Documents Relating to the Sharing of DVA Client Information
Dear FOI Officer,
I am making this request for access to documents under the Freedom of Information Act 1982 (Cth).
I seek access to any and all documents, records, data, and supporting material held by [Name of Agency] concerning the sharing of personal information originating from the Department of Veterans’ Affairs (DVA) over the last ten years. This includes any data transfers from or to the DVA, whether they were one-off exchanges or ongoing, systematic transfers of DVA client information, including personal, medical, financial, or service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA client information [Authority name] has received or accessed and for what purposes. Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name], including but not limited to memoranda of understanding, service-level agreements, emails, letters, meeting minutes, file transfer logs, internal reports, and instructions that outline what data was shared, when it was shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how [Authority name] requests, obtains, stores, handles, or uses DVA client information. This includes documents that detail the criteria for approving access to such data, any consent or authorization processes, security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments, internal review board decisions, or other documents that reflect deliberations or authorizations for obtaining DVA client information. This includes records that show the agency considered the ethical, legal, or privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the DVA client data, such as project proposals, business cases, internal strategy papers, or briefings that explain why [Authority name] sought access to this information, how it was intended to be integrated into the agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of the data or data fields received, so long as providing this sample does not breach any exemption under the FOI Act. The purpose is to understand the nature and granularity of the information shared, without disclosing identifiable personal details.
If the only data [Authority name] received pertains solely to data linked to the Centrelink Confirmation eServices (CCeS) arrangements as described at https://www.servicesaustralia.gov.au/cen..., and there were no other forms of DVA data shared, then no CCeS-related data needs to be provided under this request.
I emphasize that I am not authorizing the transfer of this FOI request to the Department of Veterans’ Affairs or any other agency. If [Authority name] holds the requested information, it should provide it directly. If there are parts of this request that [Name of Agency] does not understand or believes are not held, I invite you to contact me to clarify or refine the scope under section 24AB of the FOI Act, rather than initiating a transfer. However, I do not consent to the transfer of this request to another entity. The FOI Act places the onus on agencies to process requests for documents they hold, and I expect [Authority name] to meet its responsibilities in this regard.
I note that the statutory timeframe for processing FOI requests is 30 days from the date of receipt. I do not consent to any extension of time due to internal reduced activity periods, holiday stand-down periods, or other internal operational issues. If [Authority name] considers that it cannot meet the 30-day timeframe, it may seek an extension from the Office of the Australian Information Commissioner as provided under section 15AB of the FOI Act. I request to be notified if such an application is made.
If you consider any part of this request too broad or complex, please contact me promptly to discuss refining its scope. I remain willing to consider adjustments that will assist efficient processing, provided that they occur within the statutory timeframe and do not undermine the substance of what I am seeking.
I believe that disclosure of these documents is in the public interest, as it promotes transparency and accountability in how government agencies access and use sensitive personal information about veterans. Should you consider charges applicable, I request that you exercise your discretion to reduce or waive them, given the importance of the matter and its alignment with the principles of open government and public accountability.
I look forward to receiving your acknowledgment and decision within the statutory timeframe. Please contact me at the details below if you require further clarification.
Yours sincerely,
Nosey
Dear Nosey
Re - Freedom of Information Request: No. 2024/25-007
I refer to your request to the National Health and Medical Research
Council (NHMRC) under the Freedom of Information Act 1982 (Cth) (FOI Act)
seeking:
I seek access to any and all documents, records, data, and supporting
material held by [Name of Agency] concerning the sharing of personal
information originating from the Department of Veterans’ Affairs (DVA)
over the last ten years. This includes any data transfers from or to the
DVA, whether they were one-off exchanges or ongoing, systematic transfers
of DVA client information, including personal, medical, financial, or
service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA
client information [Authority name] has received or accessed and for what
purposes. Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name],
including but not limited to memoranda of understanding, service-level
agreements, emails, letters, meeting minutes, file transfer logs, internal
reports, and instructions that outline what data was shared, when it was
shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how
[Authority name] requests, obtains, stores, handles, or uses DVA client
information. This includes documents that detail the criteria for
approving access to such data, any consent or authorization processes,
security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments,
internal review board decisions, or other documents that reflect
deliberations or authorizations for obtaining DVA client information. This
includes records that show the agency considered the ethical, legal, or
privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the
DVA client data, such as project proposals, business cases, internal
strategy papers, or briefings that explain why [Authority name] sought
access to this information, how it was intended to be integrated into the
agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of
the data or data fields received, so long as providing this sample does
not breach any exemption under the FOI Act. The purpose is to understand
the nature and granularity of the information shared, without disclosing
identifiable personal details.
