‘Noseyrosey’
via email: xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear ‘Nosey’
FREEDOM OF INFORMATION REQUEST: No. 2024/25-007
Request Consultation (section 24AB)
I refer to your request made under the
Freedom of Information Act 1982 (Cth) (FOI Act) to the
National Health and Medical Research Council (NHMRC) on 14 December 2024 seeking:
Access to any and all documents, records, data, and supporting material held by [Name
of Agency] concerning the sharing of personal information originating from the
Department of Veterans’ Affairs (DVA) over the last ten years. This includes any data
transfers from or to the DVA, whether they were one-off exchanges or ongoing,
systematic transfers of DVA client information, including personal, medical, financial, or
service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA client
information [Authority name] has received or accessed and for what purposes.
Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name], including
but not limited to memoranda of understanding, service-level agreements, emails, letters,
meeting minutes, file transfer logs, internal reports, and instructions that outline what
data was shared, when it was shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how [Authority name]
requests, obtains, stores, handles, or uses DVA client information. This includes
documents that detail the criteria for approving access to such data, any consent or
authorization processes, security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments, internal review
board decisions, or other documents that reflect deliberations or authorizations for
obtaining DVA client information. This includes records that show the agency considered
the ethical, legal, or privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the DVA client data,
such as project proposals, business cases, internal strategy papers, or briefings that
explain why [Authority name] sought access to this information, how it was intended to
be integrated into the agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of the data or data
fields received, so long as providing this sample does not breach any exemption under
the FOI Act. The purpose is to understand the nature and granularity of the information
shared, without disclosing identifiable personal details.
If the only data [Authority name] received pertains solely to data linked to the Centrelink
Confirmation eServices (CCeS) arrangements as described at
https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.servicesaustr
alia.gov.au%2Fcentrelink-confirmation-eservices
cces&data=05%7C02%7Cfoi%40nhmrc.gov.au%7Cadab9bd05fb54bb9bc0f08dd1bf6f44b
%7C402fca06dc9c412f9bf91a335a4671f7%7C0%7C0%7C638697469811207434%7CUnkno
wn%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW
4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C40000%7C%7C%7C&sdata=Fbcnp7SquIf
hZPg2inQri4OjrbcslXPaFK0uu70dsFc%3D&reserved=0, and there were no other forms of
DVA data shared, then no CCeS-related data needs to be provided under this request.
I also note your advice that:
I emphasize that I am not authorizing the transfer of this FOI request to the Department
of Veterans’ Affairs or any other agency. If [Authority name] holds the requested
information, it should provide it directly. If there are parts of this request that [Name of
Agency] does not understand or believes are not held, I invite you to contact me to clarify
or refine the scope under section 24AB of the FOI Act, rather than initiating a transfer.
However, I do not consent to the transfer of this request to another entity. The FOI Act
places the onus on agencies to process requests for documents they hold, and I expect
[Authority name] to meet its responsibilities in this regard.
Where your request has used the terms ‘[Name of Agency]’ and ‘[Authority name]’, I have
interpreted this to be ‘[NHMRC]’.
I am an officer authorised under subsection 23(1) of the FOI Act to make decisions in relation to
FOI requests. I am writing to advise that I intend to refuse access to the documents requested,
for the reasons detailed below. However, before a final decision is made to do this, you have an
opportunity to reduce the scope of your request. This is called a ‘request consultation process’
as set out under section 24AB of the FOI Act. You have 14 days to respond to this letter in one
of the ways set out under the ‘request consultation process’ heading below.
Please note that during this period, you are welcome to seek assistance from NHMRC’s FOI Unit
to revise your request. If you would like to discuss your request with NHMRC over the phone, the
FOI Unit is happy to call you, or please feel free to call them on (02) 6217 9000. Alternatively,
NHMRC can discuss your request via email if you prefer.
Power to refuse request
Section 24 of the FOI Act provides that if NHMRC is satisfied that a practical refusal reason
exists in relation to a request, NHMRC must undertake a consultation process with you. If, after
that consultation process, NHMRC remains satisfied that the practical refusal reason still exists,
NHMRC may refuse access to the documents subject to the request.
Practical refusal
A practical refusal reason exists if either (or both) of the following applies:
(a) the work involved in the processing of the request would substantially and
unreasonably divert the resources of the agency from its other operations
(b) the request does not satisfy the requirement in section 15(2)(b) of the FOI Act, which
requires you to provide such information concerning the document you are seeking
access to, to enable the agency to be able to identify it.
Reasons for practical refusal
The work involved in processing the request – section 24AA(1)(a) of the FOI Act
I believe that the work involved in processing your request in its current form would
substantially and unreasonably divert the resources of this agency from its other operations due
to the broad scope of your request.
The FOI Act gives any person the right to request access to copies of documents held by an
agency (s11(1)). In processing a request for documents, I must have regard to the resources
required to perform the following activities (specified in s24AA(2) of the FOI Act):
• identifying, locating or collating documents within the filing system of the agency
• examining the documents to consider whether they relate to the request
• deciding whether to grant, refuse or defer access
• consulting with other parties
• redacting exempt material from the documents
• making copies of documents
• notifying an interim or final decision to the applicant.
2
link to page 3 link to page 3
NHMRC conducted a search of its electronic files and email mailboxes within the agency, to find
any documents that may be relevant to your request. The key search terms used were
[‘Department of Veterans' Affairs’, ‘Department of Veterans Affairs’ and ‘DVA’]. As your
request specified documents
over the last ten years, we also included a date range of
14 December 2014–14 December 2024. I note these are general search terms that have been
used due to the broad nature of your request.
