HCZ v Department of Education

Catchwords: ADMINISTRATIVE LAW – privacy – review of conduct of the respondent which is alleged to be a contravention of the notice and use information protection principles in section 10 and 17 of the Privacy and Personal Information Protection Act 1998 (NSW) – standing to bring the application and scope of the conduct the subject of the application
ADMINISTRATIVE LAW – decision to remit the conduct the subject of review for reconsideration by the respondent – Administrative Decisions Review Act 1997 (NSW) section 63(3)(d)

Legislation Cited: Administrative Decisions Review Act 1997 (NSW)
Civil and Administrative Tribunal Act 2013 (NSW)
Education Act 1990 (NSW)
Privacy and Personal Information Protection Act 1998 (NSW)

Cases Cited: AOZ v Rail Corporation NSW [2014] NSWCATAP 76 CJU v HealthShare NSW [2021] NSWCATAD 372
CJU v SafeWork NSW [2018] NSWCATAD 300
CNP v Commissioner for Fair Trading [2017] NSWCATAD 70
Director General, Department of Education and Training v MT [2006] NSWCA 270
DSG v Department of Education [2019] NSWCATAD 182
FZP v Sydney Children’s Hospitals Network [2025] NSWCATAD 144
GR v Director-General, Department of Housing [2004] NSWADTAP 16
KO v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56
MH v NSW Maritime [2011] NSADT 248
NS v Commissioner, Department of Corrective Services [2004] NSWADT 263
OD v Department of Education and Training (GD) [2005] NSWADTAP 74
Vice-Chancellor, Macquarie University v FM [2005] NSWCA 192
Vice-Chancellor, Macquarie University v FM (No.2)(GD) [2004] NSWADTAP 37

Texts Cited: None Cited

Category: Principal judgment

Parties: HCZ (First Applicant)
HFE (Second Applicant and father of First Applicant)
Privacy Commissioner (Intervenor)
Department of Education (Respondent)

Representation: Solicitors:
Appellant (self-represented)
Crown Solicitor (Respondent)

File Number(s): 2025/00234528

Publication restriction: Pursuant to section 64(1)(a) of the Civil and Administrative Tribunal Act 2013 (NSW) the disclosure of the name of HFE and HCZ is prohibited.
Note: a reference to the name of HFE and HCZ includes a reference to any information, picture or other material that identifies the person or is likely to lead to the identification of the person.

Reasons for Decision

1. The applicants, HCZ and HFE, seek administrative review of conduct of the respondent which is alleged to be a contravention of an information protection principle (“IPP”) that applies to the respondent in respect of their personal information collected and held by the respondent: see Privacy and Personal Information Protection Act 1998 (NSW) (“PPIP Act”) section 52.

2. HFE is the father of HCZ who, in 2025, was transitioning from primary school to high school.

3. The information in issue in this application is the residential address of HFE, as provided by HFE in the February 2025 online pro-forma NSW “Local Enrolment Application” (“local enrolment application”) he submitted for HCZ to attend the same public high school HCZ’s older sister had attended (“the School”). That School was not the local high school for the primary school where HCZ had attended.

4. In the local enrolment application, HFE entered his name as the “Parent/carer (enrolment owners)” of HCZ and the person with whom HCZ normally lived (i.e. “Parents/carers with whom the student normally lives”). HFE also entered his personal details including his residential address, which was an “in-area” address for the School.

5. Under the “Other family details” section of the local enrolment application, HFE entered the personal details of the mother of HCZ including her residential address, which is not an “in-area” address. HFE and the mother of HCZ are married but separated and have been separated for some years.

6. A detailed background to this application is set out below. However, by way of introduction it can be summarised as follows:

7. on 28 February 2025, the School wrote to HFE to advise that his local enrolment application was unsuccessful because the School was unable to verify that his residential address was the permanent residential address of HCZ. The School ended the letter by advising HFE that if he wanted to appeal the decision, he could do so by forwarding, by email, his written appeal to [name of person] Director Educational Leadership, [name of the region] Principals Networks (“Director Educational Leadership, PJ Principals Network”);

8. on the same day, HFE sent an email to the nominated Director appealing the decision of the School;

9. on 11 March 2025, at around 18.00 pm, in dealing with HFE’s appeal the School Deputy Principal (“Deputy Principal”) attended the residential address of HFE and when he found that HFE was not there, the Deputy Principal attended the residential address of the mother of HCZ. When the Deputy Principal knocked on the door of the premises at that residential address it was opened by HFE;

10. on 12 March 2025, again around 5.45pm the School Principal (“Principal”) and the Deputy Principal attend the residential address of HFE. HFE allowed the Deputy Principal to enter the premises at that residential address. While in the premises, the Deputy Principal spoke HFE, HCZ, and, with the agreement of HFE took photos of the premises;

11. on 21 March 2025, the respondent advised HFE that his appeal had been declined.

12. On 28 March 2025, HFE emailed a privacy complaint to the respondent regarding the handling of his personal information during the enrolment process for HCZ. The respondent dealt with this complaint as an application for internal review under section 53 of the PPIP Act.

13. In his privacy complaint, HFE said that the respondent’s handing of his personal information had caused significant stress for him and HCZ who had missed over seven (7) weeks of schooling. In that complaint HFE said that:

14. during the enrolment process, he had provided his residential address and other personal details for the sole purpose of verifying his daughter’s eligibility to enrol in the School. However, contrary to section 10(b) of the PPIP Act, he was never informed that this information would be used to justify a home visit by staff of the School;

15. the home visits were conducted without lawful authority;

16. the respondent’s refusal to enrol HCZ had to be reconsidered because a flawed process had been relied on; and

17. there should be an immediate acceptance of HCZ’s enrolment at the School.

18. On 3 June 2025, the respondent determined HFE’s internal review application. In that determination, the respondent found that its conduct:

19. in collecting HFE’s residential address was not a contravention of the “collection” IPP in section 10 of the PPIP Act;

20. in using HFE’s residential address to visit that address on 11 and 12 March 2025 was a contravention of the “use” IPP in section 17 of the PPIP Act because they did not meet the respondent’s procedural threshold of “reasonable in the circumstances”, even if arguably lawful.

21. In this application, the applicants accepted the findings of the internal reviewer regarding the visits to HFE’s residential address on 11 and 12 March 2025. However, based on that finding they contended that the following additional conduct was also a contravention of a collection and use IPP that applied to the respondent:

22. the 11 March 2025 visit of the Deputy Principal to the residential address of the mother of HCZ; and

23. the alleged “interrogation” of HCZ by the Deputy Principal when he visited the residential address of HFE on 12 March 2025.

24. The applicants seek compensation and other orders, including an order that refrains the respondent from undertaking home visits and an order correcting HCZ’s enrolment records, the latter of which the Tribunal has no jurisdiction to review.

25. The respondent contends that:

26. HCZ has no standing to bring this application;

27. the conduct of the respondent the subject of the internal review application does not amount to a contravention of the IPPs in section 10(b) or section 17 of the PPIP Act;

28. the Tribunal has no jurisdiction to consider the additional conduct of the respondent arising from the 11 and 12 March 2025 visit. However, in the event the Tribunal finds it does have jurisdiction to review this additional conduct it was not conduct that contravened the IPPs in section 8, 10 or 11; and

29. HFE has suffered no loss or damage, and the Tribunal otherwise has no jurisdiction to make the remaining orders sought.

30. For the reasons I am about to give I agree with the contentions of the respondent that:

31. HCZ has no standing to bring this application as the application for internal review was not made by her or made by HFE on her behalf: and

32. the additional conduct on which HFE relies in this application, is not conduct the subject of review as it was not conduct for which HFE sought internal review under section 53 of the PPIP Act.

33. In regard to HFE’s substantive application; based on the information before the Tribunal and the applicable law, I find that the respondent did not contravene IPP 3 (section 10(b) of the PPIP Act) when collecting the personal information (including residential address) of HFE.

34. In regard to the conduct the subject of HFE’s internal review application relates to an alleged contravention by the respondent of the use IPP in section 17 of the PPIP when the Deputy Principal and the Principal used HFE’s residential address (i.e. personal information) to conduct a physical residency check of HFE’s residential address on 11 and 12 March 2025, I have decided that this is a matter that should be remitted to the respondent for reconsideration under section 63(3)(d) of the Administrative Decisions Review Act 1997 (NSW) (“ADR Act”) in accordance with the applicable provisions of the Education Act and the respondent’s Enrolment Procedures. I have made that decision so that the respondent can reconsider that conduct in the context it occurred (i.e. during the appeal process) and the relevant provisions of the Education Act 1990 (NSW) and the respondent’s Enrolment Procedures which, in my opinion, have not been adequately considered previously by the respondent in the context of the application of the use IPP in section 17 of the PPIP Act to persona information that is collected in an online enrolment application.

Jurisdiction and role of the Tribunal

16. The circumstances in which the Tribunal is vested with administrative review jurisdiction over a “decision” of an administrator are those provided in the ADR Act: see Civil and Administrative Tribunal Act 2013 (NSW) (“NCAT Act”) section 30(1).

17. The word “decision” is broadly defined in section 6 of the ADR Act.

18. An “administratively reviewable decision” is defined in section 7 of the ADR Act to include “conduct” of an administrator as follows:

7 Meaning of “administratively reviewable decision”

(1) An administratively reviewable decision is a decision of an administrator over which the Tribunal has administrative review jurisdiction.

