McGinn v Australian Information Commissioner (No 2)

This case started with a customer complaint about access to personal information. Sophia McGinn complained to the Office of the Australian Information Commissioner about North Shore BMW. The central issue was whether North Shore BMW held a record dated 15 May 2017 that contained her personal information.

The dispute appears to have grown out of a service-related issue. Ms McGinn relied on information from BMW Australia suggesting a service had been performed on 15 May 2017 by North Shore BMW. North Shore BMW, however, said it did not hold a record of Ms McGinn's personal information for that date. It also said that while a key read had been done, that information was recorded directly to the BMW Australia system rather than North Shore BMW's own system.

That distinction became important. Ms McGinn's position was, in substance, that if the service happened, there should have been a record. North Shore BMW's position was that even if a service occurred, it did not hold a record dated 15 May 2017 within the scope of the privacy access request. The OAIC delegate treated those as different questions.

Before making a final decision, the delegate sent Ms McGinn a preliminary view on 18 June 2024. The delegate summarised North Shore BMW's response, attached that response, explained why he was minded not to investigate further, and invited Ms McGinn to comment by 2 July 2024. She responded on 20 June 2024. On 18 July 2024, the delegate decided not to investigate the complaint further.

Ms McGinn then brought judicial review proceedings in the Federal Court. She was self-represented. The Court heard the matter on 3 July 2025 and delivered reasons ex tempore, later revised from transcript.

The Federal Court was not deciding whether North Shore BMW had actually breached privacy law. Jackman J made that point expressly. The Court was concerned only with the legality of the OAIC delegate's decision not to investigate further, not with the merits of Ms McGinn's underlying claims.

That distinction is critical. A judicial review case under the Administrative Decisions (Judicial Review) Act 1977 (Cth) is not a fresh hearing of the original complaint. The Court asks whether the decision-maker acted within power, afforded procedural fairness, considered the right matters, avoided legal error and reached a decision that was legally open.

The delegate had relied on two bases under s 41(1) of the Privacy Act. First, under s 41(1)(a), the delegate was satisfied that the act or practice complained of was not an interference with Ms McGinn's privacy. Second, under s 41(1)(da), the delegate was satisfied that an investigation was not warranted having regard to all the circumstances.

Ms McGinn challenged that decision on five grounds. She alleged denial of procedural fairness, actual bias, reliance on irrelevant considerations, failure to consider relevant material, legal unreasonableness, no evidence, and misconduct-style allegations. The Court worked through each ground and asked whether any recognised reviewable error had been established.

The judgment summarises the relevant privacy framework. APP 12 concerns access to personal information. If an APP entity holds personal information about an individual, it must, on request, give the individual access to that information, subject to the applicable rules. There was no dispute that North Shore BMW was an APP entity.

The delegate's reasoning was that APP 12 did not require North Shore BMW to provide a record it did not hold. The delegate also said there are no record-keeping requirements in the Privacy Act requiring North Shore BMW to have made a record on 15 May 2017, or to create one later in order to answer the access request.

That reasoning mattered because the complaint appears to have combined two different concerns. One was a privacy access issue: whether North Shore BMW held personal information that had to be given to Ms McGinn. The other was a broader allegation that records should have existed, or may have been false. The delegate treated the second issue differently, saying that any claim about falsification of records was a matter for police and that the OAIC did not have power under the Privacy Act to establish whether a record was incorrect.

The Court did not decide whether a record should have existed as a matter of business practice, or whether any service dispute had merit. Instead, it held that the delegate was legally entitled to approach the matter as one about whether North Shore BMW held the requested record and whether further OAIC investigation would achieve anything useful.

For businesses, the practical point is straightforward. A customer may strongly believe a record must exist because an event occurred. But privacy access rights still turn on what the entity actually holds. That does not excuse poor systems, but it does mean privacy law is not a general mechanism for forcing a business to create records it does not have.

Ms McGinn argued that the delegate had effectively formed the view not to investigate before giving her a proper chance to respond to North Shore BMW's position that no record dated 15 May 2017 existed. The Court rejected that argument.

Jackman J pointed to the 18 June 2024 letter. Its purpose was to afford procedural fairness, not deny it. The delegate summarised North Shore BMW's response of 27 May 2024, attached a copy of that response, explained the preliminary view that there had been no interference with privacy and that an investigation was not warranted, and expressly told Ms McGinn that she had an opportunity to comment before a final decision was made.

