04 June 2014

Refugee Data Breach

In SZTXY v Minister for Immigration & Anor and SZTXZ v Minister for Immigration & Anor and SZTZJ v Minister for Immigration & Anor [2014] FCCA 841 the Federal Circuit Court has rejected an application for interlocutory relief following the Department of Immigration & Border Protection data breach noted here, here and here.

The relief sought by the applicants was in the form of an injunction restraining the Immigration Minister from removing SZTXY and SZTXZ from Australia pending the determination of final relief in proceedings brought earlier in the year as a result of the breach.

The applicants instituted proceedings in the Federal Circuit Court on 4 March 2014. Driver J states that
Other applications followed. The initial applications were not prepared with the assistance of legal advice and it was difficult to discern what the applicants were seeking from the Court. Subsequently, a group of applicants, whose applications had been allocated to my docket, obtained legal representation. Amended applications were filed between 28 March 2014 and 7 April 2014. 
He notes that
In February this year, it emerged that personal information concerning some 10,000 people held in immigration detention in Australia had inadvertently been made available on the internet. The revelation caused understandable concern and those affected received letters from the Secretary of the Minister’s Department about the circumstances. The Secretary’s letter contained what purports to be an undertaking that the Department would assess any implications for each affected person personally as part of its “normal processes”. Those affected were also invited by the letter to raise any concerns they might have during “those processes”.
Driver J goes on to state that
Counsel for the applicants submitted that the Secretary’s letter [to individuals whose data was exposed by the breach] amounted to a representation that some new process common to all of the detainees affected by the information disclosure would be applied to them separately from any other process that might be applicable to them should they make (or have made) a claim for protection in Australia. I cannot accept that submission in the light of the available evidence. That evidence establishes to my satisfaction that what the Secretary intended to convey was an undertaking that the circumstances of the release of information would be taken into account in relation to any assessment of protection claims by the affected detainees or any assessment that the Minister might undertake of his own volition, for example for the purposes of s.195A. In the case of SZTXY, the representation was misleading in its reference to the “usual processes” of the Department. It was misleading because since August 2012 there has been no process in place for the assessment of protection claims by UMAs in Australia. It appears from the affidavit of Ms Gillam [of the Dept] that a process is being developed to consider claims in that class. The Minister, through his counsel, has represented to the Court that the process will be subject to the requirements of procedural fairness and that it will be conducted according to law. The rule of law of course depends upon the supervisory jurisdiction of the courts. I proceed on the basis that the protection status determination process referred to by Ms Gillam at [8] of her affidavit will be subject to the supervisory jurisdiction of this Court under s.476 of the Migration Act, consistently with the decisions of the High Court in M61 and the Full Federal Court in SZQDZ. 
I conclude that the concerns of SZTXY are unfounded. He will not be removed from Australia until any claims for protection he wishes to make are considered pursuant to an assessment process conducted lawfully. The implications of the release of his personal information will be taken into account in that process. In the circumstances, an arguable case for the relief currently sought by him has not been established.
In relation to SZTZJ the Department argued that
the applicant arrived in Australia as an illegal maritime arrival. 
The applicant made protection claims which were assessed through a non-statutory process for the purpose of informing any consideration of the exercise of the Minister’s powers under s.46A of the Migration Act 1958. 
These processes ultimately resulted in the applicant not being referred to the Minister for consideration of the exercise of his powers under s.46A. 
Therefore, in relation to this applicant, she has been the subject of processes in which her protection claims were considered but has now been affected by the disclosure. In such a circumstance, the Department will be writing to her inviting her to provide information that she would like to have considered by the Department regarding the disclosure. Should the applicant provide such information in accordance with the invitation, this will be considered as to whether the information raises any new, substantive and credible information relevant to Australia’s non-refoulement obligations. In the event that new and credible protection related information is raised, the applicant’s case will be referred for the Minister’s consideration under the Minister’s intervention powers under the Migration Act.  
If the applicant provides information in accordance with this invitation the applicant will not be considered available for removal until this consideration occurs. 
Driver J states that
