Norkin v University of New England

1. [1]

   LEEMING JA: Mr Anton Norkin has for a number of years been in dispute with the University of New England concerning information he and his brother provided in support of an application that his brother undertake postgraduate studies in 2019. Mr Norkin is an Australian citizen who lives in Sydney, while his brother was (at relevant times) a citizen and resident of Russia. The application was refused. Mr Norkin has consistently complained that the collection of information by the University, ostensibly for the purposes of that institution’s participation in the “Simplified Student Visa Framework”, contravenes the Privacy and Personal Information Protection Act 1998 (NSW) (Protection Act).

2. [2]

   This judgment determines Mr Norkin’s application for leave to appeal from orders made in the Common Law Division of this Court by Davies J dismissing his application for leave to appeal from NCAT. Leave is required because of the absence of any matter at issue amounting to or of the value of $100,000 or more: Supreme Court Act 1970 (NSW), s 101(2)(r). Although Mr Norkin has at all times been unrepresented, he has a law degree and advanced his submissions efficiently and effectively. That said, his draft notice of appeal raised a multiplicity of grounds. Each of Mr Norkin and the University consented to the application for leave being determined without an oral hearing, a course which is authorised by r 51.15 of the Uniform Civil Procedure Rules 2005 (NSW). The Court of Appeal, constituted by Basten AJA and me, has previously explained why most of the 14 proposed grounds of appeal did not warrant a grant of leave: Norkin v University of New England [2023] NSWCA 26 at [11]. However, we regarded the summons seeking leave as giving rise to one question of principle. We said at [8]-[9]:

3. [3]

   Accordingly, Mr Norkin’s summons was listed for a concurrent hearing but confined to the ground:

4. [4]

   Amici were appointed by the Registrar and this Court had the benefit of written and oral submissions from Ms Seiden SC and Ms Levi.

5. [5]

   As will be seen below, at the forefront of the University’s submissions to this Court was the proposition that there had been an error contained in its own internal review decision, which was reflected in the decisions of the Appeal Panel and of Davies J, and was in turn reflected in the explanation given by Basten AJA and me for granting leave. In this Court, the University contended that it was wrong to proceed on the basis that the information provided to the University was provided to the Commonwealth, even though that had been treated as dispositive by the Appeal Panel and the primary judge. In short, the University now says that there was no delegation of information-collecting, and so the issue raised as warranting a hearing in this Court, and the appointment of amici, does not arise. This is a matter of some significance to the grant of leave, and the appropriate order as to costs.

Background

1. [6]

   The dispute between Mr Norkin and the University commenced when he sponsored his brother as an overseas student seeking admission to postgraduate courses at the University in 2019. As part of its assessment of the application, the University required both men to complete certain forms including a “Statement of Purpose” or “SOP” document, which, if the University made an offer of admission, would be provided to the Department of Immigration and Border Protection as part of a student visa application. I shall return below to whether it would be provided by the University or the applicant.

2. [7]

   The Statement of Purpose document was closely linked to “Genuine Temporary Entrant” or “GTE” requirements imposed in connection with the grant of a student visa. The primary judge explained these requirements and the SSVF as follows at [7]-[8]:

3. [8]

   Although the primary judge referred to the SSVF as an administrative arrangement by which the University was “authorised” to make its own inquiries about whether a potential student would satisfy the criteria for a student visa, that is to be understood in a loose and non-legal sense. The uncontroversial evidence before NCAT from “the Director, UNE International” was that the University received every six months a “risk rating” from the Department of Home Affairs. Broadly speaking, that rating reflected “the immigration risk outcomes of [each university’s] international students over the previous 12 month period”. The two greatest contributors to an institution’s risk rating were the rate of visa cancellations and the rate of refusals due to fraud. Other contributors were refusals for reasons other than fraud, visa-holders who became unlawful non-citizens (for example, because they overstayed), and visa-holders who applied for a protection visa. In some cases, if an institution with a lower risk rating made an offer to potential students from certain countries, those students would then have their student visa applications assessed on the basis of a formal declaration, as opposed to providing primary documentation as would be the case if the same student had applied to an institution with a higher risk rating. That in turn led to a faster visa approval process, and was more attractive to students.

