Federal Court of Australia

Zhang v Australian Information Commissioner [2023] FCA 132

ORDERS

THE COURT ORDERS THAT:

1.    The originating application dated 24 May 2021 be dismissed.

2.    The applicant’s application for an extension of time dated 3 January 2023 be dismissed.

3.    The applicant pay the respondent’s costs to be assessed in default of agreement in accordance with the court’s costs practice note (GPN-COSTS).

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

SNADEN J:

1    By correspondence dated 30 July 2018, the applicant, Ms Zhang, petitioned the respondent (hereafter, the “Commissioner”) to investigate what she alleged had been an interference with her privacy contrary to the requirements of the Privacy Act 1988 (Cth) (hereafter, the “Privacy Act”). Her complaint focused upon some email correspondence that was sent by an organisation known as “CareerSeekers”. Ms Zhang took issue with having been identified as a participant in a conference that formed part of the “New Australian Internship Program” that CareerSeekers was then organising.

2    On 15 January 2019—after liaising with Ms Zhang and with a representative of CareerSeekers—the Commissioner determined that she would not further investigate Ms Zhang’s complaint. That decision was purportedly made in reliance upon s 41(1)(da) of the Privacy Act. It rested substantially upon the Commissioner’s conclusion that CareerSeekers was a small business operator to which the Privacy Act did not apply.

3    In the weeks that followed, Ms Zhang exchanged a number of emails with the Commissioner’s office regarding her complaint and the decision that it should not further be investigated. The Commissioner reiterated the decision that had been made and indicated that Ms Zhang could apply to have it reviewed judicially, should she wish.

4    Nearly two years after those exchanges played out, Ms Zhang wrote again to the Commissioner’s office and requested “a review” of her complaint. By letter dated 28 April 2021, the Commissioner indicated that the Privacy Act did not make provision for any such review process and that Ms Zhang’s complaint remained closed.

5    On 25 May 2021, Ms Zhang lodged an originating application in this court, by which she sought judicial review of “…the decision of the OAIC to close the case of Privacy complaint about CareerSeekers…made on 28th April 2021”. That application was made under r 31.01 of the Federal Court Rules 2011 (Cth) (hereafter, the “Rules”), which concerns applications for orders under s 11(1) of the Administrative Decisions (Judicial Review) Act 1977 (Cth) (the “ADJR Act”).

6    The Commissioner resists the application on the basis that it is incompetent: specifically, that no such decision was made on 28 April 2021 and Ms Zhang is not at liberty to challenge the actual decision of 15 January 2019 so long beyond the expiry of the time limit for doing so. She relies, to that end, upon a notice of objection to competency, which was filed pursuant to r 31.05 of the Rules on 5 July 2022.

7    On 13 January 2023—only weeks before the matter was to be heard—Ms Zhang filed an application for an extension of time under r 31.02 of the Rules. Although not stated (neither in that application nor the affidavit affirmed in support of it), it is to be inferred that, by it, Ms Zhang seeks to review the Commissioner’s decision of 15 January 2019 (possibly by way of a separate application; but more likely by way of amendment to her existing application).

8    There are, then, two issues primarily before the court, namely:

(1)    is Ms Zhang’s originating application of 24 May 2021 (as filed) competent; and

(2)    if it is not, should Ms Zhang be granted an extension of time (or, otherwise, leave to amend her originating application) so that she might challenge the decision of 15 January 2019?

9    For the reasons that follow, both of those questions should be answered in the negative. Both applications should be dismissed and I will make orders accordingly. Ms Zhang should pay the Commissioner’s costs.

The hearing

10    The matter was scheduled for hearing in July 2022. That hearing was vacated at Ms Zhang’s request and instead took place on 31 January 2023. Ms Zhang appeared for herself, assisted by a Mandarin interpreter (albeit only on occasions, as she was, for the most part, able and content to make and understand oral submissions in English).

11    By way of evidence, Ms Zhang read without objection an affidavit that she affirmed on 4 January 2023 in support of her application for an extension of time. Additionally, the court received into evidence by consent the content of an application book that was prepared by the Commissioner.

The statutory scheme

12    It is not necessary to traverse in detail the various provisions of the Privacy Act that, by her complaint of 30 July 2018, Ms Zhang sought to invoke. For present purposes, it should suffice to map out the provisions upon which the Commissioner relied in making her decision of 15 January 2019.