We have tried to refine the search by excluding documents that do not fall within the scope of
your request. This search has identified 72,381 documents which potentially fall within the scope
of your request. Of these 72,381 documents, we have tried further refining. For example, using
the following terms that relate to some aspects of your request:
• ‘client information’, which found 1,143 documents
• ‘client data’, which found 763 documents
• ‘data sharing’, which found 3,980 documents
• ‘data transfer’, which found 1,011 documents
• ‘data collection’, which found 18,225 documents
• ‘personal information’, which found 8,959 documents.
Please note that although these documents may mention the DVA agency name as well as the
above search terms, they may still not be relevant to the scope of your request. For example, the
search has brought up job applications and recruitment information for people seeking
employment with NHMRC. As explained below, NHMRC does not conduct health and medical
research itself and does not seek personal information about participants in the research that it
funds (see information about NHMRC’s role in the below ‘Request consultation process’ section).
We would need to review the total 72,381 documents (initially found) to ensure that we consider
all information that may be relevant to the scope of your request.
I have applied an estimated review time of 2 minutes per document to confirm whether the
document is in scope of your request, identify any duplicates, examine whether any
exemptions1
and/or
conditional exemptions2 apply under the FOI Act and record the reasons for applying
any exemption/s. This would result in a process time for this FOI request of 2,413 hours, or the
equivalent of around 322 days of work.
Further time may be required for NHMRC to perform any relevant redactions and create/secure
the PDF document. In addition, NHMRC has not yet assessed if it would be required to consult
with third parties affected by the potential release of the documents. These activities would add
considerably to the above estimate of time required to meet the request in its current form.
In determining an unreasonable diversion of resources, I have taken into account the number of
hours which would be required to process your FOI request and the staffing and resources of
NHMRC; a small agency of around 220 staff, of which only a small team of officers have
specialist knowledge on the relevant subject matter. In my view, undertaking your request as it
stands would divert resources and adversely affect the ability of the team to perform their other
functions properly. My responsibilities require me to be mindful of these matters when
considering your request.
Request consultation process
I invite you to submit a revised request with a reduced scope to enable it to proceed. By
focussing your request on information that you are more interested in, NHMRC may be able to
pinpoint the documents more quickly and avoid using excessive resources to process
documents that you are less interested in.
1 URL:
https://www.oaic.gov.au/freedom-of-information/freedom-of-information-guidance-for-
government-agencies/foi-guidelines/part-5-exemptions 2 URL:
https://www.oaic.gov.au/freedom-of-information/freedom-of-information-guidance-for-
government-agencies/foi-guidelines/part-6-conditional-exemptions
3
link to page 4 link to page 4 link to page 4
I have provided the below information to give some background and context about NHMRC’s
role, which may assist in considering the scope of your request.
As the Australian Government’s lead agency for funding health and medical research, NHMRC
invests in the creation of new knowledge about the origins, prevention, diagnosis, and treatment
of disease, drives the translation of health and medical research into evidence-based health
practice and policy, and provides guidance on responsible research practices and ethical issues
that foster the highest standard of ethics, quality and integrity in health and medical research.
NHMRC provides funding to support high quality health and medical research though its grant
funding program; it does not itself conduct research. NHMRC grant funding is awarded through
Administering Institutions3 (AIs), which include universities, hospitals and medical research
institutes that meet defined research governance requirements. DVA is not an NHMRC AI. Given
its role, NHMRC does not seek to collect, store, or share personal information, health or medical
records about participants in the research that it funds. NHMRC does not have a data-sharing
memorandum of understanding or service-level agreement in place with the DVA. In terms of
ethics committee documentation, NHMRC does not have a Human Research Ethics Committee
(HREC) which reviews research proposals involving human participants to ensure that they meet
ethical standards and guidelines (NHMRC administers a
registration scheme4 for organisations
that have HRECs). Further information about NHMRC is available on our
website5.
As stated above, the consultation period runs for 14 days and starts on the day after you receive
this notice. In this time, you must do one of the following, in writing:
1. make a further revised request – that is, make a request with a reduced scope
2. withdraw your request
3. advise that you do not wish to change your current request.
If you revise your request in a way that adequately addresses the practical refusal grounds
outlined above, we will recommence processing it.
If you do not do one of the 3 things listed above during the consultation period, your request
will be taken to have been withdrawn.
Timeframe for processing your request
Your request was received by NHMRC via email on 14 December 2024. The statutory timeframe
for processing a request is 30 days, starting from the day after the day on which your
application was received. Accordingly, the due date for a decision on your request is
13 January 2025. However, once this letter is sent to you, the period stops until you respond with
your advice on how the access request will proceed as per the 3 options outlined above, or the
14-day response period concludes (whichever is shortest).
I note that your request of 14 December 2024 specified that you
do not consent to any
extension of time due to internal reduced activity periods, holiday stand-down periods, or other
internal operational issues. If [Authority name] considers that it cannot meet the 30-day
timeframe, it may seek an extension from the Office of the Australian Information Commissioner
as provided under section 15AB of the FOI Act. I request to be notified if such an application is
made.
NHMRC intends to seek an extension from OAIC under s15AB of the FOI Act, to allow further
time for consulting with you about the scope of your request and then processing it accordingly.
3 URL:
https://www.nhmrc.gov.au/funding/manage-your-funding/nhmrc-funding/administering-institutions 4 URL:
https://www.nhmrc.gov.au/research-policy/ethics/human-research-ethics-committees 5 URL:
https://www.nhmrc.gov.au/
4
Contact
If you have any queries or would like to discuss your request, please contact me via NHMRC’s
FOI Unit by email a
t xxx@xxxxx.xxx.xx or by phone on (02) 6217 9000.
Yours sincerely
Signed electronically Prue Torrance
General Manager
10 January 2025
5
