You're right, it is hard to find out concrete, "official" confirmation of this - I have just been looking myself
I have found several references to it by private companies (mostly recruitment companies) but I'm struggling to find a State or Federal Government site that spells it out.
In the absence of anything official, let's look at it from a common sense approach.
There are obvious issues around privacy and discrimination.
By contacting someone at a person's place of employment seeking a reference, your Director has effectively told that individual that you have applied for another job. That could have a variety of consequences.
Also, your Director doesn't necessarily know if the person they are seeking the reference from is an appropriate person to give a reference on the individual concerned. For example the unofficial referee may not be in a position to critique the individuals performance. The unofficial reference could just as easily biased as a reference from a nominated referee, and/or the reference could be completely subjective.
Reference checks fall under privacy laws. As such a record of the reference must be kept (by your organisation) and must be made available to the applicant if they want to access that information.
The applicant it only likely to take any action against you if they don't get the job, which in this case doesn't sound like it applies.