Bilal v Australian Information Commissioner - Privacy Act Judicial Review

Original Word Document (83.5 KB) Federal Court of Australia

Bilal v Australian Information Commissioner [2026] FCA 376

| File number: | NSD 1714 of 2025 |
| | |
| Judgment of: | STEWART J |
| | |
| Date of judgment: | 2 April 2026 |
| | |
| Catchwords: | ADMINISTRATIVE LAW – judicial review of decision of the Australian Information Commissioner under s 41 of the Privacy Act 1988 (Cth) to decline to investigate the applicant’s privacy complaint – where Commissioner conceded that decision was affected by error but dispute as to characterisation of the error and form of relief – where Commissioner fundamentally misunderstood and misconstrued the nature of the complaint – where applicant denied procedural fairness – decision set aside and referred to Commissioner for determination according to law – declaration made |
| | |
| Legislation: | Administrative Decisions (Judicial Review) Act 1977 (Cth) ss 5(1), 5(1)(d), 5(1)(h), 5(3)(b), 6(1)(a), 16(1)(a), 16(1)(b), 16(1)(c), 16(2), 16(2)(a)

Privacy Act 1988 (Cth) ss 35A, 36, 40, 41, 41(1), 41(1)(dd), 52 |
| | |
| Cases cited: | ASP15 v Commonwealth [2016] FCAFC 145; 248 FCR 372

Baggaley v Attorney-General (Cth) [2025] FCA 968

Bell Lawyers Pty Ltd v Pentelow [2019] HCA 29; 269 CLR 333

Curragh Queensland Mining Ltd v Daniel [1992] FCA 36 (AustLII citation [1992] FCA 44); 34 FCR 212

Disorganized Developments Pty Ltd v South Australia [2023] HCA 22; 280 CLR 515

Madzikanda v Australian Information Commissioner [2023] FCA 1445; 330 IR 387

Patrick v Australian Information Commissioner [2024] FCAFC 93; 304 FCR 1 |
| | |
| Division: | General Division |
| | |
| Registry: | New South Wales |
| | |
| National Practice Area: | Administrative and Constitutional Law and Human Rights |
| | |
| Number of paragraphs: | 31 |
| | |
| Date of last submissions: | 16 March 2026 |
| | |
| Date of hearing: | Determined on the papers |
| | |
| Counsel for the Applicant: | The applicant is a litigant-in-person |
| | |
| Solicitor for the Respondent: | J Pinder of Mills Oakley |
ORDERS

| | | NSD 1714 of 2025 |
| | | |
| BETWEEN: | ALI BILAL

Applicant | |
| AND: | AUSTRALIAN INFORMATION COMMISSIONER

Respondent | |

| order made by: | STEWART J |
| DATE OF ORDER: | 2 APRIL 2026 |
THE COURT DECLARES THAT:

A. The conduct of the respondent in failing to afford the applicant procedural fairness prior to making a decision under s 41 of the Privacy Act 1988 (Cth) on the applicant’s complaint was unlawful.

THE COURT ORDERS THAT:

1. The decision of the respondent dated 22 August 2025 declining to investigate the applicant’s complaint dated 24 April 2025 be set aside under s 16(1)(a) of the Administrative Decisions (Judicial Review) Act 1977 (Cth), and the complaint be referred to the respondent under s 16(1)(b) for decision according to law.

2. The respondent pay the applicant’s costs of the application.

Note:    Entry of orders is dealt with in Rule 39.32 of the Federal Court Rules 2011.

REASONS FOR JUDGMENT

STEWART J:

Introduction

1 This is an application for judicial review of a decision made on 22 August 2025 by the respondent, the Australian Information Commissioner (by her delegate), under s 41 of the Privacy Act 1988 (Cth) to decline to investigate the applicant’s privacy complaint made under s 36 of the Privacy Act.

2 Following an initial case management hearing, the Commissioner conceded that the decision of the delegate was affected by error, and that the decision should be set aside and the matter referred back to the Commissioner for a fresh decision under s 16(1)(b) of the Administrative Decisions (Judicial Review) Act 1977 (Cth) (ADJR Act). This was said to be on the basis that “the delegate made the decision based on the existence of a fact that did not exist”, referring to s 5(1)(h) of the ADJR Act.

