8N6DCI and Queensland University of Technology [2016] QICmr 33 (30 August 2016)

Application number:
312898
Applicant:
8N6DCI
Respondent:
Queensland University of Technology
Decision date:
Tuesday, Aug 30, 2016
Catchwords:

ADMINISTRATIVE LAW - INFORMATION PRIVACY ACT - compliance with relevant application requirements - whether the agency was entitled to decide an access application did not comply with all relevant application requirements - requirement to provide evidence of identity for the applicant - a document verifying the person’s identity - affidavit by the applicant - section 53 of the Information Privacy Act 2009 (Qld) - sections 43(3)(a) and 43(4) of the Information Privacy Act 2009 (Qld) - section 3(1) of the Information Privacy Regulation 2009 (Qld)

REASONS FOR DECISION

Summary

1. Mr Anthony J H Morris QC, a barrister, applied on behalf of the applicant to the Queensland University of Technology (QUT) under the Information Privacy Act 2009 (Qld) (IP Act) to access certain documents.

2. In response to a request by QUT for evidence of identity for the applicant, Mr Morris QC provided an affidavit by the applicant in a court proceeding in which the applicant had affirmed that he was a respondent in that proceeding.

3. QUT emailed Mr Morris QC, noting that the applicant’s affidavit did not comply with the evidence of identity requirements and granting an extension for satisfactory evidence to be provided.  Mr Morris QC responded that he had already provided a document verifying the applicant’s identity to QUT.

4. QUT then made a decision under section 53 of the IP Act that the access application did not comply with all relevant application requirements set out in section 43(3) of the IP Act, on the basis that the affidavit represented inadequate evidence of identity for the applicant.1 QUT’s decision—while somewhat contradictory in certain respects—appeared to accept that the relevant application requirements set out in section 43(3)(b) of the IP Act had been complied with.2

5. Mr Morris QC applied to the Office of the Information Commissioner (OIC) for external review.

6. For the reasons set out below, I affirm QUT’s decision, and find that QUT was entitled to decide, under section 53 of the IP Act, that the access application did not comply with all relevant application requirements.

Background

7. Significant procedural steps relating to the external review are set out in the Appendix.

Reviewable decision

8. The decision under review is QUT’s decision dated 6 July 2016.

Evidence considered

9. Evidence, submissions, legislation and other material I have considered in reaching this decision are set out in these reasons (including footnotes and Appendix).

Issue for determination

10. The issue for determination is whether QUT was entitled to decide, under section 53 of the IP Act, that the access application did not comply with all relevant application requirements.  In considering this issue, it will be necessary to consider whether the affidavit comprises evidence of identity for the applicant.

Relevant law

11. The IP Act sets out relevant application requirements for an access application in section 43(2) and (3) of the IP Act.3 One of the relevant application requirements is that an applicant must provide ‘evidence of identity’ for the applicant with the application or within 10 business days after making the application.4 The term ‘evidence of identity’ is relevantly defined as ‘a document verifying the person’s identity, including, for example—(a) a passport; or (b) a copy of a certificate or extract from a register of births; or (c) a driver licence; or (d) a statutory declaration from an individual who has known the person for at least 1 year …’.5

12. If a person purports to make an access application and the application does not comply with all relevant application requirements, an agency must:6

  • make reasonable efforts to contact the person within 15 business days after the purported application is received and inform the person how the application does not comply with a relevant application requirement;7 and
  • give the applicant a reasonable opportunity to consult with a view to making an application in a form complying with all relevant application requirements.8

13. If, after giving the applicant a reasonable opportunity to consult with a view to making the application in a form complying with all relevant application requirements, the agency decides the application does not comply with all relevant application requirements, the agency must give the applicant prescribed written notice of the decision within 10 business days after making the decision.9

Findings

Evidence of identity for the applicant

14. To provide evidence of identity for the applicant, Mr Morris QC provided QUT with an affidavit dated 10 February 2016, filed in a court proceeding and witnessed by a barrister.  There is no generally recognised photographic or other form of identity annexed to the affidavit.  The affidavit relevantly states:

I, [applicant’s full name] of [address], tertiary student, affirm:
1. I am the [numbered] Respondent in this proceeding.
2. I am represented in this proceeding by Mr Morris QC.