13    Section 36 of the Privacy Act concerns the making of complaints “…about an act or practice that may be an interference with [a complainant’s] privacy”. That concept—interference with the privacy of an individual—is the subject of s 13 of the Privacy Act, which relevantly provides:

13 Interferences with privacy

…

(1)    An act or practice of an APP entity is an interference with the privacy of an individual if:

(a)    the act or practice breaches an Australian Privacy Principle in relation to personal information about the individual; or

(b)    the act or practice breaches a registered APP code that binds the entity in relation to personal information about the individual.

14    “APP entity” is defined to include “organisation[s]”: Privacy Act, s 6(1). In turn, “organisation” is defined to mean an individual, body corporate, partnership, unincorporated association or trust that (relevantly for present purposes) “…is not a small business operator…”: Privacy Act, s 6C(1).

15    A “small business operator” is defined as an individual, body corporate, partnership, unincorporated association or trust that carries on one or more (and only one or more) businesses that generate annual turnover of $3 million or less: Privacy Act, s 6D. To that general definition apply a number of exemptions. The following provisions assume significance in this matter:

6D Small business and small business operators

…

(4)    However, an individual, body corporate, partnership, unincorporated association or trust is not a small business operator if he, she or it:

…

(c)    discloses personal information about another individual to anyone else for a benefit, service or advantage; or

(d)    provides a benefit, service or advantage to collect personal information about another individual from anyone else; or

…

16    Those exemptions are qualified yet further by (amongst others) ss 6D(7) and (8) of the Privacy Act, which provide as follows:

…

(7)    Paragraph (4)(c) does not prevent an individual, body corporate, partnership, unincorporated association or trust from being a small business operator only because he, she or it discloses personal information about another individual:

(a)    with the consent of the other individual; or

(b)    as required or authorised by or under legislation.

…

(8)    Paragraph (4)(d) does not prevent an individual, body corporate, partnership, unincorporated association or trust from being a small business operator only because he, she or it:

(a)    collects personal information about another individual from someone else:

(i)    with the consent of the other individual; or

(ii)    as required or authorised by or under legislation; and

(b)    provides a benefit, service or advantage to be allowed to collect the information.

17    “[P]ersonal information” is defined to include information, true or not, about an identifiable or reasonably identifiable individual: Privacy Act, s 6(1). “[C]onsent” may be either express or implied: Privacy Act, s 6(1).

18    Thus, a body corporate or unincorporated association (amongst others) that operates a business that generates less than $3 million per annum and that collects or discloses for benefit personal information about a person that was collected or disclosed with that person’s consent is (at least for present purposes) a “small business operator” and is not competent to commit an “interference with the privacy of an individual”.

19    Section 40 of the Privacy Act compels the Commissioner to investigate, upon complaint, acts or practices that may amount to interferences with the privacy of an individual. That general obligation is subject to s 41, which identifies certain circumstances in which the Commissioner may decide not to investigate, or further investigate, an act or practice about which a complaint has been received under s 36. One such circumstance is that the Commissioner is satisfied that “…an investigation, or further investigation, of the act or practice is not warranted having regard to all the circumstances”: Privacy Act, s 41(1)(da).

Factual circumstances

20    Limited evidence was led about CareerSeekers and the nature of its operation. Nonetheless, it is apparent (and not obviously in contest) that it is an organisation that serves to assist refugees in finding employment in Australia. It is also apparent that, at relevant times, its annual turnover was less than $3 million.

21    In order that it might discharge its animating function, it is (and was) of course necessary for CareerSeekers to obtain personal information about potential job applicants. That information, it seems, is collected at least in part so that CareerSeekers may assist in placing refugee (or similar) applicants with potential employers. That involves, at the least, its provision to potential employers. When applicants are matched with positions, CareerSeekers appears to receive some kind of commission or fee.

22    Similarly, limited evidence was led regarding the New Australian Internship Program that was the subject of Ms Zhang’s complaint. It appears to have been (or otherwise to have been associated with the holding of) a conference of some kind—specifically, a series of workshops and speakers—the purpose of which was to assist in the professional development of participants (and, in turn, their prospects of being matched with potential employers).