3 Despite this concession, the parties were unable to agree on the proper characterisation of the error and the form of relief to be granted. They filed further submissions dealing with that dispute, which is the issue addressed in these reasons for judgment.

Background

4 In February 2025, the applicant made a request to The Procare Group Pty Ltd (Procare) to access “all personal information” about him held by Procare. The applicant made a further enquiry to Procare a few weeks later, in March 2025.

5 Procare then responded to the applicant in which it denied the applicant’s request. The essence of the response was that the personal information that the applicant sought was collected or handled by Procare “on behalf of EML NSW, an agent for Insurance and Care NSW (iCare NSW)”. Procare asserted that it is exempt from the requirements of the Australian Privacy Principles in the Privacy Act in this instance because it was acting under a contract for EML and it is a contracted service provider for a State contract.

6 The applicant made another request to Procare a few days later but it too was refused.

7 On 24 April 2025, the applicant lodged a complaint under s 36 of the Privacy Act with the Office of the Australian Information Commissioner. The complaint was lodged by webform on the Commissioner’s internet portal. In the “Preferred Contact Method” field, the applicant entered his email address. The “Phone” and “Mobile” fields were left blank.

8 The complaint sought that the Commissioner:

(1) Investigate Procare’s refusal to comply with his request and declare that a serious interference with his privacy had occurred;

(2) Require Procare to provide complete access to all personal and health-related information they held about him;

(3) Investigate whether Procare had applied the same [allegedly] unlawful reasoning in other cases; and

(4) Award him $10,000 in general damages (reserving his right to seek further compensation).

9 On the same day, the Commissioner by letter to the applicant acknowledged receipt of the complaint and stated that “a staff member will make contact to discuss the next steps”.

10 The Commissioner made no further contact with the applicant until the email referred to below.

The decision

11 On 22 August 2025, which is to say four months later, the Commissioner’s delegate emailed the applicant. The delegate stated that he had “attempted to contact” the applicant that day but was “unable to reach [him]”.

12 Shortly before he received the delegate’s email, the applicant received a call from a “no caller ID” number which he did not answer. That may have been an attempt by the delegate to contact him, although it is not clear how the delegate would have had the applicant’s mobile number as he had not provided it in his complaint. The applicant had also, as mentioned, stipulated email as his preferred method of contact. The delegate’s email does not state what form of contact had been attempted.

13 The gravamen of the delegate’s email was that he had “decided to exercise the discretion under s 41(1) of the Privacy Act to decline to investigate the complaint”.

14 The delegate also stated: “You claim that the Respondent interfered with your privacy by not deleting your account and personal data.” That was despite the applicant’s complaint actually being that his request for his personal health records was refused by Procare. There was nothing in the request to Procare or the complaint to the Commissioner about deletion of the information.

15 Further relevant aspects of the decision are set out below (emphasis in original):

Under s 35A of the Privacy Act, the Commissioner has recognised EDR [external dispute resolution] schemes that can receive and investigate privacy complaints about its members.

I consider that your complaint would be more effectively or appropriately dealt with by Australian Financial Complaints Authority (AFCA).

…

If you are not satisfied with the outcome of your complaint against the Respondent to AFCA, you may consider re-lodging this complaint to the OAIC, after you receive that outcome…

…

Decision

I am satisfied under s 41(1)(dd) of the Privacy Act that the act or practice would be more effectively or appropriately dealt with by a recognised external dispute resolution scheme.

Section 41(1) of the Privacy Act gives the Commissioner the discretion to decide not to investigate a complaint if she is satisfied that the matter would be more effectively or appropriately dealt with by a recognised external dispute resolution scheme.

I am satisfied of the conditions for the exercise of the Commissioner’s discretion at s 41(1) of the Privacy Act and the discretion is enlivened.

I have decided to exercise the discretion under s 41(1) of the Privacy Act to decline to investigate the complaint.

