Our reference: FOIREQ24/00651
Nosey Rosey
By email: xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Nosey Rosey
Freedom of Information Request – FOIREQ24/00651
I refer to your request for access to documents made under the
Freedom of Information Act
1982 (Cth) (the FOI Act). Your Freedom of Information (FOI request) was received by the
Office of the Australian Commissioner (OAIC) on 14 December 2024.
I am writing to consult with you on the basis that you request gives rise to a practical
refusal reason.
Background
Scope of your request
Your FOI request sought access to the following information:
I seek access to any and al documents, records, data, and supporting material held
by [Name of Agency] concerning the sharing of personal information originating from
the Department of Veterans’ Affairs (DVA) over the last ten years. This includes any
data transfers from or to the DVA, whether they were one-off exchanges or ongoing,
systematic transfers of DVA client information, including personal, medical, financial,
or service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA client
information [Authority name] has received or accessed and for what purposes.
Specifical y, I request:
Al records of data sharing arrangements between DVA and [Authority name],
including but not limited to memoranda of understanding, service-level agreements,
emails, letters, meeting minutes, file transfer logs, internal reports, and instructions
that outline what data was shared, when it was shared, and the format or system
used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how [Authority
name] requests, obtains, stores, handles, or uses DVA client information. This
includes documents that detail the criteria for approving access to such data, any
consent or authorization processes, security controls, and retention or destruction
policies.
Copies of any ethics committee approvals, privacy impact assessments, internal
review board decisions, or other documents that reflect deliberations or
authorizations for obtaining DVA client information. This includes records that show
the agency considered the ethical, legal, or privacy implications of receiving or using
DVA client data.
Documents that outline the intended uses or practical applications of the DVA client
data, such as project proposals, business cases, internal strategy papers, or briefings
that explain why [Authority name] sought access to this information, how it was
intended to be integrated into the agency’s operations, and any expected outcomes
or benefits.
A representative sample (in a suitably de-identified or redacted form) of the data or
data fields received, so long as providing this sample does not breach any exemption
under the FOI Act. The purpose is to understand the nature and granularity of the
information shared, without disclosing identifiable personal details.
If the only data [Authority name] received pertains solely to data linked to the
Centrelink Confirmation eServices (CCeS) arrangements as described at
https://www.servicesaustralia.gov.au/centrelink-confirmation-eservices-cces, and
there were no other forms of DVA data shared, then no CCeS-related data needs to be
provided under this request.
I emphasize that I am not authorizing the transfer of this FOI request to the
Department of Veterans’ Affairs or any other agency. If [Authority name] holds the
requested information, it should provide it directly. If there are parts of this request
that [Name of Agency] does not understand or believes are not held, I invite you to
contact me to clarify or refine the scope under section 24AB of the FOI Act, rather than
initiating a transfer. However, I do not consent to the transfer of this request to
another entity. The FOI Act places the onus on agencies to process requests for
documents they hold, and I expect [Authority name] to meet its responsibilities in this
regard.
Following consultation with you on the scope of your request, on 30 December 2024 you
provided the following clarification:
Exclusivity to DVA
My request pertains specifical y to documents relating to data sharing or transfers
involving the Department of Veterans’ Affairs (DVA) and the OAIC. It does not include
general information that applies broadly to other agencies.
Particular Client Information
The request does not seek access to any specific individual client information.
Instead, it focuses on systematic or broad data-sharing arrangements and
governance frameworks involving DVA client information.
Data Fields
The reference to "data fields" in my request relates to a de-identified or redacted
sample of the types of data shared between DVA and the OAIC. Examples might
include categories such as name, service status, medical details, or financial
information if applicable to shared datasets.
Timeframe
The timeframe for my request is the last ten years (14 December 2014 to 14 December
2024). I am not limiting this to current policies or procedures.