(2) For the avoidance of doubt (and without limiting subsection (1) or section 6):

(a) the conduct of an administrator (or a refusal by an administrator to engage in conduct) is an administratively reviewable decision if enabling legislation identifies that conduct or refusal as conduct or refusal over which the Tribunal has administrative review jurisdiction, and

(b) in its application to any such conduct or refusal by an administrator, any reference in this Act (however expressed) to an administrator making an administratively reviewable decision includes a reference to an administrator engaging or refusing to engage in the conduct.

Note—

The jurisdiction conferred on the Tribunal by section 55 of the Privacy and Personal Information Protection Act 1998 is an example of administrative review jurisdiction of the Tribunal over conduct.

There is no dispute that, under section 53 of the PPIP Act, the respondent is the body (i.e. administrator) that internally reviews conduct which is alleged to contravene an IPP that applies to it in respect of the “personal information” of an individual that it collects and holds and that it is conduct that is administratively reviewable by the Tribunal: see ADR Act section 8 and PPIP Act section 55(1).

19. The IPPs are those set out in Division 1 of Part 2 of the PPIP Act. These principles relate to how a public sector agency is to collect “personal information” and how a public sector agency is to retain, alter and check for accuracy, use and disclose “personal information” that it holds.

20. In this application, there is no dispute that:

21. the IPPs generally apply to the respondent and that it is required to comply with these unless a specific exemption in Division 3 of Part 2 of the PPIP Act applies: PPIP Act sections 20 and 21 – in this application, the respondent does not rely on any exemption; and

22. the residential addresses of HFE, HCZ and HCZ’s mother as collected and held by the respondent in the online pro-forma enrolment application submitted by HCZ is personal information about HFE, HCZ and HCZ’s mother.

23. In reviewing the conduct the subject of the internal review application, the role of the Tribunal is to determine, having regard to any relevant factual material and any applicable written and unwritten law, whether that conduct contravened an IPP that applied to the respondent in respect to the personal information it collected and held about the applicant: see ADR Act section 63(1).

24. That is, the Tribunal determines the matter afresh by exercising all the functions that are conferred or imposed by any relevant legislation on the respondent when it internally reviewed that conduct: see ADR Act section 63(2): see GR v Director-General, Department of Housing [2004] NSWADTAP 26 at [53]; NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 at [41]-[43]. On this basis, it is well established that, on administrative review, the respondent is not bound by the findings made on internal review: see FZP v Sydney Children’s Hospitals Network [2025] NSWCATAD 144 at [107]-[109], while this decision was set aside on appeal this aspect of the decision was not a ground on which the appeal was set aside.

25. In reviewing the conduct, section 55(2) of the PPIP Act provides that the Tribunal may decide not to take any action on the matter or make one or more an order(s) under section 55(2)(a)-(g) which includes an order for compensation.

26. Section 55(3) of the PPIP Act provides that nothing in section 55 of the PPIP Act limits any power the Tribunal has in Division 3 of Part 3 of Chapter 3 of the ADR Act. Included in Division 3 are sections 63(3) and section 65 of the ADR Act which set out the orders the Tribunal may make in dealing with or determining an application for administrative review made under that Act.

27. In this regard section 63(3) of the ADR Act sets out what decisions the Tribunal may make in determining an application for administrative review as follows:

63(3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide:

(a) to affirm the administratively reviewable decision, or

(b) to vary the administratively reviewable decision, or

(c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or

(d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal.

26. Section 65 of the ADR Act gives the Tribunal the power, at any stage of the proceedings (i.e. before the proceedings are determined), to remit matters to the administrator for reconsideration.

Material before the Tribunal

27. In support of their case the applicants relied on:

28. an affidavit, affirmed on 23 August 2025 by HFE. Attached to that affidavit were a number of attachments;

29. an affidavit, affirmed on 4 October 2025 by the wife of HFE and the mother of HCZ; and

30. written submissions dated 23 August 2025 and submissions in response to the submissions provided by the respondent on 24 September 2025.

31. In support of its case the respondent provided:

32. the section 58 documents;

33. an affidavit, affirmed 24 September 2025 by Joanna French, the respondent’s Director, Education Leadership; and

34. written submissions dated 24 September 2025.

35. At the hearing of the application:

36. HFE was sworn to give evidence and was cross-examined by the solicitor for the respondent;

37. Ms French was also sworn to give evidence and was cross-examined by HFE;

38. HFE and the solicitor for the respondent gave oral submissions.

Background

30. On 4 April 2024, HFE submitted a pro-forma online high school expression of interest form for HCZ to commence year 7, in 2025, at the School [“2024 expression of interest form”]. In that expression of interest, HFE entered his name as being the “Parent/Carer” of HCZ. In providing HCZ’s details, HFE provided HCZ’s residential address, the name of the primary school she was attending and the name of her local intake high school. HCZ’s residential address was that of her mother and the named local intake high school was not the School.

31. The School declined HFE’s expression of interest as HCZ’s residential address was an out-of-area enrolment for the School and the School did not have the capacity to accept any out-of-area enrolments.

32. On 5 February 2025, HFE submitted, a pro-forma online local enrolment application for HCZ to attend the School [“2025(1) local enrolment application*”*]. In that application, HFE again identified himself as HCZ’s “Parent/carer”. HFE also provided a residential address that was his residential address and the residential address where HCZ normally lived (i.e. “Parents/carers with whom the student normally lives”). The address provided by HFE was an “in-area” residential address for the School. HFE also inserted “Yes” to the question “In area?” and provided a “Start date” of “05 Feb 2025”. It is not disputed that the residential address provided by HFE is an “in-area” residential address for the School. Nor is it disputed that the premises at this residential address was a studio apartment.

33. In the “Other family details” section of the enrolment application, HFE identified the mother of HCZ as the “Other parent/carer” of HCZ. HFE also provided details of the mother’s residential address and mobile phone number. The mother’s residential address was the same address that had been provided in the 2024 expression of interest form. Again, it was not an “in-area” address for the School.

34. Uploaded to the pro-forma online local enrolment application form were a number of documents as proof of HCZ identity and her residential address. It is not disputed that as proof of residential address HFE provided a six-month lease, in his name, for the premises at his nominated residential address. A copy of that lease was not provided by HFE or the respondent.

35. On 12 February 2025, the School requested that HFE provide a 12-month lease as further proof of HCZ’s residential address.

36. On 18 February 2025, HFE submitted another pro-forma online local enrolment application for HCZ to attend the School [“2025(2) local enrolment application*”*]. The body of the application contained the same information as contained in the earlier online local enrolment application. However, uploaded to that application were additional documents as proof of HCZ’s residential address.

37. While the respondent has not provided a copy of what was uploaded and submitted with the second local enrolment application, attached to the affidavit of HFE is a copy of two six-month leases for his nominated residential address, a home insurance policy for the premises at that address, an electricity plan, a bond payment receipt and HFE’s 2023-24 tax return details. The uploaded leases were in the name of HFE. One lease had a commencement date of 13 February 2025 and end date of 12 August 2025. The other lease was stated commence immediately after the end of the first 6-month lease.

38. On 28 February 2025, the Principal wrote to HFE to advise that his application for the enrolment of HCZ was not successful because the School Panel “was unable to definitively verify that [HFE’s residential address] is the permanent residential address where [HCZ] resides”. The letter went on to say that where an “in-area” residential status has not been clearly supported, the Principal was unable to offer a placement due to the School’s enrolment buffer having been exceeded. The letter also informed HFE that if he sought to appeal the decision, he could do so, by email, to the Director, PJ Principals Network.

39. On the same day, HFE sent an email appealing the School’s “refusal of the enrolment of [his] daughter”. He said that her enrolment had been denied on the basis that he had failed to provide a 12-month lease as proof of HCZ’s residential address.

40. Eleven days later, on 11 March 2025, at around 6-6.30pm, the Deputy Principal attended the residential address of HFE as provided in the 2025 online local enrolment applications. When no one was there, the Deputy Principal went to the premises at the nominated residential address of HFE’s wife and the mother of HCZ. When the Deputy Principal arrived at that address, the door of the premises was opened by HFE. It is not disputed that when speaking to HFE, the Deputy Principal told HFE that he needed to verify that the home address of HCZ was the address HFE had provided in the online local enrolment application.

41. The following morning, on 12 March 2025, HFE attended the front office of the School. The respondent alleges that when attending the School HFE requested that the Deputy Principal visit his residential address to verify that it is also HCZ’s residential address. HFE does not dispute that he attended the School that morning. However, he denies having requested that the Deputy Principal attend his residential address to verify that HCZ was also living there. Instead, he asserts that he attended the School to seek clarification of the respondent’s policies about unannounced home visits for residency verification and whether school principals were authorised to conduct such visits. In support of that assertion, attached at annexure 10 of HFE’s affidavit is a copy of an email he sent to the respondent at 11.29 that morning seeking clarification of its policies “on residency verification checks for school enrolments”. Of particular concern to HFE was the visit by staff of the School to the residential address of the mother of HCZ the previous afternoon when she was not the parent/carer who had enrolled HCZ. In his email, HFE asked the respondent to review the actions of the staff of the School to determine whether they align with the respondent’s policies and privacy laws.

42. It is not disputed that sometime around 5.30pm the Principal and Deputy Principal attended the residential address of HFE. It is not disputed that HFE was not here when they arrived. It is conceded that the Deputy Principal called HFE who was at a medical appointment. While there is some dispute as to whether HFE answered that call or called the Deputy Principal subsequently, HFE’s evidence is that the attendance/visit was unannounced. It is the evidence of HFE that the Deputy Principal told him that he should return home by 5.45 pm for a residence check and if he did not return HCZ’s enrolment would be further delayed.

