Our reference: FOIREQ23/00081
Attention: FOI Requestor
By email: xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Freedom of Information Request – FOIREQ23/00081
Dear FOI Requestor
I refer to your request for access to documents made under the
Freedom of
Information Act 1982 (Cth) (the FOI Act). Your Freedom of Information (FOI request)
was received by the Office of the Australian Commissioner (OAIC) on 28 April 2023.
I am writing to consult with you on the basis that your request gives rise to a practical
refusal reason.
Background
Scope of your request
Your FOI request sought access to the following information:
“In relation to the Medibank*(1) Data Breach, please release any report and
information provided by Medibank* to the OAIC, including if held, the "Deloitte"
report(2,3) on it's Cyberattack, as reported:
1. https://www.oaic.gov.au/newsroom/oaic-opens-investigation-into-
medibank-
over-data-breach
2. https://www.medibank.com.au/livebetter/newsroom/post/cybercrime-
update-
deloitte-incident-review
3. https://www.afr.com/companies/healthcare-and-fitness/medibank-to-keep-
cyberattack-report-findings-from-customers-public-20230428-p5d3yt
1300 363 992
T +61 2 9284 9749
GPO Box 5218
www.oaic.gov.au
oaic.gov.au/enquiry
F +61 2 9284 9666
Sydney NSW 2001
ABN 85 249 230 937
* Medibank includes any parent or subsidiary companies, including any
representatives of those companies.
Personal data of individuals (names, contacts details etc) is not required.
Duplicate
content is not required (for example, email trails outlining the same
content).”
Timeframe for dealing with your request
Section 15 of the FOI Act requires us to process your requests no later than 30 days
after the day we receive them. However, section 15(6) of the FOI Act allows us a
further 30 days in situations where we need to consult with third parties about
certain information, such as business documents or documents affecting their
personal privacy.
With this letter being a notice under section 24AB of the FOI Act, the time to process
your request will be stopped until we have completed this consultation with you, as
per section 24AB(8) of the FOI Act.
Notice of intention to refuse your request
I am an officer authorised under s 23(1) of the FOI Act to make FOI decisions on
behalf of the OAIC.
I am writing to consult with you under section 24AB of the FOI Act, because:
• I believe that the work involved in processing your request will substantially
and unreasonably divert the resources of the OAIC from its other operations
due to its size and scope (s 24AA(1)(a)(i)).
For the purposes of the FOI Act, this is called a ‘practical refusal reason’
(s 24AA(1)(a)(i) of the FOI Act).
On this basis, I intend to refuse your request for access to documents unless the
terms of your request are revised, so as to remove the practical refusal reason.
2
However, before I proceed to a refusal decision, you have an opportunity to revise
your request again. This is called a ‘request consultation process’ as set out under s
24AB of the FOI Act. You have 14 days to respond to this notice in one of the ways set
out at the end of this letter.
Why I intend to refuse your request
Calculation of the processing time – substantial diversion
Search and retrieval
Based on searches conducted by the relevant line areas, and a preliminary review of
the documents within the scope of your request, I estimate it will take the OAIC at
least
107.6 hours to process your FOI request in its current form.
Line areas consulted in relation to your request included the following:
• Major Investigations; and
• Data Breach Notifications
Searches were conducted using the OAIC’s internal document management systems.
As a result of the searches undertaken to date, I understand that the Major
Investigations and Data Breach Notification line areas have identified in excess of
thousands of documents as potentially falling within the scope of your request.
Estimated document identification time
The Major Investigations line area estimated that in order to extract, format, index
and consider applicable exemptions for the documents they identified as potentially
within scope of your request, it would take an average of 3 minutes per document. It
was also noted by the line area that the officer undertaking this task would likely
require a minimum 5-minute break every 20 documents.
For the purposes of providing this estimate I wil use 1000 documents as a
conservative figure for the number of documents within scope of your request.
Please note that, as identified above, the actual number of documents is in excess of
this number. Based on the information provided by the line area, I estimate that the
time it would take to complete the search and retrieval for your request would be, at
a minimum, approximately
3250 minutes or
54 hours
3
Decision making time
I have calculated the time it would take the FOI decision maker to examine, assess
and edit the documents in scope in order to process and make a decision on your FOI
request.
A sample has been conducted using 20 of the documents identified as being within
the scope of your request, to help calculate the time it would take for an FOI Officer
to process your request in full. These sample documents were reviewed for potential
sensitivities, in order to determine the average time it would take to review each
document at issue.
