Civil and Administrative Tribunal New South Wales Medium Neutral Citation: Insurance and Care NSW v EEH [2021] NSWCATAP 350 Hearing dates: 23 July 2021 Date of orders: 9 November 2021 Decision date: 09 November 2021 Jurisdiction: Appeal Panel Before: Cole DCJ, Deputy President Dr J Lucy, Senior Member Decision: (1) The orders made by the Tribunal on 24 March in case number 2020/00087351 are varied by the deletion of order 2. (2) The appeal is otherwise dismissed. (3) Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 (NSW), the disclosure of the name of the respondent in this matter, and evidence in the proceedings which identifies the respondent, is prohibited. Catchwords: ADMINISTRATIVE LAW — Whether reviewable error of law — whether procedural fairness accorded Legislation Cited: Administrative Decisions Review Act 1997 (NSW) Civil and Administrative Tribunal Act 2013 (NSW) Health Records and Information Privacy Act 2002 (NSW) Privacy and Personal Information Protection Act 1998 (NSW) Cases Cited: Cypressvale Pty Ltd v Retail Shop Leases Tribunal [1996] 2 Qd R 462 DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73 Frost v Kourouche [2014] NSWCA 39 KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 New South Wales Land and Housing Corp v Orr (2019) 100 NSWLR 578 NS v Commissioner, Department of Corrective Services [2004] NSWADT 263 Category: Principal judgment Parties: Insurance and Care NSW (Appellant) EEH (Respondent) Representation: Counsel: J Curtin (Appellant) Solicitors: Crown Solicitor (Appellant) Respondent (Self Represented) File Number(s): 2021/00111241 Publication restriction: Nil Decision under appeal Court or tribunal: Civil and Administrative Tribunal Jurisdiction: Administrative and Equal Opportunity Division Citation: [2021] NSWCATAD 72 Date of Decision: 24 March 2021 Before: A Christie, Senior Member File Number(s): 2020/00087351 REASONS FOR DECISION 1. Insurance and Care NSW ('icare') has appealed under s 80 of the Civil and Administrative Tribunal Act 2013 (NSW) against a decision by a Senior Member in the Administrative and Equal Opportunity Division of the Tribunal ('the first instance decision'). In this decision, we will refer to the Tribunal at first instance as 'the Tribunal' and to ourselves as 'the Appeal Panel'. 2. The first instance decision concerns an application by EEH under s 55 of the Privacy and Personal Information Protection Act 1998 (NSW) ('the PPIP Act') for the administrative review, under the Administrative Decisions Review Act 1997 (NSW), of certain conduct by which was alleged to be in breach of s 16 of the PPIP Act. 3. An order was made at first instance under s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013 prohibiting the publication or broadcast of the name of the respondent and evidence in the proceedings which identifies the respondent. We are satisfied that such an order is desirable and will make a similar order in this appeal. History 1. The history of the proceedings was set out succinctly in the first instance decision. 'EML' is used in the first instance decision to refer to Employers Mutual Limited. 'PN' refers to Plan Notes for claim number 770519005169 (which we will refer to as 'the Plan Notes'), which was a claim by EEH: 6. EML provides claims management services as a "Claims Manager" on behalf of the Respondent for claims covered by the Treasury Managed Fund which is a self-insurance scheme in respect of NSW Government agencies, including the NSW Police Force (NSWPF). EML's services, on behalf of the Respondent, include managing claims for work injury damages related to workplace injuries within agencies (including, in this case, claim 770519005169 of the Applicant). 7. On 22 November 2011, as the result of settlement negotiations in relation to a number of claims by the Applicant against the NSWPF and in accordance with the terms of a confidential Deed of Release dated 22 November 2011 between the Applicant and the NSWPF (Deed), the Applicant signed a letter addressed to EML formally requesting that claim 770519005169 "be finalised and closed" and stating that "I [the Applicant] acknowledge and undertake not to take any further action in respect of that claim" (22/11/2011 Letter). 8. Sometime after the Deed was executed and received by (EML on behalf of) the Respondent, the PN was prepared (or updated) by EML as agents of the Respondent to include wording in respect of, among others, claim 770519005163 [sic, should be 770519005169] as follows: All claims settled 22/11/2011 … 9. On 3 May 2016 the Applicant emailed EML seeking confirmation of whether the Applicant was entitled to workers compensation in respect of an injury to their right thumb under claim 770519005169 and/or their psychological injury under claim 770519057272 (3/5/2016 Email). 10. On 6 May 2016 the EM Email was sent on behalf of the Respondent stating that claim 770519005169 was "settled via Deed of Release in 2011". 11. On 19 July 2019 the Applicant applied to the Respondent under the Government Information (Public Access) Act 2009 (GIPA Act) for access to all documents held by the Respondent in relation to claim 770519005169 (GIPA Application). On 13 August 2019 the Respondent provided the Applicant with a number of documents in response to the GIPA Application, including the PN which contained the following personal information of the Applicant which is the subject of these proceedings (PI): All claims settled 22/11/2011… 12. On 29 August 2019 the Applicant sent an email to the Respondent (29/18/2019 Email) requesting, among other things, that the Respondent provide the Applicant with all documents containing the Applicant's personal information "All claims settled 22/11/2011". 13. On 20 September 2019 the Respondent responded to the 29/8/2019 Email noting, most relevantly: There are no associated documents. 14. By email dated 20 September 2019 the Applicant sought correction of their personal information contained in the PN, as detailed in paragraphs [8] and [11] above, to read as follows: Claim number 770519005169 has not been settled. 15. By email dated 2 October 2019 the Respondent notified the Applicant that it had changed the wording in the PN to read as follows: All claims closed 22/11/2011… 16. In the IR Request the Applicant alleges, as regards the breach of s16 PPIP Act (IPP 9) (i.e the Conduct of Concern): [The Respondent] used my personal information in the document entitled "Plan Notes for 770519005169" and email from Daniel Campbell on 6 May 2016 without taking such steps as are reasonable in the circumstances to ensure that, having regard for the purpose for which the information is proposed to be used, the information is accurate and not misleading. 17. In the IR Decision the Respondent concluded, most relevantly, at [4.6] that: … external disclosure of information should be distinguished from its internal "use" when assessing whether an agency has breached s16… On the basis of either description, the claim remained finalised for practical purposes. On balance, given the information provided, I do not consider that [the Respondent] has breached s16 of the PPIP Act. 18. The Applicant contends that they were aggrieved by the Conduct of Concern which they allege was in breach of s16 PPIP Act (IPP 9), being that the Respondent used the PI without taking such steps as were reasonable in the circumstances to ensure that, having regard to the purpose of using the PI to inform the Respondent's decision on and response to the Applicant's query and to create and send the EM Email to convey that decision/response, the PI was accurate, up to date, complete and not misleading. 1. In this decision, we will refer to icare and its agent, Employers Mutual Limited, as 'the agency'. The application at first instance and the appeal. 