The Court said it was entirely appropriate for the delegate to indicate that the material then available had led to a preliminary view. In fact, expressing a tentative view can improve fairness because it alerts the affected person to the perceived weaknesses in their case and gives them a chance to respond. The Court also accepted that the opportunity to respond to adverse material must have a natural limit. Otherwise, the administrative process would never end.

As for the final decision on 18 July 2024, the Court noted that Ms McGinn had in fact provided a substantive response on 20 June 2024 and that the delegate took that response into account. On that basis, the Court held she had been afforded procedural fairness.

The actual bias allegation also failed. The Court said actual bias requires strong grounds for supposing that the decision-maker cannot fairly discharge the task. There was no basis to conclude that the delegate had prejudged the complaint or was closed to persuasion. The fact that the delegate was not persuaded by Ms McGinn's response did not prove bias.

Ms McGinn also argued that the delegate took into account an irrelevant consideration, failed to consider relevant material from BMW Australia, acted unreasonably, and made findings without evidence. The Court rejected each of those arguments.

On irrelevant considerations, the Court held that North Shore BMW's statements about the non-existence of a record dated 15 May 2017 were directly relevant. Where the complaint is that a business failed to provide a record under APP 12, information tending to show that no such record exists goes directly to whether there has been an interference with privacy and whether further investigation is warranted.

On relevant considerations, the Court found that the delegate did consider the BMW Australia material. The delegate accepted that BMW Australia information suggested a service was undertaken on 15 May 2017, but reasoned that this did not mean North Shore BMW held a record for that date. In other words, the delegate did not ignore the material. He simply did not treat it as proving the existence of a North Shore BMW record.

On unreasonableness, the Court applied the usual test of whether the decision lacked an evident and intelligible justification. It held that the delegate had cogent reasons for accepting North Shore BMW's position. Those reasons included that North Shore BMW had provided all other requested records, that information relating to 15 May 2017 came from a different entity, that North Shore BMW had unequivocally stated no record existed for that date, and that there was no obligation to create a record to meet the request. It was therefore not unreasonable for the delegate to prefer North Shore BMW's version of events over Ms McGinn's allegation that it was lying.

On the no-evidence ground, the Court emphasised that the threshold is particularly high. It is engaged only where there is effectively no evidence at all. Here, there was material before the delegate, including North Shore BMW submissions dated 13 and 27 May 2024 stating that all documents within scope had been provided, confirming there was no document dated 15 May 2017, and explaining why an invoice might not have been created. That was enough to defeat a no-evidence challenge.

The Court also rejected the remaining misconduct-style allegations and noted that any attempt to pursue criminal findings was outside the scope of the judicial review application.

The commercial message from this case is practical rather than abstract. If your business receives a request for access to personal information, start by identifying the exact legal entity that received the request and the systems in which that entity holds customer information. If records are split across a dealer, franchisor, manufacturer, head office or third-party platform, that should be understood early and explained clearly.

This case also shows the importance of not collapsing every customer complaint into a privacy issue. A customer may believe a missing invoice, service note or transaction record proves dishonesty or poor administration. That may raise other legal or commercial issues, but it does not automatically establish an interference with privacy under the Privacy Act.

At the same time, businesses should not take comfort from this case as an excuse for weak record governance. The fact that privacy law may not require creation of a new record does not mean a business can afford confusion about where records are held, who controls them, or what searches were undertaken. A vague or inconsistent explanation can still trigger complaints, mistrust and legal cost.

Good practice includes mapping where customer information is stored, training staff on how to respond to access requests, documenting searches, and making sure written responses are accurate and consistent. If another entity holds the relevant information, say so carefully and specifically. If no record exists, explain that truthfully and avoid speculation.

The OAIC delegate gave a preliminary view on 18 June 2024 and invited a response by 2 July 2024. Ms McGinn responded on 20 June 2024. The delegate made the final decision not to investigate further on 18 July 2024. Ms McGinn filed the judicial review application on 8 August 2024.

The Federal Court heard the matter on 3 July 2025. Jackman J dismissed the originating application and ordered Ms McGinn to pay the respondent's costs. The published reasons state that they were delivered ex tempore and revised from transcript.

This page discusses McGinn v Australian Information Commissioner (No 2) [2025] FCA 780 in the Federal Court of Australia. It should be read as an administrative law decision about review of an OAIC decision under the AD(JR) Act.

The Court did not finally determine the underlying factual dispute between Ms McGinn and North Shore BMW. It decided whether the OAIC delegate's refusal to investigate further was affected by legal error. That distinction is important when applying the case to business practice.