Documents Relating to the Sharing of DVA Client Information
Dear FOI Officer,
I am making this request for access to documents under the Freedom of Information Act 1982 (Cth).
I seek access to any and all documents, records, data, and supporting material held by [Name of Agency] concerning the sharing of personal information originating from the Department of Veterans’ Affairs (DVA) over the last ten years. This includes any data transfers from or to the DVA, whether they were one-off exchanges or ongoing, systematic transfers of DVA client information, including personal, medical, financial, or service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA client information [Authority name] has received or accessed and for what purposes. Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name], including but not limited to memoranda of understanding, service-level agreements, emails, letters, meeting minutes, file transfer logs, internal reports, and instructions that outline what data was shared, when it was shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how [Authority name] requests, obtains, stores, handles, or uses DVA client information. This includes documents that detail the criteria for approving access to such data, any consent or authorization processes, security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments, internal review board decisions, or other documents that reflect deliberations or authorizations for obtaining DVA client information. This includes records that show the agency considered the ethical, legal, or privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the DVA client data, such as project proposals, business cases, internal strategy papers, or briefings that explain why [Authority name] sought access to this information, how it was intended to be integrated into the agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of the data or data fields received, so long as providing this sample does not breach any exemption under the FOI Act. The purpose is to understand the nature and granularity of the information shared, without disclosing identifiable personal details.
If the only data [Authority name] received pertains solely to data linked to the Centrelink Confirmation eServices (CCeS) arrangements as described at https://www.servicesaustralia.gov.au/cen..., and there were no other forms of DVA data shared, then no CCeS-related data needs to be provided under this request.
I emphasize that I am not authorizing the transfer of this FOI request to the Department of Veterans’ Affairs or any other agency. If [Authority name] holds the requested information, it should provide it directly. If there are parts of this request that [Name of Agency] does not understand or believes are not held, I invite you to contact me to clarify or refine the scope under section 24AB of the FOI Act, rather than initiating a transfer. However, I do not consent to the transfer of this request to another entity. The FOI Act places the onus on agencies to process requests for documents they hold, and I expect [Authority name] to meet its responsibilities in this regard.
I note that the statutory timeframe for processing FOI requests is 30 days from the date of receipt. I do not consent to any extension of time due to internal reduced activity periods, holiday stand-down periods, or other internal operational issues. If [Authority name] considers that it cannot meet the 30-day timeframe, it may seek an extension from the Office of the Australian Information Commissioner as provided under section 15AB of the FOI Act. I request to be notified if such an application is made.
If you consider any part of this request too broad or complex, please contact me promptly to discuss refining its scope. I remain willing to consider adjustments that will assist efficient processing, provided that they occur within the statutory timeframe and do not undermine the substance of what I am seeking.
I believe that disclosure of these documents is in the public interest, as it promotes transparency and accountability in how government agencies access and use sensitive personal information about veterans. Should you consider charges applicable, I request that you exercise your discretion to reduce or waive them, given the importance of the matter and its alignment with the principles of open government and public accountability.
I look forward to receiving your acknowledgment and decision within the statutory timeframe. Please contact me at the details below if you require further clarification.
Yours sincerely,
Nosey
Dear Nosey
Re - Freedom of Information Request: No. 2024/25-007
I refer to your request to the National Health and Medical Research
Council (NHMRC) under the Freedom of Information Act 1982 (Cth) (FOI Act)
seeking:
I seek access to any and all documents, records, data, and supporting
material held by [Name of Agency] concerning the sharing of personal
information originating from the Department of Veterans’ Affairs (DVA)
over the last ten years. This includes any data transfers from or to the
DVA, whether they were one-off exchanges or ongoing, systematic transfers
of DVA client information, including personal, medical, financial, or
service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA
client information [Authority name] has received or accessed and for what
purposes. Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name],
including but not limited to memoranda of understanding, service-level
agreements, emails, letters, meeting minutes, file transfer logs, internal
reports, and instructions that outline what data was shared, when it was
shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how
[Authority name] requests, obtains, stores, handles, or uses DVA client
information. This includes documents that detail the criteria for
approving access to such data, any consent or authorization processes,
security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments,
internal review board decisions, or other documents that reflect
deliberations or authorizations for obtaining DVA client information. This
includes records that show the agency considered the ethical, legal, or
privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the
DVA client data, such as project proposals, business cases, internal
strategy papers, or briefings that explain why [Authority name] sought
access to this information, how it was intended to be integrated into the
agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of
the data or data fields received, so long as providing this sample does
not breach any exemption under the FOI Act. The purpose is to understand
the nature and granularity of the information shared, without disclosing
identifiable personal details.
