FEDERAL COURT OF AUSTRALIA

DYD16 v Minister for Immigration and Border Protection [2019] FCA 828

ORDERS

THE COURT ORDERS THAT:

1.    The appeal is dismissed.

2.    The appellant is to pay the costs of the first respondent as agreed or assessed.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

STEWART J:

Introduction

1    This is an appeal from a judgment of the Federal Circuit Court of Australia (FCC) in DYD16 v Minister for Immigration [2018] FCCA 3307. The case before the FCC was an application for the review and setting aside of a decision of the Immigration Assessment Authority under Part 7AA of the Migration Act 1958 (Cth). The FCC had jurisdiction under s 476 of the Act. The Authority’s decision under review was to affirm a decision of a delegate of the Minister not to grant the appellant a Safe Haven Enterprise (subclass 790) Visa (protection visa).

2    Five grounds of appeal are raised before me. Before identifying them, it is convenient to set out some background.

Background

3    The appellant is a citizen of Sri Lanka of Sinhalese ethnicity. He arrived in Australia on 27 October 2012 as an unaccompanied minor, aged 16 years, and is what is referred to as an “unauthorised maritime arrival”: s 5AA of the Act. The appellant’s claims for protection were summarised as follows by the delegate of the Minister:

•    In February 2008 his family was targeted by a number of attacks following a dispute with a rich man named [D], who is an underworld figure linked to the provincial politician [U].

•    D owed his brothers a large sum of money for a large volume of fish they had caught and sold to him.

•    His brothers were “chasing” D for the money; however he refused to pay and threatened to harm his brothers and the whole family if they took further steps to collect the money.

•    On […] 2008 his brother M was travelling by rickshaw a few kilometres from their home when a truck drove directly into his rickshaw. His brother’s leg was severely broken and he was hospitalised for months. He now has to use crutches every day. The truck is believed to be a Sri Lankan Army (SLA) vehicle but there was no number plate.

•    Following this incident his brother went to the police and complained about the incident. He explained what had happened; however the police said they were powerless to act as the incident involved the SLA and “provincial underworld gang leaders of politicians.” The police refused to record any names “we” mentioned and didn’t conduct any investigation to identify the vehicle or people involved.

•    D has a close relationship to provincial SLA personnel because of his friendship with political leaders in the area. They know he had connections to politicians and the authorities.

•    In […] 2009 his brother M was walking down a road when he [was] run down by a motorcycle. He was taken to hospital by onlookers and spent three weeks there. It has since been found out that he has brain damage as a result of the incident.

•    The motorcycle that hit him is believed to be from D’s gang and the police couldn’t take action against the people involved in the incident.

•    Following the injuries to his brothers the dispute between his family, D and the Sri Lankan authorities increased.

•    At one stage D and five of his supporters attacked his family home. They pulled his father out from the house and tried to strangle him and yelled abuse at the family telling them they wouldn’t be able to live in their house anymore. They also attacked the windows and doors with clubs and poles.

•    Following this attack the harassment and problems with D, his gang members and the authorities continued. They tried to report the problems to the police but they would not listen. It was like D was above the law.

•    As a result of the ongoing dispute his parents sent him to his grandmother’s house for safety. He was about fourteen at the time. He lost his education and future because of these incidents. From here he made plans to depart Sri Lanka for safety.

•    His family has informed him that since his arrival in Australia there were several incidents targeting his family by D and his gang. On […] 2014, D and his gang targeted his brother S. He was on his way home after work and they tried to strangle him to death and hit him with poles and clubs. Onlookers rushed to the scene and they ran away. Police and magistrates enquiries are going on at this stage but the authorities failed to take any of the culprits into custody.

(I have used pseudonyms and obscured dates in this summary for the appellant’s protection.)

4    In fact, the appellant asserted an additional ground for protection by way of written submission to the delegate before the delegate made his decision. The appellant complained that there had been a data breach by the Department of Immigration and Border Protection. The appellant had received a letter from the Department stating that a routine report released on the Department’s website unintentionally enabled access to some personal information about people who were in immigration detention on 31 January 2014. The information was accessible online for a period of time before it was removed from the Department’s website.

5    The data breach is the same one that was considered by the High Court in Minister for Immigration v SZSSJ [2016] HCA 29; 259 CLR 180 where the nature of the breach was summarised at [3]-[4] as follows:

[3]     The Data Breach occurred on 10 February 2014. The Department routinely publishes statistics on its website. This time the particular electronic form of the document in which the statistics were published included embedded information which disclosed the identities of 9,258 applicants for protection visas who were then in immigration detention. The document containing the embedded information remained on the website until 24 February 2014.

