lotz then sets out in the letter what the counter-factual position would have been by saying that if he had considered the warrant was not what it was represented to be, he would have sought clarifying legal advice before handing over the patient records to the police officers. Dr Lotz says in the letter that he is “acutely aware” of “patient confidentiality and privacy” issues. Dr Lotz is telling the Information Commissioner that this consideration is part of the background against which he considered whether the warrant was as it purported to be, or not.

47    Eighth, Dr Lotz concludes his remarks to the Information Commissioner in the letter by saying that he responded to the police officers “in good faith”. He says that the warrant was directed to him as the treating medical practitioner of Ms Jones and he responded to a warrant directed to him concerning Ms Jones’s medical records by disclosing those records in good faith. “Good faith” in this context can only mean in good and genuine belief or faith in the entitlement of the police officers to seize Ms Jones’s medical records from him, as Ms Jones’s identified medical practitioner, and the person recited in the warrant.

48    By letter dated 10 September 2012, the Information Commissioner, by the Director of Compliance, Mr Suidgeest, expressed the “preliminary view” that he was satisfied having regard to Dr Lotz’s letter of 1 June 2012 that Dr Lotz reasonably believed that the disclosure of Ms Jones’s medical records was reasonably necessary for the investigation by the Queensland Police Service of a criminal offence and thus there had been no interference with Ms Jones’s privacy for the purposes of the Act.

49    Ms Jones was, however, invited to put any further propositions to the Information Commissioner in response by 25 September 2012. Ms Jones made submissions to the Information Commissioner by letter dated 15 October 2012.

50    By letter dated 21 December 2012, the Information Commissioner advised Ms Jones of his final decision in the matter.

51    In that letter, the author’s understanding of the principal arguments put to the Information Commissioner by Ms Jones are summarised concerning the contended interference with her privacy by Dr Lotz. The author notes Ms Jones’s claim that Dr Lotz had relied upon National Privacy Principle 2.1(g) that the disclosure was “required or authorised by or under law”. The author then observes:

Although what was on the warrant is relevant to Dr Lotz’s reasonable beliefs, I have not found it necessary to form a view about the validity of the warrant. I am of the view issues concerning warrant validity do not require further investigation, because my decision is about NPP 2.1(h)(i). It is for the OAIC to consider the exceptions listed in NPP 2.1 and determine whether or not they are applicable in the circumstances of a particular matter, regardless of whether or not, those exceptions are in fact relied upon by the parties to a complaint.

                                [emphasis added]

52    The author of the letter then sets out aspects of the comments made by Dr Lotz in his letter of 1 June 2012. The author says that he has considered the content of the phone conversation between Dr Lotz and the police officer on the day before execution of the warrant. The author notes Dr Lotz’s observation that the phone call also enabled him to prepare a response to the warrant in the event that the warrant was as described to him by the police officer, that is, a warrant directing him to hand over to the police officers the medical records of Ms Jones. The author says that he also considered the method of execution of the warrant as described by Dr Lotz and quotes that part of Dr Lotz’s letter describing the arrival of three uniformed police officers at his surgery; their pointing to the paragraph on page 1 of the warrant demonstrating that the officers had the right to seize copies of the medical records of Ms Jones; and their pointing to Dr Lotz’s name on page 2 of the warrant and declaring to him that he was the person so nominated and that they had the right to serve the warrant upon him for the medical records.

53    The author then says this:

In my view, given the charges on the warrant, and the police’s contacts with Dr Lotz he would have reasonably believed that the police could not have effectively carried out the investigation into your matter without the medical files. Dr Lotz did not need to know all the details of the investigation to form this reasonable belief.

I consider that Dr Lotz reasonably believed, on the basis of the warrant and the circumstances leading up to the execution of the warrant, that it was reasonably necessary to disclose your medical records to QPS (an enforcement body) in order to investigate the commission of a criminal offence, and consequently the disclosure was allowed under NPP 2.1(h)(i).

Accordingly, I am of the view that Dr Lotz did not interfere with your privacy because the disclosure was allowed under NPP 2.1(h)(i).

                                [emphasis added]

54    At p 1 of the letter, the author also observes that he has “carefully considered the file including your most recent correspondence, and I concur with Mr Suidgeest’s opinion”. That opinion, as earlier mentioned, was that Mr Suidgeest was satisfied that Dr Lotz reasonably believed that the disclosure of the medical records was reasonably necessary for the investigation by QPS of a criminal offence entitling Dr Lotz to rely upon NPP 2.1(h)(i) in disclosing Ms Jones’s medical records to the Queensland Police Service as an answer to the proposition that he had interfered with Ms Jones’s privacy.

