HDC v TAFE NSW [2025] NSWCATAD 317;

1. The applicant is a student who was enrolled in a course of study (HSC 2025) at the respondent's Liverpool Campus.
2. On 3 May 2025, the applicant lodged a Privacy Complaint: Internal Review Application Form, in which he alleged that the breach of privacy occurred on 19 March 2025. He also alleged that this caused him emotional distress, psychological harm, physical harm, damage to reputation, education loss and loss of employment. He alleged that in the future, this conduct may have the following effect: "1. Future financial loss; 2. Damage to reputation; 3. Loss of employment; 4 Loss of business opportunities; 5. Financial security breach; and 6. Harm to physical and to mental well-being. He concluded that he wanted the agency to do the following - "Training, Formal Apology and Compensation for damages assisting in therapy".
3. The respondent responded to the internal review request and stated that it was unable to determine the conduct to which the complaint referred. It asked the applicant to provide further information about the conduct of the respondent that he alleged to be a privacy/data breach.
4. On 3 June 2025, Mr Chester spoke with the applicant by telephone and sent him an email as follows:

...As discussed on the phone on 2 June 2025, can you please send me an email with further information and evidence regarding your breach of privacy complaint. So far, you have informed me that you believe that a misuse of your personal email has occurred via TAFE NSW. In order for our team to investigate further, please provide some further information and evidence as to how and why this occurred via TAFE NSW...

1. On 3 April 2025, the applicant sent the following email to the respondent:

Hi To whom it may concern, I do apologise for my current lack of attendance at the Liverpool college SW studying my HSC 2025, however due to the current situation of my personal emails been (sic) hacked on the 19/03/2025 from attending the TAFE in which the emails had contained extremely personal and private information and documents, due to this privacy breach it had caused a severe mental health issues causing extreme stress and anxiety towards my safety and attending the TAFE... (parts of the rest of the message have been cut off)...

Hello Mr Murphy, I have been f recent receiving multiple unknow email from unknow people which gives me reason to believe there has been a privacy breach in the biology class room and [the classroom teacher] could have been hacked...

1. On 11 June 2025, Mr Chester sent an email to the applicant, asking whether he had any evidence or other material which indicates that his emails were hacked due to actions of the respondent? He specifically asked whether the applicant was referring to his student email account or his personal email account? He also noted the reference to a privacy breach in Biology class and sought information or evidence about how this occurred.
2. On 26 June 2025, Mr Chester sent another email to the applicant, noting that he had not received any response to his email dated 11 June 2025. He stated that the current application for administrative review had been received and asked the applicant whether he wished to pursue his internal review or have the matter externally reviewed by the Tribunal? He also asked the applicant if he had any further information to provide?
3. On 26 June 2025, the applicant replied to the effect that he wanted an internal review regarding his complaints, but he did not provide any further information or evidence to the respondent.
4. On 27 June 2025, Mr Chester sent an email to the applicant, asking whether he wanted to provide any additional material for consideration in the internal review, or whether he wanted the review conducted on the information that he had already provided? Later that day, the applicant replied to the effect that he "wanted to go forth with another internal review please", but he did not provide any further information or evidence.
5. On 17 July 2025, Mr Chester made an internal review decision under s 53 of the PPIPA. He noted that the applicant had provided the respondent with limited information regarding how his privacy was allegedly breached by the respondent and that the evidence relied upon by the applicant comprised four screenshots of emails. Based on these emails, he determined that there was no information or evidence that indicated that the respondent had breached the applicant's privacy.
6. Mr Chester's decision also indicates that he reached out to Mr Murphy (a member of the Staff Email Group) and asked whether he had any further information about this email, or information about any potential privacy breaches regarding the applicant. Mr Murphy replied:

I did not think this was evidence of hacking as (the applicant) suggests. I think it was more likely the teacher sent an email to the whole class and had entered their email addresses in TO; or CC: rather than the preferred BCC: where other recipients can't see other students email. The error is then compounded when students reply to all so all students receive a single student response.

1. Mr Chester also reached out to Mr Parsons and Ms James (members of the Staff Email Group), but they did not provide him with any relevant information in response. He concluded:

29. Furthermore, (the applicant) has not provided any evidence or further information to support his allegations, despite numerous requests. It would be reasonable to assume that if (the applicant) was copied into an email, and his email address was unlawfully shared as a part of receiving this email, that he would have a copy of it. Despite requests to (the applicant), he has not provided any further evidence for this internal review.

1. The respondent formally advised the applicant of his right of review by this Tribunal.

1. On 12 June 2025, the Tribunal received the current application for administrative review, which sought review on the following grounds:

Breach of NSW Privacy rights under the Privacy and Personal Information Protection Act 1998 (PPIP Act) / Health Records and Information Privacy Act 2002 (HRIP Act).

1. On 28 July 2025, Senior Member Ziegler conducted a case conference at which the applicant was self-represented. The Senior Member ordered the parties to file and serve their evidence and submissions. She noted that the applicant applied for an anonymisation order and she directed him to file and serve specific submissions on this issue. She listed the matter for hearing on 3 October 2025 and directed the parties to make sure that their respective witnesses are available for cross-examination at the hearing.
2. On 8 August 2025, the applicant lodged a "Miscellaneous Matters Application", in which he sought leave to issue a Summons in the District Court of NSW under s 148B of the NCAT Act, on the basis that the quantum of his claim for damages exceeds the Tribunal's monetary jurisdiction limit under s 55 of the PIPPA. He also applied for a confidentiality order under s 64(1) of the NCAT Act.
3. On 14 August 2025, Principal Member Ransome ordered that the issues raised in the Miscellaneous Matters Application be determined at the hearing.
4. On 30 September 2025, Mr Chester applied for leave for himself and Ms Khoury to appear at the hearing by AVL. The applicant consented. On 2 October 2025, Principal Member Ransome granted the respondent leave for Ms Khoury to appear by AVL, but she made no such order with respect to Mr Chester.