[4]     On any view, the Data Breach was very serious. The information disclosing the identities of the applicants for protection visas embedded in the document published by the Department was information protected from unauthorised access and disclosure by criminal prohibitions in Pt 4A of the Migration Act 1958 (Cth).

6    After setting out some details of the data breach, including that eight categories of personal information of the appellant were included in it, the appellant’s submission to the Delegate stated:

This incident is a clear and significant breach of privacy, ultimately affecting the safety of our client and his family. Although this breach was unintentional, personal information of our client was accessible on the public domain, obtainable by the Sri Lankan Police Department, Sri Lankan Army, Sri Lankan Government authorities and community gang members. As a result, it would be extraordinarily unsafe for our client to travel back to Sri Lanka and have these members of his community harm him knowing that he sought refuge in another country. It would be a breach of human rights to force our client into a situation that was possibly worsened by a mistake of the department.

7    The submission concluded by saying the following:

Our client, whose fear is well-founded, fears being persecuted for reasons of:

1.     Being killed, harmed or mistreated by the Sri Lankan Army, Sri Lankan Police and Sri Lankan Government authorities.

2.     Being indefinitely imprisoned by the Sri Lankan Army, Sri Lankan Police and Sri Lankan Government authorities.

3.     Being killed, harmed or mistreated by D and other gang members who have power and control in the community.

Decision of the delegate

8    By a decision dated 19 August 2016, the delegate refused the appellant’s application for a protection visa. The delegate considered the data breach claim with the claim for complementary protection, i.e. that there are substantial grounds for believing that, as a necessary and foreseeable consequence of the appellant being removed from Australia to Sri Lanka, there is a real risk that the appellant will suffer significant harm (s 36(2)(aa)). These grounds were considered at some length.

9    The decision of the delegate records that at his protection visa interview the appellant’s representative stated that the data breach is a breach of privacy:

ultimately affecting the safety of our client and his family. Although this breach was unintentional, personal information of our client was accessible to the public domain, obtainable by the Sri Lankan Police Department, Sri Lankan Army, Sri Lankan Government authorities and community gang members. As a result, it would be extraordinarily unsafe for our client to travel back to Sri Lanka and have these members of the community harm him knowing that he sought refuge in another country. It would be a breach of human rights to force our client into a situation that was possibly worsened by a mistake of the department.

10    Although the delegate accepted that the Sri Lankan authorities will be aware that the appellant had resided in Australia, and that they may be aware that he had travelled to Australia as an unauthorised maritime arrival and may therefore deduce that he did so for the purpose of seeking asylum, he concluded that on the information before him failed asylum seekers do not face a real chance of being harmed or mistreated on account of that status. He said that he was satisfied that the appellant is not a person of particular interest to the authorities and that the nature of his interaction with authorities will involve standard questioning and will not result in him being subjected to significant harm.

11    The delegate also dismissed the other grounds for the appellant’s claim for protection.

12    The appellant is a “fast track applicant” as defined in s 5(1) of the Act and therefore the delegate’s decision was automatically referred by the Department to the Authority for limited merits review under the “Fast Track Assessment Process” in Part 7AA of the Act.

Decision of the Authority

13    The Authority affirmed the decision of the delegate not to grant the appellant a protection visa on 25 November 2016. Those parts of its 55 paragraph decision that deal with or are directly relevant to the data breach ground are the following:

Failed Asylum Seeker

23.     The applicant claims to have left Sri Lanka in October 2012 to travel to Australia as a passenger in a boat organised by a smuggler. He does not have a passport. The applicant was one of a number of asylum seekers whose information was published by the Department of Immigration and Border Patrol in 2014 due to a data breach on its website. I find that, if he were to return to Sri Lanka, he will be considered a failed asylum seeker who departed illegally by the Sri Lankan authorities.

…

29.     I am satisfied that the applicant will not face a real chance of harm from D, his gang or the Sri Lankan authorities due to the family’s dispute with D in 2008 or for any other reason on return to Sri Lanka now or in the reasonably foreseeable future.

…

37.     I accept that the applicant will be considered a failed asylum seeker on his return. DFAT reports that there have been thousands of asylum seekers returned to Sri Lanka since 2009, including some 1500 from Australia, with relatively few allegations of torture and mistreatment and assesses the risk of harm for the majority of returnees as low. While DFAT notes there are a small number of reports of mistreatment upon return by asylum seekers, they cannot verify these reports, which are often anonymous and made to third parties. I accept that an asylum seeker with actual or perceived links to the LTTE may be at risk of harm when processed at the airport. However, the country information does not suggest that simply returning to Sri Lanka as a failed asylum seeker leads the authorities to impute any anti-government political views to a returnee. The applicant is Sinhalese, has no links to the LTTE and, based on my findings, is of no adverse interest to the Sri Lankan authorities for any reason. Taking into account those findings and the country information, as well as the data breach that occurred in 2014, I do not accept that the applicant as a failed asylum seeker will be at risk of adverse attention from the current Sri Lankan authorities when scrutinised on arrival in Sri Lanka.