1. EEH applied to the Tribunal at first instance pursuant to s 55 (1) of the PPIP Act which provides: 55 Administrative review of conduct by Tribunal (1) If a person who has made an application for internal review under section 53 is not satisfied with— (a) the findings of the review, or (b) the action taken by the public sector agency in relation to the application, the person may apply to the Civil and Administrative Tribunal for an administrative review under the Administrative Decisions Review Act 1997 of the conduct that was the subject of the application under section 53. 1. The basis for EEH's application for internal review, together with the relevant part of the outcome of the review, was set out by the Tribunal in paragraphs 16 and 17 of the first instance decision, which we quote above at [4]. In the first instance decision, the Tribunal refers to EEH's request for an internal review as 'the IR request' and to the decision of the internal review as 'the IR decision'. 2. The powers conferred directly upon the Tribunal in relation to a review under s 55(1) of the PPIP Act are addressed by s 55(2) and (3) of the PPIP Act: 55 Administrative review of conduct by Tribunal (2) On reviewing the conduct of the public sector agency concerned, the Tribunal may decide not to take any action on the matter, or it may make any one or more of the following orders— (a) subject to subsections (4) and (4A), an order requiring the public sector agency to pay to the applicant damages not exceeding $40,000 by way of compensation for any loss or damage suffered because of the conduct, (b) an order requiring the public sector agency to refrain from any conduct or action in contravention of an information protection principle or a privacy code of practice, (c) an order requiring the performance of an information protection principle or a privacy code of practice, (d) an order requiring personal information that has been disclosed to be corrected by the public sector agency, (e) an order requiring the public sector agency to take specified steps to remedy any loss or damage suffered by the applicant, (f) an order requiring the public sector agency not to disclose personal information contained in a public register, (g) such ancillary orders as the Tribunal thinks appropriate. (3) Nothing in this section limits any other powers that the Tribunal has under Division 3 of Part 3 of Chapter 3 of the Administrative Decisions Review Act 1997. 1. The Administrative Decisions Review Act 1997 provides, in s 63, which is in Division 3 of Chapter 3 of that Act: 63 Determination of administrative review by Tribunal (1) In determining an application for an administrative review under this Act of an administratively reviewable decision, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including the following: (a) any relevant factual material, (b) any applicable written or unwritten law. (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. (3) In determining an application for the administrative review of an administratively reviewable decision, the Tribunal may decide: (a) to affirm the administratively reviewable decision, or (b) to vary the administratively reviewable decision, or (c) to set aside the administratively reviewable decision and make a decision in substitution for the administratively reviewable decision it set aside, or (d) to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal. 1. The Administrative Decisions Review Act 1997 provides, in s 58(1): 58 Duty of administrator to lodge material documents with Tribunal where decision reviewed (1) An administrator whose administratively reviewable decision is the subject of an application for review to the Tribunal must, within 28 days after receiving notice of the application, lodge with the Tribunal: (a) a copy of any statement of reasons given to the applicant under section 49 (or, if no such statement was given to the applicant, a statement of reasons setting out the matters referred to in section 49 (3)), and (a1) a copy of any statement of reasons for a decision in an internal review conducted in respect of the administratively reviewable decision, and (b) a copy of every document or part of a document that is in the possession, or under the control, of the administrator that the administrator considers to be relevant to the determination of the application by the Tribunal. 1. The Civil and Administrative Tribunal Act 2013 provides, relevantly, in s 32 and in s 80: 32 Internal appeal jurisdiction of Tribunal (1) The Tribunal has internal appeal jurisdiction over— (a) any decision made by the Tribunal in proceedings for a general decision or administrative review decision, and (b) any decision made by a registrar of a kind that is declared by this Act or the procedural rules to be internally appealable for the purposes of this section. (2) The Tribunal also has the following jurisdiction in proceedings for the exercise of its internal appeal jurisdiction— (a) the jurisdiction to make ancillary and interlocutory decisions of the Tribunal in the proceedings, (b) the jurisdiction to exercise such other functions as are conferred or imposed on the Tribunal by or under this Act or enabling legislation in connection with the conduct or resolution of such proceedings. (3) … (4) An internally appealable decision is a decision of the Tribunal or a registrar over which the Tribunal has internal appeal jurisdiction. (5) An internal appeal is an appeal to the Tribunal against an internally appealable decision. (6) … 80 Making of internal appeals (1) An appeal against an internally appealable decision may be made to an Appeal Panel by a party to the proceedings in which the decision is made. Note— Internal appeals are required to be heard by the Tribunal constituted as an Appeal Panel. See section 27(1). (2) Any internal appeal may be made— (a) in the case of an interlocutory decision of the Tribunal at first instance—with the leave of the Appeal Panel, and (b) in the case of any other kind of decision (including an ancillary decision) of the Tribunal at first instance—as of right on any question of law, or with the leave of the Appeal Panel, on any other grounds. (3) The Appeal Panel may— (a) decide to deal with the internal appeal by way of a new hearing if it considers that the grounds for the appeal warrant a new hearing, and (b) permit such fresh evidence, or evidence in addition to or in substitution for the evidence received by the Tribunal at first instance, to be given in the new hearing as it considers appropriate in the circumstances. 1. EEH is concerned, among other things, about the accuracy of the Plan Notes. It is EEH's contention that the Plan Notes are inaccurate in that they say that his claims, including claim 770519005169, were 'settled', and EEH disputes that interpretation of events. EEH does not consider that claim 770519005169 has been settled. EEH holds the view that the Deed referred to in the first instance decision may not be operational and may not be valid. However, EEH has not lodged an appeal in relation to the first instance decision. 2. Our function, in this appeal, is to determine whether the first instance decision is affected by the errors of law pleaded by the agency in the grounds of appeal. Grounds of Appeal 1. All seven of the grounds of appeal are confined to questions of law. 2. In the course of the hearing of the appeal, the appellant sought to tender an affidavit containing evidence which was not considered by the Tribunal at first instance. No application to amend the grounds of appeal to seek to have the Appeal Panel conduct a new hearing to reconsider the impugned conduct of the agency was made. No application to appeal on grounds other than a question of law has been made. We refused the application to tender the affidavit. The first ground of appeal 1. The first ground of appeal is as follows: The Tribunal erred at law by making material findings of fact, where there was no evidence to support such findings, that: a. there was a use of [EEH's] personal information in "Plan Notes for 770519005169" ("the Plan Notes"): [67]; and b. the purpose of icare's use of [EEH's] personal information in the Plan Notes was to make a determination of or form a view as to [EEH's] right to further worker's compensation in relation to claim 770519005169; [69]. 