Civil and Administrative Tribunal New South Wales Medium Neutral Citation: BYW v Commissioner of Police, NSW Police Force [2014] NSWCATAD 53 Hearing dates: 24 October 2013 Decision date: 30 April 2014 Jurisdiction: Administrative and Equal Opportunity Division Before: S Montgomery, Senior Member Decision: Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998 the Tribunal determines not to take any action on the matter. Catchwords: Privacy - information protection principle - personal information - disclosure to third party - reasonable security safeguards to prevent disclosure Legislation Cited: Administrative Decisions Tribunal Act 1997 Civil and Administrative Tribunal Act 2013 Privacy and Personal Information Protection Act 1998 Cases Cited: AFC v The Sydney Children's Hospital Specialty Network (Randwick and Westmead) [2012] NSWADT 189 [ Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 Director-General, Department of Education and Training v MT [2006] NSWCA 270 KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 KP v Narrandera Shire Council [2011] NSWADTAP 15 Manly Council v Byrne & Afar [2004] NSWCA 123 RL v Department of Education and Training [2009] NSWADT 257 Category: Principal judgment Parties: BYW (Applicant) Commissioner of Police, NSW Police Force (Respondent) Representation: BYW (Applicant in person) Henry Davis York Lawyers (Respondent) File Number(s): 133060 Publication restriction: Section 75(2)(b) of the Administrative Decisions Tribunal Act 1997 applies in relation to the identity of the Applicant. REASONS FOR DECISION 1This matter was commenced in the General Division of the Administrative Decisions Tribunal ("the ADT") pursuant to the Administrative Decision Tribunal Act 1997 ("the ADT Act"). On 1 January 2014, the ADT was abolished and its functions were taken over by the Civil and Administrative Tribunal of New South Wales ('NCAT'). The present decision is therefore a decision of NCAT. However, because the proceedings to which it relates are 'part heard proceedings' as defined in clause 6(1) of Schedule 1 of the Civil and Administrative Tribunal Act 2013, they are to be determined as if that Act had not been enacted (see clause 7(3)(b) of this Schedule). 2In these reasons the name of the Applicant has been anonymised so as to preserve the privacy of his personal affairs. The Applicant is referred to as BYW. I have also limited my discussion of the evidence in order to avoid the possibility that the identities of individuals might be revealed. 3BYW is seeking review by the Tribunal under the provisions of the Privacy and Personal Information Protection Act 1998 ("the PPIP Act") in relation to alleged conduct by the Respondent. The conduct is alleged to have occurred sometime prior to 22 October 2012. 4Section 27 of the PPIP Act limits the application of the PPIP Act as it applies to the NSW Police Force ("the NSWPF"). The NSWPF is not bound by the information protection principles contained in the PPIP Act except to the extent that the Respondent is exercising its administrative and educative functions. 5On 22 October 2012 an individual with whom the Applicant had had dealings ("the third party") wrote to BYW's solicitors. In his letter the third party referred to information about the Applicant, which the Applicant asserts is personal information for the purposes of the PPIP Act. A further letter from the third party to BYW's solicitors dated 25 October 2012 made reference to further information, which the Applicant asserts is personal information for the purposes of the PPIP Act. 6By letter dated 27 December 2012 BYW wrote to the Respondent and requested that the Respondent conduct an internal review of his complaint pursuant to section 53 of the PPIP Act. His complaint was in the following terms: The First and Second Letters include (but are not limited to) the following "personal information" about me as defined in section 4 of the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act): -. That I was medically discharged from the NSW Police Force (NSWPF) in March 2011; -. That a financial payout to me was negotiated; and - That I received a substantial financial settlement. (Personal Information) An unknown individual or individuals within the NSWPF have disclosed the Personal Information to [the third party] and/or another third party or parties without my consent. [The third party] was communicating with an unknown individual or individuals from the ... NSWPF in June and July 2012. The disclosure of the Personal Information is in contravention of sections 12 and 18 of the PPIP Act and has caused me significant embarrassment, humiliation and distress. ... 7Section 4 of the PPIP Act defines "personal information" as follows: 4 Definition of "personal information" (1) In this Act, "personal information" means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. (2) Personal information includes such things as an individual's fingerprints, retina prints, body samples or genetic characteristics. (3) Personal information does not include any of the following: (a) ... (b) information about an individual that is contained in a publicly available publication, ... 8Sections 12 of the PPIP Act provides: 12 Retention and security of personal information A public sector agency that holds personal information must ensure: (a) that the information is kept for no longer than is necessary for the purposes for which the information may lawfully be used, and (b) that the information is disposed of securely and in accordance with any requirements for the retention and disposal of personal information, and (c) that the information is protected, by taking such security safeguards as are reasonable in the circumstances, against loss, unauthorised access, use, modification or disclosure, and against all other misuse, and (d) that, if it is necessary for the information to be given to a person in connection with the provision of a service to the agency, everything reasonably within the power of the agency is done to prevent unauthorised use or disclosure of the information. 