4. [9]

   Hence there was an incentive on the part of the University to keep its risk rating low, and to carry out its own pre-assessment before offers were made. Further, other things being equal, the University would prefer to make a conditional offer to a student whose application for a visa would be determined using the streamlined procedure, rather than the slower, more arduous, and (it may be inferred) more likely to result in refusal, procedure. That course would tend to maximise the number of students who were able to accept offers, and the fee revenue they represented. It also allowed the University to plan its student intakes for individual courses with greater certainty.

5. [10]

   I did not understand any of the above to be controversial. All of this was a consequence of a regime established under federal law and policy, but it was not authorised by the Commonwealth. Save for an aspect of the reasons for the internal review, which the University now says is factually wrong, there is nothing in the materials to suggest that the University itself was collecting information to be provided to the Commonwealth, as opposed to considering the likelihood that a student visa would be granted to the applicant (a factor relevant to the University’s decision on whether a conditional offer should be made).

6. [11]

   The primary judge summarised the information sought from both Mr Norkin and his brother as follows (at [9]):

7. [12]

   Some further information was provided by both Mr Norkin and his brother, although it fell short of the University’s request. On 14 June 2018, the University advised that the application would be rejected:

8. [13]

   There was further correspondence between the University and Mr Norkin, largely directed to his providing a fully completed SOP. The application was ultimately sent to the University’s external assessor, which led to an email dated 18 July 2018 from the University’s International Admissions section. It was mostly directed to information and primary documentation concerning Mr Norkin’s brother, but it also sought information concerning the sponsor himself. The email included the following:

9. [14]

   The email concluded:

10. [15]

    Mr Norkin provided some but not all of the information sought in relation to his brother. In relation to the request for information concerning himself as sponsor, he wrote by email dated 15 August 2018, responding to the individual requests made of him:

11. [16]

    The University did not make an admission offer to Mr Norkin’s brother. It advised Mr Norkin that its contracted third party assessor was of the view that the requirements for admission had not been satisfied and that Mr Norkin’s brother was “high-risk” and unlikely to meet the Department of Home Affair’s GTE requirements.

12. [17]

    In response to Mr Norkin’s request for reasons, the Senior Admissions Officer wrote:

13. [18]

    On 16 August 2018, Mr Norkin made a formal complaint pursuant to s 53 of the Protection Act on his own behalf and on behalf of his brother. The complaint had five aspects: (i) the collection of information indirectly (for example, details of relatives and ex-spouses), (ii) the absence of any legislation authorising the collection, (iii) that some of the information sought was irrelevant and therefore not reasonably necessary, (iv) that some of the information sought (for example, wedding photos) amounted to an unreasonable intrusion on personal affairs, and (v) that the intended recipients of the information were not disclosed.

14. [19]

    I shall come in due course to the legislative regime, but by way of overview, the first aspect was directed to the requirement in s 9 that personal information be collected directly from the person to whom the information relates. The second and third were directed to the requirement in s 8(1) of the Protection Act that any collection of personal information be for a lawful purpose that is directly related to a function or activity of the University. The fourth was directed to the requirement in s 11 for the University to take reasonable steps to ensure that the collection does not unreasonably intrude on the individual’s personal affairs, and the fifth was directed to the requirement in s 10 to disclose the recipients of the personal information.

15. [20]

    Part of the response by a Senior Legal Officer of the University, dated 22 October 2018, was the following:

16. [21]

    (The emphasised words are now said by the University to be factually wrong.)

