Documents Relating to the Sharing of DVA Client Information
Dear FOI Officer,
I am making this request for access to documents under the Freedom of Information Act 1982 (Cth).
I seek access to any and all documents, records, data, and supporting material held by [Name of Agency] concerning the sharing of personal information originating from the Department of Veterans’ Affairs (DVA) over the last ten years. This includes any data transfers from or to the DVA, whether they were one-off exchanges or ongoing, systematic transfers of DVA client information, including personal, medical, financial, or service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA client information [Authority name] has received or accessed and for what purposes. Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name], including but not limited to memoranda of understanding, service-level agreements, emails, letters, meeting minutes, file transfer logs, internal reports, and instructions that outline what data was shared, when it was shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how [Authority name] requests, obtains, stores, handles, or uses DVA client information. This includes documents that detail the criteria for approving access to such data, any consent or authorization processes, security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments, internal review board decisions, or other documents that reflect deliberations or authorizations for obtaining DVA client information. This includes records that show the agency considered the ethical, legal, or privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the DVA client data, such as project proposals, business cases, internal strategy papers, or briefings that explain why [Authority name] sought access to this information, how it was intended to be integrated into the agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of the data or data fields received, so long as providing this sample does not breach any exemption under the FOI Act. The purpose is to understand the nature and granularity of the information shared, without disclosing identifiable personal details.
If the only data [Authority name] received pertains solely to data linked to the Centrelink Confirmation eServices (CCeS) arrangements as described at https://www.servicesaustralia.gov.au/cen..., and there were no other forms of DVA data shared, then no CCeS-related data needs to be provided under this request.
I emphasize that I am not authorizing the transfer of this FOI request to the Department of Veterans’ Affairs or any other agency. If [Authority name] holds the requested information, it should provide it directly. If there are parts of this request that [Name of Agency] does not understand or believes are not held, I invite you to contact me to clarify or refine the scope under section 24AB of the FOI Act, rather than initiating a transfer. However, I do not consent to the transfer of this request to another entity. The FOI Act places the onus on agencies to process requests for documents they hold, and I expect [Authority name] to meet its responsibilities in this regard.
I note that the statutory timeframe for processing FOI requests is 30 days from the date of receipt. I do not consent to any extension of time due to internal reduced activity periods, holiday stand-down periods, or other internal operational issues. If [Authority name] considers that it cannot meet the 30-day timeframe, it may seek an extension from the Office of the Australian Information Commissioner as provided under section 15AB of the FOI Act. I request to be notified if such an application is made.
If you consider any part of this request too broad or complex, please contact me promptly to discuss refining its scope. I remain willing to consider adjustments that will assist efficient processing, provided that they occur within the statutory timeframe and do not undermine the substance of what I am seeking.
I believe that disclosure of these documents is in the public interest, as it promotes transparency and accountability in how government agencies access and use sensitive personal information about veterans. Should you consider charges applicable, I request that you exercise your discretion to reduce or waive them, given the importance of the matter and its alignment with the principles of open government and public accountability.
I look forward to receiving your acknowledgment and decision within the statutory timeframe. Please contact me at the details below if you require further clarification.
Yours sincerely,
Nosey
Your email has been received by the Office of Australian Information
Commissioner (OAIC).
FOI requests to the OAIC
Please note that this email address is only used for making requests to
obtain access to a document held by the OAIC pursuant to the Freedom of
Information Act 1982 (Cth) (FOI Act). We will only action and respond to
emails making FOI requests to the OAIC. For information on how to make an
FOI request to the OAIC, and to ensure that your request complies with the
requirements of the FOI Act, please refer to the FOI page on the OAIC’s
website at:
[1]https://www.oaic.gov.au/about-us/access-...
Once your request has been assessed by the OAIC, and registered on our
system, a separate acknowledgement email will be sent to you with a
reference number.
The OAIC does not hold all documents of other Commonwealth government
agencies, other state government agencies, or private organisations.