9Sections 18 of the PPIP Act provides: 18 Limits on disclosure of personal information (1) A public sector agency that holds personal information must not disclose the information to a person (other than the individual to whom the information relates) or other body, whether or not such other person or body is a public sector agency, unless: (a) the disclosure is directly related to the purpose for which the information was collected, and the agency disclosing the information has no reason to believe that the individual concerned would object to the disclosure, or (b) the individual concerned is reasonably likely to have been aware, or has been made aware in accordance with section 10, that information of that kind is usually disclosed to that other person or body, or (c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person. (2) If personal information is disclosed in accordance with subsection (1) to a person or body that is a public sector agency, that agency must not use or disclose the information for a purpose other than the purpose for which the information was given to it. Preliminary Issue 10The Respondent raised an issue in relation to whether the relevant information is in fact personal information for the purposes of the PPIP Act. The Respondent contends that it is not personal information within the meaning of the PPIP Act as it is contained in publicly available publications. As such, the Respondent contends that the PPIP Act does not apply. 11The Respondent relies on the evidence of Mr Michael Thornton, a law graduate at Henry Davis York, who has not previously been involved in any matters related to the Applicant. Mr Thornton provided an affidavit and also appeared at the hearing, gave evidence and was cross-examined. 12Mr Thornton's evidence is that he undertook a number of Internet searches to ascertain what information was publicly available regarding the Applicant. Annexed to his affidavit are a number of decisions of courts and tribunals that he obtained from the internet. The decisions are available to be viewed on the website www.austlii.edu.au. The Respondent contends that the decisions are publicly available publications for the purposes of subsection 4(3)(b) of the PPIP Act; that they involved the Applicant and that the alleged 'personal information' is either contained in the decisions or can be inferred from information that is contained in the decisions. 13I am satisfied that decisions that are available to be viewed on the website www.austlii.edu.au and which were in fact viewed by Mr Thornton are 'publicly available publications' for the purpose of subsection 4(3)(b) of the PPIP Act. In my view this is not altered by the fact that an order had been made under section 75(2)(b) of the ADT Act in relation to the identity of the Applicant, if the Applicant's identity is apparent or can reasonably be ascertained from the available information. 14Following the evidence of Mr Thornton and submissions by each of the parties I determined that some of the alleged 'personal information' is contained in the decisions and is therefore not 'personal information' for the purposes of the PPIP Act. 15Following the evidence of Mr Thornton and submissions by each of the parties I determined that some of the alleged 'personal information' is contained in the decisions and is therefore not 'personal information' for the purposes of the PPIP Act. 16I did not agree with the Respondent in regard to the submission that the remaining information can be inferred from information that is contained in the decisions. 17In my view, to fall within the exception provided by subsection 4(3)(b) of the PPIP Act the information must be apparent on the face of the publicly available publication or an inevitable inference that would follow from the information in the publicly available publication. In the circumstances of this matter, it is my view that the information that a financial payout to BYW was negotiated; and that BYW received a substantial financial settlement is "personal information" for the purposes of section 4 of the PPIP Act. 18The information that BYW was medically discharged from the NSW Police Force in March 2011 falls within the exception provided by subsection 4(3)(b) of the PPIP Act and is therefore not "personal information" for the purposes of section 4 of the PPIP Act. The Substantive Issues 19Each of the parties has provided written submissions in relation to the substantive issues. BYW also relies on his own written evidence and he was cross-examined at the hearing. 20A review of conduct under the PPIP Act is confined in its scope by the initial request for internal review, reasonably construed. (See AFC v The Sydney Children's Hospital Specialty Network (Randwick and Westmead) [2012] NSWADT 189 [14], KO and KP v Commissioner of Police, New South Wales Police (GD) [2005] NSWADTAP 56 at [13]-[14] and Department of Education and Training v ZR (No 2) (GD) [2009] NSWADTAP 44 at [16]-[19]). 21As noted above, BYW asserts that his personal information was disclosed in contravention of sections 12 and 18 of the PPIP Act. He also asserts that he has suffered significant embarrassment, humiliation and distress as a consequence of the alleged breaches. 