15. Mr Morris QC provided a number of submissions to both QUT10 and OIC11 in support of the contention that this affidavit comprises evidence of identity for the applicant for the purpose of this application.  In summary, Mr Morris QC submitted that:

  • the definition of evidence of identity in section 3(1) of the IP Regulation is not exhaustive—it merely requires ‘a document verifying the person’s identity’, and the affidavit comprises such a document
  • the affidavit is the kind of document which the specified court acts upon, and Mr Morris QC is ‘at a loss to think why QUT would not do so’
  • QUT is ‘pretend[ing] it is unaware of the “identity”’ of one of its students who is a codefendant with QUT in the court proceeding
  • QUT has taken a ‘rather singular approach’ by acknowledging that there is sufficient evidence that Mr Morris QC has authority to act for the applicant, but concluding that there is insufficient proof of the applicant’s identity—Mr Morris QC questions how this is logically possible
  • the affidavit is witnessed by an independent legal practitioner and has been accepted for filing and filed in the specified court, and QUT (which is a party to the proceeding) has not challenged the affidavit, let alone on the footing that it may have been made by somebody other than the deponent; and
  • QUT is seeking to rely on an utterly unmeritorious technicality to circumvent the IP Act, and especially IPP6 of the Information Privacy Principles.

16. I agree that the examples of evidence of identity included in section 3(1) of the IP Regulation are not exhaustive.  However, for a document to comprise evidence of identity, it must be a document ‘verifying the person’s identity’.  In determining the meaning of these words, I note that the IP Act12 must be applied and interpreted to further the primary object of the IP Act, which is to provide for the fair collection and handling in the public sector environment of personal information, and a right of access to personal information in the government’s possession or under the government’s control unless, on balance, it is contrary to the public interest to give access.13 Further, section 14A(1) of the AI Act provides that, in the interpretation of a provision of an Act, the interpretation that will best achieve the purpose of the Act is to be preferred to any other interpretation.

17. The word ‘verify’ is not defined in the IP Regulation, the IP Act or the AI Act; consequently, its ordinary meaning should be used.  The definition listed for ‘verify’ in the Macquarie Dictionary Online includes ‘confirm or substantiate’.  I consider that this definition of ‘verify’ should be adopted, in light of the purpose of these provisions—namely, for agencies to adopt appropriate procedures to safeguard personal information by ensuring that an individual’s personal information:

  • is applied for under the IP Act only by that individual, or by a person acting on that individual’s behalf; and
  • is not disclosed inappropriately to other persons.

18. Further, I consider that this verification—or confirmation or substantiation—must be by a person other than the applicant themselves.  As can be seen in the examples provided, the verification of identity is by a third party—eg:

  • for a passport—the Department of Foreign Affairs and Trade has verified the relevant individual’s identity
  • for a copy of a birth certificate or extract from a register of births—the Registry of Births, Deaths and Marriages has verified the relevant individual’s identity
  • for a driver licence—the Department of Transport and Main Roads has verified the relevant individual’s identity; and
  • for a statutory declaration from another individual—the other individual has verified the applicant’s identity.

19. I note Mr Morris QC’s comments that the affidavit is the kind of document which the court acts upon for the purpose of the proceeding.  However, I consider that an affidavit by an individual about their own identity does not comprise a document verifying—ie, confirming or substantiating—that individual’s identity, and therefore does not constitute evidence of identity under the IP Act.  Further, the provision by Mr Morris QC of information about the individual who signed the affidavit, the circumstances in which it was signed and the circumstances giving rise to the making of the application, is not the type of verification of identity envisaged by the IP Act or Regulation.

20. Although I acknowledge that QUT is aware of the existence of the applicant and is, in this sense, aware of his identity, this awareness is not connected to the access application and cannot, of itself, amount to compliance with the requirement that an applicant provide evidence of their identity.  An access application under the IP Act is an entirely separate process from the specified court proceeding, and from QUT’s general awareness of the applicant’s identity.  Consistent with the care that agencies must exercise when dealing with personal information under the IP Act, it is necessary to provide evidence of the applicant’s identity in order to establish that an individual named as an access applicant in an access application is indeed the subject of the personal information applied for; a more general awareness of the existence of an individual that is named as an access applicant does not meet this requirement.

21. In response to OIC’s preliminary view to Mr Morris QC14 in terms similar to those set out at paragraph 20, he submitted that:15

  • OIC’s reasoning seemed to overlook QUT’s acknowledgement of his authority to represent the applicant; and
  • it is the fact of his authority to represent the applicant which provides the connection between, on the one hand, QUT’s awareness of the applicant’s identity, and, on the other hand, the access application made on behalf of the person of whose identity QUT is aware.