1. When the matter commenced on 3 October 2025, the applicant appeared in person, but Mr Chester appeared by way of AVL. The Tribunal noted that leave was granted for Ms Khoury to appear by AVL, but that Mr Chester was not granted leave. He replied that he misunderstood the terms of the Tribunal's order because he had applied for leave for both him and Ms Khoury to appear by AVL.
2. The applicant consented to Mr Chester appearing by AVL and, in order to give effect to the guiding principle set out in s 36 of the NCAT Act, the Tribunal granted Mr Chester him leave to appear by way of AVL.

1. The applicant relied upon the following documents:

(1) A bundle of documents headed "Applicant's Witness Testimony Statement" which was signed on 8 August 2025. This document was neither sworn nor affirmed and the Tribunal administered an oath to the applicant, after which he swore that the contents were true and correct. This bundle of documents was admitted into evidence and marked Ex A.

(2) An Affidavit sworn by the applicant on 29 September 2025, was admitted into evidence and marked Ex B.

(3) The applicant also sought to rely upon an affidavit headed "Expert's Affidavit Evidence" sworn by Anthony John Ventra on 29 September 2025.

1. The respondent relied upon a Statement of Rima Khoury dated 17 September 2025. This was admitted into evidence and marked as Ex 1.

1. The respondent gave the applicant noted that it required Mr Ventra to attend for cross-examination. However, the applicant advised the Tribunal that Mr Ventra was not available to attend the hearing on 3 October 2025. The respondent then objected to the tender of his affidavit.

1. In Ex A, the applicant alleges that his privacy was breached as follows:

(1) On 7 February 2025 at 9:47am, his personal email address (details provided) was entered into an email thread involving students and staff.

(2) On 19 March 2025 at 5:37pm, his email account was breached by an unauthorised and unknown user.

(3) On 20 March 2025 at 9:29am, his email account was further breached by unauthorised and unknown users.

(4) During March 2025, while he was attending the respondent's Liverpool Campus as a student, an IT staff member (LC) assisted him in accessing the Guest Wi-Fi network on his personal laptop. He also accessed the Guest Wi-Fi network via his personal mobile phone. However, from 19 March 2025 and "onwards", his email account was compromised "by malicious actors, with signs of unusual activity including but not limited to: (a) unusual login activity; (b) Unauthorised sent emails; (c) Password or settings changes; (d) Missing or deleted emails; and (e) Email service lockouts."

1. In Ex A, the applicant stated that as a result of the privacy breach, he has suffered: (1) Damage to physiological mental health wellbeing; (2) Emotional distress; (3) Insomnia; (4) Weight loss; (5) Embarrassment; (6) Risk to safety; (7) Financial loss; (8) Damage to reputation; and (9) High risk from identity fraud. He also stated that he has "lost complete trust" in the respondent and he has suffered "ongoing severe mental health issues caused by the matter such as PTSD, Anxiety, Depression, Insomnia, Emotional Distress, lack of appetite and paranoia". He also stated that he has lost enjoyment of life "due to constant stress and fear of safety and avoiding social settings and friends and family, and difficulty focusing on simple tasks regarding personal care, studying and household chores." He also "had difficulty in applying and trusting employment opportunities."
2. The applicant relied upon:

(1) An attendance certificate from Dr Gao, psychiatrist, dated 17 June 2025.

(2) A report from R Abdelsayad, psychologist, dated 16 January 2025.

(3) A medical certificate from K Noble, psychologist, dated 23 May 2025.

(4) An email from Ms C Neufeld (his solicitor) dated 15 May 2023, regarding a potential claim for Total and Permanent Disability Benefits against his superannuation fund.

(5) Printouts from the internet regarding alleged data breaches that occurred at different educational institutions (not involving him).

(6) Emails relating to his previous Tribunal proceedings against his former employer (TC), including correspondence with his solicitors.

(7) Medicare Certificate issued by his GP on 23 July 2025, which indicated a diagnosis of Anxiety and Panic Disorder that commenced on 20 March 2025. The doctor certified that he would be unable to work, study or participate in activities from 9 September 2025 to 9 October 2025 and that no other condition was impacting on his capacity.

(8) Medical certificate issued by Dr Muhana, GP, on 29 September 2025, which indicated that on 8 January 2025, a Mental Health Treatment Plan was issued for the applicant with respect to "a panic disorder". He concluded that the "cyber event" exacerbated the applicant's pre-existing mental health symptoms and resulted in PTSD.

(9) Letters (x 3) from the applicant to the Privacy Commissioner dated 19 August 2025, which requested an investigation of the respondent's compliance with the PPIPA. On 26 August 2025, the Privacy Commissioner replied by advising the applicant of the available options to pursue his complaint.

(10) A "Cease and desist" letter dated 18 August 2025, which the applicant sent to the respondent, alleging that it breached the Australian Privacy Principles on 19 March 2025. He demanded that within 14 days, the respondent "cease and desist from any further use or disclosure of his personal email address and any other personal information held without proper authorisation and confirm that his personal information has been removed from deleted from any systems, records, mailing lists or databases where it was used without consent." He concluded that if this was not forthcoming, "I expect to receive instructions to commence proceedings for breach of privacy without further notice to you. If such proceedings are required to be commenced. I expect instructions to claim for damages caused."

