Our reference: FOI 23/24-0279
GPO Box 700
Canberra ACT 2601
1800 800 110
15 March 2024
ndis.gov.au
Renee
By email: xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Renee
Freedom of Information request — Notification of Decision
Thank you for your correspondence of 6 September 2023, in which you requested access to
documents held by the National Disability Insurance Agency (NDIA), under the
Freedom of
Information Act 1982 (FOI Act).
Scope of your request
You have requested access to the following documents:
“1. Legal Framework
- Copies of any laws, regulations, or policies that govern data collection and
sharing within the NDIS.
2. Data Types
- A list of all types of data that are collected from NDIS participants, including but
not limited to personal, financial, and health information.
3. Consent Mechanism
- Documents explaining the consent mechanisms in place for data collection and
sharing, including forms that participants are required to sign.
4. Data Usage
- Information on how the collected data is used, including any third-party sharing
arrangements.
5. Security Measures
- Documents outlining the security measures in place to protect the data of NDIS
participants.
6. Ethical Considerations
- Any internal guidelines or policies on the ethical considerations surrounding data
collection and sharing.
7. Third-Party and International Entity Information Sharing
- A comprehensive list of all entities and third parties, either located overseas or
international entities, with whom NDIS shares information.
8. Ethical and Legal Responsibility for Data Breaches
1
- Information on who is ethically and legally responsible for data breaches within
the NDIS.
9. Data Protection Measures
- Details on what is being done to ensure that privacy and data are protected and
safe.
10. Compensation Plans
- Information on what will be done to compensate victims in the event of a data
breach.”
Decision on access to documents
I am authorised to make decisions under section 23(1) of the FOI Act. My decision on your
request and the reasons for my decision are set out below.
I have decided to refuse your request for access under section 24A of the FOI Act. The
reasons for my decision are set out below.
In reaching my decision, I took the following into account:
• your correspondence outlining the scope of your request the FOI Act
• the FOI Guidelines published under section 93A of the FOI Act
• consultation with relevant officers of the NDIA
• the NDIA’s operating environment and functions.
Reasons for decision - Refuse a request for access (section 24A)
I am writing to advise that the work involved in processing your request in its current form
would substantially and unreasonably divert the resources of the NDIA from its other
operations due to its broad scope. This is called a ‘practical refusal reason’ under section
24AA of the FOI Act.
After consultations were issued to you on 22 and 28 February 2024, no response was
received to either correspondence seeking a revision of the scope.
As a result, I am of the view that the work involved in the processing of this request would
substantially and unreasonably divert the resources of the NDIA from its other operations.
I have, therefore, decided to refuse access to these documents, in accordance with s24AA
of the FOI Act.
Rights of review Your rights to seek a review of my decision, or lodge a complaint, are set out at
Attachment A.
2
Should you have any enquiries concerning this matter, please do not hesitate to contact me
by email at
xxx@xxxx.xxx.xx.
Yours sincerely
Cooper Senior Freedom of Information Officer
Complaints Management & FOI Branch
General Counsel Division
3
Attachment A
Your review rights
Review by the Office of the Australian Information Commissioner
The FOI Act also gives you the right to apply to the Office of the Australian Information
Commissioner (OAIC) to seek a review of this decision.
If you wish to have the decision reviewed by the OAIC, you may apply for the review, in writing,
or by using the online merits review form available on the OAIC’s website
at www.oaic.gov.au,
within 60 days of receipt of this letter.
Applications for review can be lodged with the OAIC in the following ways:
Online:
www.oaic.gov.au
Post:
GPO Box 5218, Sydney NSW 2001
Email:
xxxxxxxxx@xxxx.xxx.xx
Phone:
1300 363 992 (local call charge)
Complaints to the Office of the Australian Information Commissioner or the
Commonwealth Ombudsman
You may complain to either the Commonwealth Ombudsman or the OAIC about actions taken
by the NDIA in relation to your request. The Ombudsman will consult with the OAIC before
investigating a complaint about the handling of an FOI request.
Your complaint to the OAIC can be directed to the contact details identified above. Your
complaint to the Ombudsman can be directed to:
Phone:
1300 362 072 (local call charge)
Email:
xxxxxxxxx@xxxxxxxxx.xxx.xx
Your complaint should be in writing and should set out the grounds on which it is considered
that the actions taken in relation to the request should be investigated Division.
4