If the only data [Authority name] received pertains solely to data linked
to the Centrelink Confirmation eServices (CCeS) arrangements as described
at
[1]https://aus01.safelinks.protection.outlo...,
and there were no other forms of DVA data shared, then no CCeS-related
data needs to be provided under this request.
I also note your advice that: I emphasize that I am not authorizing the
transfer of this FOI request to the Department of Veterans’ Affairs or any
other agency. If [Authority name] holds the requested information, it
should provide it directly. If there are parts of this request that [Name
of Agency] does not understand or believes are not held, I invite you to
contact me to clarify or refine the scope under section 24AB of the FOI
Act, rather than initiating a transfer. However, I do not consent to the
transfer of this request to another entity. The FOI Act places the onus on
agencies to process requests for documents they hold, and I expect
[Authority name] to meet its responsibilities in this regard.
Please see the below information about the processing of your FOI request.
Timeframe for receiving your decision – seeking an extension
The statutory timeframe for processing a request is 30 days, starting from
the day after the day on which your application was received. Therefore,
the due date for a decision on your request is Monday 13 January 2025.
The NHMRC office will be closed from 25 December 2024 to 1 January 2025
(inclusive), which will impact on the processing period. However, I note
that you advised in your email request that: I do not consent to any
extension of time due to internal reduced activity periods, holiday
stand-down periods, or other internal operational issues. If [Authority
name] considers that it cannot meet the 30-day timeframe, it may seek an
extension from the Office of the Australian Information Commissioner as
provided under section 15AB of the FOI Act. I request to be notified if
such an application is made.
Separate from any agreed extension, please note that the overall timeframe
could be extended further if charges are levied and/or if we need to
consult with third parties (see below).
Charges
Agencies may decide that an applicant is liable to pay a charge in respect
of a request for access to documents. These charges are set by the Freedom
of Information (Charges) Regulations 2019 and are for search and retrieval
of documents, decision making and provision of access (for example,
copying and postage).
If NHMRC decides to charge you in respect of this FOI request, we will
send you a preliminary assessment of the charges as soon as possible
following retrieval of any documents that may be relevant to your
request.
Consultation with third parties
NHMRC may be required under the FOI Act to consult other parties (third
parties) where information relating to third parties arises in documents
sought by your request. The FOI Act prescribes a further 30 days
processing time for NHMRC to undertake this consultation. You will be
advised as soon as possible of any requirement to consult with a third
party.
Disclosure log
Please note that section 11C of the FOI Act requires agencies to disclose
documents released under the FOI Act in a disclosure log, which is made
publicly available. There are exceptions to this requirement, such as
where release of the documents or parts of them would involve the
unreasonable disclosure of your or another person’s personal or business
information. You may choose to express a view on this issue and to
identify personal or business information that in your view would be
unreasonable to publish. However, you should be aware that section 11C of
the FOI Act embodies a pro-disclosure policy which agencies are required
to follow, subject to any exceptions provided for under the FOI Act.
If you have any queries throughout the process, please contact the FOI
office at: [2][NHMRC request email]
Kind regards
Marion
Dear Nosey
Re - Freedom of Information Request: No. 2024/25-007
Please see the attached correspondence in relation to your FOI Request.