1. The respondent required the applicant to attend for cross-examination and he was called and sworn. He stated that the contents of his statements are true and correct to the best of his knowledge, information and belief.
2. The respondent referred the applicant to para 2 of Ex B, in which he alleged that the respondent had further breached his privacy by disclosing his alternative email address (details provided) to a TAFE teacher on 20 March 2025. This allegation had not previously been made by the applicant.
3. The respondent objected to the application being amended to allege a breach of privacy on 20 March 2025 on the basis of prejudice, as it was unable to meet this allegation at this late stage of the proceedings.
4. The Tribunal refused leave to amend his application to allege that the respondent breached his privacy on 20 March 2025, by disclosing his alternative email address to a TAFE teacher.
5. The respondent referred the applicant to the statement of Rima Khoury (Ex 1). The applicant agreed that on 7 February 2025, Ms Khoury asked the students in the class to provide her with their email addresses and that they could either provide their TAFE NSW student email address or their personal email address (if they did not have a TAFE NSW address).
6. The respondent referred the applicant to para 8 of Ex 1, where Ms Khoury stated

I informed the students that I would send out group emails to the students regarding class work, assessments and other important course information. I asked the students in the class if anyone objected to me sending out group emails to the students, via the email addresses that they had provided. No students, either at that time or afterwards, objecting to the proposal to send out group emails to the students to the email addresses provided.

1. The applicant stated that he disagreed with that evidence and that he believed that he would receive an individual email and not a group email and that he believed that he was misled.
2. The respondent referred the applicant to Ms Khoury's test email dated 7 February 2025 (at page 77 of its open bundle of documents) and asked the applicant if he objected to the group email? He replied to the effect, "I did not acknowledge it was a group email until opened it on 19 March 2025".
3. The respondent referred the applicant to an email at page 78 of its open bundle of documents, which is an email that the applicant sent to Ms Khoury and all of the students on 14 March 2025. The applicant stated that he did not see that this was being sent to the entire group and he thought he was sending it to Ms Khoury alone.
4. The respondent referred the applicant to a copy of the group email that Ms Khoury sent on 19 March 2025, attaching a document titled "Mg Oxidation QA", which was the email that Ms Khoury mistakenly sent to a staff email account. The applicant replied to the effect that he believed that a member of the staff email group had accessed his email account, because he received an email from Ben Parsons.
5. The respondent asked the applicant if Mr Parsons stated that he had attempted access his email account? The applicant conceded that he had not done so. The respondent put to the applicant that he had no evidence that anyone else in the staff email group had accessed his email account. The applicant replied to the effect that he believed that a person or persons in that group had done so.
6. The respondent put to the applicant that he had been receiving medical treatment from his GP since 2023 and was prescribed medication for anxiety. The applicant stated that his GP had diagnosed PTSD as a result of the "cyber hacking". He stated that on 20 March 2025, he reported "the cyber breach" to the Head Teacher, updated his anti-virus software and changed his password.
7. The respondent put to the applicant that after he changed his password, there was no evidence that any member of the staff email group had hacked his email account? The applicant replied to the effect that he believed that a person or persons in that group had done so.
8. The applicant was asked to explain the economic loss that he believed he had suffered as a result of the alleged privacy breach. He replied to the effect that he had not been back to the TAFE Campus since the event and he did not want to attend after May 2025.
9. The Tribunal asked the applicant if online study were available to him, as there was no medical evidence that said that he could not have completed online studies. The applicant replied to the effect that he believed he was unfit to study.
10. The respondent referred the applicant to his request for Internal Review and asked if he recalled being asked to provide further evidence of his allegations? He replied, "yes". The respondent then put to him that he had only provided four pages of screen shots (found at page 21 of the bundle of documents). The applicant agreed. The respondent then put to the applicant that because he did not provide more evidence, the respondent could not determine what the alleged privacy breach was. The applicant was unresponsive.
11. The Tribunal noted that the respondent had offered the applicant an apology and asked whether this would make him feel better? He replied "No".
12. The respondent stated that it had no further questions for the applicant and he was released from cross-examination.
13. The applicant then stated that he wished to call Mr Ventra and Mr Chester stated that his attempts to contact Ms Khoury had been unsuccessful. Accordingly, the Tribunal made the following orders:

(1) The matter is stood over part-heard to 21 October 2025;

(2) Leave is granted for Mr Chester, Ms Khoury and Mr Ventra to appear by way of AVL, but the applicant intends to appear in person.

(3) No further evidence is to be filed in the matter.

1. When the hearing resumed on 21 October 2025, the applicant stated that Mr Ventra would not be appearing because his employer refused him permission to appear as a witness in these proceedings. It was necessary to determine whether Mr Ventra's affidavit should be admitted into evidence and, if so, what weight it should be given.
2. Ultimately, the Tribunal decided that as it is not bound by the rules of evidence, it would consider any evidence that the affidavit contained that is logical, probative and relevant to the matters in dispute in these proceedings.
3. The Tribunal noted that Mr Ventra deposed that he understood that the applicant alleges that the respondent disclosed his personal email address to a group of 419 internal staff and 24 students and that this disclosure was unauthorised, and that shortly afterwards, his email account was accessed by third parties and sensitive personal data was exposed.
4. Based wholly upon that history, Mr Ventra expressed a view that disclosure of the email address was "a breach of basic security practices, particularly regarding the handling of identifiable personal data". He also stated, relevantly:

On the likelihood of malicious access:

It is my professional opinion that disclosure of an individual's email address to a wide internal audience significantly increases the likelihood of that address being:

Harvested, leaked or intercepted;

Targeted by phishing or credential-stuffing attacks,

The timing of suspicious login attempts shortly after the email was shared supports the likelihood that the exposure contributed to a malicious access.

On the consequence of compromise:

The applicant has reported that the email account contained sensitive information including:

i. identification documents

ii. financial information

iii. private correspondence;

iv. medical health documents

v. legal documents

Access to this account by unauthorised actors represents serious privacy risk and likely resulted in further exposure of confidential data.

In my opinion, the disclosure was a contributing factor in enabling this compromise.