43. When HFE arrived back to his residential address, the Principal and Deputy Principal were already in the common area of the building in which HFE’s apartment was located. HFE and the Deputy Principal entered the premises. The Deputy Principal asked HFE and HCZ questions about their living arrangements at the premises. After having asked HFE whether he could take a video of the premises, the Deputy Principal took a video of the layout of the premises.

44. On 21 March 2025, the Director PJ Principals Network wrote to HFE advising that his appeal of 28 February 2025 had been declined because, following the “home visit undertaken as part of [the School’s] duty of care and responsibility to establish proof of residence”, it was found that there was reasonable doubt that HCZ was living at the residential address as entered by HFE in the online local enrolment application. The Director also explained that “Schools for a lengthy period of time have performed these verification strategies, accepted by the Department, to ensure they are following their responsibilities in relation to local intake area enrolments”.

45. On the same day (21 March 2025), HFE wrote to the respondent “formally” withdrawing his consent to allow the Deputy Principal to film his premises. In that letter HFE said:

I am writing to formally withdraw my consent for the capture of any images from my residence located at [HFE’s residential address].

On 13/03/ 2025, [name], the deputy principal of [the School] requested and was granted permission to take images of my home. The request was simple: “can I make a video”. However, upon further reflection, I do not feel comfortable with the images being taken as no conditions were provided about which cybersecurity safeguards are in place, what is permitted use and what is the retention policy, and I revoke my prior consent.

I base this request on the Education Department's breach of section 10C, 10D and 10 E Privacy and Personal Information Act 1998 ...

46. Three days later, on 24 March 2025, HFE lodged a written complaint about the 21 March 2025 decision of the Director, PJ Principals Network concerning his appeal from the 28 February 2025 decision of the School to reject the enrolment application of HCZ.

47. On 28 March 2025, HFE sent a three-page letter, headed “Invasion of Privacy Under PPIP Act & Unlawful Residency Verification Procedure”, to the respondent. At the commencement of that letter, HFE said:

I am writing to formally lodge a privacy complaint against the Department of Education regarding its handling of my personal information during the enrolment process of my daughter [HCZ], at [the School]. [HCZ] lives with me at my home address on [residential address of HFE as provided in the 2025 enrolment forms].

48. On 7 April 2025, the respondent wrote to HCZ to notify him that an internal review under section 53 of the PPIP Act would be undertaken in respect of his 28 March 2025 complaint.

49. On 11 April 2025, the Director, B Principals Network, sent a letter to HFE in response to his 24 March 2025 complaint about the appeal decision of the Director, PJ Principals Network. In that response, the Director, B Principals Network noted that the School Enrolment Panel and the Principal were genuine in their consideration of HCZ’s application, but on balance did not conclude that information at their disposal satisfied the requirements of a local enrolment. The Director, B Principals Network also noted that the website of the School contained “Enrolment Guidelines” which included a reference to a possible residential check to verify a child’s in-area address.

50. On 23 April 2025, the Director, PJ Principal Network wrote to HFE to advise that, as he had requested, the film footage taken of his residence on 13 March 2025 had been destroyed. In that letter, the Director, PJ Principals Network said:

You are however, entitled to request an internal review of the department's collection of this information. Further information can be accessed via the NSW Department of Education website under rights and accountability and privacy and Privacy Information and forms.

51. There is no evidence of HFE having made an internal review application in respect of the film footage taken by the Deputy Principal on 12 March 2025.

52. On 2 May 2025, “KI”, an officer of the respondent, met with the Principal and the Deputy Principal in preparation for her report, on behalf of the respondent, in response to HFE’s privacy complaint of 28 March 2025. A file note of that meeting is contained at tab 12 of the respondent’s section 58 bundle of documents.

53. On 3 June 2025, the respondent notified HFE of its determination of the conduct the subject of his 28 March 2025 internal review application. As noted above, the respondent found that the conduct of the School was a contravention of the use IPP in section 17 of the PPIP Act, but not a contravention of the collection IPP in section 10 of the PPIP Act.

54. On 19 June 2025, the applicant lodged this application for external review of the conduct of the respondent.

Proceedings before the Tribunal

55. In his application for review by the Tribunal, HFE:

56. named the applicant as himself on behalf of FCZ; and

57. said that his grounds for application were:

The Department breached IPP 10 (s.17 PPIP Act) by conduction unauthorised home visits using my personal information, as admitted in Internal Review dated 3/6/25 which advised NCAT review rights. Department interrogated my 11yo daughter and triggered ex-partner’s hospitalisation. Privacy breach caused severe distress and daughter missed Term 1 school. Seek compensation under s.55 PPIP Act.

56. The applicant’s application first came before the Tribunal (differently constituted) at a case conference on 28 July 2025 where orders were made for the progress of the matter. An order was also made:

57. under section 64(1)(a) of the NCAT Act, prohibiting the publication or broadcasting of the name of HFE and HCZ: and

58. amending the name of the applicant as HCZ and joining HFE as an applicant.

59. The Tribunal also noted that:

60. the respondent reserved its right to address in its submissions as to whether “HFE” had standing to bring the application; and

61. HFE had made an application to represent his daughter in these proceedings and directed the respondent to notify before the next hearing of any opposition it had to HCZ being represented by HFE.

62. I am assuming that the reference to “HFE” in (1) above is a typographical error and should be HCZ.

63. On 1 August 2025, HFE lodged an application for miscellaneous matters in which he sought the following orders:

Department bound by Internal Review findings

Proceedings to address only harm/compensation/remedies (breach established)

60. The applicant’s application for miscellaneous matters was withdrawn on 7 October 2026. Hence, I have considered it no further other than to reiterate that on administrative review the role of the Tribunal is to review the conduct the subject of the internal review application afresh. That is, it is well established that the Tribunal is not bound by the findings made on internal review and it is open to the respondent to depart from these findings on administrative review: see FZP v Sydney Children’s Hospitals Network [2025] NSWCATAD 144 at [107]-[109], while this decision was set aside on appeal this aspect of the decision was not a ground on which the appeal was set aside.

The PPIP Act – information protection principles

61. In CNP v Commissioner for Fair Trading [2017] NSWCATAD 70 at [45], the Tribunal described the PPIP Act as being:

… [in practice] a data protection statute rather than a broad privacy statute offering statutory protections against physical privacy infringements, oral disclosures not materially recorded, intrusion, surveillance (in the absence of capture) and more common additional notions of privacy.

The PPIP Act information protection principles

62. Central to the PPIP Act are the information protection principles (IPPs) set out in Division 1 of Part 2 of the PPIP Act which a public sector agency must observe in handling personal information that it collects, holds, uses and discloses. As already noted, the respondent is a public sector agency within the meaning of the PPIP Act and not permitted not do anything, engage in any practice that contravenes an IPP that applies to it: see PPIP Act sections 20 and 21.

63. IPP 1 (PPIP Act section 8) limits the purposes of collection of personal information by a public sector agency as follows:

8 Collection of personal information for lawful purposes

(1) A public sector agency must not collect personal information unless—

(a) the information is collected for a lawful purpose that is directly related to a function or activity of the agency, and

(b) the collection of the information is reasonably necessary for that purpose.

(2) A public sector agency must not collect personal information by any unlawful means.

64. IPP 2 (PPIP Act section 9) limits from whom personal information is to be collected by a public sector agency:

9 Collection of personal information directly from individual

A public sector agency must, in collecting personal information, collect the information directly from the individual to whom the information relates unless—

(a) the individual has authorised collection of the information from someone else, or

(b) in the case of information relating to a person who is under the age of 16 years—the information has been provided by a parent or guardian of the person.

65. IPP 3 (PPIP Act section 10) places obligations on a public sector agency to ensure that individuals whose personal information is collected is made aware of a range of matters relating to the collection of that information, including the purpose for which the information is being collected. That section is in the following terms:

10 Requirements when collecting personal information

If a public sector agency collects personal information from an individual, the agency must take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, the individual to whom the information relates is made aware of the following—

(a) the fact that the information is being collected,

(b) the purposes for which the information is being collected,

(c) the intended recipients of the information,

(d) whether the supply of the information by the individual is required by law or is voluntary, and any consequences for the individual if the information (or any part of it) is not provided,

(e) the existence of any right of access to, and correction of, the information,

(f) the name and address of the agency that is collecting the information and the agency that is to hold the information.

66. IPP 4 (PPIP Act section 11) requires a public sector agency to ensure that the personal information it collects from an individual is relevant, not excessive, accurate and not intrusive.

67. IPP 10 (PPIP Act section 17) places limits on the use of personal information held by a public sector agency for a purpose other than for the primary purpose for which it was collected, with it being permissible to use personal information for a secondary purpose in specified circumstances, as follows:

17 Limits on use of personal information

A public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless—

(a) the individual to whom the information relates has consented to the use of the information for that other purpose, or

(b) the other purpose for which the information is used is directly related to the purpose for which the information was collected, or

(c) the use of the information for that other purpose is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual to whom the information relates or of another person.

68. IPP 11 (PPIP Act section 18) places similar limits on the disclosure of personal information held by a public sector agency.

69. Section 4(4) defines when personal information is “held” by a public sector agency as follows:

(4) Personal information is held by a public sector agency if—

(a) the agency is in possession or control of the information, or

(b) the information is in the possession or control of a person employed or engaged by the agency in the course of such employment or engagement, or

(c) the information is contained in a State record in respect of which the agency is responsible under the State Records Act 1998.

70. Section 4(5) of the PPIP Act provides that personal information is not “collected” by a public sector agency if receipt of the information received by the agency is unsolicited.

