FOIREQ24/00508 1014
FOIREQ24/00508 1015
FOIREQ24/00508 1016
FOIREQ24/00508 1017
FOIREQ24/00508 1018
FOIREQ24/00508 1019
FOIREQ24/00508 1020
FOIREQ24/00508 1021
FOIREQ24/00508 1022
FOIREQ24/00508 1023
FOIREQ24/00508 1024
FOIREQ24/00508 1025
FOIREQ24/00508 1026
FOIREQ24/00508 1027
FOIREQ24/00508 1028
FOIREQ24/00508 1029
FOIREQ24/00508 1030
FOIREQ24/00508 1031
FOIREQ24/00508 1032
FOIREQ24/00508 1033
FOIREQ24/00508 1034
FOIREQ24/00508 1035
FOIREQ24/00508 1036
FOIREQ24/00508 1037
FOIREQ24/00508 1038
FOIREQ24/00508 1039
FOIREQ24/00508 1040
FOIREQ24/00508 1041
FOIREQ24/00508 1042
FOIREQ24/00508 1043
FOIREQ24/00508 1044
FOIREQ24/00508 1045
Referring conduct to the AFP
June 2019
Contents
Background
3
When this guidance applies
3
Offence provisions
3
Identifying circumstances that may amount to an offence
8
2
oaic.gov.au
FOIREQ24/00508 1046
Referring conduct to the AFP
June 2019
Background
When this guidance applies
The
Privacy Act 1988 (Cth) (Privacy Act) and the
Freedom of Information Act 1982 (Cth) (FOI Act)
contain a number of provisions where a breach wil amount to a criminal offence (offence
provisions). Some of these offences apply to conduct of third parties that may occur during the
course of the OAIC conducting its role as a regulator.
You need to be aware of the offence provisions if you are working on the fol owing types of cases:
• Complaints and investigations under Part V of the Privacy Act
• Credit reporting under Part IIIA of the Privacy Act
• Privacy cases involving the col ection, use and disclosure of personal information in
emergencies and disasters in which the special provisions under Part VIA of the Privacy Act
apply
• Information Commissioner reviews under Part VII of the FOI Act
• Investigations under Part VIIB of the FOI Act.
You wil also need to be aware of how to identify conduct that may amount to an offence under
these provisions and what to do if you suspect that an offence may have occurred. In the event
that conduct amounting to an offence under the Privacy Act is suspected, an officer wil need to
raise the issue with their manager, who wil then raise with their SES and Legal Services for
consideration.
Apart from an offence under s 49 of the Privacy Act which imposes a mandatory obligation to refer
to the Australian Federal Police (AFP), the offence provisions leave it to the discretion of the
Commissioner to decide whether to refer conduct to the AFP.
Purpose
This guidance material outlines:
• what the offence provisions are, with a focus on s 65(3) of the Privacy Act
• identifying whether there exist circumstances giving rise to an offence under s 65(3) of the
Privacy Act on the face of the case (prima facie case)
• processes for considering whether there is a prima facie case
• relevant considerations in exercising the referral discretion.
Offence provisions
Privacy Act
The fol owing table sets out the offence provisions relevant to the Privacy Act.
3
oaic.gov.au
FOIREQ24/00508 1047
Referring conduct to the AFP
June 2019
Types of cases Offence
Conduct
Penalty
Discretionary
provision
or
(Privacy
compulsory
Act)
referral to
AFP
Investigations
S 46(2)
A person must not,
Imprisonment for Discretionary
under s 40,
without reasonable
6 months or 10
where a person
excuse, fail to attend a
penalty units or
has been
compulsory conference,
both for
directed by a
or fail to attend from day
individuals.
s 46 written
to day unless excused or
50 penalty units
notice to attend
released from further
for a body
a compulsory
attendance by the
corporate
conference
Commissioner.
Investigations
s 49
The person committed a
Various
Compulsory
under s 40
tax file number offence, a
referral where
healthcare identifier
the
offence and AML/CTF
Commissioner
verification offence or a
forms the
credit reporting offence
opinion that
the offence
may have
occurred.
Investigations
S 65(1)
A person must not,
Imprisonment for Discretionary
under s 40,
without reasonable
12 months or 20
where a person
excuse, refuse or fail to
penalty units or
has been issued
attend before the
both
with a s 44
Commissioner or refuse
notice to attend
or fail to swear an oath or
before the
make an affirmation
Commissioner
when required to do so
under the act.