1. Based upon the material provided to him by the applicant, and his "professional expertise", Mr Ventra stated that the data breach involved the unauthorised sharing of personal emails "dated 7 February 2025 to 19 March 2025". He also stated that the likely consequences of disclosure were "psychological harm, reputational damage, risk of identity theft, economic loss and risk of one's safety and that the methods used by the respondent did not meet best practice standards for protection in a public sector agency."
2. Mr Ventra annexed a Tax Invoice dated 29 September 2025, in the sum of $142.20, for a consultation with the applicant at his home for the purposes of preparing an expert Evidence Affidavit for these proceedings.
3. However, Mr Ventra did not address the issue of whether there was a disclosure of "personal information" as defined in s 4(1) of the PPIPA and his evidence is based wholly upon acceptance of the accuracy of the applicant's history. He did not identify any independent evidence that corroborates that history.
4. Accordingly, in order to determine the weight to be given to Mr Ventra's evidence, it is necessary for the Tribunal to determine whether the applicant's evidence gave rise to sense of actual persuasion regarding the facts that he alleges.
5. During the hearing on 21 October 2025, the Tribunal referred the applicant to his heads of damage and asked him to assist it to locate any evidence that establishes that: (1) he has suffered any financial loss; (2) he has suffered insomnia; (3) the alleged incidents directly resulted in any risk to his safety; (4) anyone of the students and staff in the groups to whom the email dated 19 March 2025 was sent had accessed his data.
6. In response, the applicant referred the Tribunal to the annexures to Ex A and Ex B and he concluded that he was unable to call expert evidence because IT witness was not permitted to appear.
7. The Tribunal observed that the applicant had not filed any evidence in support of a finding that the alleged privacy breach had caused him to suffer financial loss, insomnia or a risk to his safety and there was no evidence that any of the recipients of the email dated 19 March 2025 had directly accessed his email account.

1. The respondent relied upon detailed written submissions filed on 29 September 2025 and Ms Khoury's evidence (Ex 1).

1. Ms Khoury stated that she was the applicant's classroom teacher. On 7 February 2025, she asked the applicant and all students in her class to submit either their TAFE NSW email address or a personal address to her for the purpose of her sending them class work and correspondence. She informed the class, including the applicant, that she would send out group emails to the students in relation to class work, assessments and other important information. While in the class room, she asked all students if anyone objected to her sending out group emails via the email addresses that they provided to her and no one objected.
2. Ms Khoury stated that on 7 February 2025, she sent a test email to the student group (including the applicant) and as no students had objected to the use of their email addresses, the addresses were not hidden. The applicant did not make any objection known to her about his email address being visible on 7 February 2025 or afterwards.
3. Ms Khoury stated that on 14 March 2025, the applicant responded to one of her emails and as he used the "reply all" feature, he directed his email to herself and all other students in the email group.
4. The applicant required Ms Khoury to attend for cross-examination and she was called and sworn.
5. The respondent asked Ms Khoury some questions in chief and she identified her "test" email dated 7 February 2025 at page 52 of the respondent's bundle of documents. She confirmed that she told the students that they could provide either their TAFE NSW email addresses or their personal email addresses and that none of the students objected to providing their email address and none raised any objection after she sent out her test email.
6. Ms Khoury confirmed that on 19 March 2025, she accidentally sent an assessment task to the students and a TAFE NSW staff email account. This is found at page 55 of the respondent's bundle of documents. She stated that she had no reason to believe that any staff member would attempt to access the applicant's email account and that all staff undertake mandatory training about keeping students' information confidential.
7. In cross-examination, the applicant put to Ms Khoury that he had objected to providing his email address on 7 February 2025. However, Ms Khoury stated that she has no record of any such objection. The applicant then asked if Ms Khoury had sent him an "acknowledgment that I would be included in a group email?" She replied to the effect that she did not send a written acknowledgment, but none of the students had objected to her sending class work and other information by way of a group email on 7 February 2025.
8. In re-examination, Ms Khoury stated that on 19 March 2025, she verbally apologised to the applicant and she arranged for the IT Department to send an apology to all concerned.
9. The Tribunal excused Ms Khoury from further attendance.
10. The respondent identified a threshold issue for determination by the Tribunal, namely whether an email address is "personal information" as defined in s 4(1) of the PPIPA.
11. Section 4(1) defines "personal information" as:

Information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

1. The respondent argued that an email address is not "personal information" as defined in s 4(1) for the following reasons:

(1) The caselaw indicates that for an applicant's identity to be "apparent", it must be capable of being perceived from the information itself: WL v La Trobe University (2005) 24 VAR 23; [2005] VCAT 2592 at [17] (WL).

(2) When determining whether an individual's identity can reasonably be ascertained from information or opinion, extraneous material may be considered: WL at [44] - [45].

(3) If an individual's identity is reasonably ascertainable by the taking of no more than reasonable or moderate steps, it is personal information: WL v Randwick City Council [2007] NSWADT 12 at [12].

(4) However, information will not be "reasonably ascertainable" if there is a sufficient degree of "difficulty involved in the necessary searches" required to identify the person to whom the information relates: OS v Mid-Western Regional Council (No 3) [2011] NSWADT 230 at [20].

1. The respondent argued that the applicant's identity is not apparent from the email address, and it cannot be reasonably ascertained from it and there are no reasonable searches that could be conducted to determine who owns that email address.
2. The respondent conceded that its staff who have access to its EBS Student System could cross-reference the email address against students' records. However, even if this occurred, it would not involve a breach of the PPIPA as those staff already had the ability to access and view that email address.
3. However, if the Tribunal found that the email address was "personal information" as defined in s 4(1) of the PPIPA, there was no breach of the PPIPA because:

(1) The applicant provided it with that email address on 7 February 2025;

(2) At all times, it used the email address in a manner consistent with the original purpose for which it was provided; and

(3) The applicant consented to the use of his email address for the purposes of s 17(1) of the PPIPA.

1. The respondent also argued that there was no breach of s 18 of the PPIPA, because the disclosure of the email address was directly related to the purpose for which it was collected, and there was no reason for the respondent to believe that the applicant would object to its use in that manner.
2. The respondent also argued that the applicant was reasonably likely to have been aware, and he was made aware when the email address was collected on 7 February 2025, that it would be used to send group correspondence to the class.
3. However, if the Tribunal found that it had breached ss 17 and/or 18 of the PPIPA, then:

(1) Any breach was minor as the disclosure was limited to the applicant's email address;

(2) Neither the applicant's name nor other personal information was disclosed;

(3) The email was "generic" and it does not reveal his identity;

(4) The extent of the exposure of any breach was to 24 students; and

(5) No damage was suffered by the applicant as a result of any breach.

