The Substantive Issues
19Each of the parties has provided written submissions in relation to the substantive issues. BYW also relies on his own written evidence and he was cross-examined at the hearing.
20A review of conduct under the PPIP Act is confined in its scope by the initial request for internal review, reasonably construed. (See AFC v The Sydney Children's Hospital Specialty Network (Randwick and Westmead) [2012] NSWADT 189 [14], KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 at [13]-[14] and Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [16]-[19]).
21As noted above, BYW asserts that his personal information was disclosed in contravention of sections 12 and 18 of the PPIP Act. He also asserts that he has suffered significant embarrassment, humiliation and distress as a consequence of the alleged breaches.
22The Tribunal is to ascertain whether the Respondent disclosed the personal information to the third party and/or another third party or parties and, if so, whether or not that amounted to a breach of sections 12 or 18 of the PPIP Act. The Respondent is not bound by sections 12 and 18 of the PPIP Act except to the extent that it is exercising its administrative and educative functions. If the Tribunal is satisfied that the Respondent had contravened sections 12 and/or 18 of the PPIP Act, it must also be satisfied that any contravention occurred in connection with the exercise of its administrative and educative functions.
23In KP v Narrandera Shire Council [2011] NSWADTAP 15, the Appeal Panel considered the onus of proof in applications for review pursuant to section 55 of the PPIP Act. the Appeal Panel stated:
27 Neither the ADT Act nor the PPIP Act attributes a legal burden of proof to any party. That situation may be contrasted with the situation under the Government Information (Public Access) Act 2009 (GIPA Act). The burden of establishing that a decision made under that Act is justified lies on the agency. However, in relation to a decision to provide access to government information, the burden of establishing that there is an overriding public interest against disclosure of information lies on the applicant for review: s 105. In the absence of any express legislative provision in the PPIP Act, the relevant provisions must be interpreted in context to determine whether there is a legal burden of proof and, if so, where that burden lies.
28 In NS v Commissioner, Department of Corrective Services [2004] NSWADT 263, the following discussion of this issue appears at [32] and [45] to [46]:
32 The Deputy Privacy Commissioner also submitted that there was no rule that the applicant bears an onus of proof in reviews of conduct under the PPIP Act and in this regard relied on the decision of GV v Officer of the Director of Public Prosecutions [2003] NSWADT 177. She went on to submit that if such an onus was to be placed on an applicant then applicants would be greatly disadvantaged as they do not have any knowledge of the way the agency manages the personal information it holds and they are therefore not in the same position as the agency to ascertain the exact nature of the conduct complained about.
....
45 I agree with the submissions of the Deputy Privacy Commissioner in respect of onus of proof. The Appeal Panel recently adopted such an approach in KO v Anor v Commissioner of Police, New South Wales Police (GD) [2004] NSWADT 21 at [40 to 43].
46 In GR (at [35] and [36]), the Appeal Panel adopted observations made by the Australian Law Reform Commission in its report entitled "Managing Justice: A Review of the Federal Civil Justice System" in respect of merit review by the tribunals as applying equally to a review under s.55(1) of the PPIP Act. These observations expressly stated that in a merits review "neither the applicant nor the respondent agency carries a burden of proof to prove or disprove a fact".
29 This analysis does not resolve the question of what the Tribunal should do if left in a state of uncertainty in relation to a fact in issue after reviewing all the available evidence. It was said by the Federal Court in a landmark decision in 1984 that the notion of onus of proof is not directly relevant to administrative proceedings where a tribunal, such as the Administrative Appeals Tribunal, is not bound by the rules of evidence and may inform itself as it thinks fit: McDonald v Director-General of Social Security (1984) 1 FCR 354 at 358; 6 ALD 6 at 11 per Woodward J. In particular it was held "there can be no evidential onus of proof in proceedings before the AAT unless the relevant legislation provides for it, and in the present case the Social Security Act 1947 does not." Nevertheless, Woodward J acknowledged that if the AAT, "finds itself in a state of uncertainty after considering all the available material . . . it will be necessary for it to analyse carefully the decision it is reviewing." Depending on the terms of the legislation, the issue must be resolved one way or the other.
30 The nature of the Tribunal's role under the PPIP Act is, so far as we are aware, unique. The Tribunal is not merely an executive decision maker as the AAT was in McDonald. While the Tribunal is exercising its review jurisdiction when determining whether certain conduct amounts to a contravention of an Information Protection Principle, it is exercising judicial power when determining whether to take no action or grant the relief available under s 55(2) including damages and mandatory and prohibitory injunctive relief: PPIP Act, s 55(2)(a)(b) and (c). Those functions are analogous to functions exercised by judges and other decision makers in civil proceedings before courts and tribunals, where an applicant is seeking to assert his or her rights.
31 Given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the applicant.
...
24The Respondent submitted that there is no evidence to establish that the Respondent disclosed the personal information in contravention of the PPIP Act.