1. The relevant paragraphs of the decision at first instance are as follows: "Use" of the personal information 64. The Tribunal held in FM v Macquarie University [2003] NSWADT 78 at [42] that the plain and ordinary meaning of the word 'use' in this context is 'to avail oneself of; apply to one's own purposes;' (The Macquarie Dictionary, 3rd edition, The Macquarie Library). Also see MT v Director General, NSW Department of Education and Training [2004] NSWADT 194 (MT) and VK. 65. The Tribunal has found that the mere placing of a letter on a file cannot amount to use: ZR v NSW Department of Education and Training [2008] NSWADT 199 at [168]. Also, mere access or retrieval would not normally be enough to constitute a use. In GD the Appeal Panel at [41 and 42] noted: 41. In the Act 'use' is differentiated from other activities such as 'collection', 'access' and 'disclosure'. Importantly the standards which apply to the 'use' of information are separated from the standards that apply to the 'disclosure' of the information. 42. We agree with the Tribunal that 'use' normally bears the connotation of employing information for a purpose. Mere access or retrieval would normally not be enough: see further, R v Brown [1996] 1 AC 543 (dealing with the term 'use' as found in the UK data protection statute). In our view, if an agency merely retrieves information in its possession and discloses that to an external person or body, there is no 'use' involved. 66. In the present circumstances under consideration, I do not see the sending of the EM Email in and of itself is a use of the PI by the Respondent (as this may be considered more a disclosure). However, the strong inference from the evidence before me is that the Respondent used the PI to consider and decide the answer [to] the Applicant's query in the 3/5/2016 Email and that the decision on such (i.e. embodied in the response to the Applicant's query) was set out in the EM Email. That is, the Respondent used the PI for its own administrative purpose to assess and decide the status of the Applicant's workers compensation claim 770519005169 (i.e. whether it was settled, finalised or not) in order to respond to the Applicant's query (i.e. the Applicant's right to workers compensation under claim 770519005169) as notified in the EM Email. 67. I am therefore satisfied that the conduct of the Respondent in considering the PI in order to answer the Applicant's query (and thus the Applicant's right to further compensation) did constitute a relevant use of the PI by the Respondent sufficient to trigger the operation of s16 PPIP Act (IPP 9). Did the Respondent fail to take reasonable steps to ensure the personal information was accurate, up to date, complete and not misleading 69. I find that the purpose of the use of the PI was to make a determination of or form a view as to the Applicant's right to further workers' compensation in relation to claim 770519005169. This purpose, potentially adverse to the Applicant, and given the age of the information at the time (some five years' old), imposes a high threshold on the Respondent (and its agents) as regards the steps needed to be taken to check if the information is accurate. 1. Counsel for the appellant argued that there was no evidence before the Tribunal to support the inference drawn in paragraph 67 of the first instance decision. The applicant argued that there was no evidence before the Tribunal identifying the material, if any, which was considered by Mr Campbell, who was the case manager who responded to EEH's email of 3 May 2016, before writing that response. 2. In paragraphs 64 and 65 of the first instance decision, quoted above at [17], the Tribunal set out the applicable meaning for the word 'use' in s 16 of the PPIP Act, which is to apply the information for a purpose. 3. We reject the appellant's argument that there was no evidence to support the finding of the Tribunal, in paragraph 67 of the first instance decision, that …the Respondent used the PI for its own administrative purpose to assess and decide the status of the Applicant's workers compensation claim 770519005169 (ie whether it was settled, finalised or not) in order to respond to the Applicant's query (ie the Applicant's right to workers compensation under claim 770519005169) as notified in the EM Email. 1. Both the Plan Notes and the email sent by Mr Campbell said that the claim in question had been 'settled'. The appellant's response to EEH's request of 29 August 2019 to be provided with all documents containing EEH's personal information "All claims settled 22/11/2011" said that there were no associated documents. The Tribunal could assume that s 58(1) of the Administrative Decisions Review Act 1997 had been complied with by the agency, so that the Tribunal had before it every relevant document in the possession or under the control of the agency. In these circumstances, an evidentiary basis existed for the inference drawn by the Tribunal in paragraph 67 of the first instance decision and that evidentiary basis comprised the Plan Notes and the emails. 2. It was argued on behalf of the agency that, as Mr Campbell had not provided any evidence to the Tribunal, there was no evidence before the Tribunal identifying what material, if any, Mr Campbell had considered before responding to EEH's email of 3 May 2016. Mr Campbell was a claims manager at Employers Mutual Limited, which manages workers compensation claims for icare. It was a matter for the agency as to whether Mr Campbell gave evidence at the hearing before the Tribunal, and he did not give evidence. The agency may not, therefore, rely on its own omission to adduce evidence from Mr Campbell at first instance to seek to have the Tribunal draw an inference in support of its case. The Tribunal at first instance was conducting an administrative review. It was entitled to assume that the agency, which was under an obligation to co-operate with the Tribunal to give effect to the guiding principle of the Civil and Administrative Tribunal Act 2013 that the just, quick and cheap resolution of the real issues in the proceedings be facilitated, had placed all relevant material before it. In short, if the allegation that the Plan Notes had been used in the manner alleged could readily be rebutted by evidence available to the agency, in circumstances where that allegation reasonably arose on the documents, the Tribunal was entitled to assume that the agency would have adduced the evidence available to rebut the inference. 3. As to the assertion in the first ground of appeal that there was no evidence that the agency's use of the Plan Notes was to make a determination or form a view as to EEH's right to compensation, we note that EEH's email of 3 March 2016 enquired as to his entitlement to workers compensation under claim 770519005169 and the reply, written by Mr Campbell and dated 6 May 2016, said that the claim in question had been 'settled via Deed of Release in 2011'. 4. Having read the emails of 3 March 2013 and 6 May 2013, and having inferred that the Plan Notes were a source of the statement in the 6 May 2016 email that claim 770519005169 had been 'settled', in the absence of any evidence to the contrary it was reasonable for the Tribunal to infer that the author of the email of 6 May 2016 had, for the purpose of composing that email, formed a view, that the claim had been settled based at least partly upon the Plan Notes, which expressed the same assessment. The evidentiary basis for the inference was the Plan Notes and the emails dated 3 and 6 of May of 2016, together with the email of 20 September 2019. 5. The appellant has not made out the first ground of appeal. The second, third fourth and fifth grounds of appeal 1. The second ground of appeal is as follows: The Tribunal erred by failing to properly apply s 16 of the Privacy and Personal Information Protection Act 1988 ('the PPIP Act') in finding that icare "should have taken steps to investigate, at least from the agency signatory to the Deed (ie the NSWPF), whether the Deed was still in force/could still be relied on and that there was no known challenge to its validity": [74]. 