Specific Documents
While I do not have specific documents in mind, I am seeking any relevant:
MOUs or agreements governing data sharing with DVA, Policies or guidelines for
managing DVA client information, Privacy or impact assessments related to such
data, and Internal reports or evaluations outlining the purpose or implications of
receiving DVA client data.
Exclusions
I confirm that the following may be excluded to streamline processing:
Duplicate documents or earlier parts of email chains captured in later
correspondence, Individual-level complaint records or files.
Notice of intention to refuse your request
I am an officer authorised under s 23(1) of the FOI Act to make FOI decisions on behalf of
the OAIC.
I am writing to consult with you under section 24AB of the FOI Act, because:
• I believe that the work involved in processing your request wil substantially and
unreasonably divert the resources of the OAIC from its other operations due to its
size and scope (s 24AA(1)(a)(i)); and
• I cannot sufficiently identify the documents that you are requesting (s 24AA(1)(b)).
For the purposes of the FOI Act, these are called ‘practical refusal reasons’ (s 24AA(1)(a)(i)
of the FOI Act).
On this basis, I intend to your request for access to documents unless the terms of your
request are revised, so as to remove the practical refusal reasons.
However, before I proceed to a refusal decision, you have an opportunity to revise your
request again. This is cal ed a ‘request consultation process’ as set out under s 24AB of the
FOI Act. You have 14 days to respond to this notice in one of the ways set out at the end of
this letter.
Why I intend to refuse your request
Identification of request documents
For the purposes of s 24AA(1)(b), a practical refusal reason exists in relation to a request if
the request does not provide such information concerning the document as is reasonably
necessary for the OAIC to identify it as required by s 15(2)(b) of the FOI Act.
After considering the terms of your request, including the clarification you provided, and
undertaking internal consultation within the OAIC, I have formed the view that further
information is required to sufficiently identify and conduct searches for documents in
response to your request.
The request is broad and there are multiple instances where assumptions are required, I
consider that the process of trying to identify documents that may or may not be within
the scope of the request would be an unreasonable diversion of Agency resources.
Following internal consultation, we could not identify documents falling with scope of
your request for the following reasons:
• The request is multifaceted and requires a detailed analysis of any OAIC document
that is responsive to a reasonable search term in order to identify whether the
document or part of the document fal s within any part of the scope of the request.
We don’t consider that there are currently any reasonable search parameters that
could be used to identify documents within the request scope, while reducing the
number of documents outside of scope to a manageable number.
• The request is broad and potential y captures a wide range of instances where data
is shared between the OAIC and DVA across a 10-year period. Without a specific
time period, document category or matter type, there is no way for the OAIC to
target the searches required. Reasonable searches would therefore be required
across almost every function of the OAIC.
• Searches would be required across:
o the OAIC’s case management system - Resolve
o the OAIC’s document holding system – Content Manager
o OAIC’s email system – including archived accounts of staff no longer
employed by the OAIC, requiring specialist IT support
o general computer files
o paper files
• With DVA as the specific search term that could be used, these searches would be
required to be undertaken across the whole Agency. As the OAIC has an extensive
history working with the DVA or DVA related matters across its functions, there are
likely to be an unreasonable number of responsive documents that would require
manual review in order to identify whether the document falls within the scope of
your request.
As in indication of the breadth of these searches, a preliminary search using the
search term “DVA” in the OAIC case management system, Resolve, returned over
1000 files, all containing numerous, potential y relevant documents.
• The terms of your request are unclear as to whether you seek documents strictly
about an arrangement for sharing data with DVA or data sharing generally.
Calculation of the processing time – substantial diversion
Based on our initial assessment of your request, and the internal scoping that has been
undertaken, I estimate it will take the OAIC at least 200 hours to process your FOI request
in its current form.
I consider that the processing of your request would be a substantial diversion of the
OAIC’s resources, for the purposes of section 24AA(1)(a)(i) of the FOI Act.