…

Complementary protection: conclusion

55.     There are not substantial grounds for believing that, as a necessary and foreseeable consequence of being returned from Australia to a receiving country, there is a real risk that the applicant will suffer significant harm. The applicant does not meet s 36(2)(aa).

Federal Circuit Court

14    By application filed on 16 December 2016, the appellant applied to the FCC to quash the decision of the Authority. Four grounds of review were pressed before the primary judge:

1.    The Applicant’s personal information was published online in 2014 due to a data breach on the Department of Immigration and Border Control website.

2.    This breach placed the Applicant in greater danger than he otherwise would be of being:

a.    Killed, harmed or mistreated by the Sri Lankan Army, Police and Sri Lankan Government Authorities;

b.    Indefinitely imprisoned by the Sri Lankan Army, Police and Sri Lankan Government Authorities; and

c.    Killed, harmed or mistreated by a named person (“D”) and other gang members who have power and control in the community.

3.    The Immigration Assessment Authority’s review of the Applicant’s matter, conducted on 25 November 26 (provided in Affidavit of [the Applicant] dated 14th December 2016,) did not address or consider the added danger posed to the Applicant as a result of the 2014 data breach.

4.    In Paragraphs 23 and 37 of the Immigration Assessment Authority’s review of the Applicant’s matter, conducted on 25 November 2016, no reasons were provided as to why the 2014 data breach posed no added danger to the Applicant.

15    It is readily apparent from the articulated grounds of review that although they are separately numbered they really run together and should be understood in that way. Given that the appellant was unrepresented before the FCC, as he is before me, it is not surprising that the grounds of review are not set out as self-standing separate grounds.

16    The primary judge nevertheless dealt with each ground separately. Ground 1 was dismissed on the basis that it is merely a factual allegation and does not identify jurisdictional error. Ground 2 was dismissed on the basis that the Authority meaningfully considered and had regard to the appellant’s claims. Reference was made to paragraph [29] of the decision of the Authority which I have quoted at [13] above.

17    Ground 3 was dismissed on the basis that the Authority addressed the appellant’s contention that the data breach posed an added danger to him. Reference was made, by the primary judge, to paragraphs [23], [26], [27], [29] and [37] of the Authority’s decision. Paragraphs [26] and [27] contain the Authority’s reasoning on why the appellant no longer faced a threat from D and his gang on his return to Sri Lanka, mostly because the last time there were such threats by D was in 2008. The other paragraphs are quoted at [13] above.

18    Ground 4 was dismissed on the basis that the Authority had provided reasons for its decision. Reference was made to paragraph [37] of the Authority’s decision which is quoted at [13] above.

Grounds of appeal 1-4: data breach

19    Grounds of appeal 1 to 4 before me all deal with the question of the data breach. I will accordingly consider them together.

Grounds of appeal

1.     The Federal Circuit Court Judge Dowdy erred in holding that ground 1 of the application comprises merely a factual allegation and does not constitute any meaningful assertion of jurisdictional error and, accordingly, fails to establish jurisdictional error and is not made out.

Particulars

a)    The Applicant’s personal information was published online in 2014 due to a data breach on the Department of Immigration and Border Control website.

b)    This breach placed the Applicant in greater danger than he otherwise would be of being:

i.    Killed, harmed or mistreated by the Sri Lankan Army, Police and Sri Lankan Government Authorities;

ii.    Indefinitely imprisoned by the Sri Lankan Army, Police and Sri Lankan Government Authorities; and Killed, harmed or mistreated by a named person (“D”) and other gang members who have power and control in the community.

2.     The Federal Circuit Court Judge Dowdy ought to have found that the Immigration Assessment Authority (IAA) gave “no reasons” as to why the data breach posed no added danger to the Applicant.

3.     The Federal Circuit Court Judge Dowdy erroneously held at paragraph [37] of the Decision Record of the IAA indicates that it had considered country information, that it took into account its earlier findings that the Applicant would not suffer harm upon return to Sri Lanka for any reason and in effect that the data breach did not add to or augment any risk of adverse attention if the Applicant returned to Sri Lanka.