Please note that your response to the attached correspondence is due by
close of business Friday 24 January 2025.
If you would like to discuss your request with NHMRC, please feel free to
call us on (02) 6217 9000. Or we are happy to call you. Alternatively, we
can discuss via email if you prefer.
Kind regards
Kate
____________________________________________________
NHMRC Freedom of Information
National Health & Medical Research Council
[1][NHMRC request email]
+61 (0) 2 6217 9000
[2]nhmrc.gov.au
In the spirit of reconciliation, NHMRC acknowledges the Traditional
Custodians of country throughout Australia and their connections to land,
sea and community. We pay our respects to their Elders past and present
and extend that respect to all Aboriginal and Torres Strait Islander
people.
From: NHMRC FOI <[NHMRC request email]>
Sent: Tuesday, 24 December 2024 11:44 AM
To: [FOI #12612 email]
Cc: NHMRC FOI <[NHMRC request email]>
Subject: FOI Request No. 2024/25-007 [SEC=OFFICIAL]
Dear Nosey
Re - Freedom of Information Request: No. 2024/25-007
I refer to your request to the National Health and Medical Research
Council (NHMRC) under the Freedom of Information Act 1982 (Cth) (FOI Act)
seeking:
I seek access to any and all documents, records, data, and supporting
material held by [Name of Agency] concerning the sharing of personal
information originating from the Department of Veterans’ Affairs (DVA)
over the last ten years. This includes any data transfers from or to the
DVA, whether they were one-off exchanges or ongoing, systematic transfers
of DVA client information, including personal, medical, financial, or
service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA
client information [Authority name] has received or accessed and for what
purposes. Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name],
including but not limited to memoranda of understanding, service-level
agreements, emails, letters, meeting minutes, file transfer logs, internal
reports, and instructions that outline what data was shared, when it was
shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how
[Authority name] requests, obtains, stores, handles, or uses DVA client
information. This includes documents that detail the criteria for
approving access to such data, any consent or authorization processes,
security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments,
internal review board decisions, or other documents that reflect
deliberations or authorizations for obtaining DVA client information. This
includes records that show the agency considered the ethical, legal, or
privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the
DVA client data, such as project proposals, business cases, internal
strategy papers, or briefings that explain why [Authority name] sought
access to this information, how it was intended to be integrated into the
agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of
the data or data fields received, so long as providing this sample does
not breach any exemption under the FOI Act. The purpose is to understand
the nature and granularity of the information shared, without disclosing
identifiable personal details.
If the only data [Authority name] received pertains solely to data linked
to the Centrelink Confirmation eServices (CCeS) arrangements as described
at
[3]https://aus01.safelinks.protection.outlo...,
and there were no other forms of DVA data shared, then no CCeS-related
data needs to be provided under this request.
I also note your advice that: I emphasize that I am not authorizing the
transfer of this FOI request to the Department of Veterans’ Affairs or any
other agency. If [Authority name] holds the requested information, it
should provide it directly. If there are parts of this request that [Name
of Agency] does not understand or believes are not held, I invite you to
contact me to clarify or refine the scope under section 24AB of the FOI
Act, rather than initiating a transfer. However, I do not consent to the
transfer of this request to another entity. The FOI Act places the onus on
agencies to process requests for documents they hold, and I expect
[Authority name] to meet its responsibilities in this regard.
Please see the below information about the processing of your FOI request.
Timeframe for receiving your decision – seeking an extension
The statutory timeframe for processing a request is 30 days, starting from
the day after the day on which your application was received. Therefore,
the due date for a decision on your request is Monday 13 January 2025.
The NHMRC office will be closed from 25 December 2024 to 1 January 2025
(inclusive), which will impact on the processing period. However, I note
that you advised in your email request that: I do not consent to any
extension of time due to internal reduced activity periods, holiday
stand-down periods, or other internal operational issues. If [Authority
name] considers that it cannot meet the 30-day timeframe, it may seek an
extension from the Office of the Australian Information Commissioner as
provided under section 15AB of the FOI Act. I request to be notified if
such an application is made.