1. The PPIP Act provides, in s 16 (also referred to as Information Protection Principle 9): 16 Agency must check accuracy of personal information before use A public sector agency that holds personal information must not use the information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. 1. The first instance decision said, at [70]-[74]: 73. If the Respondent cannot or does not show that such reasonable steps in the circumstances were taken then the clear inference is that it has not taken any such steps. The question then is whether the taking of no steps was reasonable in the circumstances having regard to the purpose of use of the PI: see JD at [67]. 74. In this case, given the age of the personal information in question and the purpose for which it was being used, the Respondent (or EML on behalf of the Respondent) should have taken steps to investigate, at least from the agency signatory to the Deed (i.e. the NSWPF), whether the Deed was still in force/could still be relied on and that there was no known current challenge to its validity: see GD at [44 and 70]. That is, it was not reasonable to take no steps to check the accuracy of the PI. However, as noted at paragraph [60], in this case reasonable steps do not require the taking of legal advice on the contents of the Deed where, after checking, there was no evidence of any current challenge to its validity or its continuing operation. 1. Counsel for the agency argued, in her written submissions: As the Appellant did not adduce evidence or make submissions as to what steps were taken on its behalf to check the accuracy of the Respondent's personal information prior to its use, the Tribunal drew an adverse inference against the Appellant to the effect that it did not take any such steps to check the accuracy of the Respondent's personal information prior to its use. The Tribunal was in error in making such a finding, as it was not open to it to draw an adverse inference against the Appellant in these circumstances. 1. The second, third and fourth grounds of appeal overlap to some extent. For the reasons set out below, the second ground of appeal has not been made out (see [49] below). 2. The third ground of appeal is as follows: In the alternative to Ground 2 above, the Tribunal erred by failing to provide adequate reasons as to how it applied s 16 of the PPIP Act in finding that icare "should have taken steps to investigate, at least from the agency signatory to the Deed (ie the NSWPF) whether the Deed was still in force/could still be relied on and that there was no known current challenged to its validity": [74] 1. The first instance decision said: 70. The Tribunal commented in MT at [185] that: 30 … there is merit in the argument that if there is in fact an onus, the initial onus should rest on [the Applicant] to show that there was a use which involved irrelevant, inaccurate, out of date, incomplete or misleading information, whereupon the onus would shift to [the Respondent] to show that it took reasonable steps to check the information. 71. However, given the wording of IPP 9 (and the emphasised parts of prior decisions in paragraphs [43] to [45] above), it is the action of taking reasonable steps to check the accuracy of the PI under IPP 9, rather than the actual accuracy of the PI, that is the focus of IPP 9. That is, if reasonable steps were taken but the PI nonetheless turned out to be inaccurate and misleading then there may be no breach of IPP 9. However, even if the PI turned out to be accurate, if no reasonable steps were taken by the agency in the circumstances having regard to the purpose of the proposed use then there is a breach of IPP 9, irrespective of the accuracy of the information: see ALZ v SafeWork [2017] NSWCATAD 52 at [108 to110]. If IPP 9 is breached and the PI turns out to be inaccurate, irrelevant, incomplete or out of date and misleading, then this will factor into the relief to be granted by the Tribunal. 72. Once a relevant use of the PI has been established (as in this case) IPP 9 is triggered and the Respondent then has the onus to show that it took such reasonable steps in the circumstances to check the accuracy of the information before using it. Given my finding that, for the purposes of IPP 9, the Respondent relevantly used the PI, the Respondent was required to take reasonable steps having regard to the purpose of use, to check the accuracy of the PI before using it. 73. If the Respondent cannot or does not show that such reasonable steps in the circumstances were taken then the clear inference is that it has not taken any such steps. The question then is whether the taking of no steps was reasonable in the circumstances having regard to the purpose of use of the PI: see JD at [67]. 74. In this case, given the age of the personal information in question and the purpose for which it was being used, the Respondent (or EML on behalf of the Respondent) should have taken steps to investigate, at least from the agency signatory to the Deed (i.e. the NSWPF), whether the Deed was still in force/could still be relied on and that there was no known current challenge to its validity: see GD at [44 and 70]. That is, it was not reasonable to take no steps to check the accuracy of the PI. However, as noted at paragraph [60], in this case reasonable steps do not require the taking of legal advice on the contents of the Deed where, after checking, there was no evidence of any current challenge to its validity or its continuing operation. 75. No evidence was presented or submissions made by the Respondent as to what steps were actually taken by or on behalf of the Respondent to check the accuracy of the PI prior to its use. 76. Based on the lack of submissions and evidence that any reasonable steps were taken by the Respondent in this case to check the accuracy of the PI and my findings above, I am satisfied that the Respondent (or EML on behalf of the Respondent) breached IPP 9 in respect of the use of the PI. 1. These reasons are adequate. They set out the basis for the Tribunal's decision in relation to the application of s 16 of the PPIP Act to the circumstances of this matter. They provide, at least, a basic explanation of the fundamental reasons which led the Tribunal to its conclusion: New South Wales Land and Housing Corp v Orr (2019) 100 NSWLR 578 at 596-597 [73], citing Cypressvale Pty Ltd v Retail Shop Leases Tribunal [1996] 2 Qd R 462 at 477. 2. The fourth ground of appeal is as follows: The Tribunal erred at law by failing to find against [EEH] in circumstances where it was left in a state of uncertainty about what, if any, steps were taken by icare to check the accuracy of [EEH's] personal information contained in the Plan Notes prior to its use. 1. In support of the fourth ground of appeal, the agency relied upon the decision in KP v Narrandera Shire Council (GD) [2011] NSWADTAP 15 ('KP'). KP is a decision of an Appeal Panel of the Administrative Decisions Tribunal ('ADT'), the jurisdiction of which was transferred to the Tribunal by the Civil and Administrative Tribunal Act 2013. In KP, the Appeal Panel of the ADT was dealing with a decision by the ADT at first instance in relation to an application to strike out KP's complaint about the conduct of certain employees of his local Council. The Appeal Panel of the ADT noted that the ADT at first instance had said that the material before it in relation to the application for summary dismissal had been 'fairly minimal'. The Council had not relied on any of the material filed by it in relation to the substantive application for the review of the conduct complained of. The Appeal Panel of the ADT, in KP, quoted with approval from the decision in NS v Commissioner, Department of Corrective Services [2004] NSWADT 263: 32. The Deputy Privacy Commissioner also submitted that there was no rule that the applicant bears an onus of proof in reviews of conduct under the PPIP Act and in this regard relied on the decision of GV v Officer of the Director of Public Prosecutions [2003] NSWADT 177. She went on to submit that if such an onus was to be placed on an applicant then applicants would be greatly disadvantaged as they do not have any knowledge of the way the agency manages the personal information it holds and they are therefore not in the same position as the agency to ascertain the exact nature of the conduct complained about. … 45. I agree with the submissions of the Deputy Privacy Commissioner in respect of onus of proof. The Appeal Panel recently adopted such an approach in KO v Anor v Commissioner of Police, New South Wales Police (GD) [2004] NSWADT21 at [40 to 43]. 