22The Tribunal is to ascertain whether the Respondent disclosed the personal information to the third party and/or another third party or parties and, if so, whether or not that amounted to a breach of sections 12 or 18 of the PPIP Act. The Respondent is not bound by sections 12 and 18 of the PPIP Act except to the extent that it is exercising its administrative and educative functions. If the Tribunal is satisfied that the Respondent had contravened sections 12 and/or 18 of the PPIP Act, it must also be satisfied that any contravention occurred in connection with the exercise of its administrative and educative functions. 23In KP v Narrandera Shire Council [2011] NSWADTAP 15, the Appeal Panel considered the onus of proof in applications for review pursuant to section 55 of the PPIP Act. the Appeal Panel stated: 27 Neither the ADT Act nor the PPIP Act attributes a legal burden of proof to any party. That situation may be contrasted with the situation under the Government Information (Public Access) Act 2009 (GIPA Act). The burden of establishing that a decision made under that Act is justified lies on the agency. However, in relation to a decision to provide access to government information, the burden of establishing that there is an overriding public interest against disclosure of information lies on the applicant for review: s 105. In the absence of any express legislative provision in the PPIP Act, the relevant provisions must be interpreted in context to determine whether there is a legal burden of proof and, if so, where that burden lies. 28 In NS v Commissioner, Department of Corrective Services [2004] NSWADT 263, the following discussion of this issue appears at [32] and [45] to [46]: 32 The Deputy Privacy Commissioner also submitted that there was no rule that the applicant bears an onus of proof in reviews of conduct under the PPIP Act and in this regard relied on the decision of GV v Officer of the Director of Public Prosecutions [2003] NSWADT 177. She went on to submit that if such an onus was to be placed on an applicant then applicants would be greatly disadvantaged as they do not have any knowledge of the way the agency manages the personal information it holds and they are therefore not in the same position as the agency to ascertain the exact nature of the conduct complained about. .... 45 I agree with the submissions of the Deputy Privacy Commissioner in respect of onus of proof. The Appeal Panel recently adopted such an approach in KO v Anor v Commissioner of Police, New South Wales Police (GD) [2004] NSWADT 21 at [40 to 43]. 46 In GR (at [35] and [36]), the Appeal Panel adopted observations made by the Australian Law Reform Commission in its report entitled "Managing Justice: A Review of the Federal Civil Justice System" in respect of merit review by the tribunals as applying equally to a review under s.55(1) of the PPIP Act. These observations expressly stated that in a merits review "neither the applicant nor the respondent agency carries a burden of proof to prove or disprove a fact". 29 This analysis does not resolve the question of what the Tribunal should do if left in a state of uncertainty in relation to a fact in issue after reviewing all the available evidence. It was said by the Federal Court in a landmark decision in 1984 that the notion of onus of proof is not directly relevant to administrative proceedings where a tribunal, such as the Administrative Appeals Tribunal, is not bound by the rules of evidence and may inform itself as it thinks fit: McDonald v Director-General of Social Security (1984) 1 FCR 354 at 358; 6 ALD 6 at 11 per Woodward J. In particular it was held "there can be no evidential onus of proof in proceedings before the AAT unless the relevant legislation provides for it, and in the present case the Social Security Act 1947 does not." Nevertheless, Woodward J acknowledged that if the AAT, "finds itself in a state of uncertainty after considering all the available material . . . it will be necessary for it to analyse carefully the decision it is reviewing." Depending on the terms of the legislation, the issue must be resolved one way or the other. 30 The nature of the Tribunal's role under the PPIP Act is, so far as we are aware, unique. The Tribunal is not merely an executive decision maker as the AAT was in McDonald. While the Tribunal is exercising its review jurisdiction when determining whether certain conduct amounts to a contravention of an Information Protection Principle, it is exercising judicial power when determining whether to take no action or grant the relief available under s 55(2) including damages and mandatory and prohibitory injunctive relief: PPIP Act, s 55(2)(a)(b) and (c). Those functions are analogous to functions exercised by judges and other decision makers in civil proceedings before courts and tribunals, where an applicant is seeking to assert his or her rights. 31 Given the nature of the review under the PPIP Act, and the absence of any provisions attributing onus to either party, if left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the applicant. ... 24The Respondent submitted that there is no evidence to establish that the Respondent disclosed the personal information in contravention of the PPIP Act. The Applicant's Case 25The Applicant asserts that the Respondent holds his personal information in connection with its administrative functions and that the personal information is subject to a confidential deed between him and Respondent. 