71. It is accepted that personal information “obtained by visual or oral perception in the mind of an employee” of a public sector agency without ever being recorded, is not held by that agency: see PPIP Act section 4(4) and Vice-Chancellor*, Macquarie University v FM* [2005] NSWCA 192 [25], [28], [40].

72. Division 3 of Part 2 of the PPIP Act contains specific exemptions to a public sector agency complying with one or more IPP. Section 25 in this Division provides:

25 Exemptions where non-compliance is lawfully authorised or required

A public sector agency is not required to comply with section 9, 10, 13, 14, 15, 17, 18 or 19 if—

(a) the agency is lawfully authorised or required not to comply with the principle concerned, or

(b) non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law (including the State Records Act 1998)

73. I have dealt with this section in more detail below.

Review of conduct of a public sector agency

74. Part 5 of the PPIP Act contains provisions for the review of conduct of a public sector agency which is alleged to be:

75. a contravention of an information protection principle that applies to that agency (PPIP Act section 52(1)(a));

76. a contravention of a privacy code of practice that applies to that agency (PPIP Act section 52(1)(b)); and

77. a disclosure of personal information kept in a public register (PPIP Act section 52(1)(c)).

78. Section 53(1) and (2) in Part 5 provides that a person aggrieved by the conduct of a public sector agency is entitled to a review of that conduct and, that the review is to be undertaken by the public sector agency concerned. This review by the agency is known as the internal review of the conduct for which the person seeks review.

79. Section 53(3) provides that an application for review must:

(a) be in writing, and

(b) be addressed to the public sector agency concerned, and

(c) specify an address in Australia to which a notice under subsection (8) may be sent, and

(d) be lodged at an office of the public sector agency within 6 months (or such later date as the agency may allow) from the time the applicant first became aware of the conduct the subject of the application, and

(e) comply with such other requirements as may be prescribed by the regulations.

77. Section 55(1) in Part 3 makes provisions for administrative review by the Tribunal as follows:

55 Administrative review of conduct by Tribunal

(1) If a person who has made an application for internal review under section 53 is not satisfied with—

(a) the findings of the review, or

(b) the action taken by the public sector agency in relation to the application,

the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53.

78. As noted above, section 55(2) sets out what action the Tribunal may take in reviewing the conduct the subject of the applicant’s internal review application.

Standing of HCZ

79. There is no dispute that HFE has standing to bring this application.

80. As noted, on 28 July 2025, the Tribunal (differently constituted), made an order that HFE be joined as an applicant to these proceedings. He was named as the second applicant and HCZ was named as the first applicant.

81. What is in dispute is whether HCZ has standing to bring this application, and if she has no standing, whether she should be removed as an applicant under section 44(2) of the NCAT Act.

82. As noted above, to have standing to bring an application for administrative review under section 55(1) of the PPIP Act, the person seeking administrative review must satisfy the following:

83. to have made an application to the public sector agency seeking internal review of the agency’s conduct under section 53 of the PPI Act; and

84. to be not satisfied with the findings of the internal review, or the action taken by the public sector agency in relation to the internal review application.

Legal principles

83. In FMM v icareNSW [2025] NSWCATAP 218 (“FMM”) at [42] the Appeal Panel observed:

42 The scheme of Part 5 of the PPIPA Act is clear. It contemplates a two-step review process. A person “aggrieved” by the conduct of a public sector agency is first entitled to internal review under s 53. If not satisfied with the findings of the review or the action taken by the public sector agency in relation to their application, the person may apply to the Tribunal for administrative review. It is not a scheme that allows a person to apply directly to the Tribunal for review, bypassing internal review under s 53. In other words, the aggrieved person, having exercised their entitlements to internal review under s 53, is given rights of further review under s 55. The scheme under Part 5 is not one that allows stand alone rights of review under s 55 to someone who was not a person “aggrieved” within the meaning of s 53.

84. It is accepted that a parent has standing to bring an application on behalf of his or her child under section 55(1) of the PPIP Act where that parent, in making the internal review application was aggrieved not only on his or her behalf but also on behalf of their child: see DSG v Department of Education [2019] NSWCATAD 182 (“DSG”) at [94]. In DSG at [97], the Tribunal went on to say that, in such circumstances, a parent also has standing to make an application under section 55(1) in his or her own capacity.

85. As noted by the Tribunal in DSG, the above findings were arguably obiter as each parent and each child was named as an applicant in those proceedings.

Consideration

86. In his privacy complaint, HFE did not say that he was making the complaint on his behalf and on behalf of HCZ. While that complaint arose from conduct of the respondent in respect of the personal information provided by HFE in the 2025 online local enrolment application for HCZ, this alone does not mean that HCZ is also a complainant or applicant for internal review.

87. Ultimately, whether the privacy complaint made by HFE is also a complaint made on behalf of HCZ is a question of fact, to be determined from the circumstances and the content of the complaint, in particular the conduct the subject of that complaint that is alleged to be a contravention of an IPP that applies to the respondent.

88. The legal principles applicable to determining the specific conduct the subject of an internal review application are set out below at [91]-[92]. I have applied these in making my findings as to whether HCZ has standing to bring this application.

89. As already noted, HFE began his privacy complaint of 28 March 2025 by saying that he was writing to formally lodge a privacy complaint against the respondent “regarding its handling of my personal information during the enrolment process” for HCZ.

90. That is, HFE expressly said that the complaint was about his personal information and not that of HCZ.

91. HFE went on to provide further details about his complaint under a heading entitled “My claims and concerns” which was broken up into three further sub-headings. The first sub-heading is entitled: “1. Breach of Privacy – Failure to Disclose Use of Personal Information (section 10(b) PPIP Act”. Under this sub-heading, HFE said:

During the enrolment process, I provided my residential address and other personal details for the sole purpose of verifying [HCZ’s] eligibility to enrol in the school. However, I was never informed that this information would be used to justify a home visit by school staff.

Under section 10(b) of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act), the Department was required to explicitly disclose how my personal information would be used. This obligation was not met.

The stated purpose of collecting my residential address was for a document-based residency verification.

The Department's own policy and the Education Act 1990 (NSW) (Section 34A) do not authorise home visits as a verification method. Such invasive powers must be explicitly given by legislation.

I was not given any prior notice that my information would be used for a physical residency check, nor was I given the opportunity to object to its findings…

This failure to disclose a secondary use of personal information constitutes a breach of section 10(b) of the PPIP Act and …

92. Again, under this sub-heading which in my opinion forms the essence of the conduct the subject of HFE’s privacy complaint, it is a complaint about conduct relating to the use of his personal information and not that of HCZ.

93. Under the sub-headings that followed, HFE went on to contend that the Deputy Principal had acted beyond his legal authority by using the home visit to question HCZ as a verification method. Based on that illegality, it was HFE’s contention that HCZ’s enrolment had to be reconsidered. While the authority to conduct a home visit is a factor relevant to whether the respondent’s use of HFE’s residential address for the purpose of verifying that address is a contravention of the collection or use IPPs, a finding that there is a contravention does not have the effect of setting aside the decision of the School to decline HCZ’s online local enrolment application.

94. Nor, as pointed out by the respondent, did HFE contend in his privacy complaint that in questioning HCZ the respondent collected and used, in contravention of the PPIP Act, personal information about her. Instead, it is mentioned by HFE as an event that occurred because of the respondent’s alleged contravention of the collection and use IPP of his personal information. I accept it was also an event that caused him some concern. Even if I am wrong, there is no evidence before the Tribunal that the respondent collected personal information about HCZ as a result of being questioned: see Vice-Chancellor Macquarie University v FM [2005] NSWCA 192 where the Court of Appeal held that information held in the mind of an employee was not held by the agency.

95. Accordingly, I am not persuaded that it can be inferred that HFE’s privacy complaint was made on behalf of HCZ or that it was made on his behalf and on behalf of HCZ.

96. In the absence of any evidence of HCZ having otherwise made an application for internal review under section 53 of the PPIP Act, I find that HCZ has no standing to bring this application and should be removed as an applicant.

Scope of the conduct the subject of review

97. It is convenient to first deal with the applicable legal principles for determining the conduct of an internal review application.

Legal principles

98. It is accepted that because of the interaction between section 53 and section 55(1) of the PPIP Act, the scope of the conduct the subject of the person’s application for internal review, reasonably construed, sets the parameters for the scope of the conduct the subject of the person’s application for review by the Tribunal: see O**D v Department of Education and Training (GD) [2005] NSWADTAP 74 at [12]. That is, an applicant for administrative review cannot be widened after the agency has dealt with the application: see also KO v Commissioner of Police, NSW Police Force (GD) [2005] NSWADTAP 56 at [14] and [15] where the Appeal Panel said:

14 … [Its determination] is not driven, in any significant way, in our view by any recitation of Information Protection Principles that may appear in the applicant’s application. Often there will be no recitation of Information Protection Principles. Sometimes there will be a detailed recitation seeking to bring into play many, or every one of, the Principles. The key question is what facts and circumstances has the applicant referred to which might give rise to questions of compliance with the Information Protection Principles, and to identify the relevant Principles.

15 It is necessary, once having identified the facts and circumstances, to link them to the record keeping environment of the organisation (as to which, see Vice-Chancellor Macquarie University v FM [2005] NSWCA 192) and to the Information Protection Principles.

99. In CYL v YZA [2017] NSWCATAP 105 at [58], the Appeal Panel, having reiterated that the scope of the application for internal review is a matter of fact to be determined objectively by construing the application reasonably, went on to say:

58 … [The focus] is the conduct of which the applicant complains. ‘Conduct’ is the expression used in this area of the law to describe action by the agency or circumstances involving the agency that might amount to a possible contravention of an information protection principle: see PPIPA s 52. There needs to be material that can be understood by the agency, fairly read, as connecting the action or circumstances of concern to a principle, whether or not the principle itself is actually specified by the application.