46. In GR (at [35] and [36]), the Appeal Panel adopted observations made by the Australian Law Reform Commission in its report entitled "Managing Justice: A Review of the Federal Civil Justice System" in respect of merit review by the tribunals as applying equally to a review under s.55(1) of the PPIP Act. These observations expressly stated that in a merits review "neither the applicant nor the respondent agency carries a burden of proof to prove or disprove a fact". 1. The Appeal Panel of the ADT in KP then went on to say, at paragraphs 29 to 31: 29. This analysis does not resolve the question of what the Tribunal should do if left in a state of uncertainty in relation to a fact in issue after reviewing all the available evidence. It was said by the Federal Court in a landmark decision in 1984 that the notion of onus of proof is not directly relevant to administrative proceedings where a tribunal, such as the Administrative Appeals Tribunal, is not bound by the rules of evidence and may inform itself as it thinks fit: McDonald v Director-General of Social Security (1984) 1 FCR 354 at 358; 6 ALD 6 at 11 per Woodward J. In particular it was held "there can be no evidential onus of proof in proceedings before the AAT unless the relevant legislation provides for it, and in the present case the Social Security Act 1947 does not." Nevertheless, Woodward J acknowledged that if the AAT, "finds itself in a state of uncertainty after considering all the available material . . . it will be necessary for it to analyse carefully the decision it is reviewing." Depending on the terms of the legislation, the issue must be resolved one way or the other. 30. The nature of the Tribunal's role under the PPIP Act is, so far as we are aware, unique. The Tribunal is not merely an executive decision maker as the AAT was in McDonald . While the Tribunal is exercising its review jurisdiction when determining whether certain conduct amounts to a contravention of an Information Protection Principle, it is exercising judicial power when determining whether to take no action or grant the relief available under s 55(2) including damages and mandatory and prohibitory injunctive relief: PPIP Act , s 55(2)(a)(b) and (c). Those functions are analogous to functions exercised by judges and other decision makers in civil proceedings before courts and tribunals, where an applicant is seeking to assert his or her rights. 31. Given the nature of the review under the PPIP Act , and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the applicant. 1. In the present case, it was argued on behalf of the agency that the Tribunal was left in a state of uncertainty, in the matter at first instance, in relation to the question of fact as to whether the agency had taken any steps to check the accuracy of EEH's personal information before using it. In those circumstances, it was submitted, following the decision in KP, the Tribunal should have decided the question of fact against EEH; in other words, the Tribunal should have found or assumed that the agency had taken reasonable steps to ascertain that the information which was to be used was relevant, accurate, up to date, complete and not misleading, in the context of the purpose for which it was intended to be used. 2. In the report of the internal review which was conducted by the agency and preceded EEH's application to the Tribunal, and which was dated 10 March 2020, the Account Manager who conducted the review wrote, under the headings 'Background' and 'Subject of complaint', on the first page of the report (p 46 of the Appellant's Bundle, exhibit A3): The applicant also alleged that icare has breached his privacy by using the applicant's personal information without taking reasonable steps to ensure its accuracy. This relates to a record held by icare that all claims associated with a previous workers compensation claim made by the applicant ('the claim') had been "settled". The applicant regards this description as inaccurate. 1. On page 2 of the report of the internal review, the Account Manager wrote, under the heading 'What is the conduct relevant to this Review?': The application also relates to the use by icare of information relating to the applicant's claim said to be inaccurate. As further discussed in this Internal Review, the application does not clearly identify what 'use' of information by icare is complained about. 1. On page 5 of the report of the internal review, the Account Manager wrote, under the heading 'Breach of s 16 of the PPIP Act': The application alleges that icare has used information to the effect that the applicant's workers compensation claim was 'settled' without taking steps as are reasonable in the circumstances to ensure the accuracy of that information.[sic] … It is also difficult to see how reasonable steps were not taken in the circumstances. I do not understand it to be alleged by the application that the claim in fact remained open, or that the statement that the claim was settled was relied upon to the applicant's detriment. On the basis of either description, the claim remained finalised for practical purposes. 1. EEH applied to the Tribunal for the administrative review of the agency's conduct on 19 March 2020. The application was accompanied by a copy of the request from EEH to the agency for an internal review, which said, among other things, the following: Accuracy of personal information The document entitled "Plan Notes for 770519005169" held by Insurance & Care NSW contained the statement "All claims settled 22/11/2011". The statement "All Claims settled 22/11/2011" was inaccurate and misleading because claim number 770519005169 has not been settled. On 6 May 2016, Daniel Campbell from Employers Mutual sent an email to me stating that claim number 770519005169 was "settled via Deed of Release in 2011". The statement that claim number 770519005169 was "settled via Deed of Release in 2011" is inaccurate and misleading because that claim has not been settled. … Insurance & Care NSW used my personal information in the document entitled "Plan Notes for 770519005169" and email from Daniel Campbell on 6 May 2016 without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is accurate and not misleading. The use of the inaccurate and misleading personal information is in contravention of section 16 of the PPIP Act. 1. EEH provided a copy of the report of the internal review by the agency with his application to the Tribunal. 2. In EEH's written submissions to the Tribunal at first instance, which are dated 10 August 2020 and were before the Tribunal at the hearing on 16 September 2020, EEH made submissions in relation to the application of s 16 of the PPIP Act, including submissions under the heading 'Reasonableness of steps to be taken'. Those submissions included the following paragraph: 42. Claim number 770519005169 has not been settled.³ Accordingly, the following personal information is inaccurate and misleading: (a) "All claims settled 22/11/2011"; (b) "your claims were settled via Deed of Release in 2011" Footnote ³ Statement of [EEH] dated 3 August 2020 at [5] 1. EEH says, in his statement (which appears at p 97 of Exhibit A3), which was before the Tribunal and referred to in EEH's submissions at first instance: 4. My [injury named] injury was the subject of workers compensation claim number 770519005169 (First Claim). …The First and Second Claims were initially managed by Allianz and later transferred to Employers Mutual Limited (EML). 