…

The judicial review application

16 The applicant initiated judicial review proceedings in this Court on 17 September 2025. The originating application identifies several grounds for quashing the decision of the Commissioner, one of which relies on s 5(1)(d) of the ADJR Act on the basis that the decision was not authorised by law because the discretion under s 41(1) of the Privacy Act was not properly enlivened. The application also asserts that conduct of the Commissioner, being the failure of the Commissioner to do anything about the complaint for four months and to then decline to investigate it without contacting the applicant and without giving him the opportunity to be heard on that question, was unlawful under s 6(1)(a) of the ADJR Act as being a breach of the rules of natural justice.

17 The applicant seeks the following relief (as written):

1.     An order under s 16(1)(a) of the Administrative Decisions (Judicial Review) Act 1977 (ADJR) quashing or setting aside the decision of the Respondent dated 22 August 2025 declining to investigate the Applicant’s complaint under s 41 of the Privacy Act 1988 (Cth) (PA).

2.     An order under s 16(1)(b) of the ADJR referring the Applicant’s complaint to the Respondent for determination according to law, with a direction that the complaint not be declined under s 41 of the PA, but instead be determined under s 52 of that Act.

3.     A declaration under s 16(1)(c) of the ADJR that the Applicant’s complaint of 24 April 2025 was validly made under s 36 of the PA and remains undetermined.

4.     A declaration under s 16(2)(a) of the ADJR that the conduct of the Respondent in connection with the making of the decision of 22 August 2025, including delay and the manner of communication with the Applicant, was unlawful.

5.     Costs.

18 As mentioned, the Commissioner has conceded that the decision was affected by error, but the parties remain apart as to the proper characterisation of the error and the terms of the relief that should be granted.

The characterisation of the error

19 The error that is conceded by the Commissioner is that the delegate considered that the privacy complaint could appropriately be dealt with by the Australian Financial Complaints Authority, without first making inquiries as to whether the Authority was an appropriate external dispute resolution scheme to investigate the primary complaint. The Commissioner submits that the existence of this fact was critical to the making of the decision, and therefore there was a lack of evidence to justify making the decision at the time it was made contrary to ss 5(1)(h) and 5(3)(b) of the ADJR Act, citing Curragh Queensland Mining Ltd v Daniel [1992] FCA 36 (AustLII citation [1992] FCA 44); 34 FCR 212 at 220-1 per Black CJ (Spender and Gummow JJ agreeing); Baggaley v Attorney-General (Cth) [2025] FCA 968 at [31]-[35] per Rangiah J.

20 The applicant is adamant that the decision should not be quashed or set aside on the basis of that error. It is not apparent why it matters so much to the applicant what the basis of the error is once it is accepted that the decision must be set aside.

21 It is not necessary to consider that somewhat sterile issue any further because there is at least one obvious error with the decision that is relied on by the applicant which forms a proper basis to quash it or set it aside under s 16(1)(a) of the ADJR Act. That is that the Commissioner fundamentally misunderstood and misconstrued the nature of the complaint – it was not a complaint about Procare’s refusal to delete private information, but about its refusal to provide that information to the applicant. Such an error can be classified under more than one of the grounds set out in s 5(1) of the ADJR Act, including that the decision was not authorised by the enactment in pursuance of which it was purported to be made (s 5(1)(d)). That is because the relevant enactment, s 41(1) of the Privacy Act, provides that the Commissioner may decide not to investigate “an act or practice about which a complaint has been made”. It is a miscarriage of that power to decide not to investigate some other act or practice which is not the subject of the complaint.

22 The Commissioner’s decision must therefore be set aside. There is no dispute about that.

23 The Commissioner’s pre-decision conduct in failing to give the applicant an opportunity to make submissions on whether the complaint should not be investigated should also be reviewed under s 6(1)(a) of the ADJR Act, and a declaration made in relation to it under s 16(2).