1. In the alternative, any loss or damage suffered by the applicant is less than alleged.
2. The respondent conceded that following the accidental inclusion of the TAFE NSW staff group in Ms Khoury's email dated 19 March 2025, the applicant may have felt that his privacy was breached or there had been a "cyber hack", because some of the staff replied that the email was not meant for them. However, this was not a breach of privacy or a breach of the PPIPA because:

(1) The email was only sent to TAFE NSW staff members;

(2) While the applicant did not expressly consent to share his email with TAFE NSW staff, staff have access to details of all enrolled students (including their email addresses) through its EBS system, which provides staff with access to students' details;

(3) All TAFE NSW staff undergo mandatory training regarding the TAFE NSW Code of Conduct and Privacy training, as they have daily access and interaction with students' personal and health information, via class room teaching, organising disability and counselling support, and other sensitive and confidential situations. Therefore, they have an obligation to protect students' personal and health information;

(4) There is no evidence that establishes that any TAFE NSW staff attempted to access any other personal information of the applicant, or that they accessed or took any adverse action with respect to his email account.

1. The respondent argued that if the Tribunal finds that the applicant's privacy was breached on 19 March 2025, the applicant did not suffer any damage as a result, or alternatively, any resulting damage is less than he alleges.
2. In relation to the alleged breach of privacy as a result of the applicant logging onto the Guest Wi-Fi network in March 2025, the respondent argued that:

(1) There is no evidence that the applicant actually accessed the Guest Wi-Fi network;

(2) There is no evidence that indicates that there was any data breach of the applicant's laptop or email account;

(3) In the alternative, there is no evidence that any alleged data breach of the applicant's laptop or email account was either caused by or contributed to by any action or inaction on the part of the respondent.

1. The respondent stated that when logging onto the Guest Wi-Fi network, a student must acknowledge the respondent's Privacy Policy and agree to the Guest Wi-Fi Acceptable Use Terms.
2. A copy of the Privacy Policy is in the open bundle of documents and it provides, relevantly, that:

(1) It is not responsible for any personal information that is disclosed to a third party including, but not limited to, personal information that is provided to or otherwise collected by a third party website accessed while using the Guest Wi-Fi.

(2) the user is solely responsible for checking and complying with any use terms or other terms and conditions that apply to websites.

(3) the user agrees that it is not responsible in any way if information that they transmit using the Guest Wi-Fi is accessed, altered, corrupted or otherwise affected.

(4) the user agrees that it is not responsible in any way for any unauthorised access to their computer or any other device, or the introduction of any virus or other harmful code, that may result from use of the Guest Wi-Fi.

(5) the user also agrees to be responsible for obtaining, maintaining, setting up and protecting their own hardware, devices and any other equipment to use the Guest Wi-Fi.

1. Therefore, by logging onto the Guest Wi-Fi, the applicant agreed to both the Privacy Policy and the Acceptable Terms of Use. In other words, he was aware of the risk of any damage or detriment as a result of his accessing the Guest Wi-Fi and the respondent did not take any actions or inactions that caused or contributed to any damage, loss or detriment.
2. The respondent also argued that the applicant failed to mitigate his own loss because he took insufficient steps to protect his computer from viruses or unauthorised access attempts and that the liability waiver protects it to the maximum extent permitted by law.
3. The respondent noted that the applicant raised the following claims in his submissions: (1) Civil remedies for Serious Invasions of Privacy Bill (2016-2020); (2) Work Health and Safety Act 2011 No. 10 (WHS Act); (3) Civil Liability Act 2002; (4) The Australian Privacy Principles Act (13 APPs); (5) Breach to 'serious or repeated interference with privacy clause'; (6) Breach of confidentiality; and (7) Misuse of private information (common law).
4. The respondent argued that the Tribunal lacks jurisdiction to hear any complaints under that legislation and the applicant has not provided particulars or evidence in support of any such claims in this matter.
5. The respondent noted that the applicant sought the following orders:

(1) The proposed acknowledgment of such breach of privacy and wording of a clear unqualified apology;

(2) A review of the respondent's privacy practices and information on steps taken to prevent any future breaches;

(3) $400,000 for "damages caused by the nature and extent of any loss or damages suffered due to the contravention, calculation of the maximum penalty under s 13G of the Privacy Act."

1. The respondent stated that it has offered the applicant an apology for accidentally sending his email address to the TAFE Staff email group comprising 419 persons on 19 March 2025. While this was an error, none of the alleged loss, damage or detriment was due to this error.
2. The respondent stated that it has already taken steps to remediate against any like future incidents, such as reminding the staff involved in the incident to take more care when sending out correspondence. Further information will also be added to its mandatory training, including ensuring that the recipients of correspondence are correct.
3. In relation to the claim for damages, the respondent referred to the legal principles set out in ss 55(2) and 55(4) of the PPIPA. It noted that in DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73 (DTN), the Appeal Panel held that the following principles apply to any determination of whether loss or damage was suffered because of conduct the subject of the internal review application pursuant to s 53 of the PPIPA in respect of causation:

44. The Tribunal at [68] of the Decision confirmed the following principles apply to any determination of whether loss or damage was suffered because of conduct the subject of the internal review application under s53 of the PPIP Act:

(a) The applicant bears the onus of "establishing the causal link between the breach of privacy and the damage allegedly suffered": APV v Department of Finance and Services [2016] NSWCATAD 168 at [15];

(b) The principle of causation which is to be applied is the common law test of causation. The content of that test in the privacy context is that if the agency's breaches "materially contributed" to the loss or damage suffered, it will be regarded as a cause of the damage or loss, despite other factors or conditions having played an even more significant role in producing the loss or damage. As long as the breach materially contributed towards the damage, a causal connection will ordinarily exist even though the breach without more would have not brought on the damage: CYH v Family and Community Services [2018] NSWCATAD 84 at [94]- [96]...

