Minister for Immigration and Border Protection and Another v Szssj and Another

• Jurisdiction: Australia Federal only
• Judge: French CJ,Kiefel,Bell,Gageler,Keane,Nettle,Gordon JJ
• Judgment Date: 27 July 2016
• Neutral Citation: [2016] HCA 29
• Date: 27 July 2016
• Court: High Court
• Docket Number: S75/2016 & S76/2016

[2016] HCA 29

HIGH COURT OF AUSTRALIA

French CJ, Kiefel, Bell, Gageler, Keane, Nettle AND Gordon JJ

S75/2016 & S76/2016

Matter No S75/2016

Minister for Immigration and Border Protection & Anor

Appellants

and

Szssj & Anor

Respondents

Matter No S76/2016

Minister for Immigration and Border Protection & Ors

Appellants

and

Sztzi

Respondent

Representation

S B Lloyd SC with J E Davidson for the appellants in each matter (instructed by Australian Government Solicitor)

N L Sharp and A M Hochroth with D P Hume for the first respondent in S75/2016 (instructed by N L Sharp)

Submitting appearance for the second respondent in S75/2016

M J Finnane QC with S E J Prince and P W Bodisco for the respondent in S76/2016 (instructed by Michaela Byers, Solicitor)

Migration Act 1958 (Cth), ss 48B, 195A, 417, 474, 476.

Minister for Immigration and Border Protection v SZSSJ

Minister for Immigration and Border Protection v SZTZI

Migration — Refugees — Protection visas — Procedural fairness — Where SZSSJ and SZTZI (‘respondents’) applied for protection visas — Where respondents' personal information published on Department of Immigration and Border Protection website and accessed from 104 unique IP addresses — Where IP addresses known to Department — Where Department conducted International Treaties Obligations Assessments (‘ITOAs’) to determine impact of publication on non-refoulement obligations — Where ITOAs conducted in accordance with publicly available ‘Procedures Advice Manual’ — Where Department notified respondents of ITOAs and instructed officers conducting ITOAs to assume personal information may have been accessed by authorities in countries where respondents feared persecution or other relevant harm — Where Department neither disclosed IP addresses nor provided unabridged report relating to disclosure of personal information — Whether obligation to afford procedural fairness applied to ITOA processes — Whether ITOA processes procedurally fair.

Courts and judges — Jurisdiction — Federal Circuit Court of Australia — Whether respondents' claims to relief engaged jurisdiction of Court — Whether jurisdiction excluded by s 476(2)(d) of Migration Act 1958 (Cth).

Words and phrases — ‘conduct preparatory to the making of a decision’, ‘International Treaties Obligations Assessment’, ‘privative clause decision’, ‘procedural decision to consider whether to grant a visa or to lift the bar’, ‘substantive decision to grant a visa or to lift the bar’.

1 French CJ, Kiefel, Bell, Gageler, Keane, Nettle AND Gordon JJ. These two appeals are from a decision of the Full Court of the Federal Court 1 on appeal from decisions of the Federal Circuit Court. They arise from separate proceedings commenced in the Federal Circuit Court by two former visa applicants. The relief sought in those proceedings included declarations that the former visa applicants had been denied procedural fairness in the implementation of procedures undertaken by officers of the Department of Immigration and Border Protection to assess the consequences to them of an incident that has become known as ‘the Data Breach’.

2 For reasons which follow, the Full Court of the Federal Court was right to conclude that the Federal Circuit Court had jurisdiction to entertain the proceedings, and was right to conclude that the applicants were owed procedural fairness, but was wrong to conclude that the applicants have been denied procedural fairness. Each appeal must be allowed.

The Data Breach and the administrative response

3 The Data Breach occurred on 10 February 2014. The Department routinely publishes statistics on its website. This time the particular electronic form of the document in which the statistics were published included embedded information which disclosed the identities of 9,258 applicants for protection visas who were then in immigration detention. The document containing the embedded information remained on the website until 24 February 2014.

4 On any view, the Data Breach was very serious. The information disclosing the identities of the applicants for protection visas embedded in the document published by the Department was information protected from unauthorised access and disclosure by criminal prohibitions in Pt 4A of the Migration Act 1958 (Cth).