23    On 17 July 2018, CareerSeekers’ Deputy CEO, Mr Ash Nugent, sent an email regarding the conference. Although not entirely clear, it appears to have been sent to individuals who were set to attend or participate in it (or at least some of them). Attached to the email was an “information pack” document that contained some information about the conference. Attached to that document were a series of tables, which appear to record some details concerning travel arrangements for some (and possibly all) of the attendees. Ms Zhang’s name appeared in some of those tables, alongside details of some air travel that it appears had been arranged for her and others. Neither the email nor its attachment made any other reference to Ms Zhang.

24    The following day, Mr Nugent sent another email regarding the event. Again, it is not clear to whom that email was sent. Regardless, the email assumed the following form:

Hi everyone

Further to yesterday's email, I wanted to remind everyone that Spotlight is an invitation‐only event, with invitations extended to current CareerSeekers participants, alumni and employment partners. A few people have reached out to ask if they can bring friends or family ‐ unfortunately this is not possible.

Kind regards

25    On Monday, 30 July 2018, Ms Zhang forwarded both emails to an “Early Resolution” email address created within the office of the Commissioner. It appears that she did so after first speaking to one of the Commissioner’s representatives, “Alex”. By her first email, Ms Zhang laid out the crux of her complaint (errors original):

Hi Alex,

It was lovely to talk with you over the phone. Thank you for taking care of my case and paying extra time.

We have the original email and document with my privacy attached. There are totally two emails as the evidence.

As this organisation supports a specific group of people, I believe I could be easily identified with the information from this organisation, including 1) name; 2) arrived in Australia in the last 5 years; 3) degrees before arriving in Australia; 4) majors as accounting, engineering and so on; 5) my name is rare in my nation and quite different from other names on the list.

I am one person in 140 on the list, which means that at least 140 people have received this email.

The following email makes me believe the attachment may have been shared with many people.

Please help me to control my loss and protect my safety as well as my family's.

Thank you very much.

Julie

26    In September 2018, a representative of the Commissioner, Ms Jessica Clarke, sent an email to Mr Nugent, requesting that CareerSeekers respond to Ms Zhang’s complaint. By way of response, CareerSeekers’ founder and CEO, Mr Combs, informed Ms Clarke that his organisation “…[did] not fall under the [P]rivacy Act under the definition of small business”. Information confirming its annual turnover was provided.

27    On 28 September 2018, Ms Clarke sought further information from CareerSeekers concerning its operations, including as to whether it was involved in the collection or disclosure of personal information for benefit. There was then a series of exchanges as between Ms Clarke and Mr Combs, the substance of which needn’t here be rehearsed.

28    Also in September 2018, Ms Zhang provided to Ms Clarke a copy of a one-page “Talent release form” that she signed in December 2017. The circumstances in which that form came to be are not apparent, neither on its face nor on the strength of the evidence. Nonetheless, it appears on CareerSeekers’ letterhead and contains the following passages:

CareerSeekers may want to use your name and image during and after your involvement in the CareerSeekers Program.

If you give permission to CareerSeekers using your name and image, you:

1.    Consent to your name and image being used by CareerSeekers for their communications, promotions, publications, websites and advertisements for an undefined period of time.

2.    Consent to your name and image being displayed by CareerSeekers in public in Australia and overseas.

3.    Understand that CareerSeekers will store your name and image for an undefined period of time.

4.    Acknowledge that CareerSeekers are not obliged to include your name or image in any of their communications, promotions, publications, websites and advertisements.

5.    Understand CareerSeekers may provide your name and image to a third party for reporting and other purposes.

6.    Release CareerSeekers from any claim by you or anyone on your behalf arising out of your name or image being used by CareerSeekers.

7.    Acknowledge that CareerSeekers will make no payment for using your name or image.

29    Below that passage appear two “tick boxes”: one marked “yes”, the other marked “no”. Below them are some personal details relating to Ms Zhang. Ms Zhang’s signature appears in a space reserved for it and a tick has been handwritten into the “no” box just described.

30    On Wednesday, 17 October 2018, the Commissioner (through the agency of Ms Clarke) sent email correspondence to Ms Zhang regarding her complaint. By that correspondence, Ms Zhang was informed that Ms Clarke was “…of the view that further investigation of [her] complaint [was] not warranted”. Several circumstances were then identified in support of that conclusion. On the question of present relevance, Ms Clarke’s correspondence read as follows:

I acknowledge your view that CareerSeekers is not a [small business operator], on the basis that it trades in personal information. The OAIC has been unable to confirm this with CareerSeekers, however from the available information we are of the view CareerSeekers does not trade in personal information.