81. The Tribunal summarised the relevant principles in respect of the award of damages at [69] as follows:

The Appeal Panel of the Tribunal has decided that the following principles are applicable in determining whether damages should be awarded for financial loss, or psychological or physical harm, under s 55(2)(a) and (4)(b) of the PPIP Act:

(1) the applicant has a responsibility to place material before the Tribunal in support of such a claim. The agency must have the opportunity to test that material: GR v Director-General, Department of Housing (GD) [2004] NSWADTAP 26 at [38];

(2) there is no entitlement to claim any loss for reputational damage unless that loss is financial: CPJ v The University of Newcastle [2017] NSWCATAD 350 at [30];

(3) damages may be awarded for distress in the absence of independent evidence of psychological harm, where there was acceptance from the submissions and material filed by the applicant, and an assessment of the applicant when she participated in the main appeal hearing, that she has suffered emotional distress and harm, along the lines that she has asserted, because of the aspect of the conduct of respondent in relation to which there was a finding of contravention: AOZ v Rail Corporation NSW (No 2) [2015] NSWCATAP 179 at [20] and [30];

(4) an award of damages for distress should be at the lower end of the scale because of the absence of evidence as to the consequential impact of the distress upon the applicant, and determined the amount should be $1,000: CJU v SafeWork NSW [2018] NSWCATAD 300 at [135], [138];

(5) the award of statutory damages in PPIP Act matters remains a discretionary one even where a causal link sufficient to satisfy s 55(4)(b): NW v New South Wales Fire Brigades (No 2) [2006] NSWADT 61 at [23]- [24]. The discretion not to make an award of compensation has been exercised where the Tribunal has been satisfied that the applicant has already been granted an award of damages in respect to the disclosure of the personal information: JO v Director General, NSW Department of Health (No 2) [2007] NSWADT 256 at [27];

(6) ordinarily where a breach is demonstrated, some sanction should be applied to the agency, unless it can be shown that there it has responded in an adequate way already to the problem identified, and no order therefore is needed: Vice-Chancellor Macquarie University v FM (No 2) (GD) [2004] NSWADTAP 37 at [54].

1. Further, in FJX v TAFE NSW [2023] NSWCATAD 215 (FJX), the Tribunal held that while a breach of s 17 of the PPIPA had occurred, no damages were awarded as the applicant had suffered no loss. No consequential orders were sought and the Tribunal made none.
2. In relation to this matter, the respondent argued that based on the decision in DTN, the applicant bears the onus of establishing the causal link between the breach of privacy and the damage allegedly suffered. He has provided little evidence regarding any damage, loss or harm suffered other than:

(1) Evidence that he was applying for jobs and did not follow through with those applications. However, this evidence does not attribute any loss or damage to the respondent or any events involving it. As per page 2 of the applicant's Economic loss submissions, he would not have been able to start work on the "Monday" as he had a Traffic Court matter.

(2) Sporadic evidence that his email address may have been compromised, without any evidence attributing any alleged compromise or any alleged loss or damage to any events involving the respondent.

(3) The Geeks2U invoice dated 5 August 2025, does not attribute any loss or damage to the respondent or to any events involving it.

(4) A range of medical certificates, which do not attribute any loss or damage to the respondent or events involving it.

1. In other words, there is no evidence of any causal link between any breach of privacy and any damage, loss or compromise to the applicant's email account and/or his computer, and if his email address became known to persons without his permission, this does not mean that his email account was compromised. If any damage, loss or harm was suffered as alleged, the applicant failed to mitigate his loss by changing his password or taking any steps to protect his email account or computer.
2. The respondent concluded that:

(1) The applicant has not provided any evidence of financial loss and based on the Tribunal's decision in FJX, the Tribunal should not make an award for damages in the event that it finds that the applicant's privacy was breached.

(2) In the alternative, as there is no expert evidence of the applicant's alleged loss, damage and harm, any award should be a nominal amount of $1,000 as per the decision in DTN.

1. After the Tribunal had reserved its decision, the applicant stated that that it was clear to him that I did not like him and that I was biased against him. He sought an order that I recuse myself from hearing the matter.
2. I refused the recusal application on the grounds that the hearing had concluded before the application was made and that there was no evidence of actual bias and/or apprehended bias on the part of the Tribunal. I stated that I would provide written reasons in the final decision.
3. The applicant did not specify whether he alleged actual bias and/or apprehended bias. It is therefore necessary to address both types of bias.
4. The issue of recusal on the basis of actual bias and/or apprehended bias and the applicable principles were recently considered by Garling DCJ in Gillies v State of New South Wales (No 5) [2026] NSWSC 1265 (Gillies). His Honour stated, relevantly:

7. It is appropriate to set out briefly the relevant legal principles. With respect to actual bias, the authorities require that an allegation of actual bias must be distinctly made and clearly proved, that such a finding should not be made lightly and that cogent evidence is required: see Reid v The Commercial Club (Albury) Limited [2014] NSWCA 98; South Western Sydney Area Health Services v Edmonds [2007] NSWCA 16 at [97] and the authorities referred to in those cases.

8. The High Court of Australia has said that where the issue with respect to actual bias is based upon a contention of pre-judgment, the party asserting such bias has to establish that the primary judge was "... so committed to a conclusion already formed as to be incapable of alteration, whatever evidence or arguments may be presented ...": see Minister for Immigration and Multicultural Affairs v Jia Legeng [2001] HCA 17 at [72] and the judgment of Gleeson CJ and Gummow J.

9. As their Honours had said at [71]:

"... the question is not whether a decision-maker's mind is blank; it is whether it is open to persuasion ...".