If the only data [Authority name] received pertains solely to data linked
to the Centrelink Confirmation eServices (CCeS) arrangements as described
at
[1]https://aus01.safelinks.protection.outlo...,
and there were no other forms of DVA data shared, then no CCeS-related
data needs to be provided under this request.
I also note your advice that: I emphasize that I am not authorizing the
transfer of this FOI request to the Department of Veterans’ Affairs or any
other agency. If [Authority name] holds the requested information, it
should provide it directly. If there are parts of this request that [Name
of Agency] does not understand or believes are not held, I invite you to
contact me to clarify or refine the scope under section 24AB of the FOI
Act, rather than initiating a transfer. However, I do not consent to the
transfer of this request to another entity. The FOI Act places the onus on
agencies to process requests for documents they hold, and I expect
[Authority name] to meet its responsibilities in this regard.
Please see the below information about the processing of your FOI request.
Timeframe for receiving your decision – seeking an extension
The statutory timeframe for processing a request is 30 days, starting from
the day after the day on which your application was received. Therefore,
the due date for a decision on your request is Monday 13 January 2025.
The NHMRC office will be closed from 25 December 2024 to 1 January 2025
(inclusive), which will impact on the processing period. However, I note
that you advised in your email request that: I do not consent to any
extension of time due to internal reduced activity periods, holiday
stand-down periods, or other internal operational issues. If [Authority
name] considers that it cannot meet the 30-day timeframe, it may seek an
extension from the Office of the Australian Information Commissioner as
provided under section 15AB of the FOI Act. I request to be notified if
such an application is made.
Separate from any agreed extension, please note that the overall timeframe
could be extended further if charges are levied and/or if we need to
consult with third parties (see below).
Charges
Agencies may decide that an applicant is liable to pay a charge in respect
of a request for access to documents. These charges are set by the Freedom
of Information (Charges) Regulations 2019 and are for search and retrieval
of documents, decision making and provision of access (for example,
copying and postage).
If NHMRC decides to charge you in respect of this FOI request, we will
send you a preliminary assessment of the charges as soon as possible
following retrieval of any documents that may be relevant to your
request.
Consultation with third parties
NHMRC may be required under the FOI Act to consult other parties (third
parties) where information relating to third parties arises in documents
sought by your request. The FOI Act prescribes a further 30 days
processing time for NHMRC to undertake this consultation. You will be
advised as soon as possible of any requirement to consult with a third
party.
Disclosure log
Please note that section 11C of the FOI Act requires agencies to disclose
documents released under the FOI Act in a disclosure log, which is made
publicly available. There are exceptions to this requirement, such as
where release of the documents or parts of them would involve the
unreasonable disclosure of your or another person’s personal or business
information. You may choose to express a view on this issue and to
identify personal or business information that in your view would be
unreasonable to publish. However, you should be aware that section 11C of
the FOI Act embodies a pro-disclosure policy which agencies are required
to follow, subject to any exceptions provided for under the FOI Act.
If you have any queries throughout the process, please contact the FOI
office at: [2][NHMRC request email]
Kind regards
Marion
Dear Nosey
Re - Freedom of Information Request: No. 2024/25-007
Please see the attached correspondence in relation to your FOI Request.
Please note that your response to the attached correspondence is due by
close of business Friday 24 January 2025.
If you would like to discuss your request with NHMRC, please feel free to
call us on (02) 6217 9000. Or we are happy to call you. Alternatively, we
can discuss via email if you prefer.
Kind regards
Kate
____________________________________________________
NHMRC Freedom of Information
National Health & Medical Research Council
[1][NHMRC request email]
+61 (0) 2 6217 9000
[2]nhmrc.gov.au
In the spirit of reconciliation, NHMRC acknowledges the Traditional
Custodians of country throughout Australia and their connections to land,
sea and community. We pay our respects to their Elders past and present
and extend that respect to all Aboriginal and Torres Strait Islander
people.