Accordingly:
1) if you are seeking to access documents of a particular
Commonwealth agency, you will need to make your request directly to the
relevant agency. For example, if you are requesting a copy of your visa
records, please make an FOI request and send it to the Department of Home
Affairs.
2) if you are seeking to access documents of a state or local
government agency, as each Australian state and territory also have
separate FOI legislation that governs information held by state government
agencies, please contact the relevant agency as to how to make an
application to access the documents. For example, if you are seeking
access to police report from NSW Police Force, it is governed by the
Government Information (Public Access) Act 2009 (NSW) (GIPA Act), and you
will need to contact NSW police to find out how to make a GIPA application
for the police report.
3) if you are seeking to access documents of a private organization,
which the FOI Act does not apply to, please contact the organization
directly to find out how to access the documents you are seeking. For
example, if you are seeking to access to hospital records or your medical
centre records, please contact these organisations directly.
Enquiries and other matters
If your email relates to any of the following, please utilise our online
forms instead, which are available at
[2]https://www.oaic.gov.au/about-us/contact...
- Enquiry
- Privacy Complaint
- Notifiable Data Breach
- Consumer Data Right Complaint
- FOI Complaint
- Freedom of Information Review
- Agency FOI Extension of Time Requests
- Speech requests.
Notice:
The information contained in this email message and any attached files may
be confidential information, and may also be the subject of legal
professional privilege. If you are not the intended recipient any use,
disclosure or copying of this email is unauthorised. If you received this
email in error, please notify the sender by contacting the department's
switchboard on 1300 488 064 during business hours (8:30am - 5pm Canberra
time) and delete all copies of this transmission together with any
attachments.
References
Visible links
1. https://www.oaic.gov.au/about-us/access-...
2. https://www.oaic.gov.au/about-us/contact...
Our reference: FOIREQ24/00651
Dear Nosey,
Freedom of Information request
I refer to your request for access to documents made under the Freedom of
Information Act 1982 (Cth) (FOI Act).
Your FOI request was received by the Office of the Australian Information
Commissioner (OAIC) on 14 December 2024. This means that a decision on
your FOI request is currently due on 13 January 2025.
Scope of your request
Your FOI request was made in the following terms:
I seek access to any and all documents, records, data, and supporting
material held by [Name of Agency] concerning the sharing of personal
information originating from the Department of Veterans’ Affairs (DVA)
over the last ten years. This includes any data transfers from or to the
DVA, whether they were one-off exchanges or ongoing, systematic transfers
of DVA client information, including personal, medical, financial, or
service-related details concerning veterans or their dependents.
I am interested in obtaining a comprehensive understanding of what DVA
client information [Authority name] has received or accessed and for what
purposes. Specifically, I request:
All records of data sharing arrangements between DVA and [Authority name],
including but not limited to memoranda of understanding, service-level
agreements, emails, letters, meeting minutes, file transfer logs, internal
reports, and instructions that outline what data was shared, when it was
shared, and the format or system used for the transfer.
Any policies, procedures, guidelines, or frameworks that govern how
[Authority name] requests, obtains, stores, handles, or uses DVA client
information. This includes documents that detail the criteria for
approving access to such data, any consent or authorization processes,
security controls, and retention or destruction policies.
Copies of any ethics committee approvals, privacy impact assessments,
internal review board decisions, or other documents that reflect
deliberations or authorizations for obtaining DVA client information. This
includes records that show the agency considered the ethical, legal, or
privacy implications of receiving or using DVA client data.
Documents that outline the intended uses or practical applications of the
DVA client data, such as project proposals, business cases, internal
strategy papers, or briefings that explain why [Authority name] sought
access to this information, how it was intended to be integrated into the
agency’s operations, and any expected outcomes or benefits.
A representative sample (in a suitably de-identified or redacted form) of
the data or data fields received, so long as providing this sample does
not breach any exemption under the FOI Act. The purpose is to understand
the nature and granularity of the information shared, without disclosing
identifiable personal details.
