The High Court takes an orthodox approach on the requirements of procedural fairness in extraordinary circumstances
On 27th July 2016 the High Court handed down its decision as to whether a serious data breach amounted to denial of procedural fairness for Applicant SSZJS, a Bangladeshi national and SZTZI, a Chinese National who were seeking asylum in Australia. In a unanimous decision the High Court allowed the appeal of the Minister for Immigration and Border Protection and found that there was no denial of procedural fairness to these asylum seekers.
On the 10th February 2014 the Department of Immigration and Border Protection published its monthly report entitled ‘Immigration Detention and Community Statistics Summary’. Due to an unidentified error, this report contained the personal information of 9, 258 asylum seekers who were in detention. This information was available on the internet until the 24th February 2014 during which time it was accessed 123 times. This event became known as the ‘Data Breach’. On the date of the breach the Department retained KPMG (an advisory and audit firm) to investigate.
On the 12th March 2014 the Department sent a standard form letter to all 9, 258 affected asylum seekers admitting to the Data Breach and saying “The department will assess any implications for you personally as part of its normal processes”. It was not until the 1st October 2014 that the Department confirmed it was undertaking International Treaty Obligations Assessments (‘ITOAs’) to assess the effect of the Data Breach on Australia’s international obligations with respect to each affected asylum seeker. Department Officers conducting the ITOAs were specially instructed to adopt “the assumption that an Applicants’ personal information may have been accessed by authorities in the country in which the applicant feared persecution or other relevant harm” (‘the assumption’).1
On 7th March 2014 SZSSJ commenced proceedings in the Federal Court which culminated on 2 September 2015 in front of the Full Bench of the Federal Court of Australia. The Full Bench granted a declaration that SZSSJ was denied procedural fairness and granted an injunction preventing his removal from Australia. The case found that the ITOA was preparatory to the Minister making a migration decision under the Act and so was a statutory process such that procedural fairness applied. This overruled the earlier finding of the Federal Circuit Court that there was no migration decision. SZTZI commenced proceedings in the Federal Circuit Court after an ITOA found Australia did not owe her protection obligations. Her application was joined to SZSSJ’s appeal to the High Court after SZSSJ’s victory before the Full Bench re-opened the issues of SZTZI’s case.
The High Court considered three arguments endorsed by the Full Bench. First, that the Federal Circuit Court had jurisdiction to hear the case. Second, that procedural fairness was required as the ITOA process was a statutory process. Third, that procedural fairness so required had not been afforded because the process had not been adequately explained and because the Department had not “show[n] its full hand”2 by providing the unabridged KPMG report. The High Court overturned only the last of these arguments.
The High Court upheld the Federal Court’s reasoning that the ITOA process attracted the requirements of procedural fairness on the basis that the ITOA was a process undertaken by an officer of the Department under and for the purposes of the Act and that the exercise of the statutory power affected an asylum seeker’s interest because their time in immigration detention was prolonged while the ITOA process was being undertaken.3
The High Court also upheld the Full Court’s finding that the Federal Circuit Court (from which SZSSJ had appealed) had jurisdiction, stating that “a challenge to conduct undertaken by an officer of the Department under the Act and for the purpose of assisting the Minister’s consideration of the exercise of a non-compellable power can be heard and determined by the Federal Circuit Court”.4
On the third point the High Court found that Procedural Fairness had been afforded to the applicants, overturning the findings of the Full Bench. The High Court reiterated the orthodoxy that the Federal Court could not “go beyond the declaration and enforcing of the law” and “the court has no jurisdiction simply to cure administrative justice or error”.5 In other words, the Federal Court could decide that procedural fairness was not afforded if the process was not explained but they could not make this decision on the basis that the process was explained poorly.
The High Court also found that there was no duty for the Department to “show their full hand”, stating that “ … Ordinarily, there is no requirement that the person be notified of information which is in the possession of, or accessible to, the repository but which the repository has chosen not to take into account at all in the conduct of the inquiry.  Extraordinary as they are, the circumstances of the Data Breach do not warrant a departure from those ordinary requirements”.6
The High Court considered the Department’s assumption to be “sensible” because the true extent of who had accessed an asylum seeker’s personal information “must in practical terms have been unknowable”7 and further that the assumption was reasonable to interpret and was in fact interpreted by the Department to mean that all of the asylum seeker’s personal information was accessed by all the persons or entities for whom the asylum seeker feared persecution or other relevant harm.8 As such, SZSSJ and SZTZI would not have been any further advantaged if they had had access to the full KPMG report and thereby known which IP addresses had accessed their personal information.9
On the particular facts of each case, the High Court found that SZSSJ and SZTZI were afforded a reasonable opportunity to be heard because, following the standard form letter of 12 th March 2014, both applicants received written correspondence from the Department which put each applicant on notice of the nature, purpose and issues to be considered in the ITOA process, as well as the nature and content of information the Department might take into account as a reason for reaching a conclusion adverse to SZSSJ and SZTZI. The High Court was of the view that exactly how and why the Data Breach occurred was not relevant to the question of whether each Applicant was owed protection by Australia.10
Importantly, the High Court decision affirms that the Department owes procedural fairness obligations to all 9,258 affected applicants in their ITOA although there is no more procedural fairness required than in any other circumstances, despite the seriousness of the Data Breach. Although the process was fair in this case, it does not preclude the possibility that a breach of procedural fairness has occurred for other applicants who may have received less than adequate information about the nature, purpose and issues to be considered in the ITOA process and/or were not informed of information that the Department took into account to find that Australia’s protection obligations were not engaged.
Read the complete decision by the High Court here.
1 Minister for Immigration and Border Protection v SZSSJ  HCA 29 at .
2 SZSSJ v Minister for Immigration and Border Protection  FCAFC 125 at  3 Supra n1 .
4 Ibid .
5 Ibid .
6 Ibid  – .
7 Ibid .
8 Ibid .
9 Ibid .
10 Ibid .