55    Counsel for Ms Jones, Mr Black, contends that although the Information Commissioner’s delegate was subjectively satisfied of Dr Lotz’s state of mind, the real question is whether the material before the delegate reasonably allowed of that state of satisfaction. Ms Jones contends that Dr Lotz explains in his response of 1 June 2012 that he is responding to the warrant and that he understood the warrant to be directing him to hand over Ms Jones’s medical records. Ms Jones contends, by reason of Dr Lotz’s observation in the second last paragraph of his letter of 1 June 2012 (that if he had considered the warrant was not as it purported to be he would have sought legal advice), that the only “reasonable inference” open is that Dr Lotz never reached a view or “state of thinking” to the effect of a reasonable belief that disclosure was reasonably necessary for the purposes of an investigation of a criminal offence by the Queensland Police Service. Mr Black contends that the evidence before the delegate needed to allow the delegate to conclude that Dr Lotz had gone through a process of reasoning or postulate to this effect: “I’m not obliged to hand these medical records over to the police officers but I am entitled to do so for the purposes of a police investigation and should I do that?” (T, p 14, lns 1-9).

56    Mr Black contends that the material does not demonstrate that Dr Lotz identified the charge recited in the warrant. Nor did he identify whether the medical records were relevant to the charge. Nor did he identify, assuming the medical records were relevant to the charge, whether he was prepared to disclose those confidential medical records, regardless of those matters.

57    The statutory question confronting the Information Commissioner’s delegate was whether the delegate could be satisfied, acting reasonably, or not acting unreasonably, on the material before the delegate that Dr Lotz reasonably believed that disclosure of Ms Jones’s medical records to the three police officers on 24 June 2011 (in the circumstances described in Dr Lotz’s letters of 21 November 2011 and 1 June 2012) for an investigation by the Queensland Police Service of a criminal offence, was reasonably necessary.

58    Dr Lotz was confronted with the telephone call of 23 June 2011 in the terms he describes in his letter of 1 June 2012. He was told that the Queensland Police Service intended to execute a warrant to seize clinical records, under the authority of the warrant. The police officer told Dr Lotz, according to the letter, that he intended to execute the warrant upon Dr Lotz at his practice and sought to arrange a time to do just that. Dr Lotz was then confronted by three uniformed police officers at his place of practice at 8.45am the next morning. They produced the warrant and sought to act on it. They directed Dr Lotz’s attention to that part of the warrant authorising seizure of copies of the medical records of Ms Jones. They pointed to Dr Lotz’s name and made plain to Dr Lotz that he was the Dr Lotz on p 2 of the warrant. Dr Lotz did not doubt the authority of the warrant and, in good faith, in the spirit of the law, disclosed copies of the medical records to the police officers.

59    Dr Lotz was not required to form a view about the ultimate validity of the warrant or whether the mistaken premises address was fatal to the efficacy of the warrant. Dr Lotz was obliged, for the purposes of the Act, to form a reasonable belief that disclosure was reasonably necessary for the investigation, detection, prosecution or punishment of a criminal offence. In order to exercise the statutory discretion in s 41(1)(a) of the Act, the delegate was required to be satisfied, acting reasonably, that the material demonstrated a reasonable belief held by Dr Lotz that disclosure was reasonably necessary for the investigation of a criminal offence.

60    I am entirely satisfied that there was a basis on the material before the delegate upon which the delegate could be satisfied, acting reasonably (in the sense earlier explained as a matter of principle) that Dr Lotz held a reasonable belief that disclosure of Ms Jones’s medical records was reasonably necessary for the investigation of a criminal offence.

61    It is true that Dr Lotz says in his letter of 1 June 2012 that he acted upon the warrant; what he was told about the warrant; the intentions of the Queensland Police Service as expressed to him on 23 June 2011; and, what he was told, and that which was pointed out to him in the presence of three police officers, early on the morning of 24 June 2011. Although Dr Lotz does not describe in his letter of 1 June 2012 a deliberative process of reconciling the medical records of Ms Jones to the language of the contended offence recited in the warrant, the overwhelmingly plain and natural reading of Dr Lotz’s letter of 1 June 2012 is the reciting of circumstances which caused him to reasonably believe that disclosure of the medical records was not only required under the warrant but that disclosure had a sufficiently close connection to the matters recited on p 1 of the warrant that disclosure of Ms Jones’s medical records was reasonably necessary for the investigation of a criminal offence by the Queensland Police Service.