5. The First Claim has never been settled. Relevantly, NSWPF and EML never disputed my entitlement to compensation under the First Claim. 6. On 22 November 2011, I signed a letter addressed to EML acting as agent for the NSW Self Insurance Corporation. The letter contained a voluntary request to EML to close the First Claim. Subsequently that same day, the Second Claim was settled via deed of release. 1. The Tribunal at first instance therefore had evidence before it, in EEH's case, that Claim Number 770519005169 had not been settled on EEH's interpretation of events. This amounts to evidence that the Plan Notes are not accurate, may not be up to date and are misleading. 2. There is no suggestion that the agency adduced any evidence to the Tribunal at first instance as to any steps taken to ensure that the Plan Notes are accurate, up to date and not misleading when considering the response to EEH's enquiry of 3 May 2016. The statement of Mr Waddington, Senior Manager-Contract and Support Services at EML, dated 25 August 2020, which was tendered in the agency's case before the Tribunal as part of Exhibit A3, discloses that Mr Waddington knew that EEH was claiming that the Plan Notes were inaccurate on the basis that claim 770519005169 had not been 'settled'. 3. During the hearing at first instance on 16 September 2020, reference was made to the issue of whether reasonable steps had been taken, having regard to the purpose for which the personal information was proposed to be used, to ensure that the information is accurate, up to date and not misleading, in compliance with s 16 of the PPIP Act. Counsel for the agency, in that hearing, invited the Tribunal to draw an inference that reasonable steps were taken on the basis that Mr Campbell, in writing the email of 6 May 2016, must have referred to the Deed. There was no evidence before the Tribunal to support this contention. Counsel for the agency submitted that any step beyond reference to the deed would not have been reasonable. 4. Near to the end of the hearing on 16 September 2020, the Tribunal indicated that the parties had permission to make further written submissions, limited to four pages in length. At no stage was there any request on the part of the agency for an adjournment to enable further evidence to be placed before the Tribunal in relation to the issue of whether the 'reasonable steps' required under s 16 of the PPIP Act were taken. Only the agency could have provided such evidence. EEH had no capacity to investigate what steps, if any the agency had taken. 5. The second, third and fourth grounds of appeal have not been made out. The Tribunal did not err in its application of s 16 of the PPIP Act and it did not fail to provide adequate reasons. The agency did not put forward an alternative interpretation of s 16 of the PPIP Act. As to the fourth ground of appeal, if it can be said that the Tribunal was in a state of uncertainty as to what, if any, steps were taken by the agency to check the accuracy of the Plan Notes, such uncertainty arose from the decision made by the agency not to adduce any evidence about whether steps were taken, and, if so, what those steps were. The agency made that decision in circumstances where the issue had been squarely raised by EEH at every stage of the process, and by the Tribunal, expressly, during the hearing. In those circumstances, the Tribunal would have been wrong to draw inferences favourable to the agency. 6. The fifth ground of appeal is as follows: The Tribunal erred by denying icare procedural fairness in that it drew an adverse inference against icare, to the effect that no steps were taken by icare to check the accuracy of [EEH's] personal information contained in the Plan Notes([73]), without first giving icare the opportunity to provide evidence as to what steps, if any, it took to check the accuracy of [EEH's] personal information contained in the Plan Notes prior to its use. 1. The appellant argued, in its written submissions, before us: 18 Further, the Tribunal erred in failing to provide the Appellant with an opportunity to adduce further evidence as to what steps, if any, were taken prior to responding to the Respondent's 3 May 2016 email query. The Appellant's evidence in chief before the Tribunal was not directed to this issue, but rather to whether there had been a relevant "use of the Respondent's personal information within the meaning of s 16 of the PPIP Act, and whether the personal information contained in the Admin Warning or Mr Campbell's email of 6 may 2016 was in any way inaccurate or misleading. This approach is consistent with the established practical onus for finding a breach of s 16 of the PPIP act, in accordance with the Tribunal's observation in MT v Director General, NSW Department of Education and Training [2004] NSWADT 194, that "the initial onus should rest on MT [the applicant] to show that there was a use which involved irrelevant, inaccurate, out of date, incomplete or misleading information, whereupon the onus would shift to the Agency to show that it took reasonable steps to check the information". While this observation was obiter only, this approach had been adopted and applied in several subsequent Tribunal decisions and had not been disproved or distinguished. Notwithstanding this, the Tribunal expressly disapproved the Tribunal's comments in MT and stated: Having established that the PI is the Applicant's personal information and that such was held by (or on behalf of) the Respondent, there are then three further questions to consider in respect of the Conduct of Concern. The first question is whether the Respondent relevantly used the PI for the purposes of IPP 9. If yes, the second question is whether the Respondent failed to take reasonable steps to ensure that the PI was accurate (not whether or not the PI was in fact accurate but rather what steps were taken to check if it was). Finally, if the answer to the second question is yes (i.e. the Respondent failed to take reasonable steps), the third question is whether the PI was actually inaccurate, incomplete and misleading, the answer to which may impact on the relief ordered by the Tribunal (but not whether or not the Respondent breached IPP 9). 19 The Tribunal ought to have put the Appellant on notice that it would not or may not apply MT and given the Appellant an opportunity to put on evidence as to the steps it took, if any, to check the accuracy of the Respondent's personal information prior to sending the 6 May 2016 email to the Respondent. No such notice or opportunity was given to the Appellant. While the Tribunal invited the Appellant to address the issue of reasonable steps taken (in addition to addressing a series of other discrete issues) in additional written submissions to be prepared and submitted by it after the hearing, it did not provide the Appellant with an opportunity to adduce evidence on this issue. The failure to do so amounted to a denial of procedural fairness, in circumstances where that opportunity could realistically have resulted in a different outcome. 1. The entire paragraph 185 in the first instance decision in MT, which was referred to in the appellant's submissions was as follows: 185. Accordingly, it is my view that the Agency has satisfied its obligations under section 16. On the evidence I am not satisfied that the Agency has acted in breach of section 16 of the Privacy Act. Even if there was a use by the Agency, it is my view that it has taken such steps as are reasonable in the circumstances before that use. In the circumstances I do not need to determine the issue of whether an onus of proof lies with the Agency or with MT. It seems to me however that there is merit in the argument that if there is in fact an onus, the initial onus should rest on MT to show that there was a use which involved irrelevant, inaccurate, out of date or misleading information, whereupon the onus would shift to the Agency to show that it took reasonable steps to check the information. 