A business is considered to trade in personal information if it:

Common examples of trading in personal information include where a business buys a mailing list without first getting the consent of all the individuals on that list, or it discloses customer details to someone else for some commercial gain.

Under s 6D paragraph (7) of the Privacy Act, a business is not trading in personal information if it gives or receives personal information for a benefit, service or advantage and it:

CareerSeekers’ [sic] is a registered charity with the Australian Charities and Not-for-profits Commission (ACNC). According to the summary of CareerSeekers activities, available on the ACNC website, CareerSeekers is:

a non-profit social enterprise that works with leading organisations to create employment opportunities for asylum seekers and refugees who aspire to obtain professional employment. The program supports two distinct groups of asylum seekers and refugees: Mid-career professionals - those with tertiary qualifications and professional work experience who strive to re-establish their careers in Australia. These participants undertake paid internships lasting twelve weeks that provide local work.

Your complaint relates to CareerSeekers disclosing of your full name in a document that was emailed to participants in its New Australian Internship Program. This document was an information pack for an event that CareerSeekers was arranging, designed to help participants in their ongoing professional development.

Therefore, it appears that CareerSeekers was not trading your personal information to obtain a benefit, but rather, was using your personal information to carry out its core activity of providing support to individuals seeking employment. Further, it appears CareerSeekers collected your personal information directly from you.

For the above reasons, I am satisfied that CareerSeekers’ annual turnover and activities are such that would likely meet the definition of a small business operator in the Privacy Act, and it would therefore not [be] subject to the provisions of the APPs in the Privacy Act. This would mean the [Commissioner] does not have the jurisdiction to investigate the disclosure of your name in the document, as you are seeking.

Accordingly, I do not consider that further inquiries or an investigation is warranted in this instance and I intend to close your complaint under s41(1)(da) of the [Privacy] Act.

31    The correspondence later continued:

Section 41(1)(da) of the Privacy Act gives the Commissioner the discretion not to investigate, or further investigate a complaint if she is satisfied that an investigation of the act or practice is not warranted, having regard to all the circumstances.

For the reasons outlined above, I intend to decline to investigate your complaint under s 41(1)(da) of the Privacy Act.

However, before I make a final decision I invite you to provide a response to this email, should you wish to do so…

32    Later that same day (17 October 2018), Ms Zhang responded to Ms Clarke. Amongst other things, she noted that (errors original):

I agree that my information was given to CareerSeekers on the condition that they assist me to get an internship, however, their business is checking the applicants' information and visa details to assure their working rights and managing internship opportunities with organisations to charge fees from the organisations as a part of this process, which is the income of CareerSeeker.

If buying a mailing list, as one of the common examples, is trading personal information, getting serving fees from other organisation with the service, providing a list of people's names, resumes, qualifications, visa details and the checking of working rights from VEVO, should be consider as trading personal information.

My personal information has been also sent to some organisation paying fees to CareerSeekers.

The participants of the event, include the cooperating organisations, who pay the serving fees to CareerSeekers. However, I signed the Talent release form provided by CareerSeekers, which I also have sent to you as an evidence, to clarify that I didn't give the permission to use my name or image.

33    On 15 January 2019, Ms Clarke (on behalf of the Commissioner) informed Ms Zhang by email that the preliminary inquiries communicated on 17 October had matured into a concluded view: specifically, that further investigation of Ms Zhang’s complaint was not warranted. That was said to be so because Ms Clarke was of the view that CareerSeekers was a small business operator to which the Privacy Act did not apply. The following justification was given for that conclusion:

CareerSeekers has provided information to demonstrate that it has an annual turnover of less than $3 million, and as such, may be considered a small business operator (SBO) under the Privacy Act.

I acknowledge your view that CareerSeekers is not a SBO, on the basis that it trades in personal information.

Paragraphs 6D(4)(c) and (d) of the Privacy Act provide that an entity is not a SBO if it collects from or discloses to someone else, an individual's personal information for a benefit, service or advantage. These activities are generally referred to as ‘trading in personal information’. However, an entity is not trading in personal information, and may be considered a SBO, if it carries out the activities described in ss 6D(4)(c) and (d), in circumstances where the individual has consented to the collection of their personal information.

In your email of 17 October 2018, you confirmed that you consented to providing your personal information to CareerSeekers. Section 6D (8) of the Privacy Act confirms an organisation can still be a SBO if it collects personal information with the individual’s consent, or as required under legislation; and provides a benefit, service or advantage to be allowed to collect the information.

