ADMINISTRATIVE LAW - INFORMATION PRIVACY ACT - compliance with relevant application requirements - whether the agency was entitled to decide an access application did not comply with all relevant application requirements - requirement to provide evidence of identity for the applicant - a document verifying the person’s identity - affidavit by the applicant - section 53 of the Information Privacy Act 2009 (Qld) - sections 43(3)(a) and 43(4) of the Information Privacy Act 2009 (Qld) - section 3(1) of the Information Privacy Regulation 2009 (Qld)
1. Mr Anthony J H Morris QC, a barrister, applied on behalf of the applicant to the Queensland University of Technology (QUT) under the Information Privacy Act 2009 (Qld) (IP Act) to access certain documents.
2. In response to a request by QUT for evidence of identity for the applicant, Mr Morris QC provided an affidavit by the applicant in a court proceeding in which the applicant had affirmed that he was a respondent in that proceeding.
3. QUT emailed Mr Morris QC, noting that the applicant’s affidavit did not comply with the evidence of identity requirements and granting an extension for satisfactory evidence to be provided. Mr Morris QC responded that he had already provided a document verifying the applicant’s identity to QUT.
4. QUT then made a decision under section 53 of the IP Act that the access application did not comply with all relevant application requirements set out in section 43(3) of the IP Act, on the basis that the affidavit represented inadequate evidence of identity for the applicant.1 QUT’s decision—while somewhat contradictory in certain respects—appeared to accept that the relevant application requirements set out in section 43(3)(b) of the IP Act had been complied with.2
5. Mr Morris QC applied to the Office of the Information Commissioner (OIC) for external review.
6. For the reasons set out below, I affirm QUT’s decision, and find that QUT was entitled to decide, under section 53 of the IP Act, that the access application did not comply with all relevant application requirements.
7. Significant procedural steps relating to the external review are set out in the Appendix.
8. The decision under review is QUT’s decision dated 6 July 2016.
9. Evidence, submissions, legislation and other material I have considered in reaching this decision are set out in these reasons (including footnotes and Appendix).
10. The issue for determination is whether QUT was entitled to decide, under section 53 of the IP Act, that the access application did not comply with all relevant application requirements. In considering this issue, it will be necessary to consider whether the affidavit comprises evidence of identity for the applicant.
11. The IP Act sets out relevant application requirements for an access application in section 43(2) and (3) of the IP Act.3 One of the relevant application requirements is that an applicant must provide ‘evidence of identity’ for the applicant with the application or within 10 business days after making the application.4 The term ‘evidence of identity’ is relevantly defined as ‘a document verifying the person’s identity, including, for example—(a) a passport; or (b) a copy of a certificate or extract from a register of births; or (c) a driver licence; or (d) a statutory declaration from an individual who has known the person for at least 1 year …’.5
12. If a person purports to make an access application and the application does not comply with all relevant application requirements, an agency must:6
13. If, after giving the applicant a reasonable opportunity to consult with a view to making the application in a form complying with all relevant application requirements, the agency decides the application does not comply with all relevant application requirements, the agency must give the applicant prescribed written notice of the decision within 10 business days after making the decision.9
14. To provide evidence of identity for the applicant, Mr Morris QC provided QUT with an affidavit dated 10 February 2016, filed in a court proceeding and witnessed by a barrister. There is no generally recognised photographic or other form of identity annexed to the affidavit. The affidavit relevantly states:
I, [applicant’s full name] of [address], tertiary student, affirm:
1. I am the [numbered] Respondent in this proceeding.
2. I am represented in this proceeding by Mr Morris QC.
15. Mr Morris QC provided a number of submissions to both QUT10 and OIC11 in support of the contention that this affidavit comprises evidence of identity for the applicant for the purpose of this application. In summary, Mr Morris QC submitted that:
16. I agree that the examples of evidence of identity included in section 3(1) of the IP Regulation are not exhaustive. However, for a document to comprise evidence of identity, it must be a document ‘verifying the person’s identity’. In determining the meaning of these words, I note that the IP Act12 must be applied and interpreted to further the primary object of the IP Act, which is to provide for the fair collection and handling in the public sector environment of personal information, and a right of access to personal information in the government’s possession or under the government’s control unless, on balance, it is contrary to the public interest to give access.13 Further, section 14A(1) of the AI Act provides that, in the interpretation of a provision of an Act, the interpretation that will best achieve the purpose of the Act is to be preferred to any other interpretation.