Unreasonable diversion of resources
An estimate of processing time is only one of the considerations to be taken into account
when deciding whether a practical refusal reason exists. As well as requiring a request to
substantially divert an agency’s resources, s 24AA also requires the request to
unreasonably divert an agency’s resources from its other functions before it can be
refused under s 24.
The Guidelines issued by the Australian Information Commissioner under s 93A of the FOI
Act (FOI Guidelines) identify matters that may be relevant when deciding whether
processing the request will unreasonably divert an agency’s resources from its other
functions. These include:
• the staffing resources available to the OAIC for FOI processing
• the impact that processing the request may have on other tasks and functions of
the OAIC
• whether an applicant has cooperated in revising the scope of the request
• whether there is a significant public interest in the requested documents
• other steps taken by an agency or minister to publish information of the kind
requested by an applicant.
The OAIC is a small agency, employing approximately 160 (head count) staff. I consider
that processing a request of this size would substantially impact on the OAIC’s operations
because of the limited number of people the OAIC has available to process FOI requests of
this size and nature.
Processing a request of this size would substantially impact on the OAIC’s operations
because of the limited number of people the OAIC has available to process FOI requests.
Given the substantial amount of documents which fall within scope of your FOI request, it
is likely that line areas will also be asked to assist with conducting search and retrieval of
documents in this matter, resulting in staff being diverted from their other work in the
OAIC, including undertaking regulatory functions in both FOI and privacy along with
undertaking activities set out in the OAIC’s 2024/2025 Corporate Plan.
For these reasons I have formed the view that processing your request would substantially
impact the OAIC’s operations.
I also consider that the processing of your request would be an unreasonable diversion of
the OAIC’s resources.
Request consultation process
You now have an opportunity to revise your request so as to remove the practical refusal
reasons.
There are a number of ways that you can reduce the scope of your request so as to remove
the practical refusal reasons. These include limiting and/or further revising the scope of
your request by:
• narrowing the terms of your request to a document category (e.g. email
correspondence or internal briefing documents)
• identifying the type of data sharing you are interested in. For instance, the sharing
of data in relation to a privacy assessment or investigation. Or, the sharing of data,
when the OAIC undertakes it’s FOI review functions.
• further clarifying the kinds or types of information that you are seeking access to
• narrowing the scope of your request to communication between specific individual
staff members
• reducing the date range of your request
By way of assistance, we note that the OAIC makes available a range of documents on our
website, including our privacy policy and memorandums of understanding
We have also drafted the following revised scope for your consideration. While we
understand this revision may not capture all of the documents sought in your original
request, we consider that this revised scope provides an example of what what could be
considered a reasonable request to process:
Documents that outline what data sharing arrangements were in place between the
OAIC and the Department of Veteran’s Affairs (DVA) in the course of conducting privacy
complaint investigations under s 40 of the Privacy Act from date 1 July 2024 to present.
If you would like to proceed with the above revised scope of your request or proceed with
another revision of scope you should advise us in a reply email.
Before the end of the consultation period, you must do one of the following, in writing:
• withdraw your request
• make a revised request
• tel us that you do not wish to revise your request.
The consultation period runs for
14 days and starts on the day after you receive this
notice. Therefore, you must respond to this notice by 23 January 2025.
During this period, you can ask the contact person (see below) for help to revise your
request. If you revise your request in a way that adequately addresses the practical refusal
reasons outlined above, we will recommence processing it.
Please note that the time taken to consult you regarding the scope of your request is not
taken into account for the purposes of the 30 day time limit for processing your request.
If you do not do one of the three things listed above during the consultation period or you
do not consult the contact person during this period, your request will be taken to have
been withdrawn.
Contact officer
If you would like to revise your request, or have any questions, you can contact me at
xxx@xxxx.xxx.xx.
Yours sincerely,
Lachlan Smith-Marks
Governance, Risk and Compliance Officer (FOI)
9 January 2025