17. [22]

    Dissatisfied with the University’s internal review, Mr Norkin and his brother sought external review in NCAT pursuant to s 55. After a hearing, the tribunal determined to take no action: DQU v University of New England [2020] NSWCATAD 226. For present purposes, the critical reasoning was at [119]-[121]:

18. [23]

    Section 6(1) of the University of New England Act 1993 (NSW) states that the object of the University is “the promotion, within the limits of the University’s resources, of scholarship, research, free inquiry, the interaction of research and teaching, and academic excellence”. Paragraphs (c) and (g) of s 6(2) identify that principal functions of the University for the promotion of that object are:

19. [24]

    Mr Norkin (but not his brother) sought leave to appeal to the Appeal Panel, which dismissed his application on 9 July 2021: DQV v University of New England [2021] NSWCATAP 208. Relevantly for present purposes, on the issue of whether the collection of personal information was for a lawful purpose that is directly related to a function or activity of the University, the Appeal Panel disagreed with both aspects of the reasoning of the Senior Member who constituted the Tribunal at first instance. The Appeal Panel said at [45]-[46]:

20. [25]

    However, an appeal to the Appeal Panel only lay as of right on a question of law, although an appeal on all issues was available by leave: Civil and Administrative Tribunal Act 2013 (NSW), s 80. The Appeal Panel regarded that error as an error of fact, and formed the view that it was inappropriate to grant leave because it identified a different basis upon which there was compliance with s 8 of the Protection Act. It is best to reproduce the entirety of the reasoning ([49]-[52]) dealing with this aspect of the decision:

21. [26]

    As noted above, the primary judge dismissed Mr Norkin’s further application for leave to appeal to the Supreme Court. That appeal was one which was confined to questions of law: Civil and Administrative Tribunal Act 2013 (NSW), s 83. His Honour regarded the Appeal Panel to have erred, insofar as it had determined that the Senior Member had made an error of fact in applying s 8: at [32]-[33]. His Honour, relying on Tarrant v Australian Securities and Investments Commission [2015] FCAFC 8; 317 ALR 328 at [100(e)], observed, correctly, that where the issue is whether the facts as found fall within a statutory question, there is ordinarily a question of law. But nothing turns on this. His Honour said at [33]-[34] (emphasis added):

22. [27]

    His Honour thereafter addressed the issues arising under s 8, but principally in dealing with Mr Norkin’s submission that he had been denied procedural fairness, a submission which was rejected. However, his Honour also recorded at [41] that “the plaintiff submitted that under s 8 of the PPIP Act, there are three elements that the agency needed to prove to justify collection of the information. Those three elements were said to be (1) collection for the (2) purpose, and (3) for the function or activity. The plaintiff submitted that the appeal panel confused the second and third of those elements”. His Honour was of the view that no such error was disclosed, and that the Appeal Panel had expressed the terms of s 8 in a shorthand way: at [43].

23. [28]

    The balance of his Honour’s reasons addressed a series of discrete points advanced by Mr Norkin, concerning the rejection of his brother’s claim (ground 3), “fundamental common law rights” (ground 4); “The SSVF’s status and the need for its publication” (ground 4.1), and “[t]he appeal panel’s use of precedent” (ground 6). It will not be necessary to address those aspects of his Honour’s reasons.

24. [29]

    Because the proceedings in this Court no longer include Mr Norkin’s brother, the complaints concerning non-compliance with the Protection Act are considerably more confined than they had been at earlier stages in the litigation. Nevertheless, as part of the application process, Mr Norkin, as sponsor, was asked by the University to supply copies of his bank statement, annual income and statement from his employer and his passport. That information, together with a great deal more information pertaining to his brother, was said by the University to be required for its pre-assessment of a student visa which would be required in the event that it made an offer which was accepted by Mr Norkin’s brother.

25. [30]

    In the litigation summarised above, the names of Mr Norkin (sometimes) and his brother (invariably) have been anonymised. That appears to reflect a general practice in NCAT. In the hearing in this Court, the parties confirmed that there was no basis for the identities of Mr Norkin or his brother to be suppressed.

