The NSW Civil and Administrative Tribunal has recently clarified when disclosures will be part of the NSW Police’s ‘administrative and educational functions,’ and therefore be subject to the requirements of the NSW Privacy and Personal Information Protection Act (PIPPA).
This case shows how context can be fundamental to privacy law compliance.
Key take outs
- The lawfulness of the use and disclosure of personal information can be context-dependant. For example, disclosing the exact same information may be lawful in some circumstances but unlawful in others.
- The NSW Law Enforcement have broad exemptions from complying with NSW Privacy Laws where their conduct relates to providing ‘police services.’
Background
One afternoon a group of school kids were seen shoplifting goods in a shopping mall. This was reported to the police who detained them and, ultimately issued the applicant with a caution under the Young Offenders Act (‘YOA‘). The police also disclosed the identity of the applicant and the offence to the applicant’s school pursuant to an agreement between the NSW Police and the Department of Education.
The question in the case was whether in this circumstance the police were required to comply with the rules regulating use and disclosure of personal information in the PIPPA. This question arose because of s 27 which exempts the police from complying with the act except in the exercise of their administrative and educative functions.
Arguments of the parties
The police argued that the disclosure was not the exercise of their administrative or educative function for two reasons. First, the Police Act defines the function of the police to provide ‘police services’ i.e ‘services by way of prevention and detection of crime,’ and that this includes ‘anything incidental to the exercise of those functions.’ Second, previous cases had adopted a limited understanding of ‘administrative and educative functions’ as being limited to internal functions (although note that a broader reading of that term had been adopted in another case).
The applicant disagreed with the characterisation of the disclosure as being either part of or incidental to the performance of police services. They relied on a case where the disclosure of a conviction as part of a routine police check for an employment application was found to be ‘administrative’ and therefore subject to PIPPA. They also argued that the disclosure was prohibited under the YOA, and therefore prohibited by s 22 of PIPPA. This section clarifies that the relevant part of PIPPA doesn’t authorise an agency do to something that would be otherwise prohibited.
Findings
The Tribunal adopted distinction that had been made in previous decisions that the disclosure of criminal history can sometimes be connected with administrative functions – like providing police checks for prospective employers – and in other times connected to providing police services.
More generally, it was observed that uses or disclosures of essentially the same information may, in some situations be administrative, and in others better understood as part of the investigative or prosecutorial process. Thus it will often be necessary to consider the context in which the use or disclose is made.
The Tribunal found in this case that when the disclosure to the school was made, ‘the process under the [YOA] which ultimately resulted in the issue of a caution … was still on foot’ (at [38]). This meant that fell within definition of ‘police services’ because it was an activity that was engaged in to support criminal process.
The Tribunal also rejected the Applicant’s arguments that the disclosure was prohibited under s 22. First, one of the relevant sections of the YOA prohibits publishing or broadcasting of the applicants name. The Tribunal held that the phone call to the school did not constitute a publication or broadcast.
The second relevant provision prohibited the disclosure of information collected pursuant to the YOA. As noted above, s 22 provides that the relevant part in PIPPA does not authorise the police to do something that they are otherwise prohibited to do. The Tribunal held that that the proper construction of s 27(1) is that it:
does not “authorise” a public sector agency to do anything it would otherwise be prohibited from doing, rather it operates so that any such conduct would not be in breach of an IPP.
at [40]
Thus the disclosure may have been a breach of the YOA (this was not decided) but s 27(1) means it is not a breach of the PIPPA.
Accordingly, no further action was taken.
(a version of the post was originally published on nswcriminallaw.com)