Conciliations,
S 65(3)
A person must not give
Imprisonment for Discretionary
preliminary
information or make a
12 months or 20
enquiries,
statement to the
penalty units or
investigations
Commissioner knowing
both
of privacy
that it is misleading in a
complaints
material particular.
under Part V
Investigations
S 66(1)
A person must not refuse
Imprisonment for Discretionary
under s 40,
or fail to give information, 12 months or 20
where a person
or to answer a question or penalty units or
has been issued
produce a document or
both for
with a s 44
record when so required
individuals
notice to attend
under the act.
before the
Commissioner
4
oaic.gov.au
FOIREQ24/00508 1048
Referring conduct to the AFP
June 2019
Types of cases Offence
Conduct
Penalty
Discretionary
provision
or
(Privacy
compulsory
Act)
referral to
AFP
100 penalty units
for a body
corporate
Where a person S 68A(3)
A person must not fail to
1 penalty unit
Discretionary
has been
return their identity card
authorised by
to the Commissioner as
the
soon as practicable after
Commissioner
the person ceases to be
the power to
authorised.
enter premises
under s 68
Dealing with
S 80Q(1)
A person who obtains
Imprisonment for Discretionary
personal
personal information
1 year or 60
information in
relating to an individual
penalty units or
emergencies
because of the operation
both
and disasters
of this part, and the
under Part VIA
person is not a
responsible person for
the individual, must not
disclose that information
unless the disclosure is
authorised under s
80Q(2).
Credit reporting S 20P(1)
A credit reporting body
200 penalty units Discretionary
under Part IIIA
must not use or disclose
credit reporting
information which is false
or misleading in a
material particular.
Credit reporting S 21R(1)
A credit provider must not 200 penalty units Discretionary
under Part IIIA,
disclose information
where a credit
about an individual to a
provider has
credit reporting body
disclosed
which is false or
information
misleading in a material
under s 21D.
particular.
Credit reporting S 21R(2)
A credit provider must not 200 penalty units Discretionary
under Part IIIA
use or disclose credit
eligibility information
which is false or
misleading in a material
particular.
5
oaic.gov.au
FOIREQ24/00508 1049
Referring conduct to the AFP
June 2019
Types of cases Offence
Conduct
Penalty
Discretionary
provision
or
(Privacy
compulsory
Act)
referral to
AFP
Credit reporting S 24(1)
An entity must not obtain 200 penalty units Discretionary
under Part IIIA,
credit reporting
where an entity
information from a credit
obtains credit
reporting body unless it is
reporting
an entity to which the
information
body is permitted to
disclose information to or
the entity is an access
seeker for the
information.
Credit reporting S 24(2)
An entity must not obtain 200 penalty units Discretionary
under Part IIIA,
credit reporting
where an entity
information from a credit
obtains credit
reporting body under
reporting
false pretence.
information
Credit reporting S 24A(1)
An entity must not obtain 200 penalty units Discretionary
under Part IIIA,
credit eligibility
where an entity
information from a credit
obtains credit
provider unless it is an
eligibility
entity to which the
information
provider is permitted to
disclose the information
to or the entity is an
access seeker for the
information.
Credit reporting S 24A(2)
An entity must not obtain 200 penalty units Discretionary
under Part IIIA,
credit eligibility
where an entity
information from a credit
obtains credit
provider under false
eligibility
pretence.
information
FOI Act
The fol owing table sets out the FOI Act offence provisions.
6
oaic.gov.au
FOIREQ24/00508 1050
Referring conduct to the AFP
June 2019
Types of Cases
Offence
Conduct
Penalty
Discretionary
provision
or
(FOI Act)
compulsory
referral to
AFP
IC review under Part VII, S 55W(3)
A person breaches
6 months
Discretionary
where a person has
a requirement set
imprisonment
been issued with a
out in the notice
notice to appear before
under s 55W.
the Commissioner
under s 55W
IC review under Part VII S 55R(5)
A person breaches
6 months
Discretionary
where a person has
a requirement set
imprisonment
been issued with a
out in the notice
notice under s 55R to
under s 55R.
produce
information/documents
IC review under Part VII S 55X(3)
A person breaches
6 months
Discretionary
where a person has
the requirement to imprisonment
been issued with a
be examined on
notice under s 55W and
oath or affirmation.
is required to appear
before the
Commissioner and take
an oath or affirmation
IC investigations under S 79(5)
A person breaches
6 months
Discretionary
Part VIIB, where a
a requirement set
imprisonment
person has been
out in the notice
required to produce
under s 79.
information/documents
under s 79(3)
IC investigations under S 82(3)
A person breaches
6 months
Discretionary
Part VIIB, where a
a requirement set
imprisonment
person has been
out in the notice
required to appear
under s 82.
before the
Commissioner to
answer questions under
s 82(1)
IC investigations under S 83(3)
A person breaches
6 months
Discretionary
Part VIIB, where a
the requirement to imprisonment
person has been issued
be examined on
with a notice under s
oath or affirmation.