Separate from any agreed extension, please note that the overall timeframe
could be extended further if charges are levied and/or if we need to
consult with third parties (see below).
Charges
Agencies may decide that an applicant is liable to pay a charge in respect
of a request for access to documents. These charges are set by the Freedom
of Information (Charges) Regulations 2019 and are for search and retrieval
of documents, decision making and provision of access (for example,
copying and postage).
If NHMRC decides to charge you in respect of this FOI request, we will
send you a preliminary assessment of the charges as soon as possible
following retrieval of any documents that may be relevant to your
request.
Consultation with third parties
NHMRC may be required under the FOI Act to consult other parties (third
parties) where information relating to third parties arises in documents
sought by your request. The FOI Act prescribes a further 30 days
processing time for NHMRC to undertake this consultation. You will be
advised as soon as possible of any requirement to consult with a third
party.
Disclosure log
Please note that section 11C of the FOI Act requires agencies to disclose
documents released under the FOI Act in a disclosure log, which is made
publicly available. There are exceptions to this requirement, such as
where release of the documents or parts of them would involve the
unreasonable disclosure of your or another person’s personal or business
information. You may choose to express a view on this issue and to
identify personal or business information that in your view would be
unreasonable to publish. However, you should be aware that section 11C of
the FOI Act embodies a pro-disclosure policy which agencies are required
to follow, subject to any exceptions provided for under the FOI Act.
If you have any queries throughout the process, please contact the FOI
office at: [4][NHMRC request email]
Kind regards
Marion
Hey Pru
I hope this message finds you well.
Thank you for your correspondence regarding my FOI request, FOI 481/24/25. I understand that you have raised concerns regarding the potential diversion of resources due to the scope of my request, and I appreciate the opportunity to revise the request.
However, I would like to bring to your attention that the scope of my request is not unprecedented, and similar requests have been successfully processed by other agencies, including Services Australia, in the past. For example, in the matter of RQ24/05743 involving Services Australia, the Office of the Australian Information Commissioner (OAIC) determined that a similarly broad request concerning information sharing could be processed without invoking practical refusal grounds under section 24AA of the Freedom of Information Act 1982 (Cth) (FOI Act). In this instance, the OAIC determined that the request, while involving significant work, did not amount to an unreasonable diversion of agency resources.
It is reasonable to expect consistency in how FOI requests are handled across agencies, particularly when similar requests with comparable or broader scopes have been processed successfully in the past. As outlined in section 24AA of the FOI Act, practical refusal grounds must demonstrate that processing a request would "substantially and unreasonably divert the resources" of the agency, and based on previous decisions such as the Services Australia case, this threshold has not been met in cases of similar scope.
That said, I am willing to cooperate in refining the request to ensure that the resources required to process it are within reasonable limits. If needed, I can consider narrowing the request, such as limiting it to specific types of documents or a defined timeframe. I would appreciate your guidance on how best to revise the request in a manner that addresses the practical refusal reason without unnecessarily reducing the scope of the request.
I look forward to your response and to proceeding with the consultation process under section 24AB of the FOI Act. Please do not hesitate to contact me if you require further clarification or suggestions for narrowing the request.
Thank you for your attention to this matter.
Sincerely,
Nosey Rosey
noseyrosey left an annotation ()
Timeline:
Request Submitted: 14 December 2024
The statutory 30-day timeframe began on 15 December 2024.
Original Deadline: 13 January 2025
The 30-day clock was paused when the section 24AB consultation notice was issued on 10 January 2025, with 25 days elapsed and 5 days remaining.
Your Response to Consultation: 11 January 2025
The statutory clock resumed immediately on this date.
Remaining Time:
With 5 days remaining, the new decision deadline is 16 January 2025.