10. I note that the test of actual bias in the form of pre-judgment requires an assessment of the state of mind of the judge in question: see Michael Wilson & Partners Limited v Nicholls & Others [2011] HCA 48 at [33].

11. The test for determining whether a judge disqualify himself or herself by reason of apprehended bias is the objective "double might" test. In Johnson v Johnson [2000] HCA 48; [2000] 201 CLR 488, the Court described the test in this way:

"Whether a fair-minded lay observer might reasonably apprehend that the judge might not bring an impartial and unprejudiced mind to the resolution of the question, the judge is required to decide when enumerating the relevant test."

12. The Court of Appeal has said a finding of apprehended bias is not to be reached lightly: see Polsen v Harrison [2021] NSWCA 23.

13. In Ebner v The Official Trustee in Bankruptcy [2000] HCA 63, it was said at [8] that the application of the test for apprehended bias requires two steps: The first step being that it requires the identification of what it is said might lead a judge to decide a case other than on its legal and factual merits, and secondly it was said that there must be articulated a logical connection between that matter and the feared departure by the judge from deciding the case on its merits.

14. In considering the test for apprehended bias, it is necessary to keep in mind that the general characteristics of the fair-minded lay observer will include that such an observer is not unduly sensitive or suspicious, nor is such an observer complacent. And further, that the fair-minded lay observer is taken to have knowledge of the legal, statutory, and factual context in which the decision is to be made.

1. My discussion with the applicant during oral submissions on 21 October 2025, occurred in an attempt to clarify his damages claim. I attempted to explain to the applicant the difference between submissions and objective evidence that supports submissions. I invited the applicant to assist me to locate the evidence that he had filed that gives rise to a sense of actual persuasion that the alleged events occurred and in the manner he alleges.
2. In my view, the reasonable lay observer would not form any opinion that I might not bring an impartial or unprejudiced mind to the resolution of the issues I am required to decide or that that I have demonstrated any actual bias. Accordingly, I dismissed the application.

1. On 23 October 2025, the applicant sent an application to submit further evidence to the Tribunal email, in which he stated, relevantly:

Dear Registrar, Senior Member/Respondent

I am writing to respectfully request permission to submit additional relevant evidence in relation to the above matter, which was heard on [21/10/2025], but for which a final decision has not yet been delivered.

The evidence I wish to provide relates directly to issues raised during the hearing, specifically concerning the ongoing risks to my personal safety resulting from the alleged breach of privacy by the Respondent.

Reasons for Late Submission:

The additional evidence was not available to me at the time of the hearing and only came to light recently. I believe it is highly relevant and may assist the Tribunal in assessing the seriousness of the breach and the impact on my safety and wellbeing.

I acknowledge that this request is made after the hearing has concluded, and I apologise for any inconvenience this may cause. However, I respectfully submit that allowing the Tribunal to consider this evidence would be in the interests of justice, particularly given the nature of the matter and the risks involved.

Evidence to be Submitted:

I seek to submit the following documents:

1. [A police report regarding a recent Break and Enter in to the Applicants Residential dwelling dated on the 22/10/2025 ]

2. [Police Event Number, and screenshots of Incident]

I confirm that I will provide copies of this evidence to the Respondent and the Tribunal as directed.

I respectfully request that the Tribunal grant leave for this additional evidence to be accepted and considered before a final determination is made.

Please let me know if I should file this request via a particular NCAT form or if there are any directions I should follow.

Thank you for your time and consideration.

1. The applicant did not serve this application on the respondent.
2. However, as I made a specific order on 3 October 2025, that no further evidence was to be submitted, and the decision had been reserved, I declined the application.
3. In any event, I note that the proposed further evidence, which comprised a Police report of an alleged break and entry incident at the applicant's place of residence after the completion of the second hearing, is not logical, probative and relevant to the matters that the Tribunal must determine in this matter.

(1) Is the email address that the applicant provided to the respondent "personal information" as defined in s 4(1) of the PPIPA?

(2) Did the respondent unlawfully disclose the applicant's personal information?

(3) Did any unlawful data breach result from any action or inaction on the part of the respondent?

Is the email address that the applicant provided to the respondent "personal information" as defined in s 4(1) of the PPIPA?

1. In my view, the email address that the applicant provided to Ms Khoury on 7 February 2025 was not personal information as defined in s 4(1) of the PPIPA, because it was not information from which his identify was apparent and his identity was not capable of being perceived from the email address alone: see WL.
2. I accept Ms Khoury's evidence as to the purpose for which the email address was obtained from the applicant and I am satisfied that Ms Khoury advised the class on 7 February 2025 that their provided email addresses would be used to send coursework and assessments to them.
3. I reject the applicant's evidence that he did not consent to his email address being included in group emails to be sent by Ms Khoury to the class and I also reject his argument that he was misled by Ms Khoury because he believed he would receive emails that were being sent to himself only.
4. It follows that I am satisfied that the respondent did not breach ss 17 and 18 of the PPIPA Act on 7 February 2025, when Ms Khoury sent the test email to her class (including the applicant).
5. However, when Ms Khoury accidentally sent an email on 19 March 2025 to the class and a TAFE staff email account, she disclosed the applicant's email address to a group of persons who had access to students' records that contained his email address. This made his identity capable of being perceived from his email address and as the applicant did not consent to disclosure to the staff email account.
6. It follows that I am satisfied that the respondent breached ss 17 and 18 of the PPIPA on 19 March 2025.

(2) Did the respondent unlawfully disclose the applicant's personal information?

1. For the reasons set out above, I am satisfied that the respondent did not unlawfully disclose the applicant's personal information on 7 February 2025, but it did so on 19 March 2025.

(3) Did any unlawful data breach result from any action or inaction on the part of the respondent?