17. The word ‘verify’ is not defined in the IP Regulation, the IP Act or the AI Act; consequently, its ordinary meaning should be used. The definition listed for ‘verify’ in the Macquarie Dictionary Online includes ‘confirm or substantiate’. I consider that this definition of ‘verify’ should be adopted, in light of the purpose of these provisions—namely, for agencies to adopt appropriate procedures to safeguard personal information by ensuring that an individual’s personal information:
18. Further, I consider that this verification—or confirmation or substantiation—must be by a person other than the applicant themselves. As can be seen in the examples provided, the verification of identity is by a third party—eg:
19. I note Mr Morris QC’s comments that the affidavit is the kind of document which the court acts upon for the purpose of the proceeding. However, I consider that an affidavit by an individual about their own identity does not comprise a document verifying—ie, confirming or substantiating—that individual’s identity, and therefore does not constitute evidence of identity under the IP Act. Further, the provision by Mr Morris QC of information about the individual who signed the affidavit, the circumstances in which it was signed and the circumstances giving rise to the making of the application, is not the type of verification of identity envisaged by the IP Act or Regulation.
20. Although I acknowledge that QUT is aware of the existence of the applicant and is, in this sense, aware of his identity, this awareness is not connected to the access application and cannot, of itself, amount to compliance with the requirement that an applicant provide evidence of their identity. An access application under the IP Act is an entirely separate process from the specified court proceeding, and from QUT’s general awareness of the applicant’s identity. Consistent with the care that agencies must exercise when dealing with personal information under the IP Act, it is necessary to provide evidence of the applicant’s identity in order to establish that an individual named as an access applicant in an access application is indeed the subject of the personal information applied for; a more general awareness of the existence of an individual that is named as an access applicant does not meet this requirement.
21. In response to OIC’s preliminary view to Mr Morris QC14 in terms similar to those set out at paragraph 20, he submitted that:15
22. In making these submissions, Mr Morris QC appears to be relying on QUT’s acceptance of evidence of his authorisation to act for the applicant.16 Given both parties to this external review agree that Mr Morris QC has provided evidence of his authorisation, I consider it appropriate to proceed on the basis that this issue is not in contention on external review and need not be considered by OIC. In these circumstances, while I acknowledge Mr Morris QC’s comments at paragraph 21 and his comments about there being apparent logical inconsistencies between QUT’s acceptance of evidence of an agent’s authorisation, but not of evidence of the authorising individual’s identity, I consider that it is not necessary for me to reach a decision about whether the requirements in section 43(3)(b) of the IP Act17 have been satisfied. My decision only extends to the requirements of section 43(3)(a) of the IP Act—ie, those relating to evidence of identity for the applicant—and consequently, logical inconsistencies of the type Mr Morris QC raised do not arise for consideration in this decision.
23. Accordingly, I am satisfied that the access application did not comply with the relevant application requirement at section 43(3)(a) of the IP Act.
24. I am satisfied that QUT made reasonable efforts to contact Mr Morris QC within 15 business days after the purported application was received and informed him how the application did not comply with a relevant application requirement. In reaching this conclusion, I note that:
25. I am also satisfied that QUT gave Mr Morris QC ‘a reasonable opportunity to consult with a view to making an application in a form complying with all relevant application requirements’, given:
26. Finally, I am satisfied that QUT gave the applicant prescribed written notice of the decision within 10 business days after making the decision, given:
27. In conclusion, for the reasons outlined above, I consider that QUT followed all necessary steps in section 53 of the IP Act before giving the applicant prescribed written notice of the decision under section 53(5) of the IP Act.
28. For the reasons set out above, I affirm QUT’s decision, and find that QUT was entitled to decide, under section 53 of the IP Act, that the access application did not comply with all relevant application requirements.