5 Having been alerted to the Data Breach, the Department retained external consultants, KPMG, to investigate. KPMG prepared a report for the Department. An abridged version of the KPMG report was later made available to affected applicants. The abridged version of the report recorded that, during the 14 days in which the document disclosing the identities of the visa applicants had

remained on the website, the document had been accessed 123 times and that the access had originated from 104 unique internet protocol (‘IP’) addresses.

6 The abridged version of the KPMG report did not record those IP addresses or give the precise time of access. Rather, the abridged version stated:

‘It is not in the interests of detainees affected by this incident to disclose further information in respect of entities [who] have accessed the Document, other than to acknowledge that access originated from a range of sources, including media organisations, various Australian Government agencies, internet proxies, TOR network and web crawlers’.

The abridged version went on to record that its authors had ‘not identified any indications that the disclosure of the underlying data was intentional or malicious’.

7 Irrespective of the cause of the disclosure there was obviously a risk that those in other countries from whom applicants for protection visas claimed to fear persecution or other relevant harm might have gained access to the document containing the embedded information so as to become aware of the identities of applicants for protection visas in Australia. The question for the Department was what to do about that risk.

8 In early March 2014, the Secretary of the Department sent a standard form letter to each of the affected applicants. The letter informed those applicants of the Data Breach and expressed deep regret. The letter continued:

‘The information that it was possible to access was your name, date of birth, nationality, gender, details about your detention (when you were detained, reason and where) and if you have other family members in detention.

The information did not include your address (or any former address), phone numbers or any other contact information. It also did not include any information about protection claims that you or any other person may have made, and did not include any other information such as health information.

The department will assess any implications for you personally as part of its normal processes. You may also raise any concerns you have during those processes.’

9 Beyond showing that the Department sent follow-up letters to applicants in June 2014, the record in the appeals does not reveal what was being done by the Department about the Data Breach at a systematic level before the end of September 2014. The departmental response appears by then to have been channelled into processes known as ‘International Treaties Obligations Assessments’ (‘ITOAs’) conducted in accordance with standardised procedures set out in the Department's publicly available Procedures Advice Manual. The purpose of conducting these particular ITOAs was to assess the effect of the Data Breach on Australia's international obligations with respect to affected applicants. The particular international obligations to which the ITOAs were directed were Australia's non-refoulement obligations under the Refugees Convention 2, the Torture Convention 3 and the International Covenant on Civil and Political Rights 4.

10 Departmental officers conducting the ITOAs were specifically instructed to assess the effect of the Data Breach on Australia's non-refoulement obligations adopting the assumption that an applicant's personal information may have been accessed by authorities in the country in which the applicant feared persecution or other relevant harm.

11 Standard departmental instructions in the Procedures Advice Manual for the conduct of an ITOA indicated that a finding by an officer that a non-refoulement obligation was engaged in respect of a particular applicant might result in referral of that applicant's case to the Minister for decision by the Minister whether or not to exercise a power conferred by specified sections of the Act. Relevantly to an applicant in respect of whom a non-refoulement obligation might be found to be engaged as a consequence of the Data Breach, the sections specified included ss 48B, 195A and 417.

12 Common features of those sections are that they confer ‘non-compellable’ powers on the Minister to grant a visa in the cases of ss 195A and 417 or to lift a

statutory bar to the making of an application for a visa in the case of s 48B. Each is a power: which the Minister ‘may’ exercise if ‘the Minister thinks that it is in the public interest to do so’; which can only be exercised by the Minister personally; and of which the Minister has no duty to consider the exercise. Another common feature of the sections is that the powers they confer can (and, in the case of the power conferred by s 195A, can only) be exercised in respect of unlawful non-citizens who are in immigration detention under s 189 of the Act for the duration provided by s 196.

13 One of the possible end-points of immigration detention for which s 196 provides is removal from Australia under s 198. Section 198 relevantly provides:

• ‘(1) An officer must remove as soon as reasonably practicable an unlawful non-citizen who asks the Minister, in writing, to be so removed.

• …

• (6) An officer must remove as soon as reasonably practicable an unlawful non-citizen if:

  • (a) the non-citizen is a...