26The Respondent alludes to the personal Information arising from the medical discharge process in March 2011 and the Crown Employees (Police Officers Death and Disability) Award 2005 ("D&D Award"). The Applicant submitted that the Respondent has not adduced any evidence that a financial payout to the Applicant was "negotiated" under the D&D Award. On the contrary, the Applicant has adduced uncontested evidence that a financial payout to him was negotiated during mediation on 22 November 2011. 27Further, the Applicant submitted that the Respondent has not adduced any evidence that he received a substantial financial "settlement' under the D&D Award. On the contrary, the Applicant has adduced uncontested evidence that he received a substantial financial settlement subsequent to mediation on 22 November 2011. 28The Applicant submits that entitlements or benefits under the D&D Award are not "negotiated" nor are they in the nature of a "settlement'. On the contrary, the mediation on 22 November 2011 consisted of negotiations that culminated in a settlement. 29The Applicant further submits that medical discharge from the NSWPF does not automatically mean a police officer has received a financial payout under the D&D Award. For example, the D&D Award does not apply to those police officers listed in clauses 4.1 therein. 30The Applicant submits the personal information arises out of the Deed between the Respondent and himself executed at mediation on 22 November 2011, not the medical discharge process in March 2011 or the D&D Award. Mr Watts' conversation with the third party 31The issue arises as to whether the NSWPF disclosed the personal information to the third party and/or another third party or parties. 32On 11 April 2013 Mr Martin Watts, a solicitor acting for the NSWPF, had a telephone conversation with the third party and made handwritten notes of the content of his telephone conversation with the third party. Mr Watts' Handwritten Notes record that the third party stated that he received the personal information from a female journalist and not from the NSWPF. The Applicant submits that the Handwritten Notes do not reveal the: (a)name of the female journalist and/or her organisation; (b)time, date and/or place the journalist disclosed the personal information to the third party; and (c)means or mode by which the disclosure was made to the third party. 33Notwithstanding the lack of detail in respect to the circumstance in which the third party obtained the personal information from the journalist, the evidence indicates that it occurred on or before 22 October 2012. 34At Mr Watts' request the third party sent an email to Mr Watts confirming that: (a)the third party did not obtain the personal information from the NSWPF or any member of it; and (b)the third party contacted the Kings Cross Local Area Command, on one occasion in or around June or July 2012 for the purpose of checking whether a personal safety intervention order he obtained from the Melbourne Magistrates' Court had been served on the Applicant. 35The third party's email made no reference to the: (a)female journalist or the circumstances in which he obtained the personal information from her; and (b)assertion that the female journalist did not obtain the personal information from the NSWPF. 36The Applicant points to the fact that the Respondent did not adduce evidence directly from Mr Watts in respect of: (a)whether he in fact had a telephone conversation with the third party on 11 April 2013; (b)whether he in fact is the author of the Handwritten Notes. (c)whether the Handwritten Notes are in fact a true and correct record of the content of the telephone conversation with the third party; (d)the actual questions he put to the third party during the telephone conversation and the answers that he received in response; (e)whether he is in fact the author of the email, which was sent to the third; and (f)whether he offered the third party an inducement to confirm the specific matters recorded in the Handwritten Notes. 37The Applicant also points to the fact that the Respondent did not adduce any evidence directly from the third party in respect of: (a)whether he in fact had had a telephone conversation with Mr Watts on 11 April 2013; (b)whether the Handwritten Notes are in fact a true and correct record of the content of the telephone conversation with Mr Watts; (c)the actual questions that Mr Wafts put to him during the telephone conversation and the answers that he gave in response; (d)whether he is in fact the author of the email, which was sent to Mr Watts; and (e)whether Mr Watts offered him an inducement to confirm the specific matters recorded in the Handwritten Notes. The Applicant's submission as to inferences to be drawn 38The Applicant submits the Tribunal should draw an adverse inference with respect to the Respondent's failure to make any lines of inquiry with the third party in respect to the female journalist and its failure to adduce evidence directly from Mr Watts and the third party. 39The Applicant further submits that the third party is a witness unavailable to him because of proceedings in other forums and that the third party is a witness in the Respondent's camp by reason of him having voluntarily provided information by way of telephone and email. 40The Applicant submits the Tribunal should draw the inference that the Handwritten Notes are not a true and correct record of the content of the telephone conversation with the third party, which is why the Respondent decided not to adduce evidence directly from Mr Watts and the third party with respect to the veracity of the Handwritten Notes. 