00330 Decision S2.pdf

since Leo Hardiman’s Australian Government Solicitor FOI and Privacy Practitioners
Update on 29 July 2022.
Following consultation with you on the scope of your request, on 24 June 2024 you
revised your request to be as follows:
1) any documents, inclusive of correspondence, sent by the OAIC to:
1. Department of Home Affairs;
2. Department of Health and Aged Care;
3. Department of Climate Change, Energy, the Environment and Water; 4. Civil Aviation
Safety Authority; 5. Department of Employment and Workplace Relations; 6.
Department of Agriculture, Fisheries and Forestry; 7. Department of Education; 8.
Department of Industry, Science and Resources; 9. Australian Competition and
Consumer Commission; and 10. Federal Court of Australia; discouraging the imposition
of charges for FOI requests since 29 July 2022
2) any documents, inclusive of correspondence, to the Attorney-General’s Department
relating to amending the FOI Act to remove the ability to impose charges for FOI
requests, since 29 July 2022.
I note that on 4 July 2024 you also agreed to exclude:
•  the personal information of individual Information Commissioners (IC) review
applicants; and
•  the personal information of private individuals or businesses which sought a
review of the agency’s decisions
from the scope of the request.
Request timeframe
Your request was made on 19 June 2024.
On 9 July 2024 you agreed to an extension of time under section 15AA of the FOI Act.
This means that a decision on your request is due by 2 August 2024.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
2

Subject to the following provisions of the FOI Act, I have made a decision to:
•  grant access in part to 27 documents
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to you request:
•  The OAIC Executive, inclusive of the Australian Information Commissioner
and the Freedom of Information Commissioner,
•  The Freedom of Information Branch, and
•  The Legal Services Team.
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
•  general computer files
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 19 July 2024 and subsequent revised scope dated 24
June and 4 July 2024.
•  the FOI Act, in particular sections 3, 11, 11A, 15, 22, 26 and 47E of the FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
3

Access to edited copies with irrelevant and exempt matter deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
With your agreement, I have identified the following material within the documents
to be irrelevant or out of scope of your request in accordance with s 22(1)(a)(ii) of the
FOI Act:
•  the personal information of individual Information Commissioners (IC) review
applicants; and
•  the personal information of private individuals or businesses which sought a
review of the agency’s decisions.
The FOI Guidelines provide that personal information means information or an
opinion about an identified individual, or an individual who is reasonably
identifiable.1
In this instance, I consider the names, contact details, and identifiers related to IC
review matters to be personal information, as such details have the capacity to
render an individual reasonably identifiable.
Accordingly, I have made an edited copy of the documents which removes this
material in accordance with s 22 of the FOI Act, granting you access in part to the
material in scope of your request.
Please note, that pursuant to section 31(3)(a) of the Australian Information
Commissioner Act 2010 (Cth), any redactions under s 22 where the material is
irrelevant, still renders the document access in part. For example, in this case, even
though the only redactions the OAIC made in some documents may be personal
information that you agreed to exclude, and no other exemptions are applied by the
OAIC, the document is still considered to be access in part only. We have labelled
documents where only s 22 was applied, in the schedule of document attached.
Section 47E(d) – Proper and efficient conduct of the OAIC’s operations
In accordance with section 47E(d) of the FOI Act, I have made a decision to redact
material on the basis that disclosure would or could reasonably be expected to have

1 Freedom of Information Guidelines – Part 6, paragraph 6.123.
4

a substantial adverse effect on the proper and efficient conduct of the Department of
Health and Aged Care’s (‘DoHAC’ of ‘the Department’) operations.
Paragraph 6.101 of the FOI Guidelines explains that:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or allegation that damage may occur if the document were to be
released.

Additionally, at 6.103 the FOI Guidelines further explain:

An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).
The material that I have decided is subject to conditional exemption comprises of
direct contact details and last names of non-SES DoHAC staff, and internal IT
addresses related to the back-end processing of a file, used to uniquely identify
matters within the OAIC
In undertaking an assessment of this conditional exemption, I have had regard to
relevant and recent AAT and Information Commissioner decisions including Paul
Farrel  and Department of Home Affairs (Freedom of information) (No 2) [2022] AICmr
49 (8 April 2022) and Knight v Commonwealth Ombudsman [2021] AATA 2504.
In Paul Farrel  and Department of Home Affairs (Freedom of information) (No 2) [2022]
AICmr 49 (8 April 2022), whilst the material found within the documents related to
the Department of Home Affairs’ operations, the Commissioner determined that the
Department had failed to provide sufficient evidence as to why disclosure would
have a substantial and adverse effect on its operations. These decisions further
reinforce the position that this provision requires a high threshold as to the
substantial and adverse effect that disclosure would have on an agency’s operations.
Contact Details and Last Names of Non-SES DoHAC Staff
In order to determine whether disclosure would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the
5