1. The first decision in MT was the subject of an appeal and a cross appeal to the Administrative Decisions Tribunal Appeal Panel, and a further appeal to the Court of Appeal, but not in relation to the question of onus. 2. We have set out, above, at [32] the Tribunal's response to the first instance decision in MT with respect to onus. 3. The Tribunal's response was that s 16 of the PPIP Act imposes a duty on an agency that holds personal information, namely the duty to refrain from using that personal information without taking such steps as are reasonable in the circumstances to ensure that, having regard to the purpose for which the information is proposed to be used, the information is relevant, accurate, up to date, complete and not misleading. That duty is imposed by s 16 regardless of whether the agency, at the time that it is contemplating using the personal information, has any reason to be concerned that the information might not be relevant, accurate, up to date or complete or might be misleading. The Tribunal is correct. Its approach is consistent with the decision of the Court of Appeal in MT, in which Spigelman CJ, with whom Ipp JA and Hunt AJA agreed, said: 29 It is clear from this legislative scheme that the focus of attention is on protecting the privacy interests of persons about whom public agencies collect information. However, it is also a purpose of the legislative scheme to ensure the effective conduct of the public agencies by establishing a mechanism to determine the relevance and accuracy of the information held by such agencies. 30 The enforcement provisions of the scheme, with respect to public agencies, are found in s20(1) and s21(1): "20(1) The information protection principles apply to public sector agencies. … 21(1) A public sector agency must not do any thing, or engage in any practice, that contravenes an information protection principle applying to the agency." 1. The question as to whether an applicant for review under the PPIP Act bears any kind of onus is a separate issue from the interpretation of s 16 of the PPIP Act in paragraphs [71]-[73] of the decision at first instance. 2. In this matter, as set out above in [38]-[44], at every step of the process, beginning with his initiation of the internal review, EEH has made it clear that he was challenging the accuracy of the personal information used in the email to him of 6 May 2016. It must have been clear to the agency, by the time of the hearing before the Tribunal, that one of the bases of that challenge was that EEH argued that the statement in that email that claim 770519005169 was 'settled via Deed of Release in 2011' was inaccurate, because it was a misinterpretation of the Deed of 2011. Both the email and the Deed were before the Tribunal and were documents in the possession of the agency. 3. It cannot have been intended that an applicant for review under the PPIP Act should bear an evidentiary onus to prove that the agency the subject of the review had not taken the reasonable steps to ensure that the personal information in question, to which s 16 of the PPIP Act applied, was relevant, accurate, up to date, complete and not misleading. It would be a very rare circumstance in which an applicant for review would know, or have the means of discovering, whether the agency had taken steps under s 16 of the PPIP Act. To the extent that there is an 'initial onus', it is an onus to raise the issue on a basis which is not fanciful. EEH met that onus at every step of his challenge to the conduct of the agency. 4. The relevant requirements of the rules of procedural fairness were set out in Frost v Kourouche [2014] NSWCA 39 at [35]-[37] and [41]: 35. There is a well-established line of authority for a complementary proposition to that in Kioa referred to above to the effect that critical facts need to be drawn to the claimant's attention. The complementary proposition is that it is not necessary, in order to discharge the obligation to accord procedural fairness, to go further. 36 In Minister for Immigration and Citizenship v SZGUR [2011] HCA 1; 241 CLR 594 at [9], French CJ and Kiefel J said (emphasis added): "Procedural fairness requires a decision-maker to identify for the person affected any critical issue not apparent from the nature of the decision or the terms of the statutory power. The decision-maker must also advise of any adverse conclusion which would not obviously be open on the known material. However, a decision-maker is not otherwise required to expose his or her thought processes or provisional views for comment before making the decision." 37 The distinction drawn in that passage reflects what was said by a unanimous Full Federal Court in Commissioner for Australian Capital Territory Revenue v Alphaone Pty Ltd (1994) 49 FCR 576 at 592, which had in turn been endorsed by a unanimous High Court in SZBEL v Minister for Immigration and Multicultural and Indigenous Affairs [2006] HCA 63; 228 CLR 152 at [29]. The same distinction was applied in this Court in Victims Compensation Fund Corporation v Nguyen [2001] NSWCA 264; 52 NSWLR 213 at [40]. … 41. Ultimately, the question of the content of the obligation to accord procedural fairness is one of practical justice. Gleeson CJ said that "Whether one talks in terms of procedural fairness or natural justice, the concern of the law is to avoid practical injustice": Re Minister for Immigration and Multicultural and Indigenous Affairs; Ex parte Lam [2003] HCA 6; 214 CLR 1 at [37]. In connection with the Act, in McKee at [8], Allsop P said that "procedural fairness would require any and all necessary steps to ensure a fair hearing". 1. The appellant was represented by counsel both at first instance and before the Appeal Panel. The allegation that the agency had not applied s 16 of the PPIP Act properly to the Plan Notes, and that the agency had not taken reasonable steps to ensure the accuracy of the Plan Notes was explicitly raised by EEH at every stage of the challenge to the agency's conduct, and was also raised by the Tribunal in the presence of the agency's counsel as set out in [38]–[44]. 2. The fifth ground of appeal really amounts to a submission that the Tribunal should have made a decision, after the hearing, as to whether the agency had used the Plan Notes and then, if that decision was adverse to the agency, the Tribunal should have provided another opportunity to the agency to adduce evidence in the matter concerning whether it took reasonable steps to check the accuracy of the Plan Notes at a second hearing. We note that at no stage did the agency ask the Tribunal to adopt such a procedure and it is not the usual practice of the Tribunal. That procedure would not conform with the guiding principle of the Tribunal in s 36 of the Civil and Administrative Tribunal Act 2013, which is the facilitation of the just, quick and cheap resolution of the real issues in the proceedings. Parties, particularly agencies, should come to the hearing of a matter prepared to adduce all of their evidence and make all of their submissions in relation to the matters in issue in the proceedings. The sixth ground of appeal 1. The sixth ground of appeal is as follows: The Tribunal erred at law in making an order requiring icare to amend its Privacy Management Plan to explain how icare and its agents will check the accuracy of personal information before using it, in that it was beyond the scope of its powers to make such an order. 1. It was argued on behalf of the agency that the Tribunal did not have to power to make the order it made in relation to the amendment of the agency's Privacy Management Plan under s 63(2) of the Administrative Decisions Review Act 1997, s 55(2) of the PPIP Act, or at all. 2. The Administrative Decisions Review Act 1997, in s 63(2) provides: 63 Determination of administrative review by Tribunal … (2) For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision. 