As part of your complaint, you provided a copy of CareerSeeker’s Talent Release form. You advise that your understanding was, by signing this form, CareerSeekers would not disclose your image or name. However, this form appears to refer to publishing your image in marketing and similar publications, not internal communication regarding the internship program and opportunities available to participants.

…[T]he OAIC is of the view that you consented to the collection of your personal information by CareerSeekers. As such, the SBO exception applies and the OAIC does not regulate how CareerSeekers uses or discloses personal information that it holds about an individual.

34    Under the heading “Decision”, the 15 January 2019 correspondence continued:

Section 41(1)(da) of the Privacy Act gives the Commissioner the discretion not to further investigate a complaint if she is satisfied that an investigation of the act or practice is not warranted, having regard to all the circumstances.

Therefore, for the reasons set out above and in my previous correspondence of 17 October 2018, I have decided under s 41(1)(da) of the Privacy Act to close this complaint on the grounds that further inquiries and an investigation of the act or practice is not warranted having regard to all the circumstances.

The file is now closed.

35    Ms Clarke’s email of 15 January 2019 also identified Ms Zhang’s “Review rights”:

Information about your review rights in relation to this decision or our handling of your complaint is available on our website at: www.oaic.gov.au/privacy/privacy-review-rights. If you cannot access this webpage please contact our enquiries line on 1300 363 992.

Please note that there is a 28 day time limit from the date we provide this decision to you, to apply for judicial review of the decision. An application fee may apply.

36    Ms Zhang responded to the 15 January 2019 decision by email the following day. It is unnecessary to here record the terms of that response. On 7 February—and again on 15 February—2019, Ms Zhang made attempts to have the 15 January 2019 decision reviewed. On 19 February 2019, Ms Alexandra Conlon, Acting Director of the Dispute Resolution Branch of the Commissioner’s office, wrote to Ms Zhang and confirmed that her complaint remained closed. That letter concluded as follows (emphasis original):

If you consider that the process which the OAIC used to make its decision was unfair, you should refer to the review rights information, provided to you in our correspondence of 16 January 2019 and which is attached in full below.

…

Review rights

Judicial review

You can apply to the Federal Court of Australia or the Federal Circuit Court for a review of a decision of the OAIC if you think that a decision by the OAIC not to investigate, or not to further investigate, your complaint under the Privacy Act 1988 (Privacy Act) is not legally correct. You can make this application under the Administrative Decisions (Judicial Review) Act 1977.

The Court will not review the merits of your case but it may refer the matter back to the OAIC for further consideration if it finds the decision was wrong in law or the OAIC's powers were not exercised properly.

An application for review must be made to the Court within 28 days of receiving the decision. You may wish to seek legal advice as the process can involve fees and costs. Please contact the Federal Court registry in your state or territory for more information, or visit the Federal Court website.

37    More than two years later—on 26 April 2021—Ms Zhang sent a third request for a review of her complaint. It was responded to two days later (28 April 2021): Ms Zhang was informed that the Privacy Act does not confer any process of internal review and that her complaint remained closed.

38    A few weeks later, Ms Zhang commenced this proceeding.

Competency

39    The Commissioner resists Ms Zhang’s originating process on the basis that it does not seek the review of a decision that this court has jurisdiction to review (whether under the ADJR Act or otherwise).

40    On its face, the originating application seeks orders by way of review of “…the decision of the OAIC to close the case of Privacy complaint about CareerSeekers…made on 28th April 2021”. As the above chronology makes clear, the decision that was made to not investigate, or further investigate, Ms Zhang’s complaint against CareerSeekers was made on 15 January 2019. The correspondence of 28 April 2021 did nothing more than communicate that historical truth.

41    It is plain, then, that the correspondence of 28 April 2021 did not amount to or record any relevant administrative decision made on that day. Nothing that transpired on 28 April 2021 involved the exercise of any relevant power under the Privacy Act that resulted in any alteration to or affectation of rights or obligations: see generally, Griffith University v Tang (2005) 221 CLR 99, 107 [10] (Gleeson CJ), 130-131 [89], 132 [96] (Gummow, Callinan and Heydon JJ).

42    Ms Zhang offered nothing of substance in answer to that glaring reality and the Commissioner’s submissions on this point are inarguably correct. In its present form, Ms Zhang’s originating application is incompetent and, subject to what appears below, should be dismissed for that reason.

