Law enforcement agencies and the Privacy and Personal Information Protection Act 1998

Background

Ian Turnbull was convicted of the murder of Glen Turner and sentenced to imprisonment in 2015. While incarcerated, Ian Turnbull transferred property to his wife, Mrs Turnbull also a co-executor and beneficiary of his estate. Mr Turnbull died in 2017.

Robert Strange was a colleague of Glen Turner and witnessed his murder. Mr Strange commenced proceedings in the Supreme Court of NSW against Mrs Turnbull and the other executor challenging the validity of the property transfer.

In those proceedings, the Commissioner of Corrective Services NSW (Commissioner) complied with a subpoena to produce recordings of telephone conversations between Mr and Mrs Turnbull and their son. Mrs Turnbull and the other executor (Executors) sought to have the subpoena set aside or, alternatively, that no access to the recordings be granted to Mr Strange.

The Executors argued that the recordings contained “personal information” and was protected from disclosure under the Privacy Act. They sought to have the subpoena set aside or, alternatively, that no access to the subpoenaed recordings be given to Mr Strange.

Relevant legislation

Section 18 of Privacy Act provides that public sector agencies “must not” disclose an individual’s “personal information” (the prohibition), unless doing so is consistent with the reasons the information was collected, and the agency has no reason to believe the individual involved would object.

“Personal information” in this context is defined as “information or an opinion about individual whose identity is apparent”.

Section 23 of the Privacy Act creates exceptions to the prohibition for law enforcement agencies (including NSW Police and Corrective Services NSW) for ‘law enforcement’ purposes. Relevantly, 23(5)(c) of the Privacy Act provides that compliance with the prohibition is not required if disclosure is “authorised or required by subpoena”.

However, the exceptions are themselves qualified by section 23(6) of the Privacy Act, which states:

The Executors relied on this provision in support of their argument that Corrective Services should not produce the recordings.

Section 6 of the Act confirms that none of its provisions affect or otherwise limit the functions of a court.

Decision in the Supreme Court of NSW

The primary judge, Lindsay J, found in favour of Mr Strange on the application.

While his Honour noted the “uncertainty” apparent in the wording of sections 23(5) and (6), he found that the dual effect of those provisions was to:

1. exempt law enforcement agencies from the s 18 limitations on disclosure if personal information is sought under subpoena, and
   
   
2. not to create any additional disclosure requirements beyond compliance with a subpoena.
   
   

The Executors appealed from his Honour’s decision.

Decision in the NSW Court of Appeal

The Executors advanced two arguments on appeal:

1. that the exceptions in s 23(5)(c) of the Privacy Act should be read down so that they only apply for ‘law enforcement purposes’, which would exempt a law enforcement agency from complying with a subpoena issued in civil proceedings; and
   
   
2. that s 23(6) of the Privacy Act, properly construed, entitles a law enforcement agency to refuse to comply with a subpoena for the production of personal information.
   
   

The Court of Appeal upheld the primary judge’s findings and dismissed the appeal.

As to the first argument, Basten JA (with whom Meagher JA agreed) found that the ‘narrow reading’ of s23(5)(c) advocated by the Executors was not consistent when read in its surrounding context. His Honour also confirmed that, because the functions of a court are not affected by the operation of the Privacy Act, as expressly stated in s 6 of the Act, a law enforcement agency is not bound by the prohibition on disclosure of personal information if required to do so under subpoena, whether for ‘law enforcement purposes’ or otherwise.

As to the second argument, Basten JA agreed with the primary judge’s interpretation of s23(6). He found that s23(6) was inserted into the Act for “an abundance of caution”, or to reinforce that an agency is not required to disclose personal information in the absence of a subpoena.

While Emmett AJA agreed with Basten JA’s reasoning, his Honour found that Corrective Services’ compliance with the subpoena itself did not constitute a ‘disclosure’ of personal information. Rather, disclosure would have occurred when orders for access to the documents were made. Whether or not access orders are made is solely a matter for the court given the operation of 6 of the Privacy Act. Emmett AJA’s comments in this regard are strictly obiter as no other judges adopted his reasoning.

Implications

This decision provides greater clarity for law enforcement agencies with competing disclosure obligations contained in the Privacy Act and when required under subpoena.

When personal information that is protected under the Privacy Act is sought under a lawful subpoena to produce, a law enforcement agency will not be in breach of its disclosure requirements in complying with the subpoena.