1. The PPIP Act, in s 53(7), confers the following powers upon an agency which has been the subject of an internal review: 53 Internal review by public sector agencies … (7) Following the completion of the review, the public sector agency whose conduct was the subject of the application may do any one or more of the following— (a) take no further action on the matter, (b) make a formal apology to the applicant, (c) take such remedial action as it thinks appropriate (eg the payment of monetary compensation to the applicant), (d) provide undertakings that the conduct will not occur again, (e) implement administrative measures to ensure that the conduct will not occur again. 1. It was argued on behalf of the agency that the order requiring the amendment of the agency's Privacy Management Plan did not constitute the implementation of 'administrative measures'. 2. The PPIP Act, in s 33, provides: 33 Preparation and implementation of privacy management plans (1) Each public sector agency must prepare and implement a privacy management plan within 12 months of the commencement of this section. (2) The privacy management plan of a public sector agency must include provisions relating to the following— (a) the devising of policies and practices to ensure compliance by the agency with the requirements of this Act or the Health Records and Information Privacy Act 2002, if applicable, (b) the dissemination of those policies and practices to persons within the agency, (c) the procedures that the agency proposes to provide in relation to internal review under Part 5, (d) such other matters as are considered relevant by the agency in relation to privacy and the protection of personal information held by the agency. (3) (Repealed) (4) An agency may amend its privacy management plan from time to time. (5) An agency must provide a copy of its privacy management plan to the Privacy Commissioner as soon as practicable after it is prepared and whenever the plan is amended. (6) The regulations may make provision for or with respect to privacy management plans, including exempting certain public sector agencies (or classes of agencies) from the requirements of this section. 1. Submissions were made in the agency's case to the effect that, having implemented a Privacy Management Plan under s 33(1), it would be inconsistent to read s 53(7) of the PPIP Act as enabling the implementation of a further, amended iteration of that Plan. That submission misconceives the language in s 53(7) of the PPIP Act. Assuming that it can be applied to the particular order under consideration, the reference in s 53(7) of the PPIP Act to implementation would not be a reference to the implementation of an amended Privacy Management Plan, but a reference to the implementation of the amendment to the Privacy Management Plan; in other words, the act of amending the Plan. 2. The agency made further submissions to the effect that, because s 33(4) of the PPIP Act contemplates the amendment of the Privacy Management Plan from 'time to time', and s 53(7)(e) contemplates measures to be taken after an internal review has been completed, it must have been contemplated that the two processes were distinct and would not ever intersect. The agency argued, further, that the structure of the PPIP Act supports the contention that it was not intended that s 53(7)(e) confer power to order the amendment of the Privacy Management Plan. We reject these submissions. If the Tribunal has the powers in s 53(7)(e) when hearing an application under the PPIP Act, and if s 53(7)(e) confers power on the Tribunal to order the amendment of the agency's Privacy Management Plan, there would be no inconsistency between such an amendment and the agency's power under s 33(4) of the PPIP Act to amend its own plan of its own volition. 3. The PPIP Act, in s 33(2), requires an agency's Privacy Management Plan to include certain policies and practices, provisions relating to the dissemination of those policies and practices within the agency and the procedures to be provided for in the event of an internal review. It seems to us that the Privacy Management Plan is intended by the PPIP Act to have the character of a policy document. The amendment of such a document does not come within the term 'administrative measures' in s 53(7) of the PPIP Act. 4. It is unlikely that the legislature intended that an amendment to a Privacy Management Plan, which has application across all of the functions of the agency which involve the obtaining, keeping and use of personal information under the PPIP Act and health information under the Health Records and Information Privacy Act 2002 (NSW), would arise out of a Tribunal decision with respect to two parties over a specific incident of conduct by or on behalf of the agency. The Tribunal, in such a matter, is not in a position to assess the broader consequences of the amendment in issue in circumstances beyond those before it in the proceedings in which the order is being considered. 5. The Tribunal is not empowered by s 53(7)(e) of the PPIP Act to make the order purportedly made by the Tribunal at first instance requiring that an amendment be made to the agency's Privacy Management Plan. 6. It is not beyond doubt that s 63(2) of the Administrative Decisions Review Act 1997, which confers upon the Tribunal the functions of 'the administrator who made the decision', meaning the decision being reviewed under the Administrative Decisions Review Act 1997, has direct application in relation to reviews of an agency's conduct under the PPIP Act. However, it is unnecessary to decide this point in this matter, and it was not argued before us. We acknowledge that the Appeal Panel in DTN v Commissioner of Police (No 3) [2020] NSWCATAP 73 at [105] expressed the view that s 63(2) of the Administrative Decisions Review Act 1997, and s 30(2)(b) of the Civil and Administrative Tribunal Act 2013 together operate to confer the powers set out in s 53 of the PPIP Act upon the Tribunal conducting a review of the conduct of an agency under the PPIP Act. 7. The PPIP Act, in s 55 (set out at [8] above), confers power directly upon the Tribunal to make specified orders on reviewing the conduct of an agency under the PPIP Act. The order made by the Tribunal for the amendment of the agency's Privacy Management Plan is not contemplated by s 55 of the PPIP Act. The seventh ground of appeal 1. The seventh ground of appeal is as follows: In the alternative to Ground 6 above, the Tribunal erred by denying icare procedural fairness in making an order requiring icare to amend its Privacy Management Plan without first giving it the opportunity to provide evidence with respect to, and make submissions about, whether such an order should be made. 1. From the transcript of the proceedings, it is evident that the idea that there might be an order requiring the agency to amend its Privacy Management Plan was not raised by the Tribunal with the parties, and neither did either of the parties raise it at the hearing. No submissions were made in relation to the issue, and the agency was not given the opportunity to argue that the order was not within power. The fair hearing rule was breached in relation to this issue. The seventh ground of appeal will be allowed. Conclusion and Orders 1. The agency has not succeeded on grounds one to five of its appeal. It has, however, succeeded on grounds 6 and 7. 2. We make the following orders: 1. The orders made by the Tribunal on 24 March in case number 2020/00087351 are varied by the deletion of order 2. 2. The appeal is otherwise dismissed. 3. Pursuant to s 64(1)(a) and (c) of the Civil and Administrative Tribunal Act 2013, the disclosure of the name of the respondent in this matter, and evidence in the proceedings which identifies the respondent, is prohibited. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 09 November 2021