24 A decision under s 41 of the Privacy Act not to investigate a complaint, or not to investigate a complaint any further, is a decision that is capable of an adverse effect on the complainant’s rights as an individual (as distinct from a member of the public), being their right to have their complaint investigated under s 40. There is also nothing in the Privacy Act indicating any legislative intention to deny the application of procedural fairness to such a decision. A decision under s 41 is therefore a decision that is conditioned on the observance of procedural fairness: Disorganized Developments Pty Ltd v South Australia [2023] HCA 22; 280 CLR 515 at [33]-[34]; Madzikanda v Australian Information Commissioner [2023] FCA 1445; 330 IR 387 at [28] per Wheelahan J.

25 I am not satisfied that the four months that it took the Commissioner to make the decision constitutes an unreasonable delay: Patrick v Australian Information Commissioner [2024] FCAFC 93; 304 FCR 1 at [37] per Bromwich, Abraham and McEvoy JJ; ASP15 v Commonwealth [2016] FCAFC 145; 248 FCR 372 at [21]-[23] per Robertson, Griffiths and Bromwich JJ. However, the Commissioner breached the requirements of procedural fairness by making the decision that the complaint not be investigated without giving the applicant any opportunity to be heard, particularly on the question of whether his complaint was suitable for reference to an external dispute resolution scheme. That was a material error, as the decision could realistically have been different had the applicant been given the opportunity to correct the Commissioner’s misconception as to the availability of an alternative dispute resolution process.

The other relief

26 As detailed above, in addition to the quashing of the decision and the remitting of the complaint to the Commissioner to be dealt with in accordance with the law, the applicant seeks a “direction” that the complaint not be declined under s 41 of the Privacy Act but instead be determined under s 52. The applicant submits that such a “direction” is necessary in order to prevent the Commissioner from again deciding under s 41 not to investigate the complaint, or not to investigate it any further.

27 It would be quite wrong of the Court to impose such a limitation on the decision-making power of the Commissioner. By s 41 of the Privacy Act, Parliament has reposed in the Commissioner the authority to decide not to investigate, or not to investigate further, an act or practice about which a complaint has been made under s 36. The Court is not in a position to determine in advance whether there is any lawful basis upon which that power might be exercised by the Commissioner. Prima facie, there may be innumerable reasons for the exercise of the power. The Commissioner must be left to consider and deal with the applicant’s complaint in accordance with the law including, if there is a proper basis to do so, by the exercise of the power under s 41.

28 It follows that I will not make the “direction” that the applicant seeks in relation to the complaint being dealt with under s 52.

29 The applicant also seeks a declaration that his complaint is a valid complaint under s 36 of the Privacy Act. However, whether or not it is valid is not in dispute – the Commissioner accepts, and always has accepted, that the complaint is valid. The applicant submits that the declaration nevertheless has utility because it will serve to confirm that the complaint has not been lawfully disposed of and that the Commissioner must still consider it. That purpose, however, is achieved by the relief already referred to. There is therefore no basis or good reason to make the declaration and in the exercise of my discretion I decline to do so.

30 The applicant seeks his costs of the application. Because he is a litigant in person and has not had a lawyer on the record, it is not clear what costs he may be able to claim other than the filing fee in respect of the originating application: Bell Lawyers Pty Ltd v Pentelow [2019] HCA 29; 269 CLR 333 at [1]. Because of that, the Commissioner submits that the costs order should grant the applicant only that filing fee. I disagree. What the applicant is entitled to by way of costs, once he has a costs order in his favour, is a matter for taxation and is not to be enquired into or determined at this stage. The applicant should accordingly have his costs.

Conclusion

31 For those reasons, in addition to making a declaration that the conduct of the respondent in failing to afford the applicant procedural fairness prior to making a decision under s 41 of the Privacy Act 1988 (Cth) was unlawful, I will make the following orders:

(1) The decision of the respondent dated 22 August 2025 declining to investigate the applicant’s complaint dated 24 April 2025 be set aside under s 16(1)(a) of the Administrative Decisions (Judicial Review) A ct 1977 (Cth), and the complaint be referred to the respondent under s 16(1)(b) for decision according to law.

(2) The respondent pay the applicant’s costs of the application.

| I certify that the preceding thirty-one (31) numbered paragraphs are a true copy of the Reasons for Judgment of the Honourable Justice Stewart. |
Associate:

Dated: 2 April 2026

Top