operations of DoHAC, I have taken into consideration the functions and activities of
the Department.
DoHAC works to deliver affordable, quality health and aged care for all Australians,
managing 20 portfolio agencies and administering over 80 pieces of legislation
related health and aged care management across Australia. The Department is led by
Blair Comley PSM, Secretary of DoHAC, and is further supported by an Executive
team of eight members. Relevant to this case, the Department often deals with
complex and sensitive matters. By way of illustration, DoHAC received over 500
Freedom of Information requests in the 2022/23 Financial Year. This is indicative of
the need for communications between the Department and the public to be
streamlined and centralised.
I consider that the disclosure of direct contact details and last names of non-SES
DoHAC staff would or could reasonably be expected to have an adverse effect on
DoHAC’s ability to effectively manage the communication it receives from the public.
The recent decision of Chief Executive Officer, Services Australia v Justin Warren [2020]
AATA 4557 discusses the issue of the disclosure of public servants’ names and
contact details. The FOI Guidelines and the Information Commissioner’s 2020 Policy
Paper Disclosure of public servants’ names and contact details in response to FOI
requests also discuss this issue.
DoHAC has submitted that the disclosure of direct contact details and last names of
non-SES DoHAC staff contained in this bundle of documents would have a
substantial adverse effect on their operations as it may circumvent the dedicated
contact mediums established by the Department to manage contact with the public.
Specifically, the Department highlighted that the disclosure of direct contact details
and last names of staff members working in Freedom of Information would have a
significant impact on their ability to effectively undertake their duties, and that this
may put them at an increased risk of abuse, harassment and intimidation.
Further, the Department submitted that the release of the direct contact details and
last names of non-SES staff would also impact the ability for non-Freedom of
Information staff effectively undertake their duties, particularly as irrelevant
communications would need to be directed to the appropriate area for response.
This would require each impacted staff member to review communication made and
make a determination as to the most appropriate line area to allocate this
communication to. The Department submits that this would infringe upon the
named staffer’s ability to undertake their regular duties.
In my view, the adverse effects from the disclosure of the relevant documents at this
time is more than merely an assumption and would impact upon the proper and
6

efficient operations of the DoHAC. I consider the Departments submissions above as
valid.
IT addresses
In order to determine whether disclosure would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the
operations of the OAIC, I have taken into consideration the functions and activities of
the OAIC.
The OAIC is an independent statutory agency within the Attorney-General’s portfolio,
established under the Australian Information Commissioner Act 2010 (Cth). The OAIC
comprises the Australian Information Commissioner (office currently held by
Angelene Falk), the Privacy Commissioner (office currently held by Carly Kind), the
FOI Commissioner (office currently held by Elizabeth Tydd), and the staff of the OAIC.
I consider that the disclosure of internal OAIC IT addresses would or could
reasonably be expected to have an adverse effect on the OAIC’s functions.
The IT addresses contained in the relevant documents relate to the internal location
of documents within the OAIC’s systems and are used for internal case management
purposes. The OAIC collects and stores a range of personal and financial information
about members of the public. The IT addresses contain information about the OAIC’s
IT system and may facilitate an adverse actor to gain access to a range of internal IT
information, including the network location and storage of information. I consider
that disclosure of this information could compromise the safety and security of the
storage of information held by the OAIC. The impact of any compromise to the safety
and security of the OAIC’s information systems would result in a serious adverse
impact on the functions and responsibilities of the OAIC.
In ‘AW’ and Australian Taxation Office (Freedom of information) [2014] AICmr 1, the
then FOI Commissioner considered the decision by the Australian Taxation Office
(ATO) to exempt user IDs under section 47E(d) of the FOI Act. The user IDs are used by
ATO staff to access the ATO’s IT system. The Commissioner found that disclosing the
user IDs ‘would have an adverse effect on the security of the ATO’s IT systems and
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the ATO’. In a series of subsequent IC review decisions, the
former Australian Information Commissioner agreed with the reasoning given by the
Commissioner in ‘AW’ to find that user IDs used by ATO staff to access the ATO’s IT
system are exempt under section 47E(d) of the FOI Act.
7