From: NHMRC FOI <[NHMRC request email]>
Sent: Tuesday, 24 December 2024 11:44 AM
To: [FOI #12612 email]
Cc: NHMRC FOI <[NHMRC request email]>
Subject: FOI Request No. 2024/25-007 [SEC=OFFICIAL]
Dear Nosey
Re - Freedom of Information Request: No. 2024/25-007
I refer to your request to the National Health and Medical Research
Council (NHMRC) under the Freedom of Information Act 1982 (Cth) (FOI Act)
seeking:
I seek access to any and all documents, records, data, and supporting
material held by [Name of Agency] concerning the sharing of personal
information originating from the Department of Veterans’ Affairs (DVA)
over the last ten years. This includes any data transfers from or to the
DVA, whether they were one-off exchanges or ongoing, systematic transfers
of DVA client information, including personal, medical, financial, or
service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA
client information [Authority name] has received or accessed and for what
purposes. Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name],
including but not limited to memoranda of understanding, service-level
agreements, emails, letters, meeting minutes, file transfer logs, internal
reports, and instructions that outline what data was shared, when it was
shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how
[Authority name] requests, obtains, stores, handles, or uses DVA client
information. This includes documents that detail the criteria for
approving access to such data, any consent or authorization processes,
security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments,
internal review board decisions, or other documents that reflect
deliberations or authorizations for obtaining DVA client information. This
includes records that show the agency considered the ethical, legal, or
privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the
DVA client data, such as project proposals, business cases, internal
strategy papers, or briefings that explain why [Authority name] sought
access to this information, how it was intended to be integrated into the
agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of
the data or data fields received, so long as providing this sample does
not breach any exemption under the FOI Act. The purpose is to understand
the nature and granularity of the information shared, without disclosing
identifiable personal details.
If the only data [Authority name] received pertains solely to data linked
to the Centrelink Confirmation eServices (CCeS) arrangements as described
at
[3]https://aus01.safelinks.protection.outlo...,
and there were no other forms of DVA data shared, then no CCeS-related
data needs to be provided under this request.
I also note your advice that: I emphasize that I am not authorizing the
transfer of this FOI request to the Department of Veterans’ Affairs or any
other agency. If [Authority name] holds the requested information, it
should provide it directly. If there are parts of this request that [Name
of Agency] does not understand or believes are not held, I invite you to
contact me to clarify or refine the scope under section 24AB of the FOI
Act, rather than initiating a transfer. However, I do not consent to the
transfer of this request to another entity. The FOI Act places the onus on
agencies to process requests for documents they hold, and I expect
[Authority name] to meet its responsibilities in this regard.
Please see the below information about the processing of your FOI request.
Timeframe for receiving your decision – seeking an extension
The statutory timeframe for processing a request is 30 days, starting from
the day after the day on which your application was received. Therefore,
the due date for a decision on your request is Monday 13 January 2025.
The NHMRC office will be closed from 25 December 2024 to 1 January 2025
(inclusive), which will impact on the processing period. However, I note
that you advised in your email request that: I do not consent to any
extension of time due to internal reduced activity periods, holiday
stand-down periods, or other internal operational issues. If [Authority
name] considers that it cannot meet the 30-day timeframe, it may seek an
extension from the Office of the Australian Information Commissioner as
provided under section 15AB of the FOI Act. I request to be notified if
such an application is made.
Separate from any agreed extension, please note that the overall timeframe
could be extended further if charges are levied and/or if we need to
consult with third parties (see below).
Charges
Agencies may decide that an applicant is liable to pay a charge in respect
of a request for access to documents. These charges are set by the Freedom
of Information (Charges) Regulations 2019 and are for search and retrieval
of documents, decision making and provision of access (for example,
copying and postage).
If NHMRC decides to charge you in respect of this FOI request, we will
send you a preliminary assessment of the charges as soon as possible
following retrieval of any documents that may be relevant to your
request.
Consultation with third parties
NHMRC may be required under the FOI Act to consult other parties (third
parties) where information relating to third parties arises in documents
sought by your request. The FOI Act prescribes a further 30 days
processing time for NHMRC to undertake this consultation. You will be
advised as soon as possible of any requirement to consult with a third
party.
Disclosure log
Please note that section 11C of the FOI Act requires agencies to disclose
documents released under the FOI Act in a disclosure log, which is made
publicly available. There are exceptions to this requirement, such as
where release of the documents or parts of them would involve the
unreasonable disclosure of your or another person’s personal or business
information. You may choose to express a view on this issue and to
identify personal or business information that in your view would be
unreasonable to publish. However, you should be aware that section 11C of
the FOI Act embodies a pro-disclosure policy which agencies are required
to follow, subject to any exceptions provided for under the FOI Act.
If you have any queries throughout the process, please contact the FOI
office at: [4][NHMRC request email]
Kind regards
Marion
Hey Pru
I hope this message finds you well.
Thank you for your correspondence regarding my FOI request, FOI 481/24/25. I understand that you have raised concerns regarding the potential diversion of resources due to the scope of my request, and I appreciate the opportunity to revise the request.