22. In making these submissions, Mr Morris QC appears to be relying on QUT’s acceptance of evidence of his authorisation to act for the applicant.16 Given both parties to this external review agree that Mr Morris QC has provided evidence of his authorisation, I consider it appropriate to proceed on the basis that this issue is not in contention on external review and need not be considered by OIC.  In these circumstances, while I acknowledge Mr Morris QC’s comments at paragraph 21 and his comments about there being apparent logical inconsistencies between QUT’s acceptance of evidence of an agent’s authorisation, but not of evidence of the authorising individual’s identity, I consider that it is not necessary for me to reach a decision about whether the requirements in section 43(3)(b) of the IP Act17 have been satisfied.  My decision only extends to the requirements of section 43(3)(a) of the IP Act—ie, those relating to evidence of identity for the applicant—and consequently, logical inconsistencies of the type Mr Morris QC raised do not arise for consideration in this decision.

23. Accordingly, I am satisfied that the access application did not comply with the relevant application requirement at section 43(3)(a) of the IP Act.

QUT’s compliance with section 53 of the IP Act

24. I am satisfied that QUT made reasonable efforts to contact Mr Morris QC within 15 business days after the purported application was received and informed him how the application did not comply with a relevant application requirement.  In reaching this conclusion, I note that:

  • the purported application was received by QUT by email on 14 June 2016; and
  • within 3 business days of receiving the purported application, QUT emailed Mr Morris QC on 17 June 2016 noting, with respect to evidence of identity for the applicant, that ‘[s]ection 43 of the IP Act states that an applicant must provide with the application, or within 10 business days after making the application, evidence of identity and, where relevant, evidence of the agent’s authorisation and identity.  The IP Act expresses this as a mandatory requirement and this advice is at section 8 of the approved form. Accordingly it would be greatly appreciated if you could provide evidence of identity for [the applicant] … by 28 June 2016.’

25. I am also satisfied that QUT gave Mr Morris QC ‘a reasonable opportunity to consult with a view to making an application in a form complying with all relevant application requirements’, given:

  • in an email on 17 June 2016 (3 business days after the purported application was received), QUT provided Mr Morris QC with 7 further business days in which to provide evidence of identity for the applicant—ie, with the due date being 28 June 2016 (10 business days after the purported application was made); and
  • on 28 June 2016:
    • Mr Morris QC provided the affidavit to QUT in an email at 2:09pm
    • QUT responded to Mr Morris QC, in an email at 3:43pm, stating that the affidavit did ‘not comply with the evidence of identity prescribed by the Information Privacy Regulation 2009’ and noting it was happy to grant an extension until 1 July 2016 (being 3 further business days, making a total of 13 business days after the purported application was received, and 10 business days from the date of QUT’s first request for evidence of identity for the applicant); and
    • Mr Morris QC replied, in an email at 4:17pm, that ‘[n]o extension is sought or required.  As I read regulation 3(1) under the Information Privacy Regulation 2009, it merely requires "a document verifying the person’s identity, including, for example ...". I have provided such a document. …

26. Finally, I am satisfied that QUT gave the applicant prescribed written notice of the decision within 10 business days after making the decision, given:

  • the earliest date on which QUT could have decided that the application did not comply with all relevant application requirements was 28 June 2016, being the date on which Mr Morris QC confirmed his intention not to provide anything further in response to QUT’s request for evidence of identity for the applicant; and
  • QUT emailed its decision to Mr Morris QC on 6 July 2016—ie, 6 business days after 28 June 2016.

27. In conclusion, for the reasons outlined above, I consider that QUT followed all necessary steps in section 53 of the IP Act before giving the applicant prescribed written notice of the decision under section 53(5) of the IP Act.

DECISION

28. For the reasons set out above, I affirm QUT’s decision, and find that QUT was entitled to decide, under section 53 of the IP Act, that the access application did not comply with all relevant application requirements.

29. I have made this decision as a delegate of the Information Commissioner, under section 139 of the IP Act.

________________________
Assistant Information Commissioner Corby

Date: 30 August 2016

APPENDIX

Significant procedural steps

DateEvent
14 June 2016 Mr Morris QC emailed the access application form to QUT.
15 June 2016

QUT emailed Mr Morris QC, seeking clarification about the scope of the access application, and requesting evidence about the scope of his authority to act on the applicant’s behalf.

Mr Morris QC emailed QUT, responding about the scope of the access application and the authority to act.