If the only data [Authority name] received pertains solely to data linked
to the Centrelink Confirmation eServices (CCeS) arrangements as described
at
[1]https://www.servicesaustralia.gov.au/cen...,
and there were no other forms of DVA data shared, then no CCeS-related
data needs to be provided under this request.
I emphasize that I am not authorizing the transfer of this FOI request to
the Department of Veterans’ Affairs or any other agency. If [Authority
name] holds the requested information, it should provide it directly. If
there are parts of this request that [Name of Agency] does not understand
or believes are not held, I invite you to contact me to clarify or refine
the scope under section 24AB of the FOI Act, rather than initiating a
transfer. However, I do not consent to the transfer of this request to
another entity. The FOI Act places the onus on agencies to process
requests for documents they hold, and I expect [Authority name] to meet
its responsibilities in this regard.
I note that the statutory timeframe for processing FOI requests is 30 days
from the date of receipt. I do not consent to any extension of time due to
internal reduced activity periods, holiday stand-down periods, or other
internal operational issues. If [Authority name] considers that it cannot
meet the 30-day timeframe, it may seek an extension from the Office of the
Australian Information Commissioner as provided under section 15AB of the
FOI Act. I request to be notified if such an application is made.
If you consider any part of this request too broad or complex, please
contact me promptly to discuss refining its scope. I remain willing to
consider adjustments that will assist efficient processing, provided that
they occur within the statutory timeframe and do not undermine the
substance of what I am seeking.
I believe that disclosure of these documents is in the public interest, as
it promotes transparency and accountability in how government agencies
access and use sensitive personal information about veterans. Should you
consider charges applicable, I request that you exercise your discretion
to reduce or waive them, given the importance of the matter and its
alignment with the principles of open government and public
accountability.
I look forward to receiving your acknowledgment and decision within the
statutory timeframe. Please contact me at the details below if you require
further clarification.
In order to process your request as efficiently as possible, I will
exclude duplicates and early parts of email streams that are captured in
later email streams from the scope of this request, unless you advise me
otherwise.
I will not identify you as the FOI applicant during any consultation
process. However, documents that are within the scope of your request that
the OAIC may need to consult third parties about may contain your personal
information.
Consultation on scope of request
Upon initial consideration of your request, we consider that the nature of
the documents you are seeking is not entirely clear. We also consider
that if the request in its current form was to be processed with a broad
interpretation, the work involved in processing the request could
substantially and unreasonably divert the resources of the agency from its
other operations.
To assist in clarifying the scope of your request, it may be useful if you
could identify:
o Whether information sought relates exclusively to the DVA, or
whether general information which relates to a class of agencies
inclusive of the DVA is captured in the scope.
o Whether the request seeks access to any particular client
information, or documents related to the sharing of any particular
client’s information?
o What are the data fields referred to in paragraph 7?
o Whether there is any period/s of time within the last 10 years you
are specifically interested in, or if you seeking only current
policies, procedures, guidelines, or frameworks?
o Whether there is any particular document you believe may exist that
you are seeking access to.
I would appreciate a response to my questions above by COB 20 December
2024. If I do not hear from you by this date, I will continue to process
the request in its current form. In doing so, the OAIC may need to
formally consult with you pursuant to section 24AB of the Act.
Timeframes for dealing with your request
Section 15 of the FOI Act requires the OAIC to process your request no
later than 30 days after the day we receive it. However, section 15(6) of
the FOI Act allows us a further 30 days in situations where we need to
consult with third parties about certain information, such as business
documents or documents affecting their personal privacy.
The current decision due date for your request is 13 January 2025. We will
advise you if this timeframe is otherwise extended.
Disclosure Log
Documents released under the FOI Act may be published online on our
disclosure log unless they contain personal or business information that
would be unreasonable to publish.
If you would like to discuss your FOI request, please contact me on my
contact details set out below.
