ADMINISTRATIVE LAW — administrative review — privacy — information protection principles — unauthorised disclosure of personal information — jurisdiction of the Tribunal — whether the Tribunal should transfer the matter to the District Court of NSW — application for recusal — application to file further evidence after the decision was reserved — appropriate action — damages
Quick Take
1An email address that does not on its face reveal the owner's identity is not 'personal information' under s 4(1) of the PPIPA where identity is not apparent from the address alone; however, disclosure of that address to persons who have access to records enabling cross-referencing renders the owner's identity reasonably ascertainable, converting the address into personal information for the purposes of the Act.
2Where a privacy breach is established but the applicant's claimed psychological injury (PTSD) rests on a factual premise the Tribunal has rejected (that a data breach occurred), the medical evidence supporting that diagnosis cannot ground a damages award; only the exacerbation of a pre-existing condition attributable to the proven breach is compensable.
3A recusal application made after the hearing has concluded and the decision has been reserved will be refused absent cogent evidence of actual or apprehended bias, applying the 'double might' test from Johnson v Johnson and the principles in Ebner v Official Trustee in Bankruptcy.
