It occurs to me that maybe it ought to be clear.
You make a good point. An Information Commissioner here, with order-making powers, only has the ability to enforce disclosure where she feels that the department has made an improper decision pursuant to the act to refuse disclosure. But paragraph 8(2)(m) of the Privacy Act, as you said, does specifically state in the statute “for any purpose where, in the opinion of the head of the institution”. It's unclear who then has the authority where there's a dispute between the head of the institution and the Information Commissioner.
If I were resolving that, I think it would actually lie with the head of the institution, given that's the way the statute reads, but I guess your concern is clarity.