Yours sincerely
Lachlan
[2][IMG] Lachlan Smith-Marks (he/him)
Governance, Risk and Compliance Officer (FOI)
Office of the Australian Information Commissioner
Melbourne |
E [3][OAIC request email]
The OAIC acknowledges Traditional Custodians of Country across
Australia and their continuing connection to land, waters and
communities. We pay our respect to First Nations people,
cultures and Elders past and present.
[4]Subscribe to Information Matters
Dear Lachlan Smith-Marks,
Thank you for your correspondence dated 18 December 2024 regarding my Freedom of Information (FOI) request. I appreciate the opportunity to clarify the scope of my request to ensure efficient processing.
Clarified Scope of Request
To address the questions raised in your consultation, I provide the following clarifications:
Exclusivity to DVA
My request pertains specifically to documents relating to data sharing or transfers involving the Department of Veterans’ Affairs (DVA) and the OAIC. It does not include general information that applies broadly to other agencies.
Particular Client Information
The request does not seek access to any specific individual client information. Instead, it focuses on systematic or broad data-sharing arrangements and governance frameworks involving DVA client information.
Data Fields
The reference to "data fields" in my request relates to a de-identified or redacted sample of the types of data shared between DVA and the OAIC. Examples might include categories such as name, service status, medical details, or financial information if applicable to shared datasets.
Timeframe
The timeframe for my request is the last ten years (14 December 2014 to 14 December 2024). I am not limiting this to current policies or procedures.
Specific Documents
While I do not have specific documents in mind, I am seeking any relevant:
MOUs or agreements governing data sharing with DVA,
Policies or guidelines for managing DVA client information,
Privacy or impact assessments related to such data, and
Internal reports or evaluations outlining the purpose or implications of receiving DVA client data.
Exclusions
I confirm that the following may be excluded to streamline processing:
Duplicate documents or earlier parts of email chains captured in later correspondence,
Individual-level complaint records or files.
Next Steps
I trust these clarifications address your concerns and enable you to proceed with processing my request. If further refinement is necessary, please do not hesitate to contact me.
Thank you for your assistance, and I look forward to receiving your response.
Yours sincerely,
Nosey
Dear Applicant,
Please see attached correspondence in relation to your request,
FOIREQ24/00651.
Kind regards,
Lachlan
[1][IMG] Lachlan Smith-Marks (he/him)
Governance, Risk and Compliance Officer (FOI)
Office of the Australian Information Commissioner
Melbourne |
E [2][OAIC request email]
The OAIC acknowledges Traditional Custodians of Country across
Australia and their continuing connection to land, waters and
communities. We pay our respect to First Nations people,
cultures and Elders past and present.
[3]Subscribe to Information Matters
Notice:
The information contained in this email message and any attached files may
be confidential information, and may also be the subject of legal
professional privilege. If you are not the intended recipient any use,
disclosure or copying of this email is unauthorised. If you received this
email in error, please notify the sender by contacting the department's
switchboard on 1300 488 064 during business hours (8:30am - 5pm Canberra
time) and delete all copies of this transmission together with any
attachments.
References
Visible links
1. https://www.oaic.gov.au/
2. mailto:[OAIC request email]
3. https://www.oaic.gov.au/engage-with-us/n...
Dear Lachlan Smith-Marks,
I write in response to your consultation notice under section 24AB of the Freedom of Information Act 1982 (Cth) (FOI Act) regarding my request FOIREQ24/00651. Having reviewed the reasons for your proposed refusal due to "practical refusal reasons" as outlined in your correspondence dated 9 January 2025, I wish to emphasize several points to clarify and maintain the integrity of my original request while addressing your stated concerns.
First, under section 15(2)(b) of the FOI Act, a valid FOI request is required to provide sufficient information concerning the documents sought to enable the agency to identify them. My request, both as originally framed and as clarified on 30 December 2024, meets this threshold by providing clear parameters, including specific document categories (e.g., MOUs, governance frameworks, privacy impact assessments), a specified timeframe (10 years), and exclusions (e.g., individual complaint files). I reiterate that I have not requested exhaustive searches across all functions of the OAIC but rather focused searches directly linked to systematic or formal data-sharing arrangements with the Department of Veterans’ Affairs (DVA).