I accept in the case of SZTZJ that there are established processes in place in the Minister’s Department for dealing with any fresh claim for protection that she may wish to make. I also accept that that further assessment process would have to be conducted lawfully before she could be removed from Australia consistently with s.198 of the Migration Act. Any fresh claim made by her on the basis on the release of her personal information would be a sur place claim not previously made and the circumstances would warrant a fresh consideration of her situation. SZTZJ could if necessary seek relief in this Court in relation to that process, consistently with the decision in M61. I conclude that the concerns of SZTZJ are unfounded and she has not established an arguable case for the relief she seeks.
In relation to in relation to SZTXZ the Department indicated that the applicant
has been the subject of processes in which his protection claims were considered but has now been affected by the disclosure. In such a circumstance, the Department will be writing to him inviting him to provide information that he would like to have considered by the Department regarding the disclosure. Should the applicant provide such information in accordance with the invitation, this will be considered as to whether the information raises any new, substantive and credible information relevant to Australia’s non-refoulement obligations. In the event that new and credible protection related information is raise, the applicant’s case will be referred for the Minister’s consideration under the Minister’s intervention powers under the Migration Act. 
If the applicant provides information in accordance with this invitation the applicant will not be considered available for removal until this consideration occurs.
Driver J states that
But for the new circumstances resulting from the unauthorised release of his personal information, SZTXZ would have exhausted the statutory processes for the consideration of his protection claims. However, as is conceded by Ms Gillam, the disclosure of his personal information is a new circumstance supporting a further consideration of his claims. The Minister could consider his circumstances either pursuant to s.417 of s.48B of the Migration Act. The Minister’s powers under those sections are personal and non compellable and are excluded from the jurisdiction of this Court. He could, however, if necessary seek relief in relation to those processes in the High Court of Australia in its original jurisdiction. 
I conclude that the concerns of SZTXZ are unfounded and that he has not established an arguable case for the relief he seeks. That is sufficient to dispose of these proceedings, but for completeness, I will consider alternative relief available to the applicants.
In directly addressing privacy issues Driver J goes on to state that
 If the applicants are for some reason mistrustful of the processes discussed above, they have an alternative remedy available to them. The circumstances of the release of personal information of these applicants points to a possible breach of information privacy principle 11 of the information privacy principles set out at s.14 of the Privacy Act 1988 (Cth). Under s.36 of the Privacy Act, they are entitled to complain to the Privacy Commissioner (Commissioner) about the apparent breach. . . . .
This Court has jurisdiction under s.55A of the Privacy Act to enforce a determination made by the Commissioner. If any of these applicants wished to make a complaint to the Commissioner about the release of their personal information I see no reason in principle why such a complaint, and the investigation of it by the Commissioner, could not extend to the consequences of the release for the personal safety of the applicants in their countries of origin.
He concludes
None of these three applicants has established an arguable case for the relief sought in their amended applications. I will order that the applications be dismissed pursuant to rule 44.12(1)(a) of the Federal Circuit Court Rules. The subpoenas issued will be set aside. The remaining applications the subject of these proceedings should be dealt with consistently with this judgment.
In SZTKJ v Minister for Immigration & Anor [2014] FCCA 997 Manousaridis J comments that
the applicant, in written submissions filed after the hearing, submitted that the Minister breached the applicant’s privacy by releasing his name and other details on the departmental website as part of the January 2014 Detention Statistics. This does not relate to any ground stated in the application, and cannot have any relevance to whether the Tribunal committed any jurisdictional error in affirming the delegate’s decision not to grant the applicant a protection visa.
In 1405532 [2014] RRTA 387 the Refugee Review Tribunal stated that
[1405532's] name was published by the Department on their website, as part of the January 2014 Detention Statistics for a period of several days before [date] February 2014.  
It is the applicant’s claim that he will face persecution in Nepal from his family and because his privacy has been breached as his name was published on the Department website in the manner outlined above. When asked to describe how he would be harmed because of this he indicated that his extended family would know of his detention and that would cause him shame and serious harm. The Tribunal questioned how this difficulty would amount to serious or significant harm. While the Tribunal accepts he may be questioned about his detention by his extended family on his return to Nepal and he may be put down by them, it does not accept that such questioning amounts to serious harm, as it is not analogous to the examples outlined in s.91R(2) of the Migration Act or the definition of significant harm as outlined in s.5(1) and s.36(2)(aa) of the Migration Act.