Applicable statutory regime

1. [31]

   It was common ground that the University was a “public sector agency” for the purpose of the Protection Act. This comes about because the definition of public sector agency includes “an auditable entity within the meaning of the Government Sector Audit Act 1983”, and an “auditable entity”, as defined in s 4 of the latter statute includes a university, which includes the University established by s 4 of the University of New England Act 1993 (NSW). The University was thereby subject to the information protection principles in Part 2 of the Protection Act, including ss 8 and 10:

2. [32]

   “Personal information” is defined in s 4 to mean, subject to certain exclusions, “information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion”. It was not disputed that the University collected personal information from Mr Norkin and his brother when the application for admission as a postgraduate student was made.

3. [33]

   In Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 at [20] Spigelman CJ, writing for this Court, identified a “clear bifurcation” between the information protection principles in ss 8-11, which applied to the collection of personal information, and those in ss 12-19, which applied to the holding of personal information. This appeal is concerned with the former.

4. [34]

   The obligations in ss 8 and 10 (and the other information protection principles) do not give rise to any cause of action: s 69(1). Instead, the legislation creates its own sanctions. Without being exhaustive, s 21 provides that a public sector agency must not do anything, or engage in practice, which contravenes an information protection principle applying to the agency, and that any such contravention is conduct to which Part 5 applies. Section 53 (within Part 5) entitles a person who is aggrieved by a contravention of an information protection principle to a review, and if not satisfied by the review, s 55 (also within Part 5) confers a right of administrative review to NCAT. Amongst other remedies, damages to a maximum of $40,000, and orders in the nature of mandatory and prohibitory injunctions are available in appropriate cases.

5. [35]

   Central to s 8(1)(a) and s 10(b) is the concept of the purposes for which the information is being collected. The legislation explicitly contemplates collection for multiple purposes. The exemption in s 8(1)(a) turns upon there being “a lawful purpose that is directly related to a function or activity of the agency”, and the obligation to make individuals aware in s 10(b) extends to all of the purposes for which the information is collected.

6. [36]

   There is a prohibition on the University collecting personal information except and to the extent that (a) and (b) of s 8(1) apply. I respectfully agree with the submission made by the amici that when the University chooses to collect personal information, it should have squarely in mind its purposes for doing so. That is because the University is doing something which is prohibited unless it falls within an exception, and in order to identify whether an exception is available, it is necessary to ask two questions: is there a lawful purpose for which the collection is occurring directly related to a function or activity, and is the collection reasonably necessary for that purpose. Neither question can be addressed without identifying the purpose. If the University does not attend to both questions, it runs the risk of doing something which is unlawful.

7. [37]

   That is not an end to the obligations imposed upon the University, because s 10 imposes further obligations to take reasonable steps so as to make the person to whom the information relates aware of certain matters including the fact that the information has been collected, the purposes of doing so and the intended recipient.

8. [38]

   That is to say, even if the collection of information is reasonably necessary for a lawful purpose which is directly related to a function or activity of the University, there will still be a contravention of the information protection principles if there are other undisclosed purposes of the collection. All of those purposes must be disclosed to the individuals whose personal information is being collected. That cannot occur unless the purposes have been identified at the time the information is collected.

9. [39]

   The legislation gives little explicit guidance as to the specificity of the lawful purpose, or the identification of the function or activity. However, two points do emerge from the legislative text.

10. [40]

    The first is that the relationship between the purpose and the function or activity must be one which is direct, as opposed to indirect.

11. [41]

    The second is that there is a contrast between the purpose for which the information is collected, and the function or activity of the agency. The purpose is the end, or the objective or the goal in the furtherance of which the information is collected. As already noted, there may be more than one purpose. The function or activity is something that the agency does. If the purpose is conflated with the activity for the purpose of applying the section, then it is probable that something has gone awry with the characterisation of either the purpose or the activity.

12. [42]

    Although the purposes should have been given careful attention at the time the personal information was collected, and indeed more squarely given Mr Norkin’s complaint and subsequent administrative review, the written submissions of the amici pointed out, correctly, that the University identified its purpose in a variety of ways.