However, I would like to bring to your attention that the scope of my request is not unprecedented, and similar requests have been successfully processed by other agencies, including Services Australia, in the past. For example, in the matter of RQ24/05743 involving Services Australia, the Office of the Australian Information Commissioner (OAIC) determined that a similarly broad request concerning information sharing could be processed without invoking practical refusal grounds under section 24AA of the Freedom of Information Act 1982 (Cth) (FOI Act). In this instance, the OAIC determined that the request, while involving significant work, did not amount to an unreasonable diversion of agency resources.
It is reasonable to expect consistency in how FOI requests are handled across agencies, particularly when similar requests with comparable or broader scopes have been processed successfully in the past. As outlined in section 24AA of the FOI Act, practical refusal grounds must demonstrate that processing a request would "substantially and unreasonably divert the resources" of the agency, and based on previous decisions such as the Services Australia case, this threshold has not been met in cases of similar scope.
That said, I am willing to cooperate in refining the request to ensure that the resources required to process it are within reasonable limits. If needed, I can consider narrowing the request, such as limiting it to specific types of documents or a defined timeframe. I would appreciate your guidance on how best to revise the request in a manner that addresses the practical refusal reason without unnecessarily reducing the scope of the request.
I look forward to your response and to proceeding with the consultation process under section 24AB of the FOI Act. Please do not hesitate to contact me if you require further clarification or suggestions for narrowing the request.
Thank you for your attention to this matter.
Sincerely,
Nosey Rosey
Dear Nosey
Re: Freedom of Information Request No. 2024/25-007 – Request consultation
Thank you for providing the below response on 11 January 2025.
I note from your response that you are willing to consider narrowing the
scope of your FOI request, such as limiting it to specific types of
documents or a defined timeframe. I also note that you have asked for
NHMRC’s guidance on how best to revise the request in a manner that
addresses the practical refusal reason without unnecessarily reducing the
scope of the request.
Revising your FOI request
NHMRC has considered your request for guidance and offers some examples
below of how you may wish to revise the scope of your FOI request.
However, please note that even if you revise your FOI request in a way
that adequately addresses the practical refusal reason and NHMRC resumes
processing it, we cannot guarantee that NHMRC holds any relevant
documents. This is due to NHMRC not conducting health and medical research
itself, and not seeking personal information about participants in the
research that it funds. Further information about NHMRC is outlined in its
Request Consultation letter to you on 10 January 2025.
If you wish to proceed with your FOI request, you could consider focussing
on certain elements of it. For example:
· MOUs, contracts or service level agreements between NHMRC and the
DVA governing the provision of personal information about DVA clients (see
definition of ‘DVA clients’ below) from DVA to NHMRC
· NHMRC policies or guidelines about how NHMRC manages DVA client
information that is provided from DVA to NHMRC
· Privacy Impact Assessments conducted by NHMRC related to personal
information about DVA clients.
You could also consider reducing the timeframe, for example, to the last 5
years (i.e., 14 December 2019–14 December 2024).
For the definition of ‘DVA clients’, NHMRC has interpreted this to be:
‘personal, medical, financial, or service-related details concerning
veterans or their dependents’ (as mentioned in your FOI request of 14
December 2024).
Timeframe for processing your request
As advised in NHMRC’s Request Consultation letter of 10 January 2025, the
timeframe for processing your FOI request stopped once the letter was sent
to you. As your response of 11 January 2025 did not provide a revised
request under section 24AB of the FOI Act, the request consultation
process is still underway.
The timeframe continues to be stopped until you respond with your advice
on how the FOI request will proceed as per section 24AB(6) of the FOI Act
(i.e., make a revised request, withdraw your request, indicate that you do
not wish to revise the request), or the 14-day response period concludes
(whichever is shortest). NHMRC also intends to seek an extension from OAIC
under s15AB of the FOI Act.
Please provide a response by close of business Wednesday 22 January 2025.
You are welcome to seek assistance from NHMRC’s FOI Unit to revise your
request. If you would like to discuss your request with NHMRC over the
phone, the FOI Unit is happy to call you, or please feel free to call them
on (02) 6217 9000. Alternatively, NHMRC can discuss your request via email
if you prefer.
Kind regards
Kate
____________________________________________________
NHMRC Freedom of Information
National Health & Medical Research Council
[1][NHMRC request email]
+61 (0) 2 6217 9000
[2]nhmrc.gov.au
In the spirit of reconciliation, NHMRC acknowledges the Traditional
Custodians of country throughout Australia and their connections to land,
sea and community. We pay our respects to their Elders past and present
and extend that respect to all Aboriginal and Torres Strait Islander
people.
