State government agencies are covered by their own State privacy laws. In NSW, this is the Privacy and Personal Information Protection Act 1998 (PPIP Act). Also, there is The Health Records Information Privacy Act 2002 (HRIP Act).

Section 27 of the PPIP Act exempts certain bodies from complying with the IPPs. Those agencies are:

However, section 27(2) states that the IPPs do apply to the aforementioned agencies in connection with the exercise of their administrative and educative functions.

EPR v Commissioner of Police [2021] NSWCATAD 237

Facts

In December 2020, the Applicant made a report to NSW Police (NSWPF). He alleged that his Aunt stole jewellery from his deceased grandmothers' body on the evening of her death. The NSWPF then disclosed to the Aunt (and/or her legal rep), that the Applicant had made the allegations against her.

Relevant Law

The Applicant says that that this disclosure was a breach of section 18 of the PPIP, which covers IPP 11.

IPP 11 Restricted Disclosure:

An agency can only disclose your information in limited circumstances if you have consented or if you were told at the time they collected it that they would do so. An agency can also disclose your information if it is for a directly related purpose and it can be reasonably assumed that you would not object, if you have been made aware that information of that kind is usually disclosed, or if disclosure is necessary to prevent a serious and imminent threat to any person's health or safety.

The NSWPF said the conduct was in connection with their investigative duties. As such, section 27 applied and they were exempt from the PPIP Act and the IPPs.

The Tribunal noted previous cases which distinguished administrative functions from the 'core' responsibilities of the NSWPF.

"The Police Act 1990 s 6 provides that the Police Service has three functions, the first of which is 'to provide police services for New South Wales'.

"police services" includes:

  1. services by way of prevention and detection of crime, and
  2. the protection of persons from injury or death, and property from damage, whether arising from criminal acts or in any other way, and
  3. the provision of essential services in emergencies, and
  4. any other service prescribed by the regulations." HW v Commissioner of Police, NSW Police [2003] NSWADT 214

Another Tribunal case, followed the reasoning in HW:

"As noted in HW at [29], the term "administrative" cannot refer to the entirety of the administrative activity of the NSW Police, which would include investigation of crime, and it is intended to have a narrower compass." - EFR v Commissioner of Police [2020] NSWCATAD 159

No breach found

The Tribunal ultimately decided that the disclosure of the information did not breach the PPIP.

"I am satisfied that the Conduct of Concern fell within the exemption for the NSWPF provided by s 27(1) PPIP Act."

Administrative functions construed too narrowly, some say

Some Courts have previously defined administrative tasks in relation to Police forces.

The NSW Court of Appeal in Cran v State of New South Wales [2004] NSWCA 92 at [71] indicated that administrative tasks are ancillary to investigative and preventative processes. As such they cannot be separated from law enforcement functions.

The High Court said in Carr v The State of Western Australia [2007] HCA 47 at [23] that "making entries into police databases, returning the appellant's property, photographing him and taking DNA samples" were administrative tasks.

Both of these cases, however, did not directly address the definition of administrative functions in direct comparison with law enforcement functions, in light of section 27 of PPIP.

The Tribunal noted that there are administrative tasks within the investigative function of the NSW Police Force. However that does not automatically mean the function is administrative.

Privacy Advocates call for section 27 to be cut

In 2004, the Australian Privacy Foundation (APF) was asked by the NSW Attorney-General's Department to review the PPIP Act. In the paper, the APP argued that section 27 of the PPIP should be removed.

"The complete exemption from the IPPs provided by s27 for ICAC, the Police Service, PIC and Crime Commission cannot be justified, as the more limited exemptions relating to law enforcement and investigative agencies in s23 and s24 should suffice."

Section 23 of the PPIP states that a law enforcement agency, like NSW Police, are exempt from certain provisions of the PPIP Act.

Section 23 police privacy exemptions

The NSWPF are exempt from:

  • section 9, if compliance would prejudice the agency's law enforcement functions (s23(1)-(2));
  • section 9, if the information if collected in connection with proceedings before any court or tribunal (whether or not actually commenced); (s23(2))
  • section 10, if the information is collected for law enforcement purposes (however it doesn't remove any protection provide by any other law in relation to the rights of accused persons); (223(3))
  • section 17, if information was used for a purpose other than for which it was collected, but that purpose is reasonably necessary for law enforcement purposes or protection of public revenue; (s23(4))
  • section 18, if the disclosure:
    • was made in connection with proceedings for an offence, or for law enforcement purpose;
    • if to a law enforcement agency for the purposes of ascertaining the whereabouts of an individual who was reported as a missing person;
    • is authorities or required by subpoena or by search warrant or any other statutory instrument; or
    • is reasonably necessary for the protection of public revenue or
    • is reasonably necessary in order to investigated an offence where there are reasonable ground to believe that an offence has been committed; (s23(5)(a)-(d))
  • section 19, if the info is reasonably necessary for the purpose of law enforcement where they are reasonable grounds to believe an offence has been committed. (s23(7))
  • any sections in respect to collection, use or disclosure of personal information if the collection, use or disclosure of the information is reasonably necessary for law enforcement purposes AND the agency is providing the information to another agency. (s23(6A).

Police privacy exemptions facilitate law enforcement

In conclusion, NSW Police are already exempt from many sections which a strong discretion placed on what is 'reasonably necessary for the purpose of law enforcement'. This wide net case by section 23 seems to considerably overlap section 27, which seeks to clarify the length the NSWPF is exempt from Privacy laws.