Consideration

100. In his application for administrative review that is before the Tribunal, under the heading “Grounds for Review”, HFE said:

The Department breached IPP 10 (s.17 PPIP Act) by conducting unauthorised home visits using my personal information, as admitted in internal review dated 3/6/25 which advised NCAT review rights. Department staff interrogated my 11yo daughter and triggered ex-partner’s hospitalisation. Seek compensation under s. 55 PPIP Act. …

101. In the attachment to the administrative review application HFE asserted that, based on the findings of the respondent on internal review, the conduct the subject of his application for administrative review was the Deputy Principal’s:

102. use of the residential address of the mother of HCZ to conduct an unauthorised visit to that address on 11 March 2025; and

103. alleged “interrogation” of HCZ on 12 March 2025 while conducting a home visit at his (HFE’s) residential address.

104. I accept that HFE who is not legally qualified may have assumed that, on administrative review, the respondent was bound by the findings of the internal reviewer. However, as I have already explained, as is the case in this application, on administrative review the respondent is not bound by those findings.

105. For the reasons set out above under the heading “Standing of HCZ”, my findings are that the conduct the subject of HFE’s privacy complaint is the use of his personal information, as collected by the respondent in the online local enrolment application for HCZ, to justify a home visit by the Deputy Principal to verify his residential address.

106. While HFE contended that this conduct of the Deputy Principal was a contravention of the collection IPP in section 10(b) of the PIPP Act, the internal reviewer was correct to also consider the conduct in the context of the use IPP in section 17 of the PPIP Act.

107. For the reasons set out above, in my opinion, HFE’s alleged “interrogation” of HCZ by the Deputy Principal during the 12 March 2025 home visit, is not conduct for which he sought internal review. Instead, HFE referred to it as an event that occurred as consequence of the respondent’s alleged contravention of the collection and use IPP of his personal information.

108. I make a similar finding in respect to the use of the residential address of the mother of HCZ. HFE mentioned this event under the heading “Brief Timeline of Event” but did not otherwise seek review of that conduct and appropriately so.

109. Accordingly, I find that the conduct of the Deputy Principal:

110. in using of the residential address of the mother of HCZ to conduct an unauthorised visit to that address on 11 March 2025; and

111. in questioning HCZ during the 12 March 2025 home visit

is not conduct for which HFE sought internal review in his 28 February 2025 privacy complaint.

108. This does not mean that these events are of no relevance to what action the Tribunal might decide to take if the conduct the subject of HFE’s privacy complaint were to be found to contravene an IPP that applies to the respondent.

The evidence

Evidence of HFE

109. The affidavit of HFE contains both submissions and evidence. To the extent it contains evidence relevant to the conduct the subject of review, HFE said:

110. on 11 March 2025, at approximately 6.40pm, without consent or prior warning, the Deputy Principal made a visit to the home of HCZ’s mother. He said he was there waiting to collect his children from a dance class;

111. the Deputy Principal told him that;

(a) he had attended his residential address and found that no one was home; and (b) he was performing a residency check and that this visit was something they had to do because of enrolment fraud;

3. he was upset that the School had attended the home of HCZ’s mother as he had deliberately excluded her as a non-applicant parent due to her mental health vulnerabilities. Nor had he consented to a home visit or informed that such visits were possible;

4. on the morning of 12 March 2025, he attended the School to seek clarification from the Deputy Principal about the authority under which he had attended the home of HCZ’s mother who was a non-applicant parent in the enrolment application, the policies and procedures of the School that governed such visits and why he was not notified of such visits as part of the enrolment process;

5. he did not insist that the Deputy Principal come to his residential address that day,

6. later that morning he emailed a complaint to the respondent seeking urgent clarification about the respondent’s policies on residence verification checks for school enrolments, specifically in relation to the unannounced visit on 11 March by the Deputy Principal to the residential address of HCZ’s mother. A copy of that email complaint is attached to his affidavit;

7. on 12 March at approximately 5.23 pm while he was attending a physiotherapy appointment, he received a telephone call from the Deputy Principal who informed him that he should return home by 5.45 pm for a residence check and that if he did not comply, HCZ’s enrolment would be further delayed; and

8. he arrived home at approximately 6.00 pm to find the Principal and Deputy Principal inside the building complex and waiting at the door of his apartment. He found their presence to be intimidating and a disregard of his privacy.

9. HFE went on to explain that:

10. after asking if he could enter the apartment, the Deputy Principal entered the apartment. He said the Deputy Principal looked around for a few minutes and said that he did not believe that HCZ lived there and that he would call it as he saw it. HFE said he objected to this finding and asked under what authority, policy, or procedures was the home visit and inspection being undertaken. He said the Deputy Principal advised that he was authorised by the respondent to conduct the visit and he would provide the relevant policies and procedures on the following day;

11. the Deputy Principal “interrogate” his daughter;

12. he observed HCZ becoming visibly uncomfortable during this time. He, as a parent, also became deeply distress watching his daughter being interrogated in her own home about her living arrangements. He felt helpless and humiliated; and

13. having asked if he could, the Deputy Principal took photographs of the interior of the apartment.

14. HFE went on to explain the impact these residential visits by the Deputy Principal and Principal had on him, HCZ and the mother of HCZ.

15. During cross-examination at the hearing of his application HFE said:

16. he and his wife have shared responsibility for their children – this is not pursuant to a Court order but by mutual agreement between his wife and himself;

17. he and his wife were living separately from January to July 2025. In January he was living in Hong Kong;

18. his lease was approved on 5 February 2025 and HCZ started living with him on 30 February 2025;

19. his residential premises were small, but he had made a temporary partition for HCZ to have her own space;

20. he did not enrol HCZ at any other high school;

21. after her enrolment application to the School was declined, HCZ was enrolled in another public high school;

22. in August 2025, he moved out of his residential address and returned to live at the residential address of his wife – they remain separated and he was looking to move out;

23. while living at his residential address, HCZ was living with him about 60% of the time; and

24. HCZ otherwise lived with her mother where she had her own room.

Evidence of HFE’s wife

113. In her affidavit, HCZ’s mother gave evidence that supported HFE’s evidence of them having been separated since 2020. As she needed support, she and HFE lived separately in the same residence. In 2024, she became more confident and had spoken with HFE about living in separate residence again once HCZ went to high school.

114. She said that through 2024, HCZ and her sister were picked up by a person hired by HFE. On rare occasions she would pick them up by car.

115. Attached to her affidavit was a copy of a time-stamped picture of the Deputy Principal’s visit to her home on 11 March 2025*.* The time-stamped on that picture is “18:41:54 AEDT.” In respect of that visit, the mother of HCZ said she was never given notice or made aware of a visit to her home by staff from the School.

Evidence of Ms French and file note of the 2 May 2025 meeting with the Principal and Deputy Principal

116. In her affidavit, at [11]-[12] Ms French said that:

11 Information sought in the enrolment application is collected for multiple purposes. For example, the residential address of a child (which may include the address of both parents) are collected in an enrolment application for the following purposes:

(a) to assess whether the application could be an “in-area application” or an “out-of-area application”;

(b) to enable the school and Department to discharge its duty of care to the child (for example to be able to notify and contact parents of various school related matters and to ascertain whether a person is authorised to collect a child from the school gates); and

(c) to ensure parents can be contacted in a timely manner in the event of an emergency or critical incident.

12 Information may also be collected in the enrolment application to enable a school to determine the resources (if any) that can be made available to support a child's education (for example, whether the child could be assigned to a smaller class where there is an additional learning support officer available.

117. Ms French went on to say:

15 For children who have two addresses specified for both parents in the enrolment form, where they have a different address from their sibling who is also enrolled at the school or where a school is at an enrolment capacity or in high demand, a school principal may feel it necessary to obtain additional information to be satisfied that there is an in-area application before them, including:

(a) obtaining copies of parenting orders ...

(b) visiting the residential address specified in the enrolment applications to verify that the child actually resides at the address and, does so, in a safe and secure environment.

16 Based on my experience and interactions with other principals I consider visiting residential addresses is a practise used by some NSW government school principals to verify information provided in enrolment applications. It is used for several purposes:

(a) to verify that a child and parent reside at a particular address, as specified in the application;

(b) to inspect relevant identification documents to facilitate the enrolment of a child, in circumstances where no physical or electronic copy will be provided by the parent or guardian; and

(c) to check on the wellbeing of a child as, as per mandatory reporting guidelines

17 To accord with school community expectations and ensure the effectiveness and efficiency of residential visits, I understand the following measures are generally taken by school principals:

(a) they disseminate information about the possibility of residential visits (including by expressly referring to them in their local enrolment procedures or at parent information sessions);

(b) they will develop a rough plan of the information they are seeking to obtain from the visit; and

(c) where possible and in non-urgent circumstances, they will schedule a time with parents/guardians to undertake the visit.

118. At [18]-[20], Ms French gave evidence about the School enrolment processes as follows:

18 [The School] … a comprehensive, co-educational public high school can accommodate up to 1200 students in 2025….

19 Since its opening [the School] has been in high demand for new student enrolments and has received a considerable number of out-of-area applications. For example, a recent five-year review of students enrolled at [the School] revealed that over 200 students no longer resided at the address specified in their enrolment applications. This has resulted in local enrolment procedures being developed for the school to manage its unique enrolment conditions and to ensure that enrolment decisions are made fairly and in line with the department's enrolment policy. Variations to the school's procedures (such as requiring a 12-month lease instead of a six-month lease) are made in accordance with the departmental processes. …

20 One of the challenges facing [the School] is the attempts to disguise out-of-area applications as an in-area application (for example, by parents temporarily renting an apartment that is within the in-area designation of the School and then, after the lease over the apartment has expired, moving back to the family home outside the in-area designation and providing that address to the school). This has required … the principal and deputy principal of [the School] to be extra vigilant to ensure that enrolment decisions are both fair and in the best interests of the child.