Amendment

43    Perhaps inspired by the Commissioner’s written submissions, Ms Zhang seeks to rely upon an application for an extension of time dated 3 January 2023, together with an affidavit that she affirmed on the following day. That application is made under r 31.02 of the Rules.

44    Intending no disrespect, Ms Zhang’s application of 3 January 2023 lacks the detail that normally attends equivalent processes. At the hearing of the application, it was made clear to the parties that the court would:

(1)    treat Ms Zhang’s extension application as an application for orders to permit her to challenge the Commissioner’s decision of 15 January 2019, and to do so by way of amendment to her existing proceeding; and

(2)    hear argument as to both:

(a)    why she should or should not have that permission; and

(b)    if permission is granted, why her challenge should succeed.

No objection to that course was raised (indeed, it was enthusiastically endorsed).

45    Whether Ms Zhang should be given leave to agitate her challenge to the Commissioner’s 15 January 2019 decision turns upon consideration of at least the following matters, namely:

(1)    whether she has an acceptable explanation for having not challenged it until nearly four years after it was made (or, at any event, not at or shortly after the time that it was made);

(2)    the length of the delay that has occurred;

(3)    whether the delay is likely to visit prejudice upon the Commissioner in the event that the argument is now to be ventilated;

(4)    the prejudice that will befall Ms Zhang in the event that she is precluded from running the point;

(5)    the public interest in the finality of administrative decision making; and

(6)    the substantive merits of the point.

46    The first two of those considerations can be addressed together. The third and fourth, though relevant, are not dispositive and, in my view, assume secondary importance. The relative prejudice that will befall the parties if Ms Zhang is or is not permitted to challenge the 15 January 2019 decision is self-explanatory and, on balance, favours Ms Zhang. The fifth consideration is marginal. The final consideration is perhaps the most significant. I shall return to it momentarily.

Length of and explanation for the delay

47    In her affidavit of 4 January 2023, Ms Zhang deposes as follows (errors original):

Because of the fear and frustrations from the case that I brought to OAIC, I felt into depression since 2018. I started being aware of some symptoms in September 2018 and the symptoms started quite severe in November. Since then, I have met difficulties in reading, studying and every activity that requires concentration, and no energy to do everyday tasks from time to time, together with many other symptoms as signals of poor health. Many days I was so sick that I slept every day, even unable to make myself out of bed. Therefore, I was unable to present my case to Federal Court within the 28 days timeframe however I managed to make the application as early as I could.

48    At the hearing, Ms Zhang made similar statements from the bar table.

49    With respect, that is not a good explanation for the delay that here attends Ms Zhang’s attempt to challenge the closure of her complaint against CareerSeekers. No medical evidence is led to substantiate the bare assertions that are recorded above (and that were impressed upon the court orally at the hearing); and what is asserted sits uneasily against the events that transpired in January and February 2019. As has been recounted, Ms Zhang responded almost immediately to the decision of 15 January 2019. Despite having been advised of the measures that were open to her to challenge it, she instead chose to make two attempts over the month that followed to have it reviewed internally. Why she chose that course is difficult to fathom.

50    Also unexplained—and significant—is the length of the delay. More than two years passed before Ms Zhang saw fit to re-agitate her stalled attempts to challenge the 15 January 2019 decision. Save for what appears above (and for the similarly-themed submissions that were made at the hearing), no explanation is given for such an extended period.

51    Even at that point (April and May 2021), Ms Zhang opted not to challenge what had transpired in January 2019, preferring instead to mischaracterise what was communicated to her on 28 April 2021. It was not until more than 18 months later—and only a few weeks before the hearing was scheduled to take place—that Ms Zhang made any attempt to focus her challenge upon the dismissal of her complaint.

52    Those factors incline against the granting to Ms Zhang of leave to pursue what she now seeks to pursue (or an extension of time within which she might do so).

Merits

53    Perhaps the most significant consideration for present purposes is whether Ms Zhang can demonstrate that the challenge that she hopes to mount is one that commands reasonable prospects of success. For the reasons that follow, I do not consider that it does.

54    Ms Zhang contends that the decision to dismiss her complaint under s 41(1)(da) of the Privacy Act is vulnerable to judicial review because it was made without proper consideration of matters that the Commissioner was obliged to take into account. Again intending no disrespect, it is not easy to identify from the material upon which Ms Zhang relies what those considerations are or were. Her attempts to identify any during the hearing were confused and, at times, nonsensical.