17 June 2016 QUT emailed Mr Morris QC, confirming the exclusion of certain information from the scope of the access application, responding about the authority to act issue, and requesting evidence of identity for the applicant by 28 June 2016.
21 June 2016 QUT emailed its lawyers, requesting information about the scope of Mr Morris QC’s authority to act.
22 June 2016 QUT’s lawyers emailed QUT, responding about the scope of Mr Morris QC’s authority to act.
23 June 2016 QUT emailed Mr Morris QC, confirming QUT’s satisfaction about the scope of his authority to act for the applicant, noting concerns about the breadth of the scope of the access application, and requesting evidence of identity for the applicant by 28 June 2016.
28 June 2016

Mr Morris QC emailed QUT, responding to the concerns about the breadth of the scope of the access application, and attaching a copy of the applicant’s affidavit in the court proceeding.

QUT emailed Mr Morris QC, noting that the applicant’s affidavit did not comply with the evidence of identity requirements and granting an extension for satisfactory evidence to be provided until 1 July 2016, and noting further concerns about the breadth of the scope of the access application.

Mr Morris QC emailed QUT, stating that no extension was sought or required, and submitting that he had already provided a document verifying the applicant’s identity to QUT.

6 July 2016 QUT emailed its decision to Mr Morris QC.
11 July 2016 Mr Morris QC and QUT’s lawyers corresponded about the decision, possible courses of action, and possible OIC or judicial review proceedings.
13 July 2016 Mr Morris QC and QUT’s lawyers corresponded about the decision.
18 July 2016

QUT’s lawyers emailed Mr Morris QC, explaining the decision, proposing a form of evidence of identity acceptable to QUT, and addressing possible OIC or judicial review proceedings.

Mr Morris QC emailed the external review application to OIC.

19 July 2016 OIC emailed QUT, notifying QUT of the external review application, and asking QUT to provide procedural documents.
21 July 2016 QUT emailed the requested procedural documents to OIC.
22 July 2016

OIC emailed Mr Morris QC, notifying him that OIC had accepted the application for external review, and proposing an informal resolution proposal regarding the form of evidence of identity acceptable to QUT.

Mr Morris QC emailed OIC, rejecting the informal resolution proposal and asking OIC to proceed to make a decision.

25 July 2016 OIC emailed QUT, notifying QUT that OIC had accepted the application for external review.
26 July 2016 Mr Morris QC emailed OIC, providing submissions and supporting material.
28 July 2016 Mr Morris QC emailed OIC, asking if OIC required anything further.
1 August 2016

Mr Morris QC emailed OIC, asking if OIC required anything further.

OIC emailed Mr Morris QC.

19 August 2016

OIC emailed a preliminary view to Mr Morris QC.

Mr Morris QC emailed OIC, notifying OIC of the rejection of the preliminary view, and providing submissions.

1 This relevant application requirement is set out in section 43(3)(a) of the IP Act.
2 I note that, in QUT’s decision, the decisionmaker:
* confirmed that ‘in view of [Mr Morris QC’s] instructions to act for [his] client in the [specified court] and the subject matter in the information access request, I was satisfied that those instructions constituted authority to act as agent for [the applicant’s] information access request’; and
* noted that ‘[t]he approved form is unsigned although it has been transmitted from email address morrisqc@lexscripta.com which is listed as [Mr Morris QC’s] email address on the website http://www.innsofcourt.com.au and in [the applicant’s] affidavit’.
3 See definition of‘relevant application requirement’in section 53(6) of the IP Act.
4 Section 43(3)(a) of the IP Act.
5 Section 43(4) of the IP Act and section 3(1) of theInformation Privacy Regulation(Qld) (IP Regulation).
6 Section 53(1) of the IP Act.
7 Section 53(2) of the IP Act.
8 Section 53(3) of the IP Act.
9 Section 53(5) of the IP Act.
10 Emails at 2:09pm and 4:17pm on 28 June 2016, and on 11 July 2016.
11 Emails on 18 July 2016 (external review application), and 26 July 2016.
12 Which, for relevant purposes, includes the IP Regulation: see definitions of‘Act’and‘statutory instrument’in sections 7(1) and 36(1) and schedule 1 of theActs Interpretation Act 1954(Qld) (AI Act), and section 7 of theStatutory Instruments Act 1992 (Qld).
13 Section 3 of the IP Act.
14 Sent on 19 August 2016.
15 Email on 19 August 2016.
16 The relevant comments in this regard in QUT’s decision are set out at footnote 2.
17 Including the requirement to provide evidence of the agent’s authorisation.