119. At [21], Ms French explained that while she was reliving in the Director, PJ Principals Network position she had a conversation with the Principal and Deputy Principal about the circumstances surrounding HFE’s enrolment application for HCZ. She said that the Director, PJ Principals Networkalso relayed to her conversations she had with the Principal and Deputy Principal after she returned to her position.

120. Ms French then set out her understanding of these conversations and the circumstances surrounding the residential address inspections of 11 and 12 March 2025.

121. During cross-examination at the hearing of this application Ms French said:

122. regarding paragraph 16(a) of her affidavit, she was not aware of any procedures regarding home visits to verify the residential address of the student as identified in an in-area enrolment application; and

123. regarding paragraph 17(b) of her affidavit, she had not seen a rough plan for the visit to HFE’s residential address – nor had she been told that one had existed.

124. In a file note of a meeting between the internal reviewer (“KI”) and the Principal and Deputy Principal on 2 May 2025, the Principal is recorded as having said:

“The school has its own unique enrolment guidelines ... which allows them to go and do a home visit to verify addresses. It's common practise by the school and they have done this previously on a number of occasions.

123. The Deputy Principal is recorded as having said:

To expedite the enrolment process, I conducted a residential check. I attended [HFE’s residential address] first, but no one was there. I then went to the [residential address of the mother of HCZ] and both [HFE] was there and so was [the mother of HCZ]. … I engaged with [HFE] and said I needed to verify his address he said that I could come to the other address another time. …

124. The Principal and Deputy Principal are recorded as having said “no” to the question as to whether they had consent before the initial visit or subsequent visit to HFE’s residential address.

The Education Act and relevant procedures and policies of the respondent

125. It is necessary to briefly deal with the relevant provisions concerning local enrolment under the Education Act 1990 (NSW), the relevant enrolment procedures of the respondent pursuant to that Act and the enrolment Guidelines of the School.

A: The Education Act

126. Part 2 of the Education Act sets out the principles and objects of the Act. To the extent relevant to this application, section 4 of that Act sets out the principles on which the Act is based as follows:

4 Principles on which this Act is based

In enacting this Act, Parliament has had regard to the following principles—

(a) every child has the right to receive an education,

(b) the education of a child is primarily the responsibility of the child’s parents,

(c) it is the duty of the State to ensure that every child receives an education of the highest quality,

(d) the principal responsibility of the State in the education of children is the provision of public education.

127. The principal objects of the Act are set out in section 5 and includes:

(b) to provide for the establishment and operation of government schools.

128. Section 19 in Part 4 of the Education Act sets out the general functions of the Minister under that Act, which includes, at section 19(b) “to establish and supervise the operation of government schools under Part 6”. I understand that this general function and the other functions vested in the Minister are exercised by the respondent on behalf of the Minister.

129. Section 27(1) in Part 6 of the Education Act provides the Minister may establish a school in a locality if satisfied of the matters prescribed in that sub-section are met.

130. Section 29 prescribes what kinds of government schools the Minister may establish, and section 34 makes provision for the admission to a government school. That section relevantly provides:

34 Admission to government schools

(1) The parent of a child may enrol the child at any government school if the child is eligible to attend the school and the school can accommodate the child.

(2) A child is, in any case, entitled to be enrolled at the government school that is designated for the intake area within which the child’s home is situated and that the child is eligible to attend.

(3) The Secretary is to designate intake areas, and the government school or schools for each such area, so that all school-age children in the State will be eligible to attend a government school.

…

(6) The following matters may (without limitation) be taken into consideration in determining whether a particular government school can accommodate a child—

(a) the child’s age and sex,

(b) the kind of school established under section 29,

(c) the financial and other resources provided to the school,

(d) the existing number of classrooms and other facilities at the school.

131. Section 34A of the Education Act provides that principals can require proof of eligibility to attend or entitlement to be enrolled at government schools. That section is in the following terms:

34A Principals can require proof of eligibility to attend or entitlement to be enrolled at government schools

(1) The principal of a government school may, for the purpose of establishing a child’s eligibility to attend or entitlement to be enrolled at the school, require a person seeking to enrol the child at the school to provide proof, to the satisfaction of the principal, of the child’s identity, date of birth and home address.

(2) The requirement may include a requirement to produce any document or to provide a statutory declaration, or both.

(3) The child is not entitled to be enrolled at the school unless and until the requirement is complied with (unless the requirement cannot reasonably be complied with in the circumstances).

(4) The Secretary may terminate the enrolment of a child at a government school who is not entitled to be enrolled at the school if the child was enrolled as a result of false information or a false document provided to the principal.

132. As noted above, for the purpose of establishing a child’s ability to enrol at a school, section 34A(1) gives the principal of a school the ability to require a person seeking to enrol a child at a public school to “provide proof”, to the satisfaction of the principal, of the child’s identity, date of birth and home address.

133. Section 34A(2) goes on to provide that this requirement may include the person producing a document and/or providing a statutory declaration.

B: The respondent’s “Enrolment in Kindergarten to Year 12 procedure”

134. The respondent’s “Enrolment in Kindergarten to Year 12 procedure” (*“*Enrolment Procedure”) sets out the procedures for local enrolments (section 1), assessment of enrolment applications (section 2), the sharing of enrolment information (section 3), non-local enrolments (section 4), other forms of enrolment (sections 5 and 6) and how enrolment data is managed.

Local enrolments – proof of address

135. Consistent with section 34A of the Education Act, clause 1.2.7 in section 1 of the Enrolment Procedure sets out the procedure for “Proof of address” in a local enrolment application, the introductory words of which are:

Under the Education Act 1990, principals may require proof of address to establish a child or young person’s entitlement to enrol in the local school.

Any request for proof of address must be reasonable in the circumstances.

Principals may waive or vary the 100-point residential address check requirements, to meet the needs of the school community or where a parent can give good reasons why they cannot present documents. …

…

Principals of schools that are near or above (i.e. the number of non-local enrolment applications received exceeds the number of enrolment places available outside the local enrolment buffer) their buffer level should use the following 100-point residential address check to determine the student's entitlement to enrol at the school. The residential address check does not need to be used for non-local enrolment applications.

136. These introductory words are followed by a table that identifies how the 100-point residential address check is calculated. For example, a lease agreement (in the name of the child’s parent or carer) through a registered real estate agent for a period of at least six months or rental board bond receipt (in the name of the child’s parent or carer) attracts 40 points.

Responsibilities of principals – requesting further information

137. Section 2 of the Enrolment Procedure sets out the responsibilities of principals in assessing enrolment applications. Clause 2.3 in that section deals with requesting further information as follows:

2.3 Requesting further information

Principals and school staff can request further information on students, if needed, on:

identity, date of birth, and address

…

Any requests for further information must be reasonable in the circumstances and should not create a barrier to enrolment at the school and should be in the best interests of the child.

2.3.1 Proof of identity, date of birth and/ or home address

Principals and school staff can request:

proof of student’s identity, date of birth, and home address. This can be in the form of documents or a statutory declaration, or both. The documents requested should be reasonably required to process the application

multiple documents if they have reasonable doubts about the student's true residential address.

Legal issues bulletin 43, Enrolment of students in government schools provides further information on establishing a child's identity, date of birth and home address.

Principals should manage any records and copies of records used to verify the identity of an individual in line with their record keeping requirements.

138. Bulletin 43 “Enrolment of students in government schools” (“Bulletin 43) provides information about the Education Act and public-school enrolment policy.”

139. The following guidance about requiring further information about a child (student), including further information about the student’s address is contained at paragraph 2.3 of Bulletin 43:

2.3 Requesting further information

Principals and school staff can request further information on students, if needed, on:

identity, date of birth and address

uncertain enrolment history

Any requests for further information must be reasonable in the circumstances and should not create a barrier to enrolment at the school and should be in the best interest of the child.

Reasonable means that the principal may request documentation only that verifies a student’s residential address. Principals or school staff should not use other methods, such as physically checking a residence or requesting information beyond what is readily available and directly relevant to confirm residency.

140. Section 2 of the Enrolment Procedures make no reference to “home visits” or a residency check to verify the home address of a student. However, there is mention of enquiries a school principal can make of other public schools etc.

Management of non-local enrolments - appeals

141. Clause 4.8 in section 4 of the respondent’s Enrolment Procedures make provision for “appealing decisions on non-local enrolments” as follows:

Parents can lodge an appeal if their non-local enrolment application was unsuccessful.

An appeal aims to determine whether the criteria have been applied equitably. If the principal was:

not on the enrolment panel, they will review the appeal

on the panel, the director, education leadership will review the appeal

Principal and school staff responsibilities

Principals and school staff should:

help students and parents who wish to appeal to understand their rights and the appeal process and …

ensure that the person appealing has access to the appeal process and provide or arrange any necessary assistance …

avoid involvement in the decision-making process or any appearance of such involvement by following the principles of procedural fairness

inform the parent in writing of the decision about the appeal

If the issue remains unresolved at the school level, the director, education leadership is the final level of appeal and must make the final decision.