1. In my view, there is no evidence before me that provides a safe climate for accepting that the applicant was the victim of any unlawful data breach as a result of using the respondent's Guest Wi-Fi network, as alleged in these proceedings or at all.
2. There is no evidence that any student or staff of the respondent was responsible for any alleged data breach (or hack) of the applicant's laptop computer or his email account. In relation to this issue, I accept the respondent's evidence that its staff undertake extensive training with a view to maintaining the confidentiality of students' records and there is no evidence that any staff member took any action adverse to the applicant's privacy.
3. I am satisfied on the evidence before me that before a student can log into the respondent's Guest Wi-Fi network, it is necessary for them to acknowledge the respondent's privacy policy and accept its acceptable terms of use via the home/interface page that appears in response to an access request.
4. While the applicant told the Tribunal that he did not see any such home/interface page when he logged into the Guest WI-FI Network, I am satisfied on the evidence before me that the network could not be successfully accessed unless the privacy policy was acknowledged and the acceptable terms of use were accepted by the proposed user.
5. The privacy policy and terms of use are before me in evidence and I am satisfied that they apply to the matter before me and that by accessing the Guest Wi-Fi network, the applicant acknowledged the policy and agreed to the acceptable terms of use.
6. The terms of the acceptable terms of use have been set out previously in this decision and in my view, these provide a complete answer to the applicant's allegations regarding the data breach that allegedly resulted from his use of the Guest Wi-Fi network.

What loss or damage did the applicant suffer as a result of the breaches of ss 17 and 18 of the PPIPA?

1. I accept the respondent's evidence that the Tribunal lacks jurisdiction with respect to most of the legislation that the applicant purported to rely upon in Ex A and Ex B.
2. The applicant alleges that he suffered a serious psychological injury (PTSD) as a result of the events alleged in this matter. However, I some of his medical evidence was relied upon in his previous Tribunal proceedings in which he claimed damages against a former employer ("TC").
3. The decision in the proceedings against TC are published and a matter of public record, but as the applicant's name was not anonymised in those proceedings I have decided not to expressly refer that decision in this decision in case it breaches the non-publication order.
4. However, the decision in TC clearly indicates that the applicant suffered a significant psychological injury as a result of the events that were before the Tribunal. This contradicts the applicant's evidence in this matter that he did had not previously suffered any psychological injury.
5. It is therefore necessary to consider whether the applicant's current psychological symptoms are either the result of the events alleged in these proceedings or the psychological injury that the Tribunal found resulted from the events in the TC matter.
6. In particular, the applicant relies upon a report from R Abelsayad, which pre-dates the events involving the respondent. This documents a history of moderate anxiety as a result of an unfair dismissal case that was then in progress. The report writer also noted that the applicant had been prescribed medication for that condition for the preceding year.
7. Based on the evidence before me, I am satisfied that the applicant suffered an exacerbation of a pre-existing anxiety disorder as a result of the breach of ss 17 and 18 on 19 March 2025.
8. While the applicant alleges that he suffered PTSD a result of those breaches, that diagnosis was based upon the accuracy of the history that he had been the victim of a data breach and that sensitive personal information had been accessed.
9. However, as I have found that no data breach occurred in the manner alleged by the applicant, I am not satisfied the medical evidence provides a safe climate for a finding that he suffered PTSD as a result of the breaches on 19 December 2025.
10. There is no medical evidence before me that supports a finding that the applicant continues to suffer from the effects of the exacerbation of his pre-existing anxiety condition. On that basis, I am satisfied that his continuing psychological symptoms are the result of the injury that the Tribunal found resulted from the events in the TC matter, with respect to which he was awarded damages.
11. There is no evidence before me that provides a safe climate for a finding that the applicant suffered any economic loss as a result of the accidental disclosure of his email address on 19 March 2025.
12. There is also no evidence before me that provides a safe climate for a finding that the applicant suffered any damage to reputation and/or any other loss or damage as a result of any action or inaction by the respondent.

1. The Tribunal has found that the respondent breached ss 17 and 18 of the PPIPA on 19 March 2025, by accidentally disclosing his email address to a staff email account.
2. Under s 53(7) of the PPIPA, following the completion of an internal review, the public sector agency whose conduct was the subject of the application may do a number of things, including making a formal apology to the applicant or taking such remedial action it thinks appropriate. Section 63(2) of the ADR Act states that, for the purpose of determining an application for administrative review, "the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision."
3. Further, s 30(2)(b) of the NCAT Act confirms that the Tribunal is able to "exercise such other the functions as are conferred or imposed on the Tribunal" by or under the NCAT Act, the ADR Act or enabling legislation "in connection with the conduct or resolution of the proceedings."
4. In DTN, the Appeal Panel Tribunal considered whether the Tribunal has the power to order the making of a formal apology for a contravention of a Health Privacy Principle. At [94], the Appeal Panel held that the Tribunal may either exercise the functions conferred or imposed upon the public sector agency pursuant to s 53(7) of the PPIPA, as well as make any of the orders provided for in s 55(2) of the PPIPA. The Appeal Panel held that it was appropriate for the respondent to make a formal apology to the to the appellant.
5. The Tribunal considers it appropriate in the circumstances of this case that the Respondent provide the Applicant with an unreserved written formal apology for its contravention of ss 17 and 18 of the PPIPA. The Tribunal accepts that the contravention caused the Applicant distress, and that an unreserved written formal apology is an appropriate response to these contraventions.
6. The Tribunal also considers it appropriate to exercise its discretion to order the respondent to pay the applicant damages in the sum of $2,000, together with reimbursement of the cost of his consultation with Geeks2You on 29 September 2025 ($142.20).

1. The Tribunal sets aside the decision under review and in substitution of this decision, decides that:

(1) The respondent breached ss 17 and 18 of the PPIPA on 19 March 2025.

(2) The applicant did not suffer any data breach as a result of any action or inaction by the respondent.

(3) Within 14 days, the respondent is to provide the applicant an unreserved written apology addressing and apologising for its breach of the PPIPA and for all distress and harm caused to the applicant as a result.

(4) Within 14 days, the respondent is to pay the applicant damages in the sum of $2,000.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.