62    The exercise of the discretion by the Information Commissioner’s delegate was not thus beyond the framework of the statutory discretionary power. The discretion was lawfully exercised (in the sense described earlier) so far as the delegate was satisfied that disclosure by Dr Lotz of the medical records fell within cl 2.1(h)(i) of the National Privacy Principles.

63    The Information Commissioner also relies upon cl 2.1(g) that “disclosure is required or authorised by or under law”. The Information Commissioner’s delegate did not rely upon cl 2.1(g) in exercising the discretion under s 41(1)(a) of the Act and therefore did not expressly address the foundation upon which disclosure was required or authorised by law for the purposes of cl 2.1(g). No doubt, the authority of the warrant is said to be the source of the requirement or authorisation relied upon for the purposes of cl 2.1(g). The Information Commissioner says that reliance can be placed upon any ground to support the exercise of the discretion. I am not satisfied that the Information Commissioner can call in aid, in support of the exercise of the discretion (which relies upon the delegate reaching a state of satisfaction about the particular statutory requirements of the particular ground), a ground not expressly relied upon and not addressed, as to the particular statutory integers, by the delegate. That follows because the decision-maker had to be satisfied about particular matters in exercising the discretion.

64    In any event, there is no need to further address the application of cl 2.1(g) having regard to the conclusion reached concerning the exercise of the discretion in reliance upon the delegate’s state of satisfaction reached concerning the cl 2.1(h)(i) requirements.

65    As earlier mentioned, s 13A(1) of the Act provides that an act of an organisation is an interference with the privacy of an individual if the act breaches a National Privacy Principle concerning personal information that relates to the individual (leaving aside, as not in issue in these proceedings, any question concerning s 13A(1)(b)(ii)). Section 6A(1) provides that an act breaches a National Privacy Principle if, and only if, it is contrary to or inconsistent with that principle. One of the principles (cl 2.2, see [15] of these reasons) is, relevantly, that if Dr Lotz discloses personal information of Ms Jones under cl 2.1(h), Dr Lotz “must make a written note of the use or disclosure”. Clause 2.1(h)(i) is not rendered subject to cl 2.2. However, cl 2.2 is itself a National Privacy Principle. Ms Jones contends that Dr Lotz acted inconsistently with cl 2.2 by failing to make a written note of the disclosure on 24 June 2011.

66    Clause 2.2 casts a mandatory obligation on Dr Lotz to make a written note of the disclosure made by him under cl 2.1(h). Clause 2.2 does not prescribe any timeframe for making that note. It requires the making of a written note. Clause 2.2 probably contemplates the making of a written note by Dr Lotz within a reasonable period of the disclosure, of the kind which would provide particulars of what was disclosed and when. The question of whether Dr Lotz made a written note of the disclosure of Ms Jones’s medical records to the police officers on 24 June 2011 seems not to have been agitated in any of the previous communications between the Information Commissioner and Ms Jones. In any event, Ms Jones remains entitled to rely upon conduct inconsistent with cl 2.2 as a breach of a National Privacy Principle.

67    In exercising the discretion under s 41(1)(a), the Information Commissioner’s delegate appears not to have expressly considered the question of cl 2.2. However, in dealing with the issues arising under cl 2.1(h)(i), the Information Commissioner’s delegate has extensively had regard to the written instruments of Dr Lotz comprising the letters dated 21 November 2011 and 1 June 2012. The Information Commissioner’s delegate was plainly aware that Dr Lotz had reduced to writing, on his letterhead, under the title “The Evandale Practice, Dr Trevor N. Lotz”, signed by him, written observations of the disclosure.

68    Dr Lotz made more than a “written note” of the disclosure. He provided extensive information of the facts and circumstances in which the disclosure was made. I am satisfied that the letters of 21 November 2011 and 1 June 2012 represent sufficient details of the disclosure of Ms Jones’s medical records so as to satisfy the description in cl 2.2 of “a written note of the use or disclosure”. The question of whether the written information recorded by Dr Lotz was made within a reasonable period so as to satisfy an implied qualification upon cl 2.2 is a matter the Information Commissioner’s delegate was entitled to be reasonably satisfied about in all the circumstances in the exercise of the discretion.

69    I am satisfied that the Information Commissioner’s delegate did not fall into error in the exercise of the discretionary power conferred under s 41(1)(a), on the contended footing that Dr Lotz acted inconsistently with cl 2.2 of the National Privacy Principles, in deciding to cease further investigation of Ms Jones’s s 36 complaint.

70    It follows that the application must be dismissed with an order that the applicant pay the respondent’s costs of and incidental to the application.

Associate:

Dated:    27 March 2014