13. [43]

    In (very) fine print in its initial conditional offer to Mr Norkin’s brother, there was the following passage:

14. [44]

    The first paragraph is problematic for a number of reasons. From its heading it seems to be directed to compliance with the Protection Act but it is likely that the reference to the University’s “primary purposes” and “secondary purposes” are mistakes. That is because the statute does not identify a primary purpose or a secondary purpose, but instead identified “principal functions” and “other functions” (in s 6(2) and (3)), and if read literally, the statement departs from the test in s 8. But separately from those points, the paragraph does not meaningfully make the reader aware of any purpose at all. It simply refers to the entirety of all “purposes” both primary and secondary, and says that information is collected for the purpose it was submitted and for any of the University’s other purposes. That may be true, but it does not enlighten the person whose personal information is being collected who is entitled under s 10 to be told at the time the purposes for which it is being collected. A generic statement that identifies the entirety of the University’s functions and activities and says that information is collected for those purposes falls short of achieving the object of s 10. If that were not so, then a statement such as that which appeared in the University’s form would discharge this aspect of the disclosure obligation in s 10 in every case. There is no sound reason to construe a provision in legislation intended to permit persons whose personal information was being collected to make an informed choice in such a fashion.

15. [45]

    The second paragraph is also problematic. The purpose of ensuring “that you comply with the conditions of your Student Visa” is not a purpose sought to be defended in the litigation subsequently. Nor was it said that the Education Services for Overseas Students was a source of authority for the collection of personal information.

16. [46]

    In its initial submissions to NCAT, UNE said that its purpose was “in relation to the provision of facilities of courses of study, the conferring of degrees and the provision of teaching and learning … to local and international students”. In its subsequent submissions, UNE said that its purpose was to “ensure” Mr Norkin’s brother was a genuine temporary entrant as part of its functions in offering admission to an international student.

17. [47]

    The formulation of purpose in the University’s initial submissions to NCAT is too broad. It is to be borne in mind that in addition to enabling the University to comply with s 10, another reason for fully identifying the purposes is so that the University can comply with s 12(a), which provides that a public sector agency that holds personal information must ensure that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used. No issue concerning s 12 arose in this appeal. However, it is obviously important that a university which collects electronic scans of personal information, such as passports, securely destroy the information when it is no longer needed. It is far from clear that the risk of keeping data (or the exposure of a public sector agency to claims for loss in the event that the data is kept insecurely) is fully appreciated, despite the fact that the Protection Act is now a quarter of a century old. The articulation of a purpose at the level of generality of the provision of courses to students will lead to difficulties in the University establishing the requisite “direct relationship” and it will also not assist the University in complying with s 12.

18. [48]

    On the other hand, the purpose of making an assessment of the likelihood that Mr Norkin’s brother would satisfy the Genuine Temporary Entrant test is closely linked with its purpose of providing postgraduate courses to students on campus, which could only occur with respect to Mr Norkin’s brother if he obtained a visa. That level of specificity of purpose also enables the University to comply with s 12. For it is clear that there will come a time when the information collected from Mr Norkin must be securely destroyed.

19. [49]

    One point of the above is to observe that when the legislation is read as a whole, some guidance is given as to the level of generality with which a purpose is to be framed. Legislation is normally to be construed so that it produces a workable result, and since the purpose for collection is used to regulate what is disclosed at the time of collection, and the time when the information must be destroyed, as well as the ways in which it may be used (see s 17), those matters provide some guidance to the way in which purpose is to be formulated.

20. [50]

    As the amici submitted, given the architecture of s 8 of the Protection Act, one might expect there to be a genuine difference between purpose on the one hand and function or activity on the other. The amici submitted that the Appeal Panel conflated the purpose and the activity. Mr Norkin seems to have made substantially the same point to the primary judge.

21. [51]

    The Appeal Panel’s reasons at [49]-[52] are reproduced in full at [25] of this judgment. In its reasons at [50], the Appeal Panel identified the general and ancillary functions for which s 6(3)(c) of the UNE Act made provision, and then observed that the Senior Member “was not asked to consider whether the purpose of collecting the appellant’s personal information directly related to a general or ancillary function”. At [51], the Appeal Panel affirmed that there could be little doubt that the University collected the appellant’s personal information for a purpose which was directly related to one of its activities (“which could be characterised as undertaking pre-visa assessments or providing the results of those assessments to the Commonwealth”). As was indicated at the outset, the University advised this Court that the words in brackets were wrong in fact, a point to which I shall return. However, they also form part of an analysis which departs from the statute.