82(1) and is required to
appear before the
Commissioner and take
an oath or affirmation
7
oaic.gov.au
FOIREQ24/00508 1051
Referring conduct to the AFP
June 2019
Identifying circumstances that may amount to an
offence
In any case in which it appears that there is conduct that may amount to an offence under one or
more of the offence provisions, the primary question is whether a prima facie case is made out on
the facts as known. For al instances where conduct is suspected to amount to an offence under
one or more of the offence provisions, you should contact Legal Services to assist in determining
whether a prima facie case is made out.
In circumstances involving s 65(3) of the Privacy Act in particular (the furnishing of information or
the making of a statement that is false or misleading in a material particular), please see the
guidance below.
Misleading the Commissioner – s 65(3) of the Privacy Act
In order to make out a prima facie offence having been committed under s 65(3), the fol owing
elements must be established:
1. A person furnishes information or makes a statement to the Commissioner. For example, a
person sends an email to the Commissioner containing statements.
2. The person intended to furnish the information or make the statement to the
Commissioner. In the example, this means that they intend to send the email.
3. The information or statement is false or misleading. False or misleading information can
include omissions where such omissions create a false impression. For example, the email
contains information that the individual did something that they did not do, or the email
omits information without which gives an impression of something that is false.
4. The information or statement is false or misleading in a material particular. A material
particular is something that is not trivial and has relevance to the case. For example, the
email contains false information in response to a question about whether the respondent
to a privacy complaint disclosed personal information where an individual claims that the
respondent breached their privacy by disclosing the personal information. This would
likely be false in a material particular.
If it appears that the elements exist on the facts of the case as they are known, you should refer the
information to your manager, who will then raise the issue with their SES and Legal Services. Legal
Services will consider whether advice is required to determine whether a prima facie case is made
out.
Consideration of referral
Once it has been determined that a prima facie offence has been made out, and there is no
obligation to refer, the Commissioner will need to turn thier mind to the question of whether to
refer the conduct to the AFP.
8
oaic.gov.au
FOIREQ24/00508 1052
Referring conduct to the AFP
June 2019
Relevant factors
The overriding requirement in deciding whether to refer to the AFP is to exercise good faith,
including by ensuring that the decision to refer is made having regard to the objects of the Privacy
Act and that each decision to refer is consistent with other decisions to refer.
The fol owing is a non-exhaustive list of factors that should be considered:
• the need to maintain the dignity of the Commissioner's statutory office, and to preserve
public confidence and integrity of the investigation process
• the extent to which the alleged offending has the capacity to compromise the outcome of
the Commissioner's investigations
• how the al eged offending was discovered, including whether it was brought to the
attention of the OAIC by the al eged offender
• the steps taken by the al eged offender to remedy the conduct giving rise to the al eged
offence
• whether the al eged offender has engaged in similar conduct in the past
• whether the al eged offender has demonstrated contrition, for example, by apologising
• frequency with which the relevant offence occurs more general y and whether this results
in any adverse effect such as increased costs, delays and inconvenience
• need for deterrence
• whether the al eged breach lengthened the investigation and/or unnecessarily
complicated the matter
• capacity of the alleged breach to undermine public confidence in the investigation process
• relative seriousness of the al eged offence, from the Commissioner's perspective, on the
spectrum of matters involving al eged breaches of the particular offence provision.
Irrelevant factors
Demonstrating that a decision is exercised in good faith would, at a minimum, involve ensuring
that the decision is not made in bad faith, insofar as the fol owing irrelevant considerations are not
part of the decision-making process:
• race, religion, sex, national origin or political associations, activities or beliefs of the
al eged offender or anyone else who is involved
• any personal feelings about the al eged offender or a person aggrieved by the conduct
• any possible political advantage, disadvantage or embarrassment to the government or
any political group or party
• possible effect of the decision on the personal professional circumstances of those
responsible for making it.
Other factors
Factors that could raise concerns, and which the Commissioner should be mindful of, but do not
necessarily demonstrate bad faith in making a decision to refer include:
• referral after a lengthy period of delay without reasonable explanation for the delay
• referral on the basis of external pressure in circumstances where the matter would
otherwise not be referred
• assumptions as to the likely response by the AFP and or the Commonwealth Director of
Public Prosecutions (CDPP) and the likely severity of any sentence that might be imposed.
9
oaic.gov.au
FOIREQ24/00508 1053
Referring conduct to the AFP
June 2019
AFP requirements
• In addition to the factors outlined above, the Commissioner should have regard to any
current policies of the AFP requiring certain matters to be considered before referral to the
AFP, including any guidelines for deciding whether to investigate and prosecute matters,
and any risk management framework or matrix for determining the matter is likely to be
accepted for further action on referral.
Commissioner briefing
Once a preliminary assessment has been made as to the above matters, Legal Services wil prepare
a brief to the Commissioner outlining the background and seeking a decision, together with the
fol owing:
• legal advice setting out the prima facie case of an offence being committed
• preliminary assessment as to the relevant factors applied to the specific case
• proposed AFP brief.
10
oaic.gov.au
FOIREQ24/00508 1054