Based on the sample, I calculate that:
• In conducting the sample, it took an average of approximately 2.8 minutes
for each document to:
o Review each page;
o Identify if there was any information about third party entities in the
documents, and make a note of this; and
o Identify what other exemptions may apply to the documents at issue
and make a note of this.
• Based on the above sample, and again using the example figure of 1000
documents, I estimate that it would take at a minimum of
46.6 hours to
complete this task
• I conservatively estimate that it would take the FOI decision maker
5 hours
to prepare a finalised schedule of documents of the documents in scope of
your FOI request, and another
2 hours to draft the FOI decision and reasons
for decision.
Based on the above figures, I therefore estimate that it would take
107.6 hours to
process this request, or approximately
2 weeks. This process time estimate does not
take into account the additional time required to:
• Collate and prepare documents for third party consultation. Due to the nature
of your request, and based on the sample documents, it would appear that
many of the documents within the scope of your request would contain the
information of third party entities, thereby requiring consultation.
4
• Undertake further internal consultation on the documents at issue to
determine what information, if any, would be able to be released.
In light of the above, I consider that the processing of your request would be a
substantial diversion of the OAIC’s resources, for the purposes of section 24AA(1)(a)(i)
of the FOI Act.
Unreasonable diversion of resources
An estimate of processing time is only one of the considerations to be taken into
account when deciding whether a practical refusal reason exists. As well as requiring
a request to substantially divert an agency’s resources, s 24AA also requires the
request to unreasonably divert an agency’s resources from its other functions before
it can be refused under s 24.
The Guidelines issued by the Australian Information Commissioner under s 93A of the
FOI Act (FOI Guidelines) identify matters that may be relevant when deciding
whether processing the request will unreasonably divert an agency’s resources from
its other functions. These include:
• the staffing resources available to the OAIC for FOI processing
• the impact that processing the request may have on other tasks and functions
of the OAIC
• whether an applicant has cooperated in revising the scope of the request
• whether there is a significant public interest in the requested documents
• other steps taken by an agency or minister to publish information of the kind
requested by an applicant.
The OAIC is a small agency. It does not have a dedicated FOI team. While OAIC
consists of approximately 140 staff members in total, the FOI requests received by
the OAIC are processed by a handful of staff members within its Legal Services Team.
Processing your request would have a significant impact on the line area operations
as well as the operations of the Legal Services Team. Processing your request would
mean diverting staff from their other functions, such as:
• undertaking regulatory functions in both FOI and privacy
5
• conducting Information Commissioner reviews
• delivering internal legal advice
• improving agencies’ processes for managing FOI requests
• undertaking Privacy Act investigations.
For these reasons I have formed the view that processing your request would
substantially impact the OAIC’s operations.
I also consider that the processing of your request would be an unreasonable
diversion of the OAIC’s resources.
Request consultation process
You now have an opportunity to revise your request so as to remove the practical
refusal reason.
There are a number of ways that you can reduce the scope of your request so as to
remove the practical refusal reason. These include limiting and/or further revising
the scope of your request by:
• narrowing the terms of your request to a specific document
• further clarifying the kinds or types of information that you are seeking access
to (noting that your FOI application includes a request for
“…any report and
information provided by Medibank to the OAIC”.
• reducing the date range of your request
If you would like to proceed with the above revised scope of your request or proceed
with another revision of scope you should advise us in a reply email.
Before the end of the consultation period, you must do one of the following, in
writing:
• withdraw your request
• make a revised request
• tell us that you do not wish to revise your request.
The consultation period runs for
14 days and starts on the day after you receive this
notice. Therefore, you must respond to this notice by 6 June 2023.
6
During this period, you can ask the contact person (see below) for help to revise your
request. If you revise your request in a way that adequately addresses the practical
refusal reasons outlined above, we will recommence processing it.
Please note that the time taken to consult you regarding the scope of your request is
not taken into account for the purposes of the 30-day time limit for processing your
request.
If you do not do one of the three things listed above during the consultation period
or you do not consult the contact person during this period, your request will be
taken to have been withdrawn.
Contact officer
If you would like to revise your request, or have any questions, you can contact me at
xxx@xxxx.xxx.xx.
Yours sincerely,
Jessica Summerhill
A/g Senior Lawyer
22 May 2023
7
Document Outline