29. I have made this decision as a delegate of the Information Commissioner, under section 139 of the IP Act.
________________________
Assistant Information Commissioner Corby
Date: 30 August 2016
Date | Event |
---|---|
14 June 2016 | Mr Morris QC emailed the access application form to QUT. |
15 June 2016 | QUT emailed Mr Morris QC, seeking clarification about the scope of the access application, and requesting evidence about the scope of his authority to act on the applicant’s behalf. Mr Morris QC emailed QUT, responding about the scope of the access application and the authority to act. |
17 June 2016 | QUT emailed Mr Morris QC, confirming the exclusion of certain information from the scope of the access application, responding about the authority to act issue, and requesting evidence of identity for the applicant by 28 June 2016. |
21 June 2016 | QUT emailed its lawyers, requesting information about the scope of Mr Morris QC’s authority to act. |
22 June 2016 | QUT’s lawyers emailed QUT, responding about the scope of Mr Morris QC’s authority to act. |
23 June 2016 | QUT emailed Mr Morris QC, confirming QUT’s satisfaction about the scope of his authority to act for the applicant, noting concerns about the breadth of the scope of the access application, and requesting evidence of identity for the applicant by 28 June 2016. |
28 June 2016 | Mr Morris QC emailed QUT, responding to the concerns about the breadth of the scope of the access application, and attaching a copy of the applicant’s affidavit in the court proceeding. QUT emailed Mr Morris QC, noting that the applicant’s affidavit did not comply with the evidence of identity requirements and granting an extension for satisfactory evidence to be provided until 1 July 2016, and noting further concerns about the breadth of the scope of the access application. Mr Morris QC emailed QUT, stating that no extension was sought or required, and submitting that he had already provided a document verifying the applicant’s identity to QUT. |
6 July 2016 | QUT emailed its decision to Mr Morris QC. |
11 July 2016 | Mr Morris QC and QUT’s lawyers corresponded about the decision, possible courses of action, and possible OIC or judicial review proceedings. |
13 July 2016 | Mr Morris QC and QUT’s lawyers corresponded about the decision. |
18 July 2016 | QUT’s lawyers emailed Mr Morris QC, explaining the decision, proposing a form of evidence of identity acceptable to QUT, and addressing possible OIC or judicial review proceedings. Mr Morris QC emailed the external review application to OIC. |
19 July 2016 | OIC emailed QUT, notifying QUT of the external review application, and asking QUT to provide procedural documents. |
21 July 2016 | QUT emailed the requested procedural documents to OIC. |
22 July 2016 | OIC emailed Mr Morris QC, notifying him that OIC had accepted the application for external review, and proposing an informal resolution proposal regarding the form of evidence of identity acceptable to QUT. Mr Morris QC emailed OIC, rejecting the informal resolution proposal and asking OIC to proceed to make a decision. |
25 July 2016 | OIC emailed QUT, notifying QUT that OIC had accepted the application for external review. |
26 July 2016 | Mr Morris QC emailed OIC, providing submissions and supporting material. |
28 July 2016 | Mr Morris QC emailed OIC, asking if OIC required anything further. |
1 August 2016 | Mr Morris QC emailed OIC, asking if OIC required anything further. OIC emailed Mr Morris QC. |
19 August 2016 | OIC emailed a preliminary view to Mr Morris QC. Mr Morris QC emailed OIC, notifying OIC of the rejection of the preliminary view, and providing submissions. |
1 This relevant application requirement is set out in section 43(3)(a) of the IP Act.
2 I note that, in QUT’s decision, the decisionmaker:
* confirmed that ‘in view of [Mr Morris QC’s] instructions to act for [his] client in the [specified court] and the subject matter in the information access request, I was satisfied that those instructions constituted authority to act as agent for [the applicant’s] information access request’; and
* noted that ‘[t]he approved form is unsigned although it has been transmitted from email address morrisqc@lexscripta.com which is listed as [Mr Morris QC’s] email address on the website http://www.innsofcourt.com.au and in [the applicant’s] affidavit’.
3 See definition of‘relevant application requirement’in section 53(6) of the IP Act.
4 Section 43(3)(a) of the IP Act.
5 Section 43(4) of the IP Act and section 3(1) of theInformation Privacy Regulation(Qld) (IP Regulation).
6 Section 53(1) of the IP Act.
7 Section 53(2) of the IP Act.
8 Section 53(3) of the IP Act.
9 Section 53(5) of the IP Act.
10 Emails at 2:09pm and 4:17pm on 28 June 2016, and on 11 July 2016.
11 Emails on 18 July 2016 (external review application), and 26 July 2016.
12 Which, for relevant purposes, includes the IP Regulation: see definitions of‘Act’and‘statutory instrument’in sections 7(1) and 36(1) and schedule 1 of theActs Interpretation Act 1954(Qld) (AI Act), and section 7 of theStatutory Instruments Act 1992 (Qld).
13 Section 3 of the IP Act.
14 Sent on 19 August 2016.
15 Email on 19 August 2016.
16 The relevant comments in this regard in QUT’s decision are set out at footnote 2.
17 Including the requirement to provide evidence of the agent’s authorisation.