22. [52]

    To reiterate, the collection of personal information is prima facie prohibited unless the University falls within an exception. In order to determine whether the exception in s 8(1) applies, it is necessary (among other things) to identify two things both of which are distinct from the collection of personal information itself. The first is the purpose of collecting the information. The second is the function or activity of the University to which the purpose relates. At no stage in its reasons at [50]-[51], which were dispositive of the application for leave, did the Appeal Panel identify a purpose for collecting Mr Norkin’s information. Instead, as the amici submitted, it conflated the purpose of the collection of Mr Norkin’s information with the collection itself, and then readily concluded that there was the requisite direct relationship with an ancillary activity of the University.

The University complied with s 8

1. [53]

   Teaching postgraduate students is a central function and activity of the University: s 6(2)(c) and (f) of the UNE Act. A substantial aspect of that function and activity occurs face-to-face. To the extent that the students are not citizens or permanent residents of Australia, students cannot be taught face-to-face unless they have a student visa. The University is therefore required, as a matter of legal and practical reality, to engage with whether persons who might become overseas students will obtain a student visa.

2. [54]

   The SSVF encourages universities to carry out their own inquiries as to the likelihood that applicants who might be made an offer of admission will be granted student visas. Those inquiries cannot take place without collecting personal information of the applicants and their sponsors. The purpose of collecting the personal information, namely, to inquire pursuant to the SSVF whether a potential candidate is likely to obtain a student visa, is closely related to the function or activity of teaching students. That is because it directly relates to an essential precondition of the potential student being able to be taught, namely, obtaining a student visa. I respectfully disagree with the reasons of the Appeal Panel at [45] which hold to the contrary.

3. [55]

   However, I respectfully agree that the exception in s 8(1)(a) is not satisfied with respect to the function of developing admission policies. As the Appeal Panel rightly said, Mr Norkin’s and his brother’s personal information was not collected for the purpose of developing an admission policy, but in the application of a policy which had already been developed.

4. [56]

   It is not necessary to express any concluded view on the metes and bounds of “directly related”, and it is probably impossible to do so in the abstract. In any particular case, it will turn on the size and nature of the public sector agency, and the purpose of the collection. In each case a judgment needs to be made whether there is a direct, as opposed to indirect or tangential or incidental, relationship between a lawful purpose and one of the agency’s activities or functions.

5. [57]

   Mr Norkin submitted that the collection was not for a lawful purpose, because there was no legislative authority conferred upon the University to collect information. To that end, he emphasised that part of the SSVF operated without primary or secondary legislative backing, and he pointed to the absence of formal by-rules made by the University. He cited a passage from Wade and Forsyth, Administrative Law (7th ed, 1994) at 43 that “Any administrative act or order which is ultra vires or outside jurisdiction is void in law, ie, deprived of legal effect. This is because in order to be valid it needs statutory authorisation, and if it is not within the powers given by the Act it has no legal leg to stand on”.

6. [58]

   As the High Court observed in Taikato v The Queen (1996) 186 CLR 454 at 460; [1996] HCA 28, the meaning of “lawful purpose” depends on its context, and “[a]s a result, a ‘lawful purpose’ may mean a purpose not forbidden by law or not unlawful under the statute that enacts the term; or it can mean a purpose that is supported by a positive rule of law” (footnotes omitted). The High Court also said:

7. [59]

   There is no reason to depart from that “general rule” in construing the words “lawful purpose” in the Protection Act. That is for at least two reasons. The first is that s 8(1) is to be read with 8(2), and the latter prohibits collecting personal information “by any unlawful means”. “Unlawful means” refers to the method of collection, as opposed to the purpose. Nonetheless, “unlawful” is read naturally as the opposite of “lawful” in the preceding subsection. “Unlawful” in s 8(2) means prohibited, and thus “lawful” is apt to mean something which is not prohibited.