41The Applicant further submits that the Tribunal should draw the inference that Mr Watts, on behalf of the NSWPF, offered the third party an inducement to confirm that he did not obtain the personal information from the NSWPF or any member of it. 42The Applicant asserts that the Respondent holds the personal information that was acquired by the third party in connection with its administrative functions. He points to evidence that none of those present on his behalf at the mediation - himself, his legal representatives and his support person - disclosed the personal information to the third party, anyone from the media or anyone else not involved in the Applicant's case against the NSWPF. In contrast, he submits that the Respondent has not adduced any evidence that its officers and legal representatives who were present at mediation did not disclose the personal information to the third party, the female journalist and/or anyone else not involved in the Applicant's case against the NSWPF. 43The Applicant submits the Tribunal should draw the inference that it was an unknown member of the NSWPF, not a female journalist, who disclosed the personal information to the third party, in contravention of section 18 of the PPIP Act. The Respondent's Case 44The Respondent submits that there is no evidence to establish that the personal information was disclosed by the NSWPF in contravention of section 18(1) of the PPIP Act or that the NSWPF has breached section 12 of the PPIP Act. It argues that the internal review sufficiently dealt with the alleged disclosure of personal information and that the findings should be upheld. 45With respect to the Applicant's assertion that the personal information was disclosed by an unknown member of the NSWPF, the Respondent submits that it would be an absurd proposition for the Respondent to question all sworn and unsworn officers at Kings Cross Local Area Command in relation to the alleged disclosure. It argues that this is particularly so as the third party stated that he did not receive the personal information from any such police officers; and such enquiries would only have heightened the risk of disclosure of the personal information. 46The Respondent submits that, taken at its highest, the Applicant's case may be described as an inference case. The Tribunal should be satisfied in this review that the NSWPF's conduct does not disclose any breach of the PPP Act. 47The Respondent relies on the passage from KP v Narrandera Shire Council referred to above in support of its submission that while the Applicant does not bear an onus of proof in these proceedings, if the Tribunal is left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the Applicant. 48The Respondent disputes the Applicant's assertion that if the personal information was not disclosed by persons associated with him then an inference can be drawn that the personal information was disclosed by an unknown member of the NSWPF. The Respondent submits that this is an absurd proposition. 49It argues that there is no evidence that the only people who were aware of the personal information were the NSWPF and the Applicant's witnesses and that there are numerous other inferences that may be drawn. The Respondent provided several examples of possible inferences. It submits that the more likely inference is that the information was disclosed by someone other than the NSWPF or the Applicant's witnesses. 50The Respondent referred to RL v Department of Education and Training [2009] NSWADT 257, in which Judicial Member Wilson considered whether or not personal information was disclosed by a school during discussions in the school playground between teachers and the parents of students. The Judicial Member stated at paragraph [55]: 55 The question then becomes, it being open to the Tribunal on the evidence to find by way of inference that the applicant's medical condition was discussed in the playground as she alleges, whether the Tribunal is satisfied that that inference is the correct one to draw. It can only be properly drawn if there is evidence to show that it is more likely than not the way, or one of the ways, in which the information reached the playground at the school. The competing inference, suggested by the respondent, is that the parents at the school learned of the applicant's medical condition from third parties to whom the applicant had herself revealed the information. Clearly, this inference is also available. ... 51The Respondent submits that, in the present matter, an inference that the NSWPF disclosed the personal information can only be properly drawn by the Tribunal if there is evidence to show that it is more likely than not the way, or one of the ways, in which the information was disclosed. 52In the event that the Tribunal must decide if it is more likely than not that the NSWPF disclosed the personal information in breach of the PPIP Act, in the Respondent's submission it is more likely than not that the personal information was not disclosed by the NSWPF to the third party or any other third party. Accordingly, the Respondent submits, the Tribunal cannot be satisfied that the NSWPF made the disclosure alleged or engaged in any conduct in contravention of the PPIP Act. 53For completeness, the Respondent submits that if the Tribunal is satisfied that the NSWPF made the disclosure alleged, the NSWPF should not be vicariously liable for the actions of the unidentified individual or individuals who made that disclosure. The disclosure would have been made for a purpose extraneous to the purpose of the NSWPF. In the Respondent's submission this inference may be drawn from the lack of any evidence that there was a disclosure, let alone one that was authorised by the NSWPF. 