Second, regarding your concerns about an "unreasonable diversion of resources," the FOI Guidelines issued by the OAIC under section 93A of the FOI Act provide clear factors for assessing whether processing a request would unreasonably divert an agency's resources. These factors include:
Whether the applicant has cooperated in revising the scope of the request.
The availability of staffing resources.
The public interest in the requested documents.
I have already cooperated by refining the scope of my request, excluding unnecessary materials, and providing additional clarification. I further note that any searches should focus specifically on documented arrangements with DVA concerning data sharing or transfers. The significant public interest in transparency and accountability regarding how the OAIC interacts with DVA in handling sensitive personal information about veterans outweighs administrative inconvenience.
Third, while your notice highlights the potential breadth of searches across the OAIC's various systems (Resolve, Content Manager, email systems, and general files), it does not sufficiently demonstrate why targeted searches cannot be conducted for records meeting the scope. A search term such as "DVA" limited to formalized data-sharing arrangements, agreements, and governance documents would not, on its face, create an insurmountable resource burden. I note that agencies are expected to engage in reasonable searches under section 24A of the FOI Act and not adopt overly broad interpretations of requests to create impractical burdens.
Fourth, I must respectfully disagree with your characterization of the request as unclear. My explicit exclusions of complaint records and individual-level data, combined with a focus on systemic data-sharing practices, ensure clarity and precision.
Finally, I note that your proposal to revise the scope to cover only documents related to privacy complaint investigations under section 40 of the Privacy Act is overly restrictive and excludes broader governance and data-sharing arrangements that are central to my request. While I appreciate your assistance, this revision significantly narrows the scope in a manner that undermines the intent of the request.
I request that the OAIC proceed with processing the request as clarified on 30 December 2024, focusing on systematic and formal data-sharing arrangements with DVA within the last 10 years. If specific aspects of the request remain unmanageable, I encourage further targeted consultation to resolve these issues in good faith.
I respectfully remind the OAIC of its obligations under section 3 of the FOI Act to promote a pro-disclosure culture and ensure the public's right to access government-held information is upheld. Should the OAIC maintain its intention to refuse the request, I will seek an independent review by the Australian Information Commissioner.
Thank you for your attention, and I look forward to your response.
Yours sincerely,
Nosey Rosey
Dear Nosey Rosey,
Thank you kindly for your reply.
Your email suggests that you wish for the OAIC to proceed with the scope
of your original request as clarified on 30 December 2024.
'I request that the OAIC proceed with processing the request as clarified
on 30 December 2024, focusing on systematic and formal data-sharing
arrangements with DVA within the last 10 years.'
I note that your email did not contain a revised scope, but rather
contained comments that were to be considered alongside your original
request.
Based on the above, we suggest that your request could be appropriately
interpreted, and sufficiently workable, by applying the following revised
scope:
Any documentation, policies and procedures outlining formal and systemic
data-sharing arrangements exclusively between the OAIC and the DVA over
the last 10 years.
Please advise whether you agree to this interpretation and revision of
scope. If you do not consider this to be the correct interpretation of
your request, we ask that you please explicitly provide the clarified /
refined scope of your request via return email for our consideration.
Please kindly provide your response before the cessation of the
consultation period, which is due to lapse on 23 January 2025. If we do
not hear from you by this time, we will process this request based on the
original scope of your request, with the comments provided on 30th
December 2024 included as ancillary information to the request.
Kind regards,
Lachlan
[1][IMG] Lachlan Smith-Marks (he/him)
Governance, Risk and Compliance Officer (FOI)
Office of the Australian Information Commissioner
Melbourne |
E [2][OAIC request email]
The OAIC acknowledges Traditional Custodians of Country across
Australia and their continuing connection to land, waters and
communities. We pay our respect to First Nations people,
cultures and Elders past and present.
[3]Subscribe to Information Matters