OFFICIAL: SENSITIVE
Our reference: FOI 22/25-0958
GPO Box 700
Canberra ACT 2601
1800 800 110
ndis.gov.au
29 January 2025
Nosey
By email: (xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx)
Dear Nosey
Freedom of Information request — Request consultation process
Thank you for your correspondence of 14 December 2025, in which you requested access
under the
Freedom of Information Act 1982 (FOI Act) to documents held by the National
Disability Insurance Agency (NDIA).
Scope of your request
You have requested access to the following documents:
“…I seek access to any and all documents, records, data, and supporting material held by
[Name of Agency] concerning the sharing of personal information originating from the
Department of Veterans’ Affairs (DVA) over the last ten years. This includes any data
transfers from or to the DVA, whether they were one-off exchanges or ongoing, systematic
transfers of DVA client information, including personal, medical, financial, or service-related
details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA client information
[Authority name] has received or accessed and for what purposes. Specifically, I request:
Al records of data sharing arrangements between DVA and [Authority name], including but
not limited to memoranda of understanding, service-level agreements, emails, letters,
meeting minutes, file transfer logs, internal reports, and instructions that outline what data
was shared, when it was shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how [Authority name]
requests, obtains, stores, handles, or uses DVA client information. This includes documents
that detail the criteria for approving access to such data, any consent or authorization
processes, security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments, internal review
board decisions, or other documents that reflect deliberations or authorizations for obtaining
DVA client information. This includes records that show the agency considered the ethical,
legal, or privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the DVA client data,
such as project proposals, business cases, internal strategy papers, or briefings that explain
why [Authority name] sought access to this information, how it was intended to be integrated
into the agency’s operations, and any expected outcomes or benefits.
OFFICIAL: SENSITIVE
1
OFFICIAL: SENSITIVE
A representative sample (in a suitably de-identified or redacted form) of the data or data
fields received, so long as providing this sample does not breach any exemption under the
FOI Act. The purpose is to understand the nature and granularity of the information shared,
without disclosing identifiable personal details.
If the only data [Authority name] received pertains solely to data linked to the Centrelink
Confirmation eServices (CCeS) arrangements as described at [link provided], and there
were no other forms of DVA data shared, then no CCeS-related data needs to be provided
under this request…”
Practical refusal
I am authorised to make decisions under section 23(1) of the FOI Act.
I am writing to advise that your request does not provide enough information about the
documents you are seeking as is reasonably necessary to allow us to identify them. Further,
the work involved in processing your request in its current form would substantially and
unreasonably divert the resources of the NDIA from its other operations due to its broad
scope.
These two reasons are called ‘practical refusal reasons’ under section 24AA of the FOI Act.
On this basis, I intend to refuse your request. However, before I make a final decision, I am
writing to provide you with an opportunity to revise your request. This is called a ‘request
consultation process’ as set out under section 24AB of the FOI Act. You have 14 days to
respond to this notice in one of the ways set out below.
Why I intend to refuse your request
I wrote to you on 15 January 2025 requesting a revision of scope. On 26 January 2025 you
indicated you do not wish to revise the scope of the request.
I also asked you to confirm if the NDIA is the agency from which you seek documents, as
you have not referred to the National Disability Insurance Agency or the NDIA in the request.
Your request instead refers to “Name of Agency” and “Authority name.” These terms are
unclear. You have not yet confirmed that you are seeking documents about the NDIA. This
means we do not yet have enough detail to confirm you are seeking documents held by the
NDIA.
We have consulted with relevant NDIA staff who could be expected to be able to identify
documents within the scope of the request, including staff who are knowledgeable about
how to conduct searches of the NDIA’s systems. This outcome shows that the terms of your
request do not provide sufficient information to allow us to identify the specific documents
that you are seeking.
In addition, the request is very broad and covers a date range of more than 10 years. You
have not provided a targeted document type or category, rather you have requested “any
and all”. As such, searches would have to be conducted across every business unit of the
NDIA. The NDIA has over 25 different divisions. To do a comprehensive search, we would
have to do consultations with all of them to locate “any and all” documents held by the NDIA.
In addition, searches would be required across multiple systems including:
• PACE case management system
• CRM case management system
• LEX case management system
• Content Manager document holding system
OFFICIAL: SENSITIVE
2
OFFICIAL: SENSITIVE
• SharePoint document management system
• The entirety of the NDIA email system, requiring specialist IT support
• General computer files
• Paper files
The documents assessed as being within scope of the request wil then need to be reviewed
for any sensitivities and possible exemption under the FOI Act and scheduled, we wil need
to consider any consultations and carry these out if required, a decision wil need to be made
on each document, and a decision letter prepared. This wil significantly increase the time
that it wil take an FOI officer to process your request.
As a result, I am of the view that the work involved in the processing of this request would
substantially and unreasonably divert the resources of the NDIA from its other operations.
Request consultation process
You now have an opportunity to revise your request to enable it to proceed.
Revising your request can mean narrowing the scope of the request to make it more
manageable and explaining in more detail the documents you wish to access. For example,
by providing more specific information about exactly what documents you are interested in,
the NDIA wil be able to pinpoint the documents more quickly and avoid using excessive
resources to process documents you are not interested in.
The example of scope I propose is an updated version of the clarification you sent to ASIC
via the Right to Know website:
“…I am specifically requesting documents held by the National Disability Insurance Agency
concerning systematic or broad data-sharing arrangements with the Department of Veterans’
Affairs (DVA) over the past ten years. This includes:
Formal Agreements - Memoranda of understanding (MOUs), service-level agreements
(SLAs), or other documents formalising the sharing of personal information originating from
DVA.
Governance Documents
Policies, procedures, or guidelines detailing how ASIC accesses, stores, handles, or uses
personal information from DVA.
Privacy and Ethical Deliberations - Any privacy impact assessments, internal reviews, or
ethical considerations recorded regarding the receipt, use, or sharing of DVA data.
Purpose and Use - Documents such as project proposals, internal reports, or briefings
explaining why DVA client information was accessed or shared, how it was intended to be
used, and the expected outcomes.
Exclusions
I do not seek individual complaint files or personal information unless necessary to il ustrate
the nature of systematic or broad data-sharing arrangements…”
You have 14 days from the date you receive this letter to contact me and do one of the
following:
a. withdraw your request
b. make a revised request
c. indicate that you do not wish to revise the request.
During this period, you are welcome to seek assistance to revise your request. If you revise
your request in a way that adequately addresses the practical refusal reason outlined above,
we wil recommence processing it.
OFFICIAL: SENSITIVE
3
OFFICIAL: SENSITIVE
You can contact me by email at
xxx@xxxx.xxx.xx.
Alternatively, you can reply in writing to the following address:
Freedom of Information Section
Complaints Management & FOI Branch
General Counsel Division
National Disability Insurance Agency
GPO Box 700
CANBERRA ACT 2601
If you do not contact me within this period, that is by 12 February 2025, your FOI request wil
be taken to have been withdrawn under subsection 24AB(7) and wil not be dealt with any
further.
Please do not hesitate to contact me if you have any questions.
Yours sincerely
Cindy – CGN062
Senior Freedom of Information Officer
Complaints Management & FOI Branch
General Counsel Division
OFFICIAL: SENSITIVE
4