54Accordingly, the Respondent submits that there was no "disclosure" of the personal information within the meaning of the PPIP Act. Therefore the Tribunal must find no contravention of the PPIP Act. Discussion 55As has been noted above, this matter is one in which the Applicant contends that an inference can be drawn that the personal information was disclosed by an unknown member of the NSWPF. The implication also exists that if the personal information was disclosed in contravention of the PPIP Act, then the Respondent had not taken all reasonable security safeguards to prevent that disclosure. 56For reasons that will become apparent, it is not necessary that I determine whether the Respondent holds the Applicant's personal information in connection with its administrative functions. 57A limited number of people had knowledge of the information. It is not in dispute that the Respondent held the personal information nor is it in dispute that the third party became aware of the information. 58Material before the Tribunal indicates that the third party advised Mr Watts that he did not receive the information from the NSWPF but that he received it from a journalist. Neither party called the third party to give evidence at the hearing; therefore he could not be cross-examined and that evidence could not be tested. 59The Applicant submits that the Tribunal should draw an inference against the Respondent in relation to the Respondent's failure to call the third party. I do not agree with that submission. An adverse inference may only be made in respect of a failure of a party to call a witness where "the missing witness would be expected to be called by one party rather than the other": Manly Council v Byrne & Afar [2004] NSWCA 123 at paragraph [53]. This might be expected for any of a number of reasons for example the witness might be regarded as in the camp of one party, so as to make it unrealistic for the other party to call him. If the witness is equally available to both parties, the condition generally stands unsatisfied. 60The Applicant submits that in this matter the third party is in the Respondent's camp. The Respondent argues that that is not the case. It says that the third party is a witness in neither party's camp but rather he is an independent third party contacted by the NSWPF in the course of conducting the internal review. It submits that the fact that the Respondent discharged its statutory responsibility to conduct an internal review by contacting the third party does not make him a witness "in the Respondent's camp". 61I agree with the Respondent in this regard. In my view it was open to either party to call the third party as a witness. 62As neither party called the third party, the accuracy of the information contained in Mr Watts' Handwritten Notes has not been tested. 63It was also open to the Applicant to summons Mr Watts to give evidence, but he did not do so. 64Put at its highest, the Applicant's case is that Mr Watts' Handwritten Notes may be inaccurate. They may have inaccurately recorded the information provided to Mr Watts by the third party or the information provided to Mr Watts by the third party may have been inaccurate. If either of those scenarios existed, then the question arises as to what inference should be drawn from it. 65The Applicant submits that the Tribunal should draw an inference against the Respondent. He submits that the correct inference is that the personal information was disclosed to the third party by the NSWPF. 66I agree with the Respondent that the inference should only be drawn if there is evidence to show that it is more likely than not the way, or one of the ways, in which the information was disclosed. I am unable to form that conclusion on the material before me. 67I accept that it is possible that the personal information was disclosed to the third party by an officer or officers of the NSWPF. However, that is only one of several possibilities. In my view the evidence does not support the finding that it is more likely than not that the personal information was disclosed by the NSWPF. 68As was noted in NS v Commissioner, Department of Corrective Services, if the Tribunal is left in a state of uncertainty in relation to a fact in issue, that fact should be decided against the Applicant. 69Even if I were able to make the finding that it is more likely than not that the personal information was disclosed by an officer of the NSWPF, I am unable to conclude that the disclosure should be characterised as disclosure by the Respondent or conduct of the Respondent. Where disclosure of information was for a purpose extraneous to any purpose of the agency, it should not be characterised as conduct of the agency: Director-General, Department of Education and Training v MT [2006] NSWCA 270 at paragraph [43]. 70I have no basis on which I could conclude that an officer of the Respondent disclosed the personal information or, if that had been the case, that the disclosure was authorised by the NSWPF. In my view, if an office of the Respondent had disclosed the personal information it is more likely than not that the officer was on a frolic of their own. 71Similarly, I have no basis on which I could conclude that the Respondent had not taken all reasonable security safeguards to prevent disclosure of the personal information. 72That being the case, I am not satisfied that the Respondent has contravened the PPIP Act as alleged in the Application. Order Pursuant to section 55(2) of the Privacy and Personal Information Protection Act 1998 the Tribunal determines not to take any action on the matter. ********** I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 30 April 2014