8. [60]

   The second is that there is no good reason to insist upon a separate statutory mandate to collect personal information, in order to comply with s 8(1). Section 8 is required to be applied to a wide range of public sector agencies. Some may be expected to have an elaborate and detailed statutory regime (such as local government authorities, statutory bodies representing the Crown and the NSW Police Force). However, others may operate with less legislative underpinning (such as “the office of a political office holder” and a Public Service agency).

9. [61]

   That conclusion aligns with a body of decisions in NCAT: see ALZ v SafeWork NSW [2017] NSWCATAP 51 at [76]-[82] and WL v Randwick City Council [2007] NSWADTAP 58 at [45]-[47].

10. [62]

    Those reasons resemble those given by the Senior Member. I am satisfied there was a direct relationship between the lawful purpose of determining the likelihood of prospective students obtaining a student visa and the function or activity of teaching overseas students.

Misapprehension of facts of the case

1. [63]

   The University made these submissions in advance of the hearing:

2. [64]

   Mr Norkin did not squarely dispute the University’s contention in the written submissions he filed in response, or in his oral submissions. The amici made no submission on the point.

3. [65]

   Having reviewed the whole of the material, it is not established that the University itself provided any personal information to the Department of Home Affairs, even in the case where the University made a conditional offer to an applicant, and thus it became necessary for the applicant to obtain a student visa. On the facts of the particular case, where the University ended up rejecting the application sponsored by Mr Norkin, it is clear that the personal information was not supplied to the Department of Home Affairs. More importantly, there is nothing to suggest that the personal information was collected for the purpose potentially of supplying it to the Department if an offer had been made.

4. [66]

   It is a little troubling that the errors in the decision in the Appeal Panel were not sought to be corrected before the primary judge. Mr Norkin sought leave to appeal, as was his right, from the decision of the Appeal Panel to the Supreme Court constituted by a judge sitting in the Common Law Division. The dispositive passage in the reasons of the Appeal Panel has been reproduced above. The reason that the Appeal Panel found that the collection of personal information by the University was “directly related” to a lawful purpose was that it was directly related to its activity of “undertaking pre-visa assessments or providing the results of those assessments to the Commonwealth”. That was not contradicted in the lengthy affidavit filed by the University, which was silent on this point. Nor was it contradicted in oral submissions made by junior counsel who then appeared for the University (the written submissions were not included in the materials provided to this Court). In those circumstances, it was not surprising that the same erroneous finding was made by the primary judge.

5. [67]

   The foregoing is not necessarily by way of criticism of the lawyers who settled the evidence, or junior counsel who appeared in the Common Law Division. The evidence adduced, and the submissions made, may have been a consequence of instructions. But whatever the reason, it is a matter of regret that the litigation has proceeded on what is now said to be (and I accept is) a material factual mistake.

6. [68]

   The basis upon which Basten AJA and I identified a point of public importance and directed that there be an oral hearing was incorrect. It is a result which has been reached in part because of the way the University’s evidence has been presented, and, especially, the stance taken by it before the Appeal Panel and in the Common Law Division. I shall return to this when dealing with orders.

Remaining submissions

1. [69]

   Although that is sufficient to dispose of the appeal, I shall for completeness deal with three miscellaneous points, upon which Mr Norkin placed considerable emphasis in oral submissions, and an issue left unresolved by this appeal.

2. [70]

   First, Mr Norkin was critical of a document on University letterhead described as “Postgraduate Admission for International Students: Operating Procedure”. In particular paragraph 4 provided:

3. [71]

   Mr Norkin submitted that the document was a rule, not a procedure, and that it was invalid because it had not been made in accordance with the UNE Act. The submission is only relevant because of Mr Norkin’s submission that “lawful purpose” for the purposes of s 8 of the Protection Act is confined to a purpose which is authorised by primary or secondary legislation. That submission has been rejected above at [57]-[61]. The document is expressed to be an Operating Procedure. Mr Norkin is right that it has not been made so as to be a rule or by-law under the UNE Act but nothing turns on that.