For the purposes of IT security and information protection at the OAIC, we consider
IT addresses and internal IT Codes to attract similar protections, and therefore the
reasoning for exempting this material is similar for both.
I consider that the disclosure of the IT addresses within the OAIC’s case management
system could reasonably be expected to have a substantial adverse effect on the
proper and efficient conduct of the OAIC’s operations. I have decided that the
address is conditionally exempt from disclosure under section 47E(d) of the FOI Act.
In my view, the adverse effects from the disclosure of the relevant material at this
time is more than merely an assumption and would impact upon the proper and
efficient operations of the OAIC by opening the OAIC’s security systems to potential
vulnerabilities. In the case these vulnerabilities are realised, the security response
required by the OAIC would result in the diversion of resources, resulting in a
substantial adverse effect on the proper and efficient operation of the agency.
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47E(d) of the FOI Act.
As section 47E is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject
to conditional exemption under s 47E(d).

Section 11A(5) provides that where a documents are considered to be conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision maker would, on balance, would be contrary to the public interest.

This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions. This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not
be taken into account.
8

6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely
of individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter wil  often depend
on a balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to al  members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole. It
may be sufficient that the matter is in the interest of a section of the public
bounded by geography or another characteristic that depends on the
particular situation.  A matter of public interest or benefit to an individual or
small group of people may also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:

… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest.  Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.

The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, we consider the following to be relevant:
•  promote the objects of the FOI Act.
In addition to these factors favouring disclosure, I have also considered that the
following factors in favour of disclosure apply:
•  disclosure would enhance scrutiny around government decision making, and
•  disclosure would facilitate transparency in government.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in, which I have had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the following factors against disclosure apply:
9

•  disclosure would have an adverse effect on DoHAC’s proper and efficient
operations relating to the management of incoming communication from the
public, where that communication is not via the existing contact methods as
established by the Department, and
•  disclosure would have an adverse effect on the OAIC’s ability to manage
internal systems and could impact and compromise the OAIC’s IT security.
Whilst I consider there is a public interest in the release of this information to
facilitate a full release of the documents within scope of this request, I have placed
greater weight in relation to factors weighted against disclosure. I consider there to
be a significant public interest in facilitating the proper and efficient conduct of the
DoHAC due to the importance of the work they engage with for the Australian
community at large. DoHAC has several responsibilities pertinent to managing the
health and safety of the community at large, and enabling their staffers to work
efficiently will serve the public interest more so than releasing this information.

I also consider there to be little public interest in the disclosure of internal IT
addresses  which do not relate to the substance of the material to which the file
relates. This is because the IT address is merely for internal use in back-end systems,
and do not impact or otherwise relate to the file which has been requested. I
consider the protection of the OAIC’s information security management to be of
great public interest. This is because, as the regulator of the Privacy Act 1988 (Cth)
(Privacy Act) and its implementation across Commonwealth Government agencies,
the OAIC must emulate best practice, and cannot be in breach of the very instrument
it regulates. To act in a manner inconsistent with the purpose of the Privacy Act
would be contrary to the public interest and diminish the OAIC’s ability to effectively
manage privacy across other Commonwealth agencies and private entities.

In addition, I consider that the release of the redacted material does not impact the
substance of the material within the documents provided. All other relevant material
has been released; the removal of this information does not alter the information
within the document. I do not consider the release of this information would serve to
further transparency or accountability in decision-making, as the substance of the
decision-making remains available. In addition, and as highlighted in Chief Executive
Officer, Services Australia v Justin Warren [2020] AATA 4557 at paragraphs [70] – [83],
the considerations of ‘accountability in decision-making’ and ‘transparency’ apply
most appropriately at an agency or departmental level, and not necessarily on an
individual public servant level. As such, I consider that there is little public interest in
the disclosure of direct contact details and last names of non-SES DoHAC staff and
internal IT addresses related to the back-end processing of a file. I consider that the
10

disclosure of this material would likely impact upon both DoHAC and the OAIC’s
ability to effectively and efficiently manage their existing workload, and protect the
OAIC’s network security, respectively.

On balance, I consider the public interest factors against disclosure to be more
persuasive than the public interest factors favouring disclosure. I am satisfied that
the public interest is to withhold the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
I have made a decision to publish the documents subject to your request on the
OAIC’s disclosure log.
Release of document
The documents are enclosed for release.
The documents are identified in the attached schedule of documents.
Please see the following page for information about your review rights.
Yours sincerely,
Tahlia Pelaccia
Lawyer
2 August 2024
11

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

12

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

13