55    Nonetheless, it is clear enough that Ms Zhang maintains that the Commissioner was wrong to conclude that CareerSeekers is or was a small business operator for the purposes of the Privacy Act. That, she says, is a conclusion that the Commissioner ought not to have drawn because CareerSeekers’s operation involves or involved the disclosure of personal information for benefit: that is, it is or was in the business of providing third parties with personal information collected about individuals such as Ms Zhang with a view to securing their placement in employment and the resultant receipt of a placement fee. As has been said, that appears to be an uncontroversial appraisal of CareerSeekers’s undertaking. By itself, that reality would (or, perhaps, could) tend to indicate that CareerSeekers was not a small business operator.

56    Further, Ms Zhang sought to impress upon the court the fact that she had, by the “Talent release form” referred to above, expressly declined to grant consent to CareerSeekers to use her personal information, at least for some purposes.

57    Two things may be said in response.

58    First, it remains unclear what is said to have gone wrongly unconsidered. Assuming, momentarily—and generously to Ms Zhang—that the Commissioner was obliged first to consider whether CareerSeekers was a small business operator before contemplating the exercise of the discretion conferred by s 41(1)(da) of the Privacy Act, it is quite apparent that that occurred. Ms Zhang’s contention appears to be not so much that there was something that should have been but wasn’t considered; it is that the conclusion in which that consideration culminated was wrong.

59    Second, s 6D(7) of the Privacy Act here looms large. On such evidence as is apparent, the only personal information that CareerSeekers was (or might be thought to have been) in the business of disclosing for benefit was information that it collected with the consent of those to whom it pertained. In order that it might match people with job opportunities—and, thereby, secure for itself payment for having done so—it necessarily had to disclose to third parties information that it collected about potential applicants. That information, of course, was collected specifically with that end in mind (which is to say that its disclosure by CareerSeekers was relevantly consented to, implicitly if not explicitly). That proposition was and is not obviously controversial.

60    If the information so collected was disclosed to third parties for benefit in a way that was not consented to, that disclosure might suffice to exclude CareerSeekers from the definition of “small business operator”. Presently, though, there are at least two bases upon which seriously to doubt that that occurred. First, the conference in respect of which CareerSeekers sent the two emails about which Ms Zhang complained was, on any view, an event designed to assist people like Ms Zhang find employment. There can be no doubt—and, at the very least, it was plainly open to the Commissioner to conclude, on the evidence before her—that Ms Zhang had consented to the use of her information for that purpose. Nothing in the “Talent release form” suggests otherwise.

61    Second, even if CareerSeekers disclosed Ms Zhang’s personal information in a way about which no consent, express or implied, was given, there is no credible suggestion that it did so (or was in the business of doing so) for benefit, service or advantage. It disclosed Ms Zhang’s information (with consent or otherwise) as part of an information pack relating to an event that it was organising; it did not disclose anything for a benefit, advantage or service. Again at the very least, it was open to the Commissioner to conclude as much (as she did, via Ms Clarke’s correspondence of 17 October 2018, upon the reasoning in which the decision of 15 January 2019 expressly relied).

62    It follows from that that the Commissioner was almost certainly correct to regard CareerSeekers as a small business operator to which the Privacy Act had no application. I am not persuaded that Ms Zhang has much in the way of prospects of establishing otherwise. Substantively, the point of principle that Ms Zhang now requires permission to agitate is not one that is attended by sufficient merit to warrant the procedural indulgence for which she moves (that is to say, the extension of time and/or leave to press her challenge to the decision of 15 January 2019).

Conclusion

63    Taking account of the matters considered above (particularly the relative prejudice of permitting the extension and/or amendment that Ms Zhang now presses, her explanation for (and the length of) the delay that has attended its prosecution and its lack of substantive merit), I am not disposed to grant the extension of time for which Ms Zhang moves, nor otherwise to permit the amendment of her claim so that she might seek orders for the review of the 15 January 2019 decision.

Disposition

64    Ms Zhang’s originating application of 24 May 2021 should and will be dismissed. Her application dated 3 January 2023 for an extension of time under r 31.02(1) of the Rules should and will also be dismissed. Rule 31.05(5) of the Rules is not here applicable and Ms Zhang should pay the Commissioner’s costs. There will be orders accordingly.

Associate:

Dated:    27 February 2023