4. [72]

   Secondly, Mr Norkin submitted that the information collected from him occurred pursuant to procedures and guidelines which were in addition to the ordinary rules governing postgraduate admission to the University. That is undoubtedly true. His further submission was that the ordinary rules were exhaustive, and further that the procedures and guidelines were inconsistent with the entitlements created by the rules. I do not accept the submission, which turns on the proposition that the University’s rules are an exhaustive statement of the prerequisites to admission. Plainly they are not. In particular, in the case of a foreign student it will also be necessary to obtain a student visa.

5. [73]

   Thirdly, the Court reserved on the admissibility of a document titled “Ministerial submission”, signed by the Minister for Immigration and Border Protection in November 2015, the subject of which was “Policy approval to amend the Migration Regulations 1994 to simplify the student visa framework”. The document had not been tendered before the primary judge, however, Mr Norkin said that it had only recently been released following an application under the Freedom of Information Act 1982 (Cth). Mr Norkin’s point was that part of the document stated that the SSVF was “intended to operate in policy rather than be formally legislated”, and that that was wrong:

6. [74]

   It is plain that the framework operates largely by policy. However, once again, there is no need to identify primary or secondary legislation in order for the University to fall within the “lawful purpose” exception in s 8(1) of the Protection Act. It follows that the document is not relevant, and therefore is not admissible: Evidence Act 1995 (NSW), s 56(2).

7. [75]

   Finally, I have not overlooked the fact that Mr Norkin’s personal information was supplied to the third party contractor, whose identity was not disclosed in the record. However, this was outside the scope of the appeal. Even Mr Norkin’s amended notice of appeal with 12 proposed grounds makes no complaint about this. The materials make it plain that Mr Norkin was aware that the personal information was being provided to a third party contractor, although they do not state his, her or its identity. When the point was raised during the hearing, senior counsel said that the identity was not an issue in this proceeding, and Mr Norkin made no submission to the contrary. For that reason, the materials were not directed to establishing whether there had been compliance with s 10(c), or how the University complied with the obligations in s 12 to ensure that the information is kept no longer than necessary, is disposed of securely, and that “everything reasonably with the power of the agency” be done to prevent unauthorised use or disclosure of personal information provided to the third party. As it happened, Mr Norkin has brought separate proceedings directed to this: see Norkin v University of New England [2022] NSWCATAP 146, and nothing more need be said of these issues.

Orders

1. [76]

   For those reasons, the decision made by Davies J was correct. Further, the matter identified as warranting a separate hearing, and the appointment of amici, does not arise. The application for leave to appeal should be dismissed.

2. [77]

   The parties will have an opportunity to be heard as to costs, which will be determined on the papers. However, my present view is that this is a case to depart from the usual rule in r 42.1 of the Uniform Civil Procedure Rules 2005 (NSW), with the result that the University ought not obtain a favourable costs order. This hearing was brought about by an uncorrected error for which the University or its lawyers were responsible. If Mr Norkin had himself incurred recoverable costs, I would have been minded to consider an order that the University pay the costs of the hearing. However, as an unrepresented litigant, even one with a law degree, Mr Norkin is not entitled to recover any professional costs: Bell Lawyers Pty Ltd v Pentelow (2019) 269 CLR 333; [2019] HCA 29. Both parties may if they wish be heard further as to the exercise of the discretion as to costs (including as to the proper order for costs of the proceedings in the Common Law Division), by application made within the period specified by r 36.16 of the Uniform Civil Procedure Rules.

3. [78]

   BASTEN AJA: I agree that the application for leave should be dismissed, for the reasons given by Leeming JA. My tentative view is that there should be no order as to costs in this Court. I would also entertain submissions as to the proper order in the Division, where Mr Norkin was ordered to pay the University’s costs.

4. [79]

   GRIFFITHS AJA: I agree with Leeming JA’s reasons and with the orders he proposes.