142. Non-local enrolment criteria are set out in clause 4.4 of section 4.

C: The Enrolment Guidelines of the School

143. Included in the respondent’s section 58 documents is a copy of the “Enrolment Guidelines” (“Guideline”) for the School. This Guideline is nine (9) pages long and provides guidance as to what is required for an “In-area Enrolment” and “Out-of-Area Enrolment”.

144. For an “In-area Enrolment”, the Guidelines (consistent with the respondent’s Enrolment Procedures) describe the documentation that is required for proof of permanent residence (see at pages 1 and 2). Under the heading “Please note” on the bottom of page 2 there is a note to say that completion of the online application did not automatically guarantee enrolment. That note is followed by a series of bullet points including:

Penalties may apply for providing false or misleading information to a school when making an application for enrolment.

If false or misleading information is given, the enrolment application may be revoked.

145. On page 4 of the Guideline, at the end of “Out-of-Area Enrolment” and under the heading “Appeals” is the following:

If a parent or carer wishes to appeal against the decision of the school placement panel, the appeal should be made in writing to the principal who will seek to resolve the matter. If the matter is not resolved, the Director, Educational Leadership will consider the appeal and make a determination. The Director will consult with the Principal and the school community as necessary. The purpose of the appeal is to determine whether the stated criteria have been applied fairly.

Appeals will be assessed in relation to all applications previously considered. The process at [the School] will be thorough, exhaustive and fair to all applicants. The procedures are transparent, while upholding the confidentiality of each student's application and submitted documents.

146. At Annexure 7 of the affidavit of HFE is a further copy of the “Enrolment Guidelines” for the School which appear to relate to enrolments for the 2026 school year.

147. The respondent provided HFE with a copy of this document in response to an access application he made, on 18 March 2025, under the Government Information (Public Access) Act 2009 (NSW) (“GIPA Act”).

148. With one exception, the copy of the Guideline provided to HFE in response to his GIPA Act access application is in the same terms to the one provided by the respondent. The exception is the addition of a bullet point on page 3, under the heading “Please note”. That additional bullet point is inserted between those listed at [135] above and states:

Verification of the child's permanent in area address may include - residential checks, contacting the leasing agent and/ or their current school.

149. As the respondent has not sought to rely on this version of the Guideline and Ms French did not refer to it, I have not considered it any further other than to note that residential checks and contacting a leasing agent are not provided for in the Education Act or the respondent’s Enrolment Procedures. Nor are there any procedures in place about the circumstances in which such checks and contact can be made (e.g. with the knowledge or consent of the person making the enrolment application).

Consideration

150. I re-iterate; it is not for the Tribunal to determine whether the decision of the School to decline HCZ’s enrolment application is correct or incorrect. Nor is it for the Tribunal to determine whether HCZ did or did not reside at HFE’s nominated residential address.

151. What is in issue is whether:

152. the respondent contravened the collection IPP in section 10 of the PPIP Act and/or the use IPP in section 17 of that Act when:

(a) on 11 March 2025 the Deputy Principal attended the residential address of HFE as collected by the respondent in the online local enrolment application for HCZ; and (b) on 12 March 2025 the Principal and the Deputy Principal attended the residential address of HFE as collected by the respondent in the online local enrolment application for HCZ; and

2. In the event it is found the respondent did contravene an IPP what action, if any should be taken.

3. It is not disputed that the Deputy Principal and the Principal used the personal information (i.e. residential address) of HFE, as collected and held in the online local enrolment application for HCZ, to attend HFE’s residential address on 11 March 2025 and 12 March 2025 for the purpose of a “home visit” to verify that address as being the address where HCZ lived.

4. The evidence is that the School had its own “unique guidelines” that permitted “home visits”. Ms French seemed to suggest that these reflect school community expectations. This might be so however they must also be consistent with the relevant provisions of the Education Act and the respondent’s Enrolment Procedures. In the case of online enrolment applications, the Act nor the Enrolment Procedures make provision for a staff member of a school to undertake physical residential checks for the purpose of verifying the home address of a student. Instead, detailed provision is made for document-based checks for the purpose of verifying the home address, which includes documents provided by the parent/care applicant for enrolment or those that are otherwise available to the school principal or deputy principal.

5. While the respondent contends that “home visits” can nevertheless be inferred from the terms of the Education Act and the respondent’s Enrolment Procedure, I am not persuaded that this is so given the terms section 2.3 of Bulletin 43 which expressly states that principals or school staff should not use methods such as physically checking a residence when requesting further information about a student’s residential address.

6. In this case, on the material before the Tribunal, the School declined the online enrolment application for HCZ without having undertaken a physical check or “home visit” of the premises at the residential address of HFE as collected by the respondent in the online local enrolment application for HCZ.

7. Instead, it was undertaken during the appeal process. As noted above, the respondent’s Enrolment Procedures only provide for an appeal process where an “out-of-area” enrolment application is made and refused. I have dealt with this issue and the “home visits” of the Deputy Principal and Principal during the appeal process in more detail below under the heading “Did the respondent contravene IPP 10 in section 17 of the PPIP Act.

Did the respondent contravene IPP 3 in section 10 of the PPIP Act?

157. As noted above, in collecting HFE’s personal information in the local enrolment application, IPP 3 required the respondent to take such steps as are reasonable in the circumstances to ensure that, before the information is collected or as soon as practicable after collection, HFE was made aware of the matters in section 10(a)-(f), which includes the purposes for which the information was collected.

158. IPP 3, as set out in section 10 of the PPIP Act, is a notice provision in that it requires public sector agencies to have in place practices (i.e. systems such as a collection/privacy notice or statement) which make an individual from whom personal information is being collected by a public sector agency is reasonably made aware of why it is being collected, what that agency does with the information, and what rights the individual has to see and correct that information: see AOZ v Rail Corporation NSW [2014] NSWCATAP 76 (“AOZ”) at [52] and CJU v HealthShare NSW [2021] NSWCATAD 372 (“CJU”) at [64]-[66]. While the remarks made by the Appeal Panel in AOZ were made in respect of the equivalent health privacy principle (“HPP”) in the Health Records Information Privacy Act 2002 (NSW) they equally apply to IPP 3.

159. In Vice-Chancellor, Macquarie University v FM (No.2) (GD) [2004] NSWADTAP 37 at [27], the Appeal Panel of the former Administrative Decisions Tribunal observed that the notification requirement in IPP 3 is clearly addressed to circumstances where information is being collected in a systemic way for inclusion in a database, as is the case in this application.

160. It is accepted that the provision helps promote transparency about an agency’s collection and handling of personal and health information. It also allows an individual to give (or refuse) their informed consent to the collection of their personal information: KJ v Wentworth Area Health Service [2004] NSWADT 84 at [35].

161. Finally, the principle is cast in strict terms in that the public sector agency “must ... take steps that are reasonable in the circumstances to ensure that the individual is aware” of the matters prescribed in (a) to (f): see AOZ at [57] and [70].

162. In this case, the evidence is that the home page of the online Enrolment Application for the School contained a link to the respondent’s online enrolment privacy notice, which the respondent contends satisfied the requirements of section 10. That notice relevantly provided:

The personal information collected on this application is for purposes directly related to your child's education including processing this application.

Any information provided to the NSW Department of Education (Department) will be used, disclosed and stored consistent with the NSW privacy laws.

Certain information is acquired by the Department to meet its duty of care and other legal obligations and functions under public health, education and child protection legislation and for meeting data collection and reporting requirements under Commonwealth dash state funding agreements. …

Information may be disclosed between NSW State and Commonwealth government agencies and other organisations for the above purposes and as authorised or required by law.

…

If you choose not to provide some requested information it may have a detrimental impact on your child's enrolment, resourcing of the school or meeting your child's educational needs.

Further information about the collection of information while your child is enrolled at a NSW Government school, and how we protect your privacy, is available on the department's website or from your school.

…

163. Within the online enrolment privacy notice is a hyperlink titled “Privacy Collection Notice”, which links to the “Collection Notice – Schools”. The School's Collection Notice relevantly states:

The department collects personal and health information about students, their parents, carers, families and other persons of significance before and during the course of a student's enrolment at a NSW government school ...

The department collects information to ensure compliance with its obligations under laws governing or relating to the operation of schools ...

The department may also collect personal and health information required for the effective management, resourcing and administration of education in public schools ...

Information is collected for the primary purpose of providing every student with the opportunity to achieve their educational potential and for other directly related purposes including but not limited to:

...

maintaining the good order and management of schools

...

operational and administrative purposes

...

satisfying the department's legal obligations, in particular, its duty of care.

164. In my opinion, the privacy/collection notice of the respondent complies with the requirements of IPP 3 in that it informs a parent/carer applicant seeking approval for the enrolment of their child as a student at the school of the following:

165. the personal information that is provided in the online enrolment application is being collected by the respondent;

166. the purpose for which the personal information is collected in the online enrolment application is directly related to the education of the child the subject of the application and for the purpose of assessing that application and any other directly related purpose;

167. the intended recipients of the personal information provided in the online enrolment form;

168. supply of personal information is required by law and the consequences for not providing that information may have a detrimental effect on the enrolment application;

169. the existence of a right to access and correction of the information; and

170. the holder of the information collected is the respondent.

171. Accordingly, I find that the conduct of the respondent the subject of HFE’s internal review application to the extent it is alleged that the respondent contravened the requirements of IPP 3 in section 10 of the PPIP Act as not been established.

Did the respondent contravene IPP 10 in section 17 of the PPIP Act?