4.     The Federal Circuit Court Judge Dowdy erroneously held “In my view, the IAA in its Decision Record did provide reasons as to why the 2014 data breach posed no danger to the Applicant and, in my view, Ground 4 also fails to establish jurisdictional error.” [at 27].

20    The essential question that these grounds of appeal raise is whether the Authority committed jurisdictional error in the way in which it considered and dealt with the data breach claim, including whether it gave adequate reasons for its conclusions.

21    In my view there is no jurisdictional error in the Authority’s treatment of the data breach issue. It underlies the Authority’s reasoning that it was prepared to assume that relevant people in Sri Lanka, both from government and security agencies and private people such as D and his gang, might know that the appellant had applied for asylum in Australia and failed. That assumption applied both in respect of whether there had been a data breach or not – in either event the Authority reasoned that there was no well-grounded apprehension of significant harm to the appellant on his return to Sri Lanka. On the facts that the Authority found, as it was entitled to do within its jurisdiction, there was no error in its reasoning to the conclusion that the data breach did not give rise to circumstances such as to mean that Australia has protection obligations to the appellant.

22    In the circumstances, the appeal on grounds 1 to 4 must fail.

Ground of appeal 5: pre-trial detention

23    This ground asserts that the Authority did not properly address and deal with the likelihood of pre-trial detention of the appellant on his return to Sri Lanka.

24    The first difficulty with this ground is that it was not raised before the primary judge. That would not necessarily be an absolute bar, as the appellant could be granted leave to raise the ground before me. That, however, leads to the second difficulty, which is that the ground must in any event fail.

25    The delegate stated as follows with regard to the possible detention of the appellant on his return to Sri Lanka:

The information outlined above indicates that the applicant will likely be questioned, briefly detained and fined as a result of departing Sri Lankan illegally. I have given regard to Minister for Immigration and Border Protection v WZAPN [2015] HCA 22. I am satisfied that a very short period of detention to facilitate the processing of such charges and fines does not meet the definition serious harm. I am not satisfied that there is a real chance that the applicant will face serious harm on return to Sri Lanka for this reason.

26    In Minister for Immigration and Border Protection v WZAPN [2015] HCA 22; 254 CLR 610 it was held that loss of liberty that did not constitute “serious harm” did not provide a basis for protection, and that the question of whether a threat to a person’s liberty involved serious harm required a qualitative judgment including an evaluation of the nature and gravity of the apprehended loss of liberty; it requires a qualitative judgment, involving the assessment of matters of fact and degree (at [41] and [45]). There, anticipated temporary detention and questioning on being returned to the receiving country was not found to amount to serious harm such as to give rise to an entitlement to protection (at [51]).

27    The Authority found on the basis of country information that the appellant is likely to be detained and questioned at the airport, for up to 24 hours, before being taken by the police to the nearest Magistrates Court on returning to Sri Lanka. The Authority went on to consider in some detail what would be likely to occur thereafter, including reasoning that if the appellant was held over a weekend or public holiday until seen by a Magistrate, he would face only a brief period in detention. The Authority referenced WZAPN and concluded that even having regard to general poor prison conditions, and the appellant’s age, it did not consider that a brief period – 1 to 3 days – in detention would constitute the necessary level of threat to his life or liberty, or to significant physical harassment or treatment under s 5J(5) of the Act, or otherwise amounts to serious harm.

28    In the circumstances, ground of appeal 5, which asserts that the Authority did not properly address and deal with the likelihood of pre-trial detention, must fail. The Authority dealt with that likelihood at some length in its reasons, including by relying on country information as a basis to support the conclusions that it reached.

Further matters

29    In oral submissions at the hearing of the appeal, the appellant said that the situation in Sri Lanka has recently changed which makes matters more dangerous for him. He referred to the highly publicised and devastating bomb attacks over Easter this year, as a consequence of which tourists have been warned not to travel to Sri Lanka. He said that the situation following the bombing can be used by his opponents (whom I take to be D and his gang).

30    The appellant also said that two of his cousins were murdered on Christmas Day last year in the harbour. He said that although no one has taken responsibility, it is “obvious” that D and his gang carried out the murders.

31    The appellant submitted that due to the current situation in Sri Lanka it is not safe for him to be returned there.

32    Mr Liu, who appeared for the Minister, submitted that I cannot take these matters into account because they are not covered by the notice of appeal, there is no evidence in support of them, and they were not before the Authority or the primary judge. I accept those submissions. In addition, there is no basis upon which an application to amend the notice of appeal and to adduce evidence on appeal, if made, could succeed.

Conclusion

33    The appeal must accordingly be dismissed with costs.

Associate:

Dated:    4 June 2019