Dear Kate,
Thank you for your email dated 17 January 2025 and for providing guidance on how to revise the scope of my FOI request. I appreciate NHMRC’s assistance in helping to refine the request to address practical refusal concerns.
After reviewing your suggestions, I would like to revise the scope of my request as follows:
Timeframe: I am limiting the request to documents from the past 5 years (14 December 2019–14 December 2024).
Document Categories: I request access to the following specific types of documents:
MOUs, contracts, or service-level agreements between NHMRC and DVA governing the provision of personal information about DVA clients.
NHMRC policies or guidelines on managing DVA client information provided from DVA.
Privacy Impact Assessments conducted by NHMRC related to personal information about DVA clients.
I hope these adjustments address the practical refusal concerns raised while retaining the substance of my original request. Please proceed with processing the revised request, and let me know if any further clarification is required.
Thank you for your time and assistance.
Kind regards,
Nosey Rosey
Dear Nosey
Re: Freedom of Information Request No. 2024/25-007 – Revised scope
Thank you for responding to NHMRC’s email of 17 January 2025.
NHMRC acknowledges that you have revised the scope of your request, and
you are now seeking:
Timeframe: I am limiting the request to documents from the past 5 years
(14 December 2019–14 December 2024).
Document Categories: I request access to the following specific types of
documents:
o MOUs, contracts, or service-level agreements between NHMRC and DVA
governing the provision of personal information about DVA clients.
o NHMRC policies or guidelines on managing DVA client information
provided from DVA.
o Privacy Impact Assessments conducted by NHMRC related to personal
information about DVA clients.
We will process your request accordingly.
Please note that the request consultation period ended when you made your
below revised request to NHMRC on 19 January 2025.
Today (22 January 2025), NHMRC will seek a 30-day extension from the
Office of the Australian Information Commissioner (OAIC) under s15AB of
the FOI Act, to allow NHMRC time to process your revised request.
If you have any queries, please contact the FOI Unit by email at
[1][NHMRC request email], or by phone on (02) 6217 9000.
Kind regards
Kate
____________________________________________________
NHMRC Freedom of Information
National Health & Medical Research Council
[2][NHMRC request email]
+61 (0) 2 6217 9000
[3]nhmrc.gov.au
In the spirit of reconciliation, NHMRC acknowledges the Traditional
Custodians of country throughout Australia and their connections to land,
sea and community. We pay our respects to their Elders past and present
and extend that respect to all Aboriginal and Torres Strait Islander
people.
Our reference: RQ25/00427
Agency reference: FOI 2024/25-007
Agency name National Health and Medical Research Council
By Email: [NHMRC request email]
Name Nosey Rosey
By Email:
[FOI #12612 email]
Extension of time under s 15AB
Dear Parties,
Please find attached an extension of time decision relating to the above
referenced FOI request.
Regards,
[1][IMG] Andriana DeIeso
Review Adviser
Office of the Australian Information Commissioner
GPO Box 5288 Sydney NSW 2001
E [2][email address]
I am available Tuesday and Wednesday.
Please note: The OAIC has revised its IC review procedures from 1 July
2024. For more information about these revised procedures, including new
resources to assist applicants and respondents, see our webpage:
[3]Information Commissioner reviews | OAIC
The OAIC acknowledges Traditional Custodians of Country across
Australia and their continuing connection to land, waters and
communities. We pay our respect to First Nations people,
cultures and Elders past and present.
[4]Subscribe to Information Matters
Notice:
The information contained in this email message and any attached files may
be confidential information, and may also be the subject of legal
professional privilege. If you are not the intended recipient any use,
disclosure or copying of this email is unauthorised. If you received this
email in error, please notify the sender by contacting the department's
switchboard on 1300 488 064 during business hours (8:30am - 5pm Canberra
time) and delete all copies of this transmission together with any
attachments.
References
Visible links
1. https://www.oaic.gov.au/
2. mailto:[email address]
3. https://www.oaic.gov.au/freedom-of-infor...
4. https://www.oaic.gov.au/engage-with-us/n...
noseyrosey left an annotation ()
Timeline:
Request Submitted: 14 December 2024
The statutory 30-day timeframe began on 15 December 2024.
Original Deadline: 13 January 2025
The 30-day clock was paused when the section 24AB consultation notice was issued on 10 January 2025, with 25 days elapsed and 5 days remaining.
Your Response to Consultation: 11 January 2025
The statutory clock resumed immediately on this date.
Remaining Time:
With 5 days remaining, the new decision deadline is 16 January 2025.