166. It is convenient to re-iterate that section 17 relevantly provides that a public sector agency that holds personal information must not use the information for a purpose other than that for which it was collected unless:

167. the individual to whom the information relates has consented to the use of the information for that other purpose; or

168. the other purpose for which the information is used is directly related to the purpose for which the information was collected; …

169. It is also convenient to briefly re-iterate the contentions of HFE and the respondent. `

170. It is the contention of HFE that, under the respondent’s Enrolment Procedures and the School Enrolment Guidelines that applied at the time, the purpose for which his residential address had been collected by the respondent, did not include a use for the purpose of the Deputy Principal or the Principal attending his address for a physical “home visit” to verify HCZ’s home address. Instead, under the Enrolment Procedures and School Enrolment Guidelines verification, was by means of documentation uploaded onto the online enrolment application, any further documentation or statutory declaration that is requested and provided and any other information that is available to the school principal.

171. HFE went on to submit that had “home visits” been authorised as a form of verification of a student’s home address, then the Enrolment Procedures and the School Enrolment Guidelines would have provided for such along the lines that are contained in the respondent’s “Student attendance in NSW public schools procedures” (“Student Attendance Policy”). That Policy HFE noted set out the circumstances in which such visits can be made, by whom they can be made and when they can be made. Finally, in the absence of such a provision, it cannot be inferred to apply under the respondent’s the Enrolment Procedures and School Enrolment Guidelines.

172. The respondent submitted:

173. first, the respondent’s use of the residential addresses (i.e. the residential address of HFE and the residential address of the mother of HCZ) to undertake home visits to verify the addresses to process HCZ’s enrolment application was for the purpose for which that information was collected;

174. secondly, in the alternative, even if the respondent's use of the residential addresses to undertake a home visits was not for the purpose for which that information was collected, the use was directly related to the purpose for which it was collected and, therefore, fell within the exception provided in section 17(b) of the PPIP Act; and

175. thirdly, in the further alternative, the second applicant impliedly consented to the respondent using his personal information to undertake a home visit to his residential address on 12 March 2025.

176. Again, the purpose for which the information was collected is a question of fact.

177. In my opinion, the purpose for which HFE’s residential address was collected should not be considered in the context of enrolment generally. Instead, its purpose should be considered in the context in which it was collected, namely in the context of an enrolment application which is formulated on the basis of the respondent’s Enrolment Procedures for local enrolments and/or out-of-area enrolments that is assessed by the school on the documentation collected in that application together with any other relevant information available to the school.

178. In this case, on 28 February 2025, the Principal advised HFE that his application for the enrolment of HCZ was unsuccessful because the School Panel was unable to “definitively verify” that his residential address was the permanent residential address of HCZ.

179. HFE was clearly dissatisfied with this advice. However, he does not contend that the respondent contravened the use IPP in respect of his personal information at this stage of the enrolment process.

180. The alleged contravening conduct, as noted in the background, occurred during the appeal process, outside school hours and without any prior arrangements having been made. It is unclear why the appeal process was applied as respondent’s Enrolment Procedures only provide for an appeal where an out-of-area enrolment application has been made. Even if the appeal process did apply, clause 4.8 of the respondent’s Enrolment Procedures provide that the purpose of an appeal is to determine whether the applicable criteria were applied equally when the decision to decide an out-of-area enrolment application.

181. The alleged contravening conduct (i.e. the physical “home visits”) occurred in the appeal process raises several questions that have not been considered by the parties, and in my opinion, they should be given an opportunity to do so. This is especially so when, without having regard to the application of Bulletin 43 or the specific role of school staff under its Enrolment Procedures, the respondent has given a very broad application to the purpose for which the residential address and other personal information relating to that address are collected by it in an online local enrolment application. Furthermore, neither were these issues addressed by Ms French in her evidence.

182. As noted above, under section 63(3)(d) of the ADR Act the Tribunal can decide to set aside the administratively reviewable decision (i.e. reviewable conduct in this case) and remit the matter for reconsideration by the respondent in accordance with any directions or recommendations of the Tribunal.

183. However, I would make the following observations about the use of HFE’s residential address as collected by the respondent in the online enrolment application for the purpose of conducting a physical “home visit” or residency check as a form of verifying a student’s home address for the purpose of assessing the student’s entitlement to enrol at a school:

184. the Education Act, nor the respondent’s Enrolment Procedures expressly authorise a school or a staff member of a school to undertaking a physical “home visit” or residency check to verify the home address of the student for whom an enrolment application is made. On the contrary, paragraph 2.3 of Bulletin 43 expressly provides that principals or school staff should not use physically checking a residence as a method of verifying a student’s residential address;

185. it is difficult to see how it can be implied that the Education Act or the respondent’s Enrolment Procedures authorise such a physical “home visit” or residency check in circumstances where section 34A of the Education Act and the respondent’s Enrolment Procedures for a local enrolment expressly make provision for verification of a student’s home address by means of documentation provided by the parent/carer applicant of the student and any other documentation/information that is otherwise available to the principal of the school (see Enrolment Procedures at clause 1.2.7, 2.1, 2.3); and

186. when, how and by whom is a physical “home visit” or residency check of a parent or carer of a student authorised?

187. Whether the conduct of the staff of the School in using HFE’s residential address to conduct a “home visit” or residency check is a use of that information by the respondent for a purpose for which that information had been collected, or a use of that information for another purpose that directly related to that purpose for which the information had been collected, will depend on the answer to the abovementioned questions and the relevant appeal procedures. If found not to be conduct of the respondent, this is not conduct over which the Tribunal has jurisdiction: see Director General, Department of Education and Training v MT [2006] NSWCA 270 at [45] and [55], CJU v SafeWork NSW [2018] NSWCATAD 300 at [28] and MH v NSW Maritime [2011] NSADT 248 at [138].

188. If found to be conduct of the respondent, but not a use for a purpose for which that information had been collected in the online local enrolment application and not a use for another purpose that is directly related to the purpose for which the information was collected, the question will be whether:

189. HFE consented to the use of that information for that other purpose. I agree with the respondent that the evidence is that, on 12 March 2025, HFE allowed the Deputy Principal to enter his premises to look around, ask questions and take photos. This allowance does not, in my opinion, on the evidence before the Tribunal amount to a consent for such other purpose under section 17(a) of the PPIP Act, should that section apply. In this regard I found HFE ton the whole to be a credible witness. However, his allowance is a factor relevant to what action, if any, might be taken in reviewing the alleged contravening conduct, I make no finding whether, this allowance amounts to consent; or

190. non-compliance is otherwise permitted (or is necessarily implied or reasonably contemplated) under an Act or any other law: PPIP Act section 25.

191. In conclusion, for the reasons set out above, I have decided that the respondent should be given an opportunity to reconsider the conduct the subject of HFE’s internal review application to the extent it alleges that the use, by the Deputy Principal on 11 and 12 March 2025 and the Principal on 12 March 2025, of his personal information (i.e. residential address) as collected in the online local enrolment application lodged by HFE, for the purpose of a physical residency check was a contravention of the use IPP in section 17 of the PPIP Act. That review should be undertaken based on the evidence before the Tribunal and the applicable provisions of the Education Act and the respondent’s Enrolment Procedures.

192. On this bases the appropriate order is, pursuant to section 63(3)(d) of the ADR Act, to set aside the respondent’s internal review of the conduct the subject to HFE’s internal review application and remit it for reconsideration by the respondent to the extent the conduct the subject of internal review relates to an alleged contravention by the respondent of the use IPP in section 17 of the PPIP when the Deputy Principal and the Principal used HFE’s residential address (i.e. personal information) as collected by the respondent in the online local enrolment application, to attend that residential address for a physical residency check. That review should be undertaken based on the evidence before the Tribunal and the applicable provisions of the Education Act and the respondent’s Enrolment Procedures.

Conclusion and Orders

183. For the reasons set out above I have found that:

184. HCZ has no standing to bring this application; and the appropriate order is to remove her as an applicant under section 44(2) of the NCAT Act;

185. the Tribunal has no jurisdiction to review the conduct of the respondent in regard to the alleged “interrogation” of HCZ by the Deputy Principal on 12 March 2025 or the attendance by the Deputy Principal at the residential address of the mother of HCZ on 11 March 2025 because that was no conduct for which HFE had sought review in his internal review application;

186. the respondent did not contravene IPP 3 as alleged by HFE; and

187. pursuant to section 63(3)(d) of the ADR Act, the respondent’s internal review of the conduct the subject to HFE’s internal review application is set aside and remitted for reconsideration by the respondent to the extent the conduct the subject of internal review relates to an alleged contravention by the respondent of the use IPP in section 17 of the PPIP when the Deputy Principal and the Principal used HFE’s residential address (i.e. personal information) as collected by the respondent in the online local enrolment application, to attend HFE’s residential address on 11 and 12 March 2025 for a physical residency check. That review should be undertaken based on the evidence before the Tribunal and the applicable provisions of the Education Act and the respondent’s Enrolment Procedures.

188. Accordingly, I make the following orders:

189. Pursuant to section 44(2)(b) of the Civil and Administrative Tribunal Act 2013 (NSW), HCZ is to be removed as a party to these proceedings.

190. Pursuant to section 63(3)(d) of the ADR Act, the respondent’s internal review of the conduct the subject to HFE’s internal review application is set aside and remitted for reconsideration by the respondent to the extent the conduct the subject of internal review relates to an alleged contravention by the respondent of the use IPP in section 17 of the PPIP when the Deputy Principal and the Principal used HFE’s residential address (i.e. personal information) as collected by the respondent in the online local enrolment application, to attend HFE’s residential address on 11 and 12 March 2025 for the purpose of conducting a physical residency check. That review should be undertaken based on the evidence before the Tribunal and the applicable provisions of the Education Act and the respondent’s Enrolment Procedures.

191. HFE’s administrative review application is otherwise dismissed.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar