FOIREQ24.00134 Bundle of documents.pdf

FOIREQ24/00134 001

FOIREQ24/00134 002
Consultation
I consulted with one third party in relation to your request. I do not agree with the
views of the third party in relation to the personal information contained within the
documents and I have decided to grant part access to the documents.
Subsection 27(7) of the FOI Act provides that access is not to be given to the
documents until the third party’s review or appeal opportunities have been
exercised or expire.
As a result, the documents will not be released to you until all opportunities for
review or appeal in relation to this decision have been exercised or expire. If the third
party applies for internal review with the OAIC, or IC review, the OAIC cannot release
the document until the review is concluded and the time for instituting a review or
appeal has expired.
The attached schedule indicates the documents that are subject to third party review
rights.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have identified 15 documents
relevant to your request.  I have made a decision to:
•  grant full access to 1 document, and
•  grant access in part to 5 document(s), and/or
•  refuse access in full to 9 document(s).
In accordance with section 26(1)(a) of the FOI Act, the reasons for my decision and
findings on material questions of fact are provided below.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to your request:
•  Executive
•  Legal Services
•  Regulation & Strategy
2

FOIREQ24/00134 003
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 5 November 2023;
•  the FOI Act, in particular sections 3, 11, 11A, 15, 22, 26, 42, 47F and 47G of the
FOI Act; and
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines).
Access to edited copies with exempt material deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that FOI Act exemptions apply to this material and that it would
be reasonably practicable to prepare an edited copy of the documents
Accordingly, I have made an edited copy of the documents which removes this
exempt material and otherwise grants you access to the material in scope of your
request.
Documents subject to legal professional privilege (section 42)
I have identified material contained within the documents which comprises legal
advice and requests for legal advice associated with to the Commissioner’s
submissions to, and appearance before, the Senate Inquiry.
3

FOIREQ24/00134 004
In accordance with section 42 of the FOI Act, I have made a decision to exempt
material on the basis that it is subject to legal professional privilege.
Section 42(1) of the FOI Act provides that:
A document is an exempt document if it is of such a nature that it would be privileged
from production in legal proceedings on the ground of legal professional privilege.
In determining whether or not these documents could be privileged from production
in legal proceedings I have considered:
•  whether there is a legal adviser-client relationship,
•  whether the communication was for the purpose of giving or receiving,
•  legal advice, or use in connection with actual or anticipated litigation,
•  whether the advice given is independent, and
•  whether the advice given is confidential.
In relation to the identified material, both internal and external lawyers, were
engaged to provide legal advice. In relation to external lawyers, I am satisfied that a
legal adviser-client relationship exists as the external lawyers were engaged for the
purposes of providing legal advice.
In relation to the internal lawyers, I note that generally, privilege may be claimed in
relation to advice sought from and given by an inhouse lawyer, where the
professional relationship between the lawyer and the agency seeking advice has the
necessary quality of independence, as per Taggart and Civil Aviation Safety Authority
(Freedom of information) [2016] AATA 327 at [32].
The OAIC legal team is part of the corporate branch and is separate from the OAIC
Executive. Requests for legal advice are settled by General Counsel or a principal
lawyer within the legal team. Although not a determinative factor, all members of
the legal team hold practising certificates and are subject to all professional
obligations of legal practitioners.
I consider that the separation of the legal team from the OAIC Executive reinforces
the independence of the legal advice and made the relationship a legal adviser –
client relationship.
Whether privilege attaches to a document depends on the purpose for which the
communication in the document was created. The High Court has confirmed that the
common law requires a dominant purpose test rather than a sole purpose test, as
per Esso Australia Resources Ltd v Commissioner for Taxation (1999) 201 CLR 49. I am
satisfied that the relevant documents were created for the dominant purpose of
providing legal advice.
4

FOIREQ24/00134 005
Finally, I have turned my mind to whether the advice was given in confidence. In
relation to the relevant documents, the legal advice was clearly marked legal in
confidence, and it was only distributed to a limited number of OAIC employees who
were involved in the matters. As outlined below, I have not been able to identify any
express or implied waiver of the privilege and am satisfied that the advice was
provided in confidence.
Waiver
Section 42(2) of the FOI Act provides that a document is not exempt under
section 42(1) if ‘the person entitled to claim legal professional privilege in relation to
the production of the document in legal proceedings waives that claim’. As such, I
have also considered whether the privilege attached to the relevant documents has
been waived. Waiver of privilege may be express or implied.
Generally, privilege can only be explicitly waived by the General Counsel of the OAIC.
I understand that this has not occurred. I further understand that material contained
within the documents has not otherwise been impliedly waived, by way of incidental
disclosure outside of its intended audience.
For the reasons given above, I consider the relevant documents identified in the
schedule are exempt under section 42 of the FOI Act.
Real Harm
The FOI Guidelines provide at paragraph 5.150 that:
Agencies are advised not to claim exemption for a document under s 42 unless it is
considered that ‘real harm’ would result from releasing the document. A ‘real harm’
criterion is not an element of the common law doctrine of LPP, but has been
acknowledged within government as a relevant discretionary test to apply in FOI
administration. The phrase ‘real harm’ distinguishes between substantial prejudice to
the agency’s affairs and mere irritation, embarrassment or inconvenience to the
agency.
I acknowledge that the Senate enquiry has now provided its final report to
Government. The Commissioners appearance and submissions to the Senate
enquiry involved the examination of the processes and culture of the OAIC. It was
important that the Commissioner was able to seek and receive legal advice clarifying
issues to ensure that the information provided to the Senate enquiry was as
forthright and accurate as possible without that information being made public. In
my view, real harm would result from releasing the documents I have identified as
exempt.
5

FOIREQ24/00134 006
As section 42 is not a conditional exemption, I am not required to consider the
application of a public interest test.
Personal privacy conditional exemption (section 47F)
In accordance with section 47F of the FOI Act, I have made a decision to exempt
material on the basis that disclosure would constitute an unreasonable disclosure of
personal information.
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) also applies to the FOI Act. The term personal information is
defined in section 6 of the Privacy Act to be:
… information or an opinion about an identified individual, or an individual who is
reasonably identifiable:
(a)  whether the information or opinion is true or not;
(b)  whether the information or opinion is recorded in a material form or not.
The documents contain the names and contact details of individuals associated with
the provision of the legal advice. I am satisfied that this material meets the definition
of personal information because disclosure of this material would reasonably
identify the individuals.
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:
•  the extent to which the information is well known;
•  whether the person to whom the information relates is known to be associated with the
matters in the document;
•  the availability of the information from publicly accessible sources; and
•  any other matters the agency or Minister considers relevant.
The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:
•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.
6

FOIREQ24/00134 007
The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals’.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
•  any detriment that disclosure may cause to the person to whom the information relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s collection and use of the information
•  the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
•  any submission an FOI applicant chooses to make in support of their application as to
their reasons for seeking access and their intended or likely use or dissemination of the
information, and
•  whether disclosure of the information might advance the public interest in government
transparency and integrity
I have also had regard to the submissions provided in response to consultation with
the affected parties. I have decided to release names where those names are in the
public domain and associated with the matters raised in the Senate enquiry. I have
also decided to release the contact details for names that I have released where that
information is readily available in the public domain.
I have decided to exempt names where those names are not necessarily in the public
domain and where the names are not associated with the matters raised in the
Senate enquiry. This is particularly the case where there is the potential of ongoing
work associated with the outcomes of the Senate enquiry.
In consideration of these factors and the material contained within the documents, I
am satisfied that the release of this personal information would be unreasonable
because the connection of the affected individuals to contested and sensitive
matters involving people they have a professional relationship with, is likely to cause
them a high level of stress. I also do not consider that the disclosure of this material
would advance the public interest in government transparency and integrity.
I am satisfied that the relevant material is not public information and is not well
known. I am also satisfied that the individuals to whom the information relates is not
known to be associated with the matters dealt with in the document. If this
information were disclosed publicly, it would unreasonably impact on the privacy of
the individual.
7

FOIREQ24/00134 008
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47F of the FOI Act.
As section 47F is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Business information conditional exemption (section 47G)
I have made a decision to exempt material contained within the documents in
accordance with section 47G of the FOI Act.
Section 47G of the FOI Act provides:
(1)
A document is conditionally exempt if its disclosure under this Act would
disclose information concerning a person in respect of his or her business or
professional affairs or concerning the business, commercial or financial affairs
of an organisation or undertaking, in a case in which the disclosure of the
information:
(a)
would, or could reasonably be expected to, unreasonably affect that
person adversely in respect of his or her lawful business or professional
affairs or that organisation or undertaking in respect of its lawful
business, commercial or financial affairs; or
(b)
could reasonably be expected to prejudice the future supply of
information to the Commonwealth or an agency for the purpose of the
administration of a law of the Commonwealth or of a Territory or the
administration of matters administered by an agency.
On review of the documents, I have identified the following business information:
•  hourly rates;
•  hours allocated to, or recorded to undertake certain work;
•  sub-totals allocated to and recorded; and
•  timekeeper codes and narrations adopted to describe work undertaken.
I consider that the above information is sensitive business information which details
how an external legal provider has charged for a specific matter. This information is
not publicly available and if disclosed could negatively impact the external legal
provider both in relation to other clients and also provide competitors an unfair
advantage in the market.
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47G of the FOI Act.
8

FOIREQ24/00134 009
As section 47G is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject
to conditional exemption under sections 47F and 47G of the FOI Act.
Section 11A(5) provides that where documents are considered to be conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision maker would, on balance, would be contrary to the public interest.
This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that must
be taken into account where relevant, and some factors which must not be taken
into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely of
individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter wil  often depend on a
balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to al  members of the public,
or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole. It may
be sufficient that the matter is in the interest of a section of the public bounded by
geography or another characteristic that depends on the particular situation. A
matter of public interest or benefit to an individual or small group of people may also
be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:
9

FOIREQ24/00134 010
… the time at which I make my decision for section 11A(5) requires access to be given to
a conditionally exempt document “at a particular time” unless doing so is, on balance,
contrary to the public interest.  Where the balance lies may vary from time to time for it
is affected not only by factors peculiar to the particular information in the documents
but by factors external to them.
The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, I consider the relevant public interest factors to be that
disclosure would :
•  promote the objects of the FOI Act by informing the community of the
Government’s operations; and
•  inform debate on a matter of public importance
•  promote effective oversight of public expenditure.
I have not identified any other factors for disclosure. Section 11B(4) of the FOI Act
provides factors which are not to be taken into account in , which I have had regard
to. Section 11B does not further prescribe the factors against disclosure to be
considered.
The FOI Guidelines set out at paragraph 6.22 factors against disclosure. In
considering the documents subject to this request, I have considered the following
factors against disclosure relevant:
•  Disclosure of the business information contained in the documents could
reasonably be expected to unreasonably reveal commercially sensitive
information; and
•  Disclosure of the personal information contained in the documents could
reasonably be expected to unreasonably interfere with an individual’s right to
privacy.
Although I acknowledge the importance of allowing effective oversight of
government expenditure and also better information debate on a matter of public
importance, I note that I have released information about the total costs associated
with the legal advice provided and only considered exempt the breakdown of the
total cost. I consider that this adequately balances the importance of public
oversight of public expenditure while also protecting commercially sensitive
information.
In relation to the disclosure of names and contact details that are not already in the
public domain, I have given limited weight to how the release would promote the
object of the FOI Act or inform debate on a matter of public importance. I have given
10

FOIREQ24/00134 011
significant weight to the fact the release would prejudice the privacy of individuals
and cause unreasonable stress to these third parties.
On balance, I consider the public interest factors against disclosure to be more
persuasive than the public interest factors favouring disclosure. I am satisfied that
the public interest is to withhold the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
I have made a decision to publish the documents subject to your request on the
OAIC’s disclosure log.
Release of documents
The documents not subject to third-party review rights are enclosed for release and
are also identified in the attached schedule of documents. The schedule also
identifies the documents which will be released to you pending the expiry of third-
party review rights.
Documents which are exempt in full have been removed from the document bundle
but are clearly identified on the schedule.
Please see the following page for information about your review rights.
Yours sincerely
Emily Elliott
Senior Lawyer
4 January 2023
11

FOIREQ24/00134 012
If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
12

FOIREQ24/00134 013
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

13

FOIREQ24/00134 014

OFFICIAL: Sensitiv
FOIREQ24/00134 015 e

30 days under s 15(6) of the FOI Act to allow time for this consultation. This means
that a decision on your request is due by 16 January 2024.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to grant full
access to 8 document(s).
Searches undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
In response to your request, the following line areas of the OAIC conducted
reasonable searches for documents relevant to you request:
•  Early Resolution
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
•  general computer files
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request and that all relevant documents have
been found.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 17 November 2023
•  the FOI Act, in particular sections 3, 11, 11A, 15 and 26 of the FOI Act
2
OFFICIAL: Sensitive

OFFICIAL: Sensitiv
FOIREQ24/00134 016 e

•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
•  third party submissions in relation to the release of the documents dated 15
December 2023
•  consultation with line area/s of the OAIC in relation to your request
Disclosure log decision
Section 11C of the FOI Act requires the OAIC to publish documents released under
the FOI Act on the OAIC’s disclosure log within 10 days of release, except if they
contain personal or business information that would be unreasonable to publish.
As discussed above and identified in the attached documents schedule, 8 documents
subject to your request contain personal and/or business information.
Accordingly, I have determined that it would be unreasonable to publish documents
1 to 8 on the disclosure log.
Release of document/s
The documents are enclosed for release.
The documents are identified in the attached schedule of documents.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
9 January 2024
3
OFFICIAL: Sensitive

OFFICIAL: Sensitiv
FOIREQ24/00134 017 e

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

4
OFFICIAL: Sensitive

OFFICIAL: Sensitiv
FOIREQ24/00134 018 e
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.
5
OFFICIAL: Sensitive

FOIREQ24/00134 019

FOIREQ24/00134 020
On 2 November 2023, we wrote to you stating that that OAIC had recently made an
FOI decision for a similar FOI request, where the documents were released up to 31
August 2023, and provided a link to the OAIC’s disclosure log, and the relevant
reference number. Noting that the documents up to 31 August 2023 are already
released, we requested that you revise the scope of your period from 1 September
2023 to 30 October 2023.
On 3 November 2023, you agreed to revise the scope of your request for the period
from 1 September 2023 to 30 October 2023.
Request timeframe
Your request was made on 2 November 2023, meaning that it was originally due on 4
December 2023.
On 30 November 2023, we wrote to you to inform you that documents within the
scope of your request contained organisation(s) business and personal information.
We informed you that in order to consult with those organisation(s), the period for
processing your request was extended by 30 days in accordance with section 15(6) of
the FOI Act and would now end on 2 January 2024. On the 2 January 2024 you agreed
to a 7 day extension of time under section 15AA of the FOI Act. Your request is now
due on 9 January 2024.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
I have identified 39 documents within the scope of your request. I have made a
decision to:
•  grant full access to 5 documents,
•  grant access in part to 31 documents, and
•  refuse access in full to 3 documents.
In accordance with section 26(1)(a) of the FOI Act, the reasons for my decision and
findings on material questions of fact are provided below.
2

FOIREQ24/00134 021
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 2 November 2023;
•  the FOI Act, in particular sections 3, 11, 11A, 15, 22, 26, 37, 47C, 47E(c) and
47E(d) of the FOI Act;
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines); and
•  consultation with relevant staff members of the OAIC in relation to your
request
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following staff members of the OAIC conducted reasonable searches for
documents relevant to you request:
•  Deputy Commissioner;
•  Policy adviser – Regulation and Strategy;
•  Director – Regulation and Strategy;
•  Assistant Director – Regulation and Strategy; and
•  Assistant Commissioner – Regulation and Strategy.
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request and that all documents in scope of your
FOI request has been identified and that that no additional documents exist.
3

FOIREQ24/00134 022
Access to edited copies with exempt material deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that FOI Act exemptions apply to this material and that it would
be reasonably practicable to prepare an edited copy of the documents.
Accordingly, I have made an edited copy of the documents which removes this
exempt material and otherwise grants you access to the material in scope of your
request.
Investigation of a possible breach of law (section 37 of the FOI Act)
Under s 37(1)(a), a document is exempt if its disclosure would, or could reasonably
be expected to, prejudice the conduct of a current investigation or proper
administration of the law in a particular instance.
Section 37(1)(a) of the FOI Act states:
(1) A document is an exempt document if its disclosure under this Act would, or
could reasonably be expected to:
(a) prejudice the conduct of an investigation of a breach, or possible
breach, of the law, or a failure, or possible failure, to comply with a law
relating to taxation or prejudice the enforcement or proper
administration of the law in a particular instance;
The FOI Guidelines at [5.82] provide:
To be exempt under ss 37(1)(a) or 37(1)(b), the document in question should
have a connection with the criminal law or the processes of upholding or
enforcing civil law or administering a law… This is not confined to court action
or court processes, but extends to the work of agencies in administering
legislative schemes and requirements, monitoring compliance, and
investigating breaches.
The FOI Guidelines at [5.86] further explain:
Section 37(1)(a) applies to documents only where there is a current or pending
investigation and release of the document would, or could reasonably be
expected to, prejudice the conduct of that investigation. Because of the phrase
‘in a particular instance’, it is not sufficient that prejudice wil  occur to other or
4

FOIREQ24/00134 023
future investigations: it must relate to the particular investigation at hand. In
other words, the exemption does not apply if the prejudice is about
investigations in general.
Additionally, at [5.87] the FOI Guidelines state:
The exemption is concerned with the conduct of an investigation. For example,
it would apply where disclosure would forewarn the applicant about the
direction of the investigation, as wel  as the evidence and resources available to
the investigating body — putting the investigation in jeopardy. The section wil
not apply if the investigation is closed or if it is being conducted by an overseas
agency.
In order to determine whether disclosure of the documents would, or could
reasonably be expected to prejudice the conduct of current investigations, the FOI
Guidelines at [5.16] - [5.17] note:
The test requires the decision maker to assess the likelihood of the predicted or
forecast event, effect or damage occurring after disclosure of a document.
The use of the word ‘could’ in this qualification is less stringent than ‘would’,
and requires analysis of the reasonable expectation rather than certainty of an
event, effect or damage occurring. It may be a reasonable expectation that an
effect has occurred, is presently occurring, or could occur in the future.
I am satisfied that the material identified as exempt relates to ongoing investigations
and matters before the Federal Court, and that release of such material prematurely
could reasonably be expected to impact the conduct of these processes. In
particular, the documents relate to the pertinent facts that are not currently within
the public domain. The premature release of that information may impact on both
the efficiency and impartiality of the current processes.
Accordingly, I have decided that the material at issue is exempt under s. 37(1)(a) of
the FOI Act.
Public interest conditional exemption--deliberative processes (section 47C)
Section 47C of the FOI Act provides for the exemption of deliberative matter as
follows:
(1)
A document is conditional y exempt if its disclosure under this Act would
disclose matter (deliberative matter) in the nature of, or relating to,
opinion, advice or recommendation obtained, prepared or recorded, or
consultation or deliberation that has taken place, in the course of, or for
the purposes of, the deliberative processes involved in the functions of:
5

FOIREQ24/00134 024

(a)
an agency; or

(b)
a Minister; or

(c)
the Government of the Commonwealth.

Exceptions

(2)
Deliberative matter does not include either of the following:

(a)
operational information (see section 8A);

(b)
purely factual material.

Paragraph [6.55] of the FOI Guidelines confirms that section 47C of the FOI Act is not
a harm provision and that the only consideration is whether the document does or
does not contain deliberative matter. As explained in the decision of Parnel  &
Dreyfus and Attorney-General’s Department [2014] AlCmr 71 (30 July 2014) at [38],
deliberative matter is a shorthand term for ‘opinion, advice and recommendation’
and ‘consultation and deliberation’. I am satisfied that the material contains
opinions, advice and recommendations in relation to government considerations of
matters that are yet to be fully considered and determined.
Accordingly, I have determined that the material is conditionally exempt under s.47C
of the FOI Act.
Section 47E(c) – Management or assessment of personnel
Section 47E(c) of the FOI Act provides that material is exempt if disclosure would or
could reasonably be expected to have a substantial adverse effect on the
management or assessment of personnel by the Commonwealth or an agency.
Section 47E(c) of the FOI Act provides that:
A document is conditional y exempt if its disclosure under this Act would, or
could reasonably be expected to, do any of the following:

(c)  have a substantial adverse effect on the management or assessment of
personnel by the Commonwealth or by an agency;
Paragraph 6.101 of the FOI Guidelines explains that:
6

FOIREQ24/00134 025
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or al egation that damage may occur if the document were to be
released.

At 6.103 the FOI Guidelines further explain:

An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).

Paragraph 6.144 the FOI Guidelines confirms that for 47E(c) of the FOI Act to apply
the documents must relate to either the management or assessment of personnel.
Having considered the material within the document, I consider the relevant
material relates to the management of personnel, including the broader human
resources policies and activities, particularly occupational health and safety.  The
material relates to the staﬀ names and contact details of non-SES staﬀ (the
Australian Communications and Media Authority and the eSafety Commissioner) and
the location of meetings that have yet to occur.
As a Commonwealth employer the OAIC has duties and obligations under the Work
Health and Safety Act 2011. This includes a duty to manage workplace health and
safety by eliminating and minimising risks as much as is reasonably practicable.
Psychosocial hazards are any occupational hazard that affects the psychological and
physical wel being of employees and includes workplace violence including verbal
threats.

Both Australian Communications and Media Authority and the eSafety Commissioner
made submissions stating that release of information relating to non-SES staff
members and location of meetings would have significant impact on their ability to
manage their obligations under the Work Health and Safety Act 2011. These agencies,
because of the nature of their work and the current environment, face challenges in
providing secure working environment for their staﬀ which minimises psychosocial
hazards.

The public disclosure of information that is not otherwise in the public domain will
increase the risk of psychosocial and physical hazards for staﬀ. I am satisfied that the
7

FOIREQ24/00134 026
disclosure  of  this material would  or could reasonably be expected to have a
substantial adverse effect on the management or assessment of personnel by the
Commonwealth or an agency. Accordingly, I have decided that this material is
conditionally exempt under s.47E(c) of the FOI Act.

My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Certain operations of agencies exemption (s 47E(d))
Under s 47E(d) of the FOI Act, a document is conditionally exempt if its disclosure
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the operations of an agency.
Section 47E(d) of the FOI Act states:
A document is conditionally exempt if its disclosure under this Act would, or could
reasonably be expected to, do any of the following:
…
(d) have a substantial adverse effect on the proper and efficient conduct of the
operations of an agency.
The FOI Guidelines at [6.101] provides:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be reasonably
expected to occur. The term ‘could reasonably be expected’ is explained in greater
detail in Part 5. There must be more than merely an assumption or allegation that
damage may occur if the document were to be released.
Additionally, at [6.103] the FOI Guidelines further explain:
An agency cannot merely assert that an effect would occur following disclosure. The
particulars of the predicted effect should be identified during the decision making
process, including whether the effect could reasonably be expected to occur. Where
the conditional exemption is relied upon, the relevant particulars and reasons
should form part of the decision maker’s statement of reasons, if they can be
included without disclosing exempt material (s 26, see Part 3).
The term ‘substantial adverse effect’ is explained in the Guidelines [at 5.20] and it
broadly means ‘an adverse effect which is sufficiently serious or significant to cause
concern to a properly concerned reasonable person’.
8

FOIREQ24/00134 027
The word ‘substantial’, taken in the context of substantial loss or damage, has been
interpreted as ‘loss or damage that is, in the circumstances, real or of substance and
not insubstantial or nominal’.
In deciding whether disclosure would, or could reasonably be expected to, have a
substantial adverse effect on the relevant agency operations, I have considered the
functions and responsibilities of the agency, I have given significant consideration to
the regulatory responsibilities of the relevant agency.
Consideration
Following consultation with the relevant agencies including ACCC, ACMA and the
eSafety Commissioner, I am satisfied that the release of the document in full would
be reasonably likely to disrupt or prejudice the agency’s ability to exercise its
regulatory functions. I consider that full disclosure of the documents at issue could
reasonably be expected to have an adverse substantial impact on the proper and
efficient conduct of the agency’s operations, through the release of information
(including draft policy and procedures) that sets out how the regulatory agencies
operate.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, Deputy President
Forgie found documents concerned with ASIC’s investigation and surveillance
functions to be exempt under s 47E(d). Deputy President Forgie found that the
subject-matter of the documents was directed to the investigations associated with
Utopia and that:
… disclosure would give insight into an aspect or aspects of the way in which ASIC
goes about its task of investigating or conducting surveillance on those who come
within its regulatory responsibilities. Utopia itself might have some idea of them as it
has been the subject of such surveillance and examination of its affairs. Others would
not. To disclose them under the FOI Act would, I find, have an adverse effect on the
proper and efficient conduct of ASIC’s operations. I am also satisfied that the adverse
effect would be substantial.1
I find that this reasoning is also relevant in this matter. In particular, the release of
this information would provide organisations the opportunity to circumvent
regulatory processes and procedures.

1 Utopia Financial Services Pty Ltd and Australian Securities and Investments Commission (Freedom of
information) [2017] AATA 269 [103].
9

FOIREQ24/00134 028
Accordingly, in this case, I am satisfied that giving you access in full to the documents
at issue would, or could reasonably be expected to, substantially adversely affect the
proper and efficient conduct of the operations of the agencies.
As section 47E(d) of the FOI Act is a conditional exemption, I am also required to
consider the application of a public interest test. My consideration of the public
interest test is discussed below.

Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject
to conditional exemption under s.47C and s.47E(c) of the FOI Act.

Section 11A(5) provides that where a document is considered to be conditionally
exempt, an agency must give the person access to that document unless the FOI
decision maker would, on balance, would be contrary to the public interest.

This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions. This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not
be taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely
of individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter wil  often depend
on a balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to al  members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole. It
may be sufficient that the matter is in the interest of a section of the public
bounded by geography or another characteristic that depends on the
10

FOIREQ24/00134 029
particular situation.  A matter of public interest or benefit to an individual or
small group of people may also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:

… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest.  Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.

The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, we consider the following to be relevant:
•  promote the objects of the FOI Act,
•  inform debate on a matter of public importance,
In addition to these factors favouring disclosure, I have also considered that access
to this information would inform debate on a matter of public importance.

Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in, which I have had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the factor against disclosure of the information is that it
could reasonably be expected to prejudice the management function of an agency.

In relation to the information relating to non-SES staff and meeting locations, I
acknowledge the importance of public oversight of government agencies and
recognise the public interest in the regulation of digital platforms. However, I have
balanced this with the need to manage psychosocial hazards of staff. I note that
access to the content of most documents have been provided in full and only
removed those parts of the documents necessary to ensure this balance. For the
material I have decided is exempt I have put a significant weight on the management
of psychosocial and physical safety of staff.

In relation to the deliberative material relating to government processes that are not
yet in the public domain, I note that in some instances, the material relates to
matters that may have been or may be considered by Cabinet. The FOI Guidelines
provide at [6.86]:
11

FOIREQ24/00134 030
In some cases, a document may contain deliberative matter that relates to
Cabinet in some way but is not exempt under the Cabinet exemption in s 34. An
example would be a document containing deliberative matter that is marked
‘Cabinet-in-Confidence’ but nonetheless does not satisfy any of the exemption
criteria in s 34. Disclosing a document of this kind would not necessarily be
contrary to the public interest only because of the connection to Cabinet
deliberations. For example, disclosure is less likely to be contrary to the public
interest if:
•  the document contains deliberative but otherwise non-sensitive matter
about a policy development process that has been finalised, and
•  the Government has announced its decision on the issue.

Even if Government has not announced a decision on the issue, disclosure of such
a document is less likely to be contrary to the public interest if it is public
knowledge that the Government considered or is considering the issue. The key
public interest consideration in both situations is to assess whether disclosure
would inhibit the Government’s future deliberation of the issue.
I have also considered the AAT decisions Secretary, Dept of Prime Minister and
Cabinet and Secretary, Dept of Infrastructure and Regional Development and
Sanderson [2015] AATA 361, and the recent Information Commissioner decisions of
Seven Network Operations Limited and Australian Human Rights Commission [2021]
AICmr 66 (10 November 2021) which discuss the application of this conditional
exemption provision. In both decisions whilst the material itself was identified as
deliberative, there was not sufficient evidence to prove that disclosure of the
material would be contrary to the public interest, particularly in circumstances
where a significant passage of time had passed since the material was the subject of
active deliberation.  I note that the material I have considered exempt at this time, is
material that consists of draft documents still being developed and policy proposals
that are under active consideration by the relevant agencies. I consider that the
release of the material at this time would inhibit the Government’s future
deliberation of the issues and proposal raised.

Finally, in relation to material that would have a substantial and adverse impact on
the proper and efficient conduct of an agency, I have given significant weight to the
fact that the release of detailed information about the focus of regulators current
activities and how they conduct their activities can undermine the efficiency of those
processes and allow organisations to circumvent those processes.

12

FOIREQ24/00134 031
On balance, I consider the public interest factors against disclosure to be more
persuasive than the public interest factors favouring disclosure. I am satisfied that
the public interest is to withhold the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online documents released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
I have made a decision to publish the documents subject to your request on the
OAIC’s disclosure log.
Release of documents
The documents are enclosed for release and the exemptions applied are clearly
identified in the schedule of documents.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer

9 January 2024
13

FOIREQ24/00134 032
If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5288
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

14

FOIREQ24/00134 033
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5288
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

15

FOIREQ24/00134 034

FOIREQ24/00134 035
On 3 January 2024 I consulted with you under s 24AB of the FOI Act on the basis that
a practical refusal reason existed under s 24AA of the FOI Act. On 4 January 2024 you
responded to my consultation notice advising that you did not want to revise the
scope of your request.
You responded as follows:
s 47F
Request timeframe
On 3 January 2024, following my consultation notice under s 24AB of the FOI Act, the
statutory period was paused. You responded on 4 January 2024 and a decision is due
in relation to your request on 15 January 2024.
Decision
I am an officer authorised under s 23(1) of the FOI Act to make decisions in relation to
FOI requests on behalf of the OAIC.
Following consultation with you under s 24AB of the FOI Act, I have decided to refuse
access to the documents you requested under s 24(1) of the FOI Act because a
‘practical refusal reason’ still exists under s 24AA of the FOI Act.
Reasons for decision
Request consultation process
On 3 January 2024, I wrote to you under s 24AB of the FOI Act to advise you of my
intention to refuse your request under s 24(1) of the FOI Act on the basis that you
request gave rise to the following practical refusal reason under s 24AA of the FOI
Act) being:
•  I cannot sufficiently identify the documents that you are requesting
(s 24AA(1)(b)).
I gave you an opportunity to respond to my consultation notice and revise the scope
of your request so as to remove the practical refusal reason. Specifically, I asked you
to advise whether you wanted to:
•  withdraw your request
2

FOIREQ24/00134 036
•  make a revised request
•  tell us that you do not wish to revise your request.
On 4 January 2024, you responded to the consultation notice stating:
s 47F
Materials taken into account
In making my decision, I have had regard to the following:
•  your freedom of information request of 15 December 2023;
•  the reasons why a practical refusal reason exists, as provided to you in my
consultation notice of 3 January 2024;
•  your correspondence of 4 January 2024;
•  the FOI Act, in particular s 15, 24, 24AA and 24AB; and
•  the Guidelines issued by the Australian Information Commissioner under s
93A of the FOI Act to which regard must be had in performing a function or
exercising a power under the FOI Act (FOI Guidelines).
Practical refusal reason
Under s 24(1) of the FOI Act, if an agency or Minister is satisfied, when dealing with a
request for a document, that a practical refusal reason exists in relation to the
request, the agency or Minister:
(a) must undertake a request consultation process; and

(b) If, after the request consultation process, the agency or Minister is
satisfied that the practical refusal reason still exists- the agency or
Minister may refuse to give access to the document in accordance with
the request.
For the purposes of s 24, a practical refusal reason exists in relation to a request if:
•  the work involved in processing the request will substantially and
unreasonably divert the resources of the OAIC from its other operations (s
24AA(1)(a)(i)); and/or

3

FOIREQ24/00134 037
•  the request does not sufficiently identify the documents being sought
(s 24AA(1)(b) and s 15(2)(b)).
Identification of request documents
For the purposes of s 24AA(1)(b), a practical refusal reason exists in relation to a
request if the request does not provide such information concerning the document
as is reasonably necessary for the OAIC to identify it as required by s 15(2)(b) of the
FOI Act.
I have determined that your request does not sufficiently identify the documents
sought.
In determining that your request does not sufficiently identify the documents sought
for the purposes of section 15(2)(b) of the FOI Act, I have also had regard to the
OAIC’s guidance material on practical refusal notices and relevant decisions of the
Australian Information Commissioner on the application of section 24AA(1)(b).1
I have carefully ensured that I have reasonably read the terms of your request and
have not taken a strict or pedantic approach to the interpretation of the scope of
your request.2
I am satisfied that the terms of your request are unclear and do not enable an officer
of the OAIC to sufficiently identify the documents being sought.
Conclusion
On the basis of the above considerations, I have found that:
•  your request does not provide such information concerning the documents/s
as is reasonably necessary to enable a responsible office of the OAIC to
identify it/them (s 24AA(1)(b) and s 15(2)(b)).
As such I have decided to refuse your request on the basis that a practical refusal
reason exists in relation to your request for access to the documents. Accordingly, I
have decided to refuse your request under s 24(1) of the FOI Act.
Your review rights are outlined on the following page.

1 See Freedom of Information Guidelines, paragraphs 3.109-3.110 available at FOI Guidelines
(oaic.gov.au).
2 ‘BI’ and Professional Services Review [2014] AICmr 20, applying Re Anderson and AFP [1986] AATA 79.
4

FOIREQ24/00134 038
Yours sincerely,
Emily Elliot
Senior Lawyer
10 January 2024

5

FOIREQ24/00134 039
If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further Review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

6

FOIREQ24/00134 040
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

7

FOIREQ24/00134 041

OFFICIAL: Sensitiv
FOIREQ24/00134 042 e

Request timeframe
Your request was made on 13 December 2023.
This means that a decision on your request is due to be decided by 12 January 2024.
Decision and reasons for decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
I have made the decision to refuse your request on the basis that documents cannot
be found or do not exist.
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 13 December 2023 and subsequent revised scope
dated 19 December 2023
•  the FOI Act, in particular including sections 3, 11, 11A, 15, 26, 24A of the FOI
Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
•  consultation with line area/s of the OAIC in relation to your request
Documents cannot be found, do not exist or have not been received – Section 24A of
the FOI Act
Section 24A(1) of the FOI Act provides that an agency may refuse a request for access
to documents requested under the FOI Act if all reasonable steps have been taken to
find the document and the agency is satisfied that the document cannot be found  or
do not exist.
I have made the decision to refuse your request under section 24A of the FOI Act on
the basis that all reasonable steps have been taken to find the documents you have
requested and no documents could be found/do not exist.
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
2
OFFICIAL: Sensitive

OFFICIAL: Sensitiv
FOIREQ24/00134 043 e

Searches Undertaken
In response to your request, the following line areas of the OAIC conducted
reasonable searches for documents relevant to you request:
•  Corporate
•  Enquiries
Searches were conducted across the OAIC’s various document storage systems
including:
•  OAIC’s email system
The line areas provided the following information as to why documents could not be
found or do not exist.
Corporate consulted with the ICT provider who provided the fol owing
information:
Email messages from the oaic.gov.au domain not actively track users outside of
system administration. There is no method for IT to send tracking/ cookie
agents via email.

Enquiries also provided the fol owing information:
s 47F
Having consulted with the Corporate and Enquiries line areas, and having
undertaken a review of the records of the various search and retrieval efforts, I am
satisfied that a reasonable search has been undertaken in response to your request
and that no relevant documents could be found or do not exist.
Conclusion
Based on the terms of your request and searches undertaken, I am satisfied that all
reasonable steps have been taken to find documents that fall within the scope of
your request and am satisfied that the documents cannot be found or that no
documents exist.
I have made the decision to refuse your request for access to documents under
section 24A of the FOI Act, on the basis that documents cannot be found or no
documents exist.
3
OFFICIAL: Sensitive

OFFICIAL: Sensitiv
FOIREQ24/00134 044 e

Please see the following page for information about your review rights in relation to
this FOI request.
Yours sincerely,
Emily Elliott
10 January 2024
4
OFFICIAL: Sensitive

OFFICIAL: Sensitiv
FOIREQ24/00134 045 e

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

5
OFFICIAL: Sensitive

OFFICIAL: Sensitiv
FOIREQ24/00134 046 e

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

6
OFFICIAL: Sensitive

FOIREQ24/00134 047

FOIREQ24/00134 048
s 47F
Request timeframe
Your request was made on 12 November 2023.
On 1 December 2023, the OAIC wrote to you to advise that the period for processing
your FOI request was extended by 30 days to allow time for the OAIC to consult with
a third-party organisation regarding information contained in the documents
concerning that organisation’s business or professional affairs and third-party
personal information.
This means that a decision on your FOI request is due by 11 January 2024.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to grant
access in part to one document.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The Early Resolution line area of the OAIC conducted reasonable searches for
documents relevant to you request. Searches were conducted across the OAIC’s
various document storage systems including the OAIC’s:
•  case management system (Resolve); and
•  email system.
The Resolve reference s 47F
was used when undertaking electronic records
searches.
Having consulted with the relevant line area and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
2

FOIREQ24/00134 049
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 12 November 2023;
•  the FOI Act, in particular sections 3, 11, 11A, 15, 26 and 47F; and
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines).
Access to edited copies with exempt matter deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that an FOI Act exemption applies to the document as set out
below.
Accordingly, I have made an edited copy of the document which removes this
exempt material and otherwise grants you full access to the material in scope of
your request.
Personal privacy conditional exemption (section 47F)
In accordance with section 47F of the FOI Act, I have made a decision to redact
material in the document on the basis that disclosure would constitute an
unreasonable disclosure of personal information.
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) (Privacy Act) also applies to the FOI Act. The term personal
information is defined in section 6 of the Privacy Act to be:
3

FOIREQ24/00134 050
… information or an opinion about an identified individual, or an individual who is
reasonably identifiable:
(a) whether the information or opinion is true or not;
(b) whether the information or opinion is recorded in a material form or not.
The document contains the mobile phone number of a s 47F
staff
member.
I am satisfied that this material meets the definition of personal information because
the material relates closely to the personal matters of an individual and disclosure of
this information would reasonably identify that individual.
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:
•  the extent to which the information is wel  known;
•  whether the person to whom the information relates is known to be associated with
the matters in the document;
•  the availability of the information from publicly accessible sources; and
•  any other matters the agency or Minister considers relevant.
The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:
•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.
The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals’.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
•  any detriment that disclosure may cause to the person to whom the information
relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s col ection and use of the information
•  the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
4

FOIREQ24/00134 051
•  any submission an FOI applicant chooses to make in support of their application as
to their reasons for seeking access and their intended or likely use or dissemination
of the information, and
•  whether disclosure of the information might advance the public interest in
government transparency and integrity
In consideration of these factors and the material contained within the document, I
am satisfied that the release of this personal information would be unreasonable
because the information is not readily available from publicly accessible sources and
could reasonably be expected to cause stress to the individual concerned if released.
I am also of the view that disclosure of this information does not advance the public
interest in government transparency and integrity. s 47F

I am of the view that this mobile phone number is not related to your
reasons for making this FOI request.
For the reasons given above, I consider this material to be conditional y exempt
under section 47F of the FOI Act.
As section 47F is a conditional exemption, I am also required to consider the
application of a public interest test. My consideration of the public interest test is
discussed below.
Application of the public interest test (section 11A and 11B)
As provided above, I have considered that material within the document is subject to
conditional exemption under section 47F.
Section 11A(5) provides that where a document is considered to be conditionally
exempt, an agency must give the person access to that document unless the FOI
decision maker would, on balance, would be contrary to the public interest.
This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not be
taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely of
5

FOIREQ24/00134 052
individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter wil  often depend on a
balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to al  members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole. It may
be sufficient that the matter is in the interest of a section of the public bounded by
geography or another characteristic that depends on the particular situation.  A
matter of public interest or benefit to an individual or smal  group of people may
also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:
… the time at which I make my decision for section 11A(5) requires access to be
given to a conditional y exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest.  Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.
The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, I consider the relevant public interest factor to be that
disclosure would promote the objects of the FOI Act generally by informing the
community of the Government’s operations.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in, which I have had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the relevant factor against disclosure to be that disclosure of
the personal information contained in the document could reasonably be expected
to unreasonably interfere with an individual’s right to privacy.
In balancing these factors for and against, I have placed greater weight on the factor
against disclosure.
I consider that there is little public interest in the disclosure of the mobile phone
number of a s 47F
staff member. Disclosing this information would add
little material value to the overall context and insight provided into Government
6

FOIREQ24/00134 053
activities achieved by the release of the documents but it would, however, cause
unreasonable stress and prejudice to the privacy of an individual.
On balance, I consider the public interest factor against disclosure to be more
persuasive than the public interest factor favouring disclosure. I am satisfied that the
public interest is to withhold the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
As discussed above, the document subject to this decision contains personal and
business information. Accordingly, I have determined that it would be unreasonable
to publish the document on the disclosure log.
Release of document
The document is enclosed for release.
Please see the following page for information about your review rights.
Yours sincerely
Molly Cooke
Lawyer
10 January 2023
7

FOIREQ24/00134 054
If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

8

FOIREQ24/00134 055
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

9

FOIREQ24/00134 056

FOIREQ24/00134 057
As we advised you on 29 November 2023, the document created in response to your
FOI request included the information of a third party. We were of the view that this
third party might reasonably wish to make a contention that the material at issue is
conditional y exempt and that providing access to the document would be contrary
to the public interest.
In light of this, we were required to undertake consultation with this third party
under sections 27 and 27A of the FOI Act. This extended the due date of your request
by 30 days, as per section 15(6) of the FOI Act.
This means that a decision on your request is due by 11 January 2024.
Consultation
As noted above, the OAIC consulted with one third party in relation to the document
falling within scope of your request in relation to third-party personal and business
information contained within the document.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to create
and grant access in part to one document.
Searches undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The Privacy Determinations line area of the OAIC conducted reasonable searches for
documents relevant to your request. Searches were conducted using the OAIC’s case
management system (Resolve).
Having undertaken a review of the records of the various search and retrieval efforts,
I am satisfied that a reasonable search has been undertaken in response to your
request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
2

FOIREQ24/00134 058
•  your FOI request dated 12 November 2023;
•  the FOI Act, in particular sections 3, 11, 11A, 15, 17, 26, 27, 27A and 47F of the
FOI Act;
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines); and
•  third party submissions in relation to the release of the document at issue.
Access to edited copies with exempt matter deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that FOI Act exemptions apply to this material, and that it is
practicable to provide you with such an edited copy.
Creation of a document in response to your FOI request (section 17)
Pursuant to section 17 of the FOI Act, I have created one document in response to
your request. I have made a decision to grant part access to this document.
Under section 17 of the FOI Act, if an FOI request is made for a document that could
be produced by using a computer ordinarily available to the agency for retrieving or
collating stored information, an agency is required to deal with the request as if it
was a request for written documents to which the FOI Act applies.
The FOI Guidelines [at 3.204] explain that section 17 may require an agency to
produce a written document of information that is stored electronical y and not in a
discrete written form, if it does not appear from the request that the applicant
wishes to be provided with a computer tape or disk on which the information is
recorded. The obligation to produce a written document arises if:
•  the agency could produce a written document containing the information by
using a computer or other equipment that is ordinarily available to the
agency for retrieving or collating stored information (section 17(1)(c)(i)), or
making a transcript from a sound recording (section 17(1)(c)(ii)); and
•  producing a written document would not substantially and unreasonably
divert the resources of the agency from its other operations (section 17(2)).
3

FOIREQ24/00134 059
If those conditions are met, the FOI Act applies as if the applicant had requested
access to the written document and it was already in the agency’s possession.
Your request seeks access to the names of the respondents in the determinations
where allegations were substantiated, as referred to in the 2022 – 2023 OAIC annual
report. The material sought is not available in a discrete form but instead is able to
be produced in a written document through the use of a computer.
In light of this, a document has been created under section 17 in response to your
request.
Personal privacy conditional exemption (section 47F)
In accordance with section 47F of the FOI Act, I have made a decision to redact
material on the basis that disclosure would constitute an unreasonable disclosure of
personal information.
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) (Privacy Act) also applies to the FOI Act. The term personal
information is defined in section 6 of the Privacy Act to be:
… information or an opinion about an identified individual, or an individual who is
reasonably identifiable:
(a)
whether the information or opinion is true or not;
(b)
whether the information or opinion is recorded in a material form or not.
The document contains the name of a respondent to a privacy complaint that I am
satisfied would be unreasonable to release in the circumstances.
I am satisfied that this material meets the definition of personal information because
disclosure of this information would reasonably identify the individual to whom the
information relates.
In determining whether disclosure of other personal information in the document
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:
• the extent to which the information is wel known
4

FOIREQ24/00134 060
•  whether the person to whom the information relates is known to be associated with
the matters in the document
•  the availability of the information from publicly accessible sources
•  any other matters the agency or Minister considers relevant.
The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:
•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.
The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals’.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
•  any detriment that disclosure may cause to the person to whom the information
relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s col ection and use of the information
•  the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
•  any submission an FOI applicant chooses to make in support of their application as
to their reasons for seeking access and their intended or likely use or dissemination
of the information, and
•  whether disclosure of the information might advance the public interest in
government transparency and integrity
In consideration of these factors and the material contained within the document, I
am satisfied that the release of this personal information would be unreasonable
because of the following factors:
•  release of this personal information could expose the individual to which the
information relates to unnecessary stress; and
•  the individual to which the information relates has expressed opposition to
the disclosure of this information.
The individual in question was a respondent to a privacy complaint, in which
ultimately no breach of the Privacy Act was found. The publicly available
5

FOIREQ24/00134 061
determination, in which the respondent was assigned a pseudonym, also refers to a
notification made to another Government agency, which also ultimately lead to no
adverse findings.
I am satisfied that the relevant material is not public information and is not well
known. I am also satisfied that the individual to whom the information relates is not
known to be associated with the matters dealt with in the document. If this
information were disclosed publicly it would unreasonably impact on the privacy of
the individual.
The FOI Guidelines at paragraph 6.171 state:
An agency or minister must have regard for any submissions made before deciding
whether to give access to the document (ss 27A(3) and 27A(4)). The third party does
not, however, have the right to veto access and agencies should take care that the
third party is not under such a misapprehension.
I have also had regard to the submissions of the relevant third party in respect of the
release of the personal information contained within the document. As noted above,
this third party raised concerns as to release of their name into the public domain.
For the reasons given above, I consider the document is conditionally exempt under
section 47F of the FOI Act.
As section 47F is a conditional exemption, I am also required to consider the
application of a public interest test.
Application of the public interest test (section 11A and 11B)
As provided above, I have considered that material within the document is subject to
conditional exemption under section 47F.
Section 11A(5) provides that where a document is considered to be conditionally
exempt, an agency must give the person access to that document unless the FOI
decision maker finds that disclosure would, on balance, would be contrary to the
public interest.
This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4  There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that
6

FOIREQ24/00134 062
must be taken into account where relevant, and some factors which must not be
taken into account.
6.5  The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely of
individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter wil  often depend on a
balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to al  members of the
public, or a substantial section of the public.
6.6  It is not necessary for a matter to be in the interest of the public as a whole. It may
be sufficient that the matter is in the interest of a section of the public bounded by
geography or another characteristic that depends on the particular situation.  A
matter of public interest or benefit to an individual or smal  group of people may
also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:
… the time at which I make my decision for section 11A(5) requires access to be
given to a conditional y exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest.  Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.
The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, I consider that the relevant factor in this case is that
disclosure would promote the objects of the FOI Act generally by providing access to
government information.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in, which I confirm I have not had regard to. Section 11B does not further prescribe
the factors against disclosure to be considered but does contain a non-exhaustive
list of factors against disclosure at [6.22].
In light of this, I consider that the relevant factors to be that disclosure of the
material could reasonably be expected to:
•   interfere with an individual’s right to privacy;
7

FOIREQ24/00134 063
•  prejudice the fair treatment of individuals and the information is about
unsubstantiated allegations of misconduct or unlawful, negligent or
improper conduct; and
•  could reasonably be expected to harm the interests of an individual or group
of individuals.
In balancing these factors for and against, I have placed greater weight on factors in
relation to an individual’s right to privacy.
On balance, I consider the public interest factors against disclosure to be more
persuasive than the public interest factors favouring disclosure. I am satisfied that
the public interest is to withhold the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
I have made a decision to publish the edited document subject to your request on
the OAIC’s disclosure log.
Release of document
The document is enclosed for release.
Please see the following page for information about your review rights.
Yours sincerely
Molly Cooke
Lawyer
10 January 2024
8

FOIREQ24/00134 064
If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

9

FOIREQ24/00134 065
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

10

FOIREQ24/00134 066

FOIREQ24/00134 067
I note that on 29 November 2023, you amended the scope of your FOI request as
follows:
Seeing as your agency is availing itself of the additional processing time under
s27/27A, please take my request to also seek any and al  personal information that is
caught in the advice and is deemed reasonable to disclose by the respective third
parties.
Request timeframe
Your request was made on 14 November 2023.
On 29 November 2023, the OAIC wrote to you to advise that the period for processing
your FOI request was extended by 30 days to allow time for the OAIC to consult with
a third-party organisation regarding information contained in the documents
concerning that organisation’s business or professional affairs and third-party
personal information.
This means that a decision on your request is due by 15 January 2023.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to:
•  grant full access to 2 documents; and
•  grant access in part to one document.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The Legal Services line area of the OAIC conducted reasonable searches for
documents relevant to your request. Searches were conducted using the OAIC’s case
management system (Resolve), and the Resolve reference number associated with
the HWL Ebsworth letter referred to in your FOI request.
Having consulted with the relevant line area and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
2

FOIREQ24/00134 068
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 14 November 2023 and subsequent revised scope
dated 29 November 2023;
•  the FOI Act, in particular sections 3, 11, 11A, 15, 26, 47F and 47G of the FOI Act;
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines); and
•  third party submissions in relation to the release of the documents.
Access to edited copies with exempt matter deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that FOI Act exemptions apply to this material as set out below.
Accordingly, I have made an edited copy of the documents which removes this
irrelevant material and otherwise grants you full access to the material in scope of
your request.
Personal privacy conditional exemption (section 47F)
In accordance with section 47F of the FOI Act, I have made a decision to redact
material in one document on the basis that disclosure would constitute an
unreasonable disclosure of personal information.
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) also applies to the FOI Act. The term personal information is
defined in section 6 of the Privacy Act to be:
3

FOIREQ24/00134 069
… information or an opinion about an identified individual, or an individual who is
reasonably identifiable:
(a)  whether the information or opinion is true or not;
(b)  whether the information or opinion is recorded in a material form or not.
The document lists matters where HWL Ebsworth is acting for the OAIC which were
affected by the cyber incident experienced by HWL Ebsworth in 2023 (the cyber
incident). This includes the names of individuals who are parties to proceedings
involving the OAIC, as well as HWL Ebsworth client and matter codes linked to these
matters.
I am satisfied that this material meets the definition of personal information because
disclosure of this material would reasonably identify the individuals.
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:
•  the extent to which the information is wel  known;
•  whether the person to whom the information relates is known to be associated with
the matters in the document;
•  the availability of the information from publicly accessible sources; and
•  any other matters the agency or Minister considers relevant.
The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:
•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.
The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals’.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
4

FOIREQ24/00134 070
•  any detriment that disclosure may cause to the person to whom the information
relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s col ection and use of the information
•  the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
•  any submission an FOI applicant chooses to make in support of their application as
to their reasons for seeking access and their intended or likely use or dissemination
of the information, and
•  whether disclosure of the information might advance the public interest in
government transparency and integrity
The material contained in the documents does not only identify individuals as
parties to proceedings, but also identifies that information concerning these
individuals and proceedings was accessed as part of the cyber incident, and
exfiltrated by a threat actor. Disclosure of this information may therefore make it
easier for that exfiltrated information to be linked to these individuals and for further
unauthorised access and disclosure to occur. I therefore consider that there is a high
risk of detriment being caused to the individuals by the disclosure of this material.
In consideration of these factors and the material contained within the documents, I
am satisfied that the release of this personal information would be unreasonable
because the connection of the affected individuals to the cyber incident would be
likely to cause them a high level of stress. I also do not consider that the disclosure of
this material would advance the public interest in government transparency and
integrity.
I am also satisfied that the relevant material, in connection with the cyber incident, is
not public information and is not well known. If this information were disclosed
publicly it would unreasonably impact on the privacy of the individuals.
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47F of the FOI Act.
As section 47F is a conditional exemption, I am also required to consider the
application of a public interest test. My consideration of the public interest test, in
respect of all the material subject to conditional exemption in this document is
discussed below.
5

FOIREQ24/00134 071
Business information conditional exemption (section 47G)
I have made a decision to redact material contained within the documents in
accordance with section 47G of the FOI Act.
Section 47G of the FOI Act provides:
(1)
A document is conditional y exempt if its disclosure under this Act would
disclose information concerning a person in respect of his or her business or
professional affairs or concerning the business, commercial or financial
affairs of an organisation or undertaking, in a case in which the disclosure of
the information:
(a)
would, or could reasonably be expected to, unreasonably affect that
person adversely in respect of his or her lawful business or
professional affairs or that organisation or undertaking in respect of
its lawful business, commercial or financial affairs; or
(b)
could reasonably be expected to prejudice the future supply of
information to the Commonwealth or an agency for the purpose of
the administration of a law of the Commonwealth or of a Territory or
the administration of matters administered by an agency.
As noted above, the document lists matters where HWL Ebsworth is acting for the
OAIC which were affected by the cyber incident experienced by HWL Ebsworth in
2023 (the cyber incident). This includes the name of a company which is the party to
proceedings involving the OAIC as well as HWL Ebsworth client and matter codes
linked to the matter.
As with the individual parties to proceedings discussed above, the material identifies
that information concerning this organisation and the proceedings was accessed as
part of the cyber incident, and exfiltrated by a threat actor.
I consider that the disclosure of this material could reasonably be expected to
adversely impact this organisation as it could facilitate the exfiltrated information to
be linked to the organisation and for further unauthorised access and disclosure to
occur. This would negatively impact the business operations of this organisation.
For the reasons given above, I consider the relevant material is conditionally exempt
under section 47G of the FOI Act.
As section 47G is a conditional exemption, I am also required to consider the
application of a public interest test. My consideration of the public interest test, in
respect of all the material subject to conditional exemption in this document is
discussed below.
6

FOIREQ24/00134 072
Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject
to conditional exemption under sections 47F and 47G.
Section 11A(5) provides that where documents are considered to be conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision maker would, on balance, would be contrary to the public interest.
This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not be
taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely of
individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter wil  often depend on a
balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to al  members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole. It may
be sufficient that the matter is in the interest of a section of the public bounded by
geography or another characteristic that depends on the particular situation.  A
matter of public interest or benefit to an individual or smal  group of people may
also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:
… the time at which I make my decision for section 11A(5) requires access to be
given to a conditional y exempt document “at a particular time” unless doing so is,
7

FOIREQ24/00134 073
on balance, contrary to the public interest. Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.
The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, I consider the relevant public interest factor to be that
disclosure would promote the objects of the FOI Act general y by informing the
community of the Government’s operations.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in, which I have had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the follow factors do not favour disclosure:
•
Disclosure of the business information contained in the documents could
reasonably be expected to unreasonably reveal commercially sensitive
information; and
•
Disclosure of the personal information contained in the documents could
reasonably be expected to unreasonably interfere with an individual’s right to
privacy.
In balancing these factors for and against, I have placed greater weight on the factors
against disclosure.
I consider that there is little public interest in the disclosure of the personal and
business information because disclosing this information would add little material
value to the overal context and insight provided into Government activities achieved
by the release of the documents. I consider that the disclosure of this material would,
however, cause unreasonable stress and prejudice to the privacy of individuals, and
also reveal sensitive information that could cause harm to the commercial interests
of a third party.
On balance, I consider the public interest factors against disclosure to be more
persuasive than the public interest factors favouring disclosure. I am satisfied that
the public interest is to withhold the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
8

FOIREQ24/00134 074
I have made a decision to publish the edited documents subject to your request on
the OAIC’s disclosure log.
Release of documents
The documents are enclosed for release and are identified in the attached schedule
of documents.
Please see the following page for information about your review rights.
Yours sincerely
Molly Cooke
Lawyer
10 January 2023
9

FOIREQ24/00134 075
If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

10

FOIREQ24/00134 076
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

11

FOIREQ24/00134 077

FOIREQ24/00134 078

Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to:
•  grant full access to 309 documents;
•  grant part access to 4 documents.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to you request:
•  Privacy Complaints
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  OAIC’s email and messaging systems
•  general computer files
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 15 December 2023
•  the FOI Act, in particular sections 3, 11, 11A, 15, 26 and 47E(d) of the FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines).
2

FOIREQ24/00134 079

Section 47E(d) – Proper and efficient conduct of the OAIC’s operations
I have found four documents exempt in part under section 47E(d) of the FOI Act.
The type of material I have found to be exempt in part is material that relates to:
•  user IDs of OAIC staff members.
Under s 47E(d) of the FOI Act, a document is conditionally exempt if its disclosure
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the operations of an agency.
Section 47E(d) of the FOI Act states:
A document is conditionally exempt if its disclosure under this Act would, or
could reasonably be expected to, do any of the following:
…
(d) have a substantial adverse effect on the proper and efficient conduct of
the operations of an agency.
The FOI Guidelines at [6.101] provides:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or allegation that damage may occur if the document were to be
released.
Additionally, at [6.103] the FOI Guidelines further explain:
An agency cannot merely assert that an effect would occur following
disclosure. The particulars of the predicted effect should be identified during
the decision-making process, including whether the effect could reasonably
be expected to occur. Where the conditional exemption is relied upon, the
relevant particulars and reasons should form part of the decision maker’s
statement of reasons, if they can be included without disclosing exempt
material (s 26, see Part 3).
The term ‘substantial adverse effect’ explained in the Guidelines [at 5.20] and it
broadly means ‘an adverse effect which is sufficiently serious or significant to cause
concern to a properly concerned reasonable person’.
3

FOIREQ24/00134 080

The word ‘substantial’, taken in the context of substantial loss or damage, has been
interpreted as ‘loss or damage that is, in the circumstances, real or of substance and
not insubstantial or nominal’.
OAIC IT system codes
Contained in the four documents are user IDs for the OAIC’s IT system. The OAIC
assigns user IDs for staff to access the inhouse IT systems. I consider that disclosure
of this information could compromise the safety and security of the storage of the
information held by the OAIC. The impact of any compromise to the safety and
security of the OAIC’s information systems would result in a serious adverse impact
on the functions and responsibilities of the OAIC.
In ‘AW’ and Australian Taxation Office (Freedom of information) [2014] AICmr 1, the
then FOI Commissioner considered the decision by the Australian Taxation Office
(ATO) to exempt user IDs under section 47E(d) of the FOI Act. The user IDs are used by
ATO staff to access the ATO’s IT system. The Commissioner found that disclosing the
user IDs ‘would have an adverse effect on the security of the ATO’s IT systems and
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the ATO’. In a series of subsequent IC review decisions, the
former Australian Information Commissioner agreed with the reasoning given by the
Commissioner in ‘AW’ to find that user IDs used by ATO staff to access the ATO’s IT
system are exempt under section 47E(d) of the FOI Act.
I consider that the disclosure of the user IDs of the OAIC’s computer system could
reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the OAIC’s operations. I have decided that these User IDs from
the OAIC’s IT system are conditionally exempt from disclosure under section 47E(d)
of the FOI Act.
The public interest test – (section 11A and 11B)
An agency cannot refuse access to conditionally exempt documents unless giving
access would, on balance, be contrary to the public interest (s 11A(5)). The FOI
Guidelines explain that disclosure of conditionally exempt documents is required
unless the particular circumstances at the time of decision reveal countervailing
harm which overrides the public interest in giving access. In this case, I must
consider whether disclosure of the 4 documents at this time would be contrary to the
public interest.
Subsection 11B(3) of the FOI Act provides a list of public interest factors favouring
disclosure. The FOI Guidelines at paragraph [6.19] also provide a non-exhaustive list
of public interest factors favouring disclosure, as well as public interest factors
4

FOIREQ24/00134 081

against disclosure. The relevant public interest factor in favour of disclosure in this
case is that disclosure would promote the objects of the FOI Act and provide you
access to your personal information.
The public interest factors favouring disclosure must be balanced against any public
interest factors against disclosure. The FOI Guidelines at paragraph [6.22] contain a
non-exhaustive list of factors against disclosure. In my view, the following relevant
public interest factors against disclosure in this case is that disclosure:
•  could reasonably be expected to prejudice the proper and efficient
operations of the OAIC.
I am satisfied that the public interest factors against disclosure outweigh the public
interest factor in favour of disclosure.
Accordingly, I have redacted the material from 4 of the 313 documents relevant to
your FOI request. As such I have made the decision to:
•  grant full access to 309 documents; and
•  grant part access to 4 documents with the conditionally exempt material
removed from the document.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
The documents subject to this decision contain personal information.
Accordingly, I have determined that it would be unreasonable to publish the
documents on the disclosure log.
Release of documents
The documents are enclosed for release.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
15 January 2024
5

FOIREQ24/00134 082

If you disagree with my decision
6

FOIREQ24/00134 083

Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
7

FOIREQ24/00134 084

Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

8

FOIREQ24/00134 085

FOIREQ24/00134 086

s 47F
Request timeframe
Your request was made on 15 December 2023.
This means that a decision on your request is due by 15 January 2024.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to:
•  grant access in full to 44 documents.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to you request:
•  Early Resolution
•  Enquiries
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  OAIC’s email system
Having consulted with the relevant line area and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Release of documents
The documents are enclosed for release.
2

FOIREQ24/00134 087

Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
The documents I have decided to release to you contains personal information. As a
result, the documents will not be published on the disclosure log.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
15 January 2024
3

FOIREQ24/00134 088

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

4

FOIREQ24/00134 089

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

5

FOIREQ24/00134 090

FOIREQ24/00134 091
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to refuse
access in full to 7 documents.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The Privacy Dispute Resolution branch of the OAIC conducted reasonable searches
for documents relevant to your request. Searches were conducted across the OAIC’s
various document storage systems including:
• the OAIC’s case management system - Resolve
• the OAIC’s document holding system – Content Manager
• the OAIC’s email system
• general computer files
• MS Teams
The following search terms were used when undertaking electronic records
searches:
s 47F
Having consulted with the relevant line area and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
• your FOI request dated 21 December 2023;
2

FOIREQ24/00134 092
•  the FOI Act, in particular sections 3, 11, 11A, 15, 26 and 47F of the FOI Act; and
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines).
Personal privacy conditional exemption (section 47F)
In accordance with section 47F of the FOI Act, I have made a decision to refuse access
to 7 documents on the basis that disclosure would constitute an unreasonable
disclosure of personal information.
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) also applies to the FOI Act. The term personal information is
defined in section 6 of the Privacy Act to be:
… information or an opinion about an identified individual, or an individual who is
reasonably identifiable:
(a)
whether the information or opinion is true or not;
(b)
whether the information or opinion is recorded in a material form or not.
The documents at issue contain the names, email addresses, contact details, and
other personal information relating to a privacy complaint made by a third party
individual. I note that, as per your request, you do not appear to have any
involvement with the matters the subject of your request.
I am satisfied that this material meets the definition of personal information because
the material relates to the personal matters of individuals, and disclosure of the
material would reasonably identify these individuals.
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:
•  the extent to which the information is well known
•  whether the person to whom the information relates is known to be associated
with the matters in the document
3

FOIREQ24/00134 093
•  the availability of the information from publicly accessible sources
•  any other matters the agency or Minister considers relevant.
The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:
•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.
The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals’.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
•  any detriment that disclosure may cause to the person to whom the information
relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s collection and use of the information
•  the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
•  any submission an FOI applicant chooses to make in support of their application
as to their reasons for seeking access and their intended or likely use or
dissemination of the information, and
•  whether disclosure of the information might advance the public interest in
government transparency and integrity
In consideration of these factors and the material contained within the documents, I
am satisfied that the release of this personal information would be unreasonable
because:
•  none of the personal information within the documents at issue is publicly
known, or appears to be available from publicly available sources;
•  the personal information was collected and used by the OAIC to respond to a
privacy complaint made by that individual;
4

FOIREQ24/00134 094
•  the individual to which the personal information relates would not
reasonably expect their personal information to be released by the OAIC, and
would likely be distressed by the release of the personal information.
I am satisfied that the individual to whom the information relates is not known to be
associated with the matters dealt with in the documents at issue. If this information
was disclosed publicly it would unreasonably impact on the privacy of the affected
individual.
The recent decision of Knight v Commonwealth Ombudsman [2021] AATA 2504
discusses personal information collected in the course of a complaint or
investigation. At paragraph [32] the Tribunal found that:
In the circumstances where the information is highly sensitive and has been
disclosed on a confidential basis, it would be unreasonable to disclose that
information to the applicant.
I consider the collection of the material contained in this document to be of a similar
nature, in that it was collected during the course of an OAIC privacy complaint. I
consider that it would be unreasonable to disclose this information.

For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47F of the FOI Act.
As section 47F is a conditional exemption, I am also required to consider the
application of a public interest test.
Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject
to conditional exemption under section 47F.
Section 11A(5) provides that where documents are considered to be conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision maker is satisfied that disclosure would, on balance, be contrary to the
public interest.
This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There  is  a  single  public  interest  test  to  apply  to  each  of  the  conditional
exemptions.  This public interest test is defined to include certain factors that
5

FOIREQ24/00134 095
must be taken into account where relevant, and some factors which must not be
taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely of
individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter will often depend on a
balancing of interests
•  necessarily broad and non-specific, and
•  related  to  matters  of  common  concern  or  relevance  to  all  members  of  the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole.  It may
be sufficient that the matter is in the interest of a section of the public bounded by
geography or another characteristic that depends on the particular situation.  A
matter of public interest or benefit to an individual or small group of people may
also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:
… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest.  Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.
The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, I consider the relevant factor to be that disclosure would
generally promote the objects of the FOI Act.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account,
which I have not had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the follow factors do not favour disclosure:
•  disclosure would have an adverse effect on the OAIC’s proper and efficient
operations relating to its management of privacy complaints, through a loss
of public confidence that the OAIC will keep personal information of
individuals that is disclosed in the course of privacy complaints private.
6

FOIREQ24/00134 096
•  disclosure of the personal information contained in the documents could
reasonably be expected to interfere with an individual’s right to privacy.
In balancing these factors for and against, I have placed greater weight on the factors
relating to the proper and efficient functioning of the OAIC’s operations, and also on
the importance of protecting an individual’s right to privacy, particularly in the
context of a privacy complaint made by that individual.
In this case, I am satisfied that the public interest factor against disclosure outweighs
the public interest factor in favour of disclosure.
I have decided that at this time, giving you access to the documents which I have
found to be conditionally exempt under s 47F of the FOI Act, would, on balance, be
contrary to the public interest.
Please see the following page for information about your review rights.
Yours sincerely
Molly Cooke
Lawyer
22 January 2024
7

FOIREQ24/00134 097
If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

8

FOIREQ24/00134 098
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

9

FOIREQ24/00134 099

FOIREQ24/00134 100

Subject to the following provisions of the FOI Act, I have made a decision to create
and grant full access to 1 document.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 28 December 2023
•  the FOI Act, in particular ss 17 and 26 of the FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
•  consultation with line areas of the OAIC in relation to your request
Requests involving the use of computers (s 17)
Under section 17 of the FOI Act, if an FOI request is made for a document that could
be produced by using a computer ordinarily available to the agency for retrieving or
collating stored information, an agency is required to deal with the request as if it
was a request for written documents to which the FOI Act applies.
The FOI Guidelines [at 3.204] explain that section 17 may require an agency to
produce a written document of information that is stored electronically and not in a
discrete written form, if it does not appear from the request that the applicant
wishes to be provided with a computer tape or disk on which the information is
recorded. The obligation to produce a written document arises if:
•  the agency could produce a written document containing the information by
using a computer or other equipment that is ordinarily available’ to the
agency for retrieving or collating stored information (section 17(1)(c)(i)), or
making a transcript from a sound recording (section 17(1)(c)(ii)); and
•  producing a written document would not substantially and unreasonably
divert the resources of the agency from its other operations (section 17(2)).
If those conditions are met, the FOI Act applies as if the applicant had requested
access to the written document and it was already in the agency’s possession.
Your request sought access to the number of reviews by agency name that are open
as of December 31st, 2023. Business Analytics, Data and Reporting advised me that
the material sought is not available in a discrete form but instead is able to be
produced in a written document through the use of a computer.
2

FOIREQ24/00134 101

In light of this, a document(s) has been created under section 17 in response to your
request and is attached.
Disclosure log decision
Section 11C of the FOI Act requires the OAIC to publish documents released under
the FOI Act on the OAIC’s disclosure log within 10 days of release, except if they
contain personal or business information that would be unreasonable to publish.
As discussed above and I have identified 1 document subject to your request that
does not contain personal or business information.
Accordingly, I have made a decision to publish the document subject to your request
on the OAIC’s disclosure log.
Release of document/s
The document is enclosed for release.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
23 January 2024
3

FOIREQ24/00134 102

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

4

FOIREQ24/00134 103

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

5

FOIREQ24/00134 104

FOIREQ24/00134 105

emails between O.A.I.C STAFF / MANAGEMENT TO FROM AND BETWEEN, a.c.i.c
(staff and management), A.C.I.C IS AS PER understood
Further, on 8 January 2024 you also identified:
the ‘A.C.I.C’ to be referring to the Australian criminal intelligence commission
On 15 January, I consulted with you under section 24AB of the FOI Act for a second
time. I found that a practical refusal reason still existed as the work involved in
processing your revised request would substantially and unreasonably divert the
resources of the OAIC from its other operations due to its size and scope (s
24AA(1)(a)(i) of the FOI Act). I thus gave you the opportunity to revise your request
again.
On 18 January, you responded to my second s 24AB notice email with the following:
Altered to read , emails between A.C.I.C AND o.a.i.c
Request timeframe
On 15 January 2024, following my second consultation notice under s 24AB of the FOI
Act, the statutory period was paused. You responded on 18 January 2024 and a
decision is due in relation to your request on 25 January 2024.
Decision
I am an officer authorised under s 23(1) of the FOI Act to make decisions in relation to
FOI requests on behalf of the OAIC.
Following consultation with you under s 24AB of the FOI Act, I have decided to refuse
access to the documents you requested under s 24(1) of the FOI Act because a
‘practical refusal reason’ still exists under s 24AA of the FOI Act.
I am satisfied that the work involved in processing your request will substantially and
unreasonably divert the OAIC’s resources from its other operations due to its size and
broad scope.
Reasons for decision
Request consultation process
On 15 January 2024, I wrote to you under s 24AB of the FOI Act to advise you of my
intention to refuse your request under s 24(1) of the FOI Act on the basis that you
2

FOIREQ24/00134 106

request gave rise to the following practical refusal reason under s 24AA of the FOI
Act) being:
•  I believe that the work involved in processing your request/your revised
request will substantially and unreasonably divert the resources of the OAIC
from its other operations due to its size and scope (s 24AA(1)(a)(i)
I gave you an opportunity to respond to my consultation notice and revise the scope
of your request so as to remove the practical refusal reason. Specifically, I asked you
to advise whether you wanted to:
•  withdraw your request
•  make a revised request
•  tell us that you do not wish to revise your request.
In my consultation letter, I suggested the following ways you could revise your
request:
•  narrowing the terms of your request to a document category (e.g. email
correspondence)
•  refer to particular matter or issue
•  limit the request by time period
•  limit the request by records held on Resolve
I also suggested the following revision of scope for your consideration:
i request under the freedom of information, act documents to/from/between the
A.C.I.C and the O.A.I.C 1/1/23 to date held on resolve
On 18 January 2024, you responded to the consultation notice, with the following
revised scope:
Altered to read , emails between A.C.I.C AND o.a.i.c
Materials taken into account
In making my decision, I have had regard to the following:
•  your freedom of information request of 22 December 2023;
•  the reasons why a practical refusal reason exists, as provided to you in my
consultation notice of 15 January 2024;
•  your correspondence of 18 January 2024;
•  the FOI Act, in particular s 15, 24, 24AA and 24AB; and
3

FOIREQ24/00134 107

•  the Guidelines issued by the Australian Information Commissioner under s
93A of the FOI Act to which regard must be had in performing a function or
exercising a power under the FOI Act (FOI Guidelines).
Practical refusal reason
Under s 24(1) of the FOI Act, if an agency or Minister is satisfied, when dealing with a
request for a document, that a practical refusal reason exists in relation to the
request, the agency or Minister:
(a) must undertake a request consultation process; and

(b) If, after the request consultation process, the agency or Minister is
satisfied that the practical refusal reason still exists- the agency or
Minister may refuse to give access to the document in accordance with
the request.
For the purposes of s 24, a practical refusal reason exists in relation to a request if:
•  the work involved in processing the request will substantially and
unreasonably divert the resources of the OAIC from its other operations (s
24AA(1)(a)(i)); and/or

•  the request does not sufficiently identify the documents being sought
(s 24AA(1)(b) and s 15(2)(b)).
Unreasonable diversion of resources
An estimate of processing time is only one of the considerations to be taken into
account when deciding whether a practical refusal reason exists. As well as requiring
a request to substantially divert an agency’s resources, s 24AA also requires the
request to unreasonably divert an agency’s resources from its other functions before
it can be refused under s 24.
The Guidelines issued by the Australian Information Commissioner under s 93A of the
Freedom of Information Act 1982 (FOI Guidelines) identify matters that may be
relevant when deciding whether processing the request will unreasonably divert an
agency’s resources from its other functions. These include:
•  the staffing resources available to the OAIC for FOI processing
•  the impact that processing the request may have on other tasks and functions
of the OAIC
•  whether an applicant has cooperated in revising the scope of the request
4

FOIREQ24/00134 108

•  whether there is a significant public interest in the requested documents
•  other steps taken by an agency or minister to publish information of the kind
requested by an applicant.
The OAIC is a small agency, employing approximately 150 (head count) staff. I
consider that processing a request of this size would substantially impact on the
OAIC’s operations because of the limited number of people the OAIC has available to
process FOI requests of this size and nature.
Calculation of the processing time – substantial diversion

As outlined in my second consultation notice, based on preliminary analysis of the
potential documents within the scope of your request, I consider that it would in
excess of 70 hours to complete search and retrieval for documents relevant to your
request. This is before any time is taken into account for the review of the documents
and decision making.
I acknowledge that in your response to the consultation notice you revised the scope
to emails between A.C.I.C AND o.a.i.c. However, without limiting the scope to emails
held on resolve as suggested or limiting the timeframe further the same search and
retrieval will be required to identify all documents relevant to your revised request.
My preliminary analysis identified that to identify documents within the scope of
your request:

•  Staff would need to review 35 resolve files where the ACIC was named to
identify relevant correspondence between the OAIC and the ACIC. Relevant
documents would need to be downloaded and scheduled.
•  Staff would need to review 50 documents on content manager where the
ACIC was named to identify relevant correspondence between the OAIC and
the ACIC. Relevant documents would need to be downloaded and scheduled.
•  All staff (approximately 150) would need to conduct searches on their outlook
to identify correspondence between themselves and the ACIC. Relevant
documents would need to be downloaded and scheduled
•  Generic outlook inboxes (approximately 30).

I have conservatively estimated that it would take on average:

•  1 hour per resolve file to (1 hour x 35 = 35 hours)
•  6 minutes per document on content manager (0.1 x 50 = 5 hours)
•  12 minutes per staff member to search their outlook (0.2 x 150 = 30 hours)
•  12 minutes per search of generic outlook inboxes (0.2 x 30 = 6 hours)
5

FOIREQ24/00134 109

As set out above, I consider that the same search and retrieval would be required for
your revised request. As such, I consider it would take more than 76 hours to
complete the search and retrieval and identify all documents relevant to your
request.
I have reviewed the sample of documents falling within scope of your request. I have
reviewed 3 resolve files and a total of 270 pages of documents. The documents
comprise of documents to and from applicants in additional to correspondence with
ACIC. I have identified on these files only a small number of documents relevant to
the request (>10).
A preliminary review of this material indicates that the documents contain
sensitivities. At a minimum, I would have to consider the application of the following
FOI Act exemption provisions;

•  Section 47E (operations of an agency)
•  Section 47F (personal information)
•  Section 42 (legal professional privilege)

Based on a sampling exercise, I estimate that it will take between 1-2 minutes per
page to examine and assess each document for potential release in accordance with
FOI Act exemption provisions. However, even after conducting a sample it is difficult
to accurately ascertain how many documents relevant to the scope of the request
would be identified. I have conservatively estimated 5 hours for decision making. I
further estimate that it will require 3 hours to prepare an edited PDF copy of the
documents, including the redaction of exempt material. I also estimate that it will
take 2 hours to prepare a decision statement and schedule of documents.

I have therefore calculated it will take at least 86 hours to process your request.
I consider that the processing of your request would be a substantial diversion of the
OAIC’s resources, for the purposes of section 24AA(1)(a)(i) of the FOI Act.
On the basis that your request will require at least 86 hours to process, it is likely that
the processing of your request would divert OAIC staff away from their other work,
including the OAIC’s:
•  ability to process its ongoing FOI request load
•  regulatory functions in both FOI and privacy
•  activities set out in the OAIC’s 2020/2021 Corporate Plan such as:
6

FOIREQ24/00134 110

o  conciliating and investigating privacy complaints, responding to
notifiable data breaches, and overseeing the privacy aspects of the My
Health Record system
o  monitoring the handling of personal information in the COVIDSafe
system.
o  implementation of the Consumer Data Right scheme
o  monitoring compliance with new legislation and providing guidance
and education
o  improvement of processes for managing FOI requests
o  engage with the Open Government Partnership, with delivery of the
third National Action Plan.
I have also taken into consideration relevant decisions from the Administrative
Appeals Tribunal (AAT).  In particular, I have had regard to the decision of Tate and
Director, Australian War Memorial [2015] AATA 107, another smaller agency of a
similar size to the OAIC, in which the AAT affirmed a decision by the Australian War
Memorial to refuse access to documents for a practical refusal reason. In making its
decision, the AAT considered not only the size of the Australian War Memorial (which
employs 330 full-time equivalent staff) but also that at the time the request was
made the corporate priority of the Australian War Memorial was to prepare for and
deliver on the Centenary of ANZAC and First World War commemorations. In this
context, processing the request was considered to involve a substantial and
unreasonable diversion of the Australian War memorial’s resources. In that matter,
the AAT also considered that the Australian War Memorial had acted reasonably in
relation to the applicant’s requests and had cooperated with him to a significant
extent by providing documents in response to informal requests.
Having regard to the above time estimate and advice received in relation to the
processing of your request. I consider that 86 hours to process one FOI request is
clearly both a substantial and unreasonable diversion of the OAIC’s resources from
its other operations.
Conclusion
On the basis of the above considerations, I have found that:
•  the processing of your FOI request would substantially and unreasonably
divert the resources of the OAIC from its other operations (s 24AA(1)(a)(i)
As such I have decided to refuse your request on the basis that a practical refusal
reason exists in relation to your request for access to the documents. Accordingly, I
have decided to refuse your request under s 24(1) of the FOI Act.
7

FOIREQ24/00134 111

Your review rights are outlined on the following page.
Yours sincerely,
Emily Elliot
Senior Lawyer
25 January 2024

8

FOIREQ24/00134 112

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further Review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

9

FOIREQ24/00134 113

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

10

FOIREQ24/00134 114

OFFICIAL: Sensitive
FOIREQ24/00134 115

Decision
Searches undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
In response to your request, the following line areas of the OAIC conducted
reasonable searches for documents relevant to you request:
•  OAIC People and Culture
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
The following search terms were used when undertaking electronic records
searches:
•  Position description information all stored in one folder relating to the
advertisement of this job.
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request and that all relevant documents have
been found.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 06 January 2024.
•  the FOI Act, in particular section 3, 11, 11A, 15 and 26 of the FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
•  consultation with line area/s of the OAIC in relation to your request
2
OFFICIAL: Sensitive

OFFICIAL: Sensitive
FOIREQ24/00134 116

I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC. I have made a decision to grant full
access to the 2 documents identified as relevant to your request
Disclosure log decision
Section 11C of the FOI Act requires the OAIC to publish documents released under
the FOI Act on the OAIC’s disclosure log within 10 days of release, except if they
contain personal or business information that would be unreasonable to publish.
I have made a decision to publish the documents subject to your request on the
OAIC’s disclosure log.
Release of document/s
The documents are enclosed for release.
The documents are identified in the attached schedule of documents.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
24 January 2024.
3
OFFICIAL: Sensitive

OFFICIAL: Sensitive
FOIREQ24/00134 117

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

4
OFFICIAL: Sensitive

OFFICIAL: Sensitive
FOIREQ24/00134 118

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

5
OFFICIAL: Sensitive

FOIREQ24/00134 119

FOIREQ24/00134 120

Request timeframe
Your request was made on 24 December 2023.
On 4 January 2024, you agreed to an extension of time under section 15AA of the FOI
Act.
This means that a decision on your request is due to be decided by 6 February 2024.
Decision and reasons for decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
I have made the decision to refuse your request on the basis that documents cannot
be found or do not exist.
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 24 December 2023
•  the FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
Documents cannot be found, do not exist or have not been received – Section 24A of
the FOI Act
I have made the decision to refuse your request under section 24A of the FOI Act on
the basis that all reasonable steps have been taken to find documents relevant to
your request and that documents cannot be found or do not exist.
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
Searches Undertaken
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
2

FOIREQ24/00134 121

•  OAIC’s email system
•  general computer files
•  paper files
I have reviewed the searches undertaken and am satisfied that all reasonable steps
have been taken to identify documents relevant to your request. I note that draft
guidance was identified but as this draft is not currently in use it is excluded by the
terms of your request. I also note that staff refer to the FOI guidelines and in
particular, part 3 of the FOI Guidelines, available on the Office of the Australian
Information Commissioner website. You can access this document at Part 3:
Processing and deciding on requests for access | OAIC. Again, as your request only
related to internal guidance, this document is excluded by the terms of your request.
Conclusion
Based on the terms of your request and searches undertaken, I am satisfied that all
reasonable steps have been taken to find documents that fall within the scope of
your request and am satisfied that documents cannot be found or do not exist
I have made the decision to refuse your request for access to documents under
section 24A of the FOI Act.
Please see the following page for information about your review rights in relation to
this FOI request.
Yours sincerely,
Emily Elliott
Senior Lawyer
29 January 2024
3

FOIREQ24/00134 122

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

4

FOIREQ24/00134 123

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

5

FOIREQ24/00134 124

FOIREQ24/00134 125

Request timeframe
Your request was made on 7 December 2023.
On 8 December 2023, the OAIC wrote to you to acknowledge receipt of your request
and requested whether you would be agreeable to an extension of time under
section 15AA of the FOI Act due to reduced staff capacity over the Xmas and New Year
period. On the same day, you replied with the following:
s 47F
On 4 January 2024, the OAIC wrote to you to inform you that your request includes
documents which contain information concerning an organisation’s business or
professional affairs and third-party personal information. Accordingly, as the OAIC is
required to consult with those individuals and organisation(s) under s 27 and s 27A of
the FOI Act before making a decision on the release of those document(s), the period
for processing your request has been extended by 30 days to allow time for this
consultation.
This means that a decision on your request is due by 5 February 2024.
2

FOIREQ24/00134 126

Consultation
I consulted with the relevant third party in relation to this request and they did not
raise any objection in relation to the release of the relevant documents.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to:
•  grant full access to 30 documents, and
•  grant access in part to 27 documents, and
•  refuse access in full to 2 documents.
In accordance with section 26(1)(a) of the FOI Act, the reasons for my decision and
findings on material questions of fact are provided below.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within the scope of an FOI request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to you request:
•  Legal Services
•  Strategic Communications
•  OAIC Executive staff
Searches were conducted across the OAIC’s various document storage systems
including:
•  individual OAIC staff members’ Microsoft Teams chat messages
The following search terms were used when undertaking electronic records
searches:
•  HWL Ebsworth
•  HWLE
•  Ebsworth
3

FOIREQ24/00134 127

Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 7 December 2023
•  the FOI Act, in particular sections 22, 27, 27A, 47E(d) and 47F of the FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
•  third party submissions in relation to the release of the documents dated 16
January 2024
•  consultation with line areas of the OAIC in relation to your request
Access to edited copies with irrelevant and exempt matter deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that FOI Act exemptions apply to this material.
I have also identified the following material within the documents to be irrelevant or
out of scope of your request:
•  discussions between OAIC staff regarding work not related to the HWL
Ebsworth data breach
Accordingly, I have made an edited copy of the documents which removes this
irrelevant material.
Section 47E(d) – Proper and efficient conduct of the OAIC’s operations
In accordance with section 47E(d) of the FOI Act, I have also made a decision to
exempt material on the basis that disclosure would or could reasonably be expected
to have a substantial adverse effect on the proper and efficient conduct of the OAIC’s
operations.
4

FOIREQ24/00134 128

Paragraph 6.101 of the FOI Guidelines explains that:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or allegation that damage may occur if the document were to be
released.

Additionally, at 6.103 the FOI Guidelines further explain:

An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision-
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).
The material that I have decided is subject to conditional exemption comprises of
material relating to ongoing and closed investigation and litigation matters. This
material includes information about the third parties that were impacted by the HWL
Ebsworth data breach. In addition, I have also decided that some material relating to
how the OAIC was to manage the HWL Ebsworth data breach is subject to the
conditional exemption where that information may impact on the ability to manage
this and other similar data breaches that may occur in the future.
In undertaking an assessment of this conditional exemption, I have had regard to
relevant and recent AAT and Information Commissioner decisions including Seven
Network Operations Limited and Australian Human Rights Commission [2021] AICmr
66, Paul Farrell and Department of Home Affairs (Freedom of information) (No 2) [2022]
AICmr 49 (8 April 2022) and Knight v Commonwealth Ombudsman [2021] AATA 2504.
In Seven Network Operations Limited and Australian Human Rights Commission [2021]
AICmr 66, a document was found not to be conditionally exempt under
section 47E(d) of the FOI Act in circumstances where the agency argued that
disclosure of the relevant material would or could reasonably be expected to have
resulted in stakeholders declining to work with the Australian Human Rights
Commission. The decision found that there was not sufficient evidence to support
the conclusion that such harm would occur. Similarly in Paul Farrell and Department
of Home Affairs (Freedom of information) (No 2) [2022] AICmr 49 (8 April 2022), whilst
the material found within the documents related to the Department of Home Affairs’
operations, the Commissioner determined that the Department had failed to provide
sufficient evidence as to why disclosure would have a substantial and adverse effect
5

FOIREQ24/00134 129

on its operations. These decisions further reinforce the position that this provision
requires a high threshold as to the substantial and adverse effect that disclosure
would have on an agency’s operations.
In order to determine whether disclosure would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the
operations of the OAIC, I have taken into consideration the functions and activities of
the OAIC.
The OAIC is an independent statutory agency within the Attorney-General’s portfolio,
established under the Australian Information Commissioner Act 2010 (Cth). The OAIC
comprises the Australian Information Commissioner and the Privacy Commissioner
(both offices currently held by Angelene Falk), the FOI Commissioner (office currently
held in an acting capacity by Toni Pirani), and the staff of the OAIC.
I consider that the disclosure of the material would or could reasonably be expected
to have an adverse effect on this function for the following reasons:
Litigation and investigations impacted by the HWL Ebsworth breach
The material that I have considered as conditionally exempt, is the names of
individuals and parties (and identifying information such as file reference numbers)
who have or had matters with the OAIC. If this information is disclosed in response
to this FOI request, it will become known that these individuals and parties were also
affected by the HWL Ebsworth breach. In my view, the disclosure of this information
may subject these individuals and parties to a greater risk of harm from the HWL
Ebsworth breach. In addition, it may impact on the confidence of those making
complaints to the OAIC to manage data breaches affecting the OAIC to ensure the
minimisation of harm. In my view, the disclosure particularly of the identity of those
affected by the HWL Ebsworth breach could reasonably be expected to have an
adverse effect on the OAIC’s functions.
Management of the HWL Ebsworth breach

The material I have considered as conditionally exempt, is material relating to the
management of the HWL Ebsworth breach where that information is not in the public
domain and its release could impact on the effectiveness of the response to both this
breach and future breaches. In my view, the disclosure of this material could
reasonably be expected to have an adverse effect on the OAIC’s functions.
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47E(d) of the FOI Act.
6

FOIREQ24/00134 130

As section 47E is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Public interest conditional exemptions--personal privacy (section 47F)
In accordance with section 47F of the FOI Act, I have made a decision to redact
material on the basis that disclosure would constitute an unreasonable disclosure of
personal information.
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) also applies to the FOI Act. The term personal information is
defined in section 6 of the Privacy Act to be:
… information or an opinion about an identified individual, or an individual
who is reasonably identifiable:

(a)
whether the information or opinion is true or not;

(b)
whether the information or opinion is recorded in a material form or
not.
Teams messages are used by OAIC to message about both work and work related
personal matters such as medical appointments, leave and personal circumstances.
I am satisfied that this material meets the definition of personal information.
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:

•  the extent to which the information is well known
•  whether the person to whom the information relates is known to be
associated with the matters in the document
•  the availability of the information from publicly accessible sources
•  any other matters the agency or Minister considers relevant.

7

FOIREQ24/00134 131

The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:

•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.

The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
•  any detriment that disclosure may cause to the person to whom the
information relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s collection and use of the information
•  the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
•  any submission an FOI applicant chooses to make in support of their
application as to their reasons for seeking access and their intended or
likely use or dissemination of the information, and
•  whether disclosure of the information might advance the public interest in
government transparency and integrity
In consideration of these factors and the material contained within the documents, I
am satisfied that the release of this personal information would be unreasonable
because it relates to the personal circumstances of individual staff members. This is
because the relevant material is not publicly available and is not well known. If this
information were disclosed publicly, it would unreasonably impact on the privacy of
the individual.
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47F of the FOI Act.
As section 47F is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
8

FOIREQ24/00134 132

Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject
to conditional exemption under sections 47E(d) and 47F.

Section 11A(5) provides that where documents are considered to be conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision, on balance, would be contrary to the public interest.

This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not
be taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely
of individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter will often depend
on a balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to all members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole.  It
may be sufficient that the matter is in the interest of a section of the public
bounded  by  geography  or  another  characteristic  that  depends  on  the
particular situation.  A matter of public interest or benefit to an individual or
small group of people may also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision, Deputy President Forgie explained that:

… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest. Where the balance lies may vary from
9

FOIREQ24/00134 133

time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.

The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, we consider the following to be relevant:
•  promote the objects of the FOI Act,
•  inform debate on a matter of public importance, and
•  allow a person to access his or her own personal information
Section 11B(4) of the FOI Act provides factors which are not to be taken into account,
in which I have had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the follow factors do not favour disclosure:
•  disclosure could subject individuals and organisations subject to the HWL
Ebsworth breach to greater risk of harm from the breach;
•  disclosure could have an impact on the ability to respond effectively to the
breach and future breaches; and
•  disclosure of the personal information contained in the documents could
reasonably be expected to interfere with an individual’s right to privacy.
In balancing these factors for and against, I have placed significant weight on
ensuring the OAIC can effectively respond to the HWL Ebsworth breach and protect
the interests of those individuals and organisations affected by the breach. I have
also given weight to the fact that Teams messages are used by OAIC to advise
colleagues of absences and personal matters and these while related to the
workplace do not contribute to public understanding of how the OAIC has responded
to the HWL Ebsworth breach as an agency affected by the breach.

On balance, I consider the public interest factors against disclosure to be more
persuasive than the public interest factors favouring disclosure. I am satisfied that
the public interest is to not disclose the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online documents released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
Although I have determined that the documents released will be uploaded to the
OAIC’s disclosure log, I note that your name appears within the document. I have
10

FOIREQ24/00134 134

decided to exempt your name from the documents released on the disclosure log
under s 11C(1)(a) of the FOI Act.
Release of document
The documents are enclosed for release.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
5 February 2024
11

FOIREQ24/00134 135

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5288
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

12

FOIREQ24/00134 136

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5288
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

13

FOIREQ24/00134 137

FOIREQ24/00134 138

Subject to the following provisions of the FOI Act, I have made a decision to grant full
access to 1 document.
Searches undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
In response to your request, the OAIC conducted reasonable searches for documents
relevant to your request. In relation to your previous request s 47F
you
requested:
s 47F
I have concluded that any documents relevant to your current request would be
contained within the documents identified as relevant to the above request. As such,
a review of these documents was undertaken and 1 document was identified as
relevant to your request.
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 10 January 2024;
•  the FOI Act, in particular sections 3, 11, 11A, 15 and 26 of the FOI Act;
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
Disclosure log decision
Section 11C of the FOI Act requires the OAIC to publish documents released under
the FOI Act on the OAIC’s disclosure log within 10 days of release, except if they
contain personal or business information that would be unreasonable to publish.
The document subject to this decision contains personal information.
2

FOIREQ24/00134 139

Accordingly, I have determined that it would be unreasonable to publish the
document on the disclosure log.
Release of document
The documents are enclosed for release.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
7 February 2024
3

FOIREQ24/00134 140

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 30 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

4

FOIREQ24/00134 141

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

5

FOIREQ24/00134 142

FOIREQ24/00134 143

s 47F
On 10 January 2024, the OAIC advised you of the original decision. The delegate Ms
Emily Elliott decided to refuse the FOI request on the basis that all reasonable steps
have been taken to find the documents in scope of the request, and that relevant
documents cannot be found or do not exist, in accordance with s 24A of the FOI Act.
On the same day, you applied for an internal review of that decision. You said:
s 47F
A decision on your internal review decision is due on 9 February 2024.
Decision
I am an officer authorised under s 23(1) of the FOI Act to make decisions in relation to
FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to:
•  affirm the decision of 10 January 2024.
Reasons for decision
Materials taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 13 December 2023 and subsequent revised scope
dated 19 December 2023
•  your internal review request dated 10 January 2024
•  original decision of Ms Emily Elliott dated 10 January 2024
•  consultation/communications with you in relation to your request
•  the FOI Act, in particular s 24A of the FOI Act

FOIREQ24/00134 144

•  the Guidelines issued by the Australian Information Commissioner under s
93A of the FOI Act to which regard must be had in performing a function or
exercising a power under the FOI Act (FOI Guidelines)
•  consultation with line area/s of the OAIC in relation to your request, and
search efforts from the line area in conducting search and retrieval of your FOI
request.
•  Search results from the searches I conducted of the relevant Outlook mailbox.
Searches Undertaken (s 24A)
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
Part [3.88] and [3.89] of the FOI Guidelines explain:
The Act is silent on what constitutes ‘all reasonable steps’. The meaning of
‘reasonable’ in the context of s 24A(1)(a) has been construed as not going beyond the
limit assigned by reason, not extravagant or excessive, moderate and of such an
amount, size or number as is judged to be appropriate or suitable to the
circumstances or purpose.

Agencies and ministers should undertake a reasonable search on a flexible and
common sense interpretation of the terms of the request. What constitutes a
reasonable search will depend on the circumstances of each request and will be
influenced by the normal business practices in the agency’s operating environment
or the minister’s office.
As part of the internal review process I reviewed the searches performed in the
course of processing your original request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to you request:
•  Corporate Services Team
•  Enquiries Team
•  Information, Communication and Technology team (ICT) and
•  Legal Services Team.
Searches were conducted across the OAIC’s various document storage systems
including:
•  OAIC’s email system – Microsoft Outlook, and
•  OAIC’s relevant IT systems.

FOIREQ24/00134 145

The Corporate Services Team coordinated with the ICT team, which provided the
following additional information as to the searches conducted/documents found:
We have coordinated feedback from the relevant technical teams in response to the
enquiry.
…..
Email messages from the oaic.gov.au domain, or any DEWR managed domains, do
not actively track users outside of system administration. There is no method for IT
to send tracking/cookie agents via email.
The Enquiries team provided the following additional information as to the searches
conducted:
s 47F
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, and having considered your internal
review request, there is no evidence of any dishonesty or officers acting in bad faith
in conducting the searches, as you have alleged.
Based on the search efforts before me, and having considered the requirements of
reasonable steps undertaken under the FOI Act, I am satisfied that a reasonable
search has been undertaken in response to your request, and that no relevant
documents can be found or they do not exist.
If you are not satisfied with my decision, please see the following page for
information about your review rights.
Yours sincerely
Margaret Sui
Principal Lawyer
9 February 2024

FOIREQ24/00134 146

If you disagree with my decision

Further Review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You have the right to seek review of this decision by the Information Commissioner.
(IC review). If you wish to apply for IC review, you must do so in writing within 30
days. Your application must provide an address (which can be an email address or
fax number) that we can send notices to and include a copy of this letter.
It is the Information Commissioner's view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR_
10
Alternatively, you can post your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001

Or apply by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.

FOIREQ24/00134 147

FOIREQ24/00134 148

Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to you request:
•  Dispute Resolution Team
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  OAIC’s email system
•  general computer files
The following search terms were used when undertaking electronic records
searches:
•  Summary contains ‘1KB’ & ‘s 47F
’ and ‘s 47F
’
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 15 December 2023
•  the FOI Act, in particular, including sections 3, 11, 11A, 15 and 26 of the FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
Access to edited copies with irrelevant and exempt matter deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
2

FOIREQ24/00134 149

I have determined that no exemptions apply to this material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
As discussed above and identified in the attached documents schedule, the
documents subject to this decision contain personal information.
Accordingly, I have determined that it would be unreasonable to publish documents
on the disclosure log.
Release of document
The documents are enclosed for release.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
15 January 2024
3

FOIREQ24/00134 150

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

4

FOIREQ24/00134 151

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

5

FOIREQ24/00134 152

FOIREQ24/00134 153

Applications from agencies under s 89K of the FOI Act seeking to have persons
declared vexatious applicants, for the period from 1 January 2022 to the date of
this  request, excluding  any attachments.  Personal information relating to the
applicants  is  excluded  from  the  scope  of  this  request  (except  for  applicants
names).
Decision
I  am  an  officer  authorised  under  section  23(1)  of  the  FOI  Act  to  make  decisions  in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to:
•  grant access in part to 13 documents; and
•  refuse access in full to 3 documents.
In accordance with section 26(1)(a) of the FOI Act, the reasons for my decision and
findings on material questions of fact are provided below.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within  scope  of  an  FOI  request.  The  following  line  area  of  the  OAIC  conducted
reasonable searches for documents relevant to you request:
•  Significant Decisions Team, Freedom of Information Branch
Searches  were  conducted  across  the  OAIC’s  various  document  storage  systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
•  general computer files
•  paper files
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
2

FOIREQ24/00134 154

Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 17 January 2024 and subsequent revised scope dated
2 February 2024;
•  the FOI Act, in particular sections 3, 11, 11A, 11B 15, 22, 24AB, 26, 47E(d), 47F,
of the FOI Act;
•  the  Guidelines  issued  by  the  Australian  Information  Commissioner  under
section 93A of the FOI Act to which regard must be had in performing a function
or exercising a power under the FOI Act (FOI Guidelines); and
•  consultation  with  the  relevant  line  area  of  the  OAIC  in  relation  to  your  FOI
request.
Access to edited copies with irrelevant and exempt matter deleted (section 22)
In  accordance  with  section  22  of  the  FOI  Act,  an  agency  must  consider  whether  it
would be reasonably practicable to prepare an edited copy of documents subject to
an  FOI  request  where  material  has  been  identified  as  exempt  or  irrelevant  to  the
request.
I have determined that FOI Act exemptions apply to this material. I also note that you
have excluded personal information relating to the applicants from the scope of your
FOI request (except for applicants’ names).
Accordingly,  I  have  made  an  edited  copy  of  the  documents  which  removes  this
irrelevant and conditionally exempt material and otherwise grants you part access to
the material in scope of your request.
Section 47E(d) – Proper and efficient conduct of the OAIC’s operations
In accordance with section 47E(d) of the FOI Act, I have made a decision to exempt
material on the basis that disclosure would or could reasonably be expected to have
a  substantial  adverse  effect  on  the  proper  and  efficient  conduct  of  the  OAIC’s
operations.  The  material  I  have  determined  is  exempt  is  contained  in  documents
relating to a vexatious declaration application that is currently open and ongoing.  In
relation  to  vexatious  declaration  applications  that  have  been  closed  I  have
determined that material identifying either the agency that made the application or
3

FOIREQ24/00134 155

individual/organisation that was subject to the application is also exempt. Paragraph
6.101 of the FOI Guidelines explains that:
For  the  grounds  in  ss  47E(a)–(d)  to  apply,  the  predicted  effect  needs  to  be
reasonably  expected  to  occur.  The  term  ‘could  reasonably  be  expected’  is
explained  in  greater  detail  in  Part  5.  There  must  be  more  than  merely  an
assumption or allegation that damage may occur if the document were to be
released.
Additionally, at 6.103 the FOI Guidelines further explain:
An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).
In  undertaking  an  assessment  of  this  conditional  exemption,  I  have  had  regard  to
relevant  and  recent  AAT  and  Information  Commissioner  decisions  including  Seven
Network Operations Limited and Australian Human Rights Commission [2021] AICmr 66,
Paul  Farrell and Department of Home Affairs  (Freedom of  information)  (No  2)  [2022]
AICmr 49 (8 April 2022) and Knight v Commonwealth Ombudsman [2021] AATA 2504.
In Seven Network Operations Limited and Australian Human Rights Commission [2021]
AICmr 66, a document was found not to be conditionally exempt under section 47E(d)
of  the  FOI  Act  in  circumstances  where  the  agency  argued  that  disclosure  of  the
relevant  material  would  or  could  reasonably  be  expected  to  have  result  in
stakeholders declining to work with the Australian Human Rights Commission. The
decision found that there was not sufficient evidence to support the conclusion that
such harm would occur.
Similarly in Paul Farrell and Department of Home Affairs (Freedom of information) (No
2)  [2022]  AICmr  49  (8  April  2022),  whilst  the  material  found  within  the  documents
related to the Department of Home Affairs’ operations, the Commissioner determined
that the Department had failed to provide sufficient evidence as to why disclosure
would have a substantial and adverse effect on its operations. These decisions further
reinforce the position that this provision requires a high threshold as to the substantial
and adverse effect that disclosure would have on an agency’s operations.
In order to determine whether disclosure would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the operations
of the OAIC, I have taken into consideration the functions and activities of the OAIC.
4

FOIREQ24/00134 156

The OAIC is an independent statutory agency within the Attorney-General’s portfolio,
established under the Australian Information Commissioner Act 2010 (Cth). The OAIC
comprises  the  Australian  Information  Commissioner  (IC)  and  the  Privacy
Commissioner (both offices currently held by Angelene Falk), the FOI Commissioner,
and  the  staff  of  the  OAIC.  Relevant  to  this  case,  the  OAIC  is  responsible  for
determining applications made by agencies under  s 89K of the FOI Act. This forms
part of the OAIC’s regulatory functions.
The AAT has recognised that the conduct of an agency’s regulatory functions can be
adversely  affected  in  a  substantial  way  when  there  is  a  lack  of  confidence  in  the
confidentiality of the investigation process Telstra Australian Limited and Australian
Competition  and  Consumer  Commission  [2000]  AATA  71  (7  February  2000)  [24].  I
further  note  that  the  importance  of  protecting  information  collected  during  an
investigation  process  was  upheld  in  the  recent  IC  decision  of  ‘YU’  and  Bureau  of
Meteorology (Freedom of Information) [2021] AICmr75 (YU).  Whilst the decision of YU
was in relation to an investigation of under the  Public Interest Disclosures Act 2013
(Cth), YU also highlighted other relevant case law that confirms the importance of
agencies being able to undertake confidential investigative processes.
The  determination  of  an  application  under  s  89K  of  the  FOI  Act  is  an  investigative
process  insofar  as  the  OAIC  is  required  to  obtain  facts  from  the  relevant  parties,
consider  submissions  and  make  an  assessment  prior  to  determining  an  outcome.
The  FOI  Guidelines  set  out  the  process  for  an  agency  in  making  an  application  for
vexatious  declaration.    Detailed  information  about  the  FOI  applicant  and  their
applications is required. Paragraph 12.4 of the FOI Guidelines also provide that:
12.4…..A  broader  pattern  of  contact  between  a  person  and  an  agency  may
nevertheless  be  relevant  in  deciding  whether  as  a  matter  of  discretion  a
declaration should be made under s 89K.
As such, applications may include detailed information about patterns of behaviour
an  individual  has  with  an  agency.  This  information  is  provided  to  the  OAIC  in
confidence  in  the  initial  consideration  of  the  application  and  if  the  matter  is
withdrawn or the application declined, no information is publicly released about the
application.
I have identified 7 relevant applications during the specified period.  In one case, the
application  has  yet  to  be  determined  and  I  have  determined  that  the  material  is
exempt  in  full.    In  relation  to  the  other  6  applications,  1  was  declined  and  5  were
withdrawn by the agency prior to a decision being made.  No information has been
made public regarding these applications.
5

FOIREQ24/00134 157

In  my  view,  the  disclosure  of  this  information  may  impact  on  the  OAIC’s  ability  to
effectively assess future applications under s 89K of the FOI Act.  Particularly, agencies
may be reluctant to make applications and fully engage and provide all information
relevant to the application if this information is to be released publicly, particularly in
cases where the matter has been withdrawn or an application is unsuccessful.  For
these reasons, I consider the material to be conditional exempt under s 47E(d) of the
FOI  Act  on  the  basis  that  it  would  or  could  reasonably  be  expected  to  have  a
substantial  adverse  effect  on  the  proper  and  efficient  conduct  of  the  OAIC’s
operations.
As  section  47E  is  a  conditional  exemption,  I  am  also  required  to  consider  the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Section 47F – personal privacy
In  accordance  with  section  47F  of  the  FOI  Act,  I  have  made  a  decision  to  redact
material on the basis that disclosure would constitute an unreasonable disclosure of
personal information.
A  document  is  conditionally  exempt  under  section  47F(1)  of  the  FOI  Act  where
disclosure would involve the unreasonable disclosure of personal information of any
person,  including  a  deceased  person.  This  exemption  is  intended  to  protect  the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) also applies to the FOI Act. The term personal information is
defined in section 6 of the Privacy Act to be:
… information or an opinion about an identified individual, or an individual who
is reasonably identifiable:
(a)
whether the information or opinion is true or not;
(b)
whether the information or opinion is recorded in a material form or
not.
The documents contain personal information including names of third parties subject
to  the  vexatious  declarant  application.    I  note  that  you  have  exempted  personal
information about those individuals apart from their name and this information has
been removed under s 22 of the FOI Act.
6

FOIREQ24/00134 158

I am satisfied that this material meets the definition of personal information because
the material relates closely to the personal matters of an individual and disclosure of
this information would reasonably identify that individual.
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI Guidelines
provide the following considerations at paragraph 6.140:
•  the extent to which the information is well known
•  whether the person to whom the information relates is known to be associated
with the matters in the document
•  the availability of the information from publicly accessible sources
•  any other matters the agency or Minister considers relevant.
The  FOI  Guidelines  further  describes  the  key  factors  for  determining  whether
disclosure is unreasonable at paragraph 6.143:
•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.
The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of government-
held information and the private interest in the privacy of individuals’.
Consistent  with  FG  and  National  Archives  of  Australia  [2015]  AICmr  26,  the  FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
•  any  detriment  that  disclosure  may  cause  to  the  person  to  whom  the
information relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s collection and use of the information
7

FOIREQ24/00134 159

•  the fact that the FOI Act does not  control or restrict any subsequent use or
dissemination of information released under the FOI Act
•  any  submission  an  FOI  applicant  chooses  to  make  in  support  of  their
application as to their reasons for seeking access and their intended or likely
use or dissemination of the information, and
•  whether  disclosure  of  the  information  might  advance  the  public  interest  in
government transparency and integrity
I  am  satisfied  that  the  relevant  material  is  not  public  information  and  is  not  well
known.  I  am  also  satisfied  that  the  individuals  to  whom  the  information  relates  is
reasonably not known to be associated with the matters dealt with in the document.
If  this  information  were  disclosed  publicly,  it  would  unreasonably  impact  on  the
privacy of the individual.
The  recent  decision  of  Knight  v  Commonwealth  Ombudsman  [2021]  AATA  2504
discusses personal information collected in the course of a complaint or investigation.
At paragraph [32] the Tribunal found that:
In  the  circumstances  where  the  information  is  highly  sensitive  and  has  been
disclosed  on  a  confidential  basis,  it  would  be  unreasonable  to  disclose  that
information to the applicant.
I consider the collection of the material contained in this document to be of a similar
nature, in that it was collected during the course of an OAIC decision-making process.
I consider that the information is highly sensitive and that it would be unreasonable
to disclose this information.
For  the  reasons  given  above,  I  consider  the  relevant  documents  identified  in  the
schedule are conditionally exempt under section 47F of the FOI Act.
As  section  47F  is  a  conditional  exemption,  I  am  also  required  to  consider  the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Application of the public interest test – section 11A and 11B
As provided above, I have considered that material within the documents is subject to
conditional exemption under sections 47E(d) and 47F of the FOI Act.
8

FOIREQ24/00134 160

Section  11A(5)  provides  that  where  documents  are  considered  to  be  conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision maker would, on balance, would be contrary to the public interest.
This means that I must balance factors for and against disclosure in light of the public
interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not
be taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely
of individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter will often depend
on a balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to all members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole.  It
may be sufficient that the matter is in the interest of a section of the public
bounded  by  geography  or  another  characteristic  that  depends  on  the
particular situation.  A matter of public interest or benefit to an individual or
small group of people may also be a matter of general public interest.
In  the  AAT  case  of  Utopia  Financial  Services  Pty  Ltd  and  Australian  Securities  and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:
… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so
is, on balance, contrary to the public interest.  Where the balance lies may vary
from time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.
9

FOIREQ24/00134 161

The  FOI  Act  sets  out  four  factors  favouring  access  which  must  be  considered  if
relevant. Of these factors, I consider the following to be relevant:
•  disclosure would promote the objects of the FOI Act; and
•  disclosure would inform debate on a matter of public importance.
In  addition  to  these  factors  favouring  disclosure,  I  have  also  considered  that  the
following factors in favour of disclosure apply:
•  disclosure  would  reveal  the  reason  for  a  decision  of  government  and/or
provide further information surrounding that decision; and
•  disclosure would enhance scrutiny around government decision making.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in ,  which I have had  regard  to.  Section  11B  does not  further  prescribe the  factors
against  disclosure  to  be  considered.  In  considering  the  documents  subject  to  this
request, I consider that the follow factors do not favour disclosure:
•  disclosure  would  have  an  adverse  effect  on  the  OAIC’s  proper  and  efficient
operations relating to its decision-making processes under s 89K of the FOI Act,
and the FOI Act more broadly; and
•  disclosure  of  the  personal  information  contained  in  the  documents  could
reasonably be expected to interfere with an individual’s right to privacy.
I  have  given  significant  weight  to  the  sensitive  nature  of  the  personal  information
provided in an application under s 89K of the FOI Act and the fact that this information
is not disclosed publicly unless a declaration is made under s 89K of the FOI Act.  I note
that in each of the relevant applications the application is either open, declined or
withdrawn and the sensitive information is not publicly available.
I have balanced this with the importance of allowing publicly scrutiny of government
decision  making.    I  consider  that  by  removing  material  that  identifies  either  the
agency/organisation  or  individual  but  allowing  access  to  information  about  the
reasons for the application strikes the correct balance in weighing up these factors.  In
relation to the matter that is still open, I do not consider release of information about
the reasons for the application is appropriate at this time.
On  balance,  I  consider  the  public  interest  factors  against  disclosure  to  be  more
persuasive than the public interest factors favouring disclosure. I am satisfied that the
public interest is in withholding the exempt material.
10

FOIREQ24/00134 162

Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online documents released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
I have made a decision to publish the redacted documents subject to your request on
the OAIC’s disclosure log.
Release of documents
The  documents  are  being  prepared  for  release.    The  schedule  of  documents  is
attached and the documents will be released on Monday 19 February 2024.
Please see the following page for information about your review rights.
Yours sincerely
Emily Elliott
Senior Lawyer
16 February 2024
11

FOIREQ24/00134 163

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There is
no application fee for internal review.
If  you  wish  to  apply  for  an  internal  review,  please  mark  your  application  for  the
attention of the FOI Coordinator and state the grounds on which you consider that my
decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC review).
If  you  wish  to  apply  for  IC  review,  you  must  do  so  in  writing  within  60  days.  Your
application must provide an address (which can be an email address or fax number)
that we can send notices to, and include a copy of this letter. A request for IC review
can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the Act
it  is  desirable  that  my  decision  be  considered  by  the  AAT,  the  Information
Commissioner may decide not to undertake an IC review.
Section 57A of the FOI Act provides that, before you can apply to the AAT for review of
an FOI decision, you must first have applied for IC review.
12

FOIREQ24/00134 164

Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page on
our website.

13

FOIREQ24/00134 165

FOIREQ24/00134 166

Decision and reasons for decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
I have made the decision to refuse your request on the basis that documents do not
exist or cannot be found
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 29 January 2024
•  the FOI Act, in particular sections 3, 11, 11A, 15, 26 and 24A of the FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
•  consultation with line area of the OAIC in relation to your request
Documents cannot be found, do not exist or have not been received – Section 24A of
the FOI Act
Section 24A(1) of the FOI Act provides that an agency may refuse a request for access
to a documents requested under the FOI Act if all reasonable steps have been taken
to find the document and the agency is satisfied that the document cannot be found
or do not exist.
Section 24A(2) of the FOI Act provides that an agency may refuse a request for access
to a documents requested under the FOI Act if the agency has taken contractual
measures to ensure it receives a document from a contracted service provider but
has not done so after taking all reasonable steps to receive the document in
accordance with the contractual measures (section 24(2)).
I have made the decision to refuse your request under section 24A of the FOI Act on
the basis that all reasonable steps have been taken to find the documents you have
requested and the documents do not exist or cannot be found.
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
Searches Undertaken
In response to your request, the following line area of the OAIC conducted
reasonable searches for documents relevant to you request:
2

FOIREQ24/00134 167

•  Corporate Services
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
The following search terms were used when undertaking electronic records
searches:
s 47F
The officer from the line area who completed the search for documents was
nominated as that officer manages Content Manager and assists with Resolve system
administration.  The officer conducted searches of both record titles and document
content, as well as searches of case entities and client contacts. They concluded that
no relevant documents could be found after conducting these searches.
Having consulted with the relevant line area and having undertaken a review of the
records of the various search and retrieval efforts, I am satisfied that a reasonable
search has been undertaken in response to your request and that relevant
documents do not exist or cannot be found.
Conclusion
Based on the terms of your request and searches undertaken, I am satisfied that all
reasonable steps have been taken to find documents that fall within the scope of
your request and am satisfied that the documents do not exist.
I have made the decision to refuse your request for access to documents under
section 24A(1)(b)(ii) of the FOI Act, on the basis that documents do not exist or
cannot be found.
Please see the following page for information about your review rights in relation to
this FOI request.
Yours sincerely,
Emily Elliott
16 February 2024
3

FOIREQ24/00134 168

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

4

FOIREQ24/00134 169

Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.

5

FOIREQ24/00134 170

FOIREQ24/00134 171

s 47F
Request timeframe
Your request was made on 21 December 2023.
On 12 January 2024, you were informed that documents within the scope of your
request contained information concerning an organisation’s business or professional
affairs and third-party personal information. Accordingly, the OAIC was required to
consult with those third parties under s 27 and s 27A of the FOI Act before making a
decision on the release of those documents.
For this reason, the period for processing your request was extended by 30 days to
allow time for this consultation (see s 15(6) of the FOI Act).
This means that a decision on your request is due by 19 February 2024.
Consultation
I consulted with one third party in relation to third party personal information and
third-party business information contained within the documents.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to:
•  grant full access to 8 documents, and
•  grant access in part to 12 documents.
2

FOIREQ24/00134 172

In accordance with section 26(1)(a) of the FOI Act, the reasons for my decision and
findings on material questions of fact are provided below.
Searches undertaken
Section 24A(1) of the FOI Act provides that an agency may refuse a request for access
to a document requested under the FOI Act if all reasonable steps have been taken to
find the document and the agency is satisfied that the document cannot be found or
does not exist.
The FOI Act therefore requires that all reasonable steps have been taken to locate
documents within scope of an FOI request.
In response to your request, the following line areas of the OAIC conducted
reasonable searches for documents relevant to your request:
•  Privacy Early Resolution; and
•  Privacy Dispute Resolution.
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  Electronic documents on OAIC-issued laptops
•  the OAIC’s email system
•  Records of Microsoft Teams
•  iPads or tablets, smartphones and third-party apps (emails, text messages,
etc.)
•  Portable media devices including USBs or CD drives
•  CCTV
•  Hardcopy files
•  Searches for Metadata
Resolve
Searches of your complaint files regarding s 47F
was undertaken by
the Privacy Dispute Resolution and Privacy Early Resolution branches to obtain all
correspondence relating to these case files held by the OAIC. All correspondence on
this file has been extracted and provided to you for the purposes of this FOI request.
3

FOIREQ24/00134 173

Content Manager
The Information Management team and Privacy Dispute Resolution branch were
instructed to undertake searches for documents relating to s 47F
and
s 47F
and s 47F
and no additional documents were found that were
not already saved to the Resolve files.
Metadata
Previously in processing your FOI requests, the OAIC Business and Analytics and Data
Reporting team (BARD) advised that:
Metadata is the information that defines and describes data. It is often
referred to as data about data or information about data because it provides
data users with information about the purpose, processes, and methods
involved in the data collection. Metadata is information about the fields not the
content of the field.
BARD advised that should you wish to seek the metadata from your case files, this
could be obtained by generating a Resolve report. The relevant Resolve report has
been provided.
In our acknowledgement to you on 11 September, we sought clarification to whether
the Resolve Report was the document you were after. We did not receive a direct
response from you relating to this, and therefore your request has been processed
accordingly.
I can confirm that these searches and the Resolve Report incorporate and address the
following:
•  Internal and external phone calls, including the associated data & metadata;
•  Internal and external meetings;
•  Recordings  of  conciliation  and  associated  metadata,  notes,  system  notes,
including applicant, respondent and mediator; and
•  Ditto, notes system notes.
Internal and External calls
The OAIC does not record phone calls, both external and inbound phone calls, hence
the metadata for calls is not available.
Electronic documents on OAIC-issued laptops
The Privacy Dispute Resolution and Privacy Early Resolution branches undertook
4

FOIREQ24/00134 174

searches for electronic documents associated with the case files saved on any OAIC
issued laptops. All records saved to OAIC issued laptops are stored on Cloud System
called OneDrive which is the shared online network used by the OAIC. The line area
confirmed that there were no additional documents found on OAIC-issued laptops.
Microsoft Teams
Searches were conducted by Privacy Dispute Resolution and Privacy Early Resolution
branches on the Microsoft Teams program in relation to your OAIC case files, and no
documents were identified.
iPads or Tablets, smartphones and third-party apps (emails, text messages)
Searches were conducted by Privacy Dispute Resolution and Privacy Early Resolution
branches on the above devices who advised that they have not been issued with
iPads or tablets, and third-party apps (such as Twitter, WhatsApp) were not used to
discuss matters associated with the relevant case files.
Portable media devices including USBs and CD drives
The Privacy Dispute Resolution and Privacy Early Resolution branches confirmed
that no documents were saved on USBs or CD drives for the relevant case files.
CCTV
CCTV is relevant to the case files if you were provided access to the OAIC’s Sydney
Office. s 47F

Hardcopy files
The Privacy Dispute Resolution and Privacy Early Resolution branches confirmed
that no hard copy documents exist for the relevant case files.
I note that consistent with the terms of your request I have only provided access
to documents that have not already been exchanged with you.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
5

FOIREQ24/00134 175

•  your FOI request dated 21 December 2023,
•  the FOI Act, in particular sections 3, 11, 11A, 15, 26, 47E(d), and 47F of the FOI
Act,
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines), and
•  third party submissions in relation to the release of the documents.
Access to edited copies with irrelevant and exempt matter deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that FOI Act exemptions apply to this material.
Accordingly, I have made an edited copy of the documents which removes this
exempt material and otherwise grants you part access to the material in scope of
your request.
Section 47E(d) – Proper and efficient conduct of the OAIC’s operations
In accordance with section 47E(d) of the FOI Act, I have made a decision to redact
material on the basis that disclosure would or could reasonably be expected to have
a substantial adverse effect on the proper and efficient conduct of the OAIC’s
operations.
Paragraph 6.101 of the FOI Guidelines explains that:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or allegation that damage may occur if the document were to be
released.

Additionally, at 6.103 the FOI Guidelines further explain:

An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
6

FOIREQ24/00134 176

and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).

In order to determine whether disclosure would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the
operations of the OAIC, I have taken into consideration the functions and activities of
the OAIC.
The OAIC is an independent statutory agency within the Attorney-General’s portfolio,
established under the Australian Information Commissioner Act 2010 (Cth). The OAIC
comprises the Australian Information Commissioner, the Privacy Commissioner, and
the FOI Commissioner.
I consider that the disclosure of the material would or could reasonably be expected
to have an adverse effect on this function for the following reasons:
Contained in a document within the scope of your request is the network address for
the OAIC’s IT system. The OAIC collects and stores a range of personal and financial
information about members of the public. The network address contains information
about the OAIC’s IT system (including the network location and storage of
information). I consider that disclosure of this information could compromise the
safety and security of the storage of the information held by the OAIC. The impact of
any compromise to the safety and security of the OAIC’s information systems would
result in a serious adverse impact on the functions and responsibilities of the OAIC.
In ‘AW’ and Australian Taxation Office (Freedom of information) [2014] AICmr 1, the
then FOI Commissioner considered the decision by the Australian Taxation Office
(ATO) to exempt user IDs under section 47E(d) of the FOI Act. The user IDs are used by
ATO staff to access the ATO’s IT system. The Commissioner found that disclosing the
user IDs ‘would have an adverse effect on the security of the ATO’s IT systems and
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the ATO’. In a series of subsequent IC review decisions, the
former Australian Information Commissioner agreed with the reasoning given by the
Commissioner in ‘AW’ to find that user IDs used by ATO staff to access the ATO’s IT
system are exempt under section 47E(d) of the FOI Act.
I consider that the disclosure of the network address of the OAIC’s computer system
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the OAIC’s operations. I have decided that the network address
of the OAIC’s IT system is conditionally exempt from disclosure under section 47E(d)
of the FOI Act.
7

FOIREQ24/00134 177

For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47E(d) of the FOI Act.
As section 47E is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Public interest conditional exemptions--personal privacy (section 47F)
In accordance with section 47F of the FOI Act, I have made a decision to redact
material on the basis that disclosure would constitute an unreasonable disclosure of
personal information.
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) also applies to the FOI Act. The term personal information is
defined in section 6 of the Privacy Act to be:
… information or an opinion about an identified individual, or an individual
who is reasonably identifiable:

(a)
whether the information or opinion is true or not;

(b)
whether the information or opinion is recorded in a material form or
not.
The documents contain the names, phone numbers, and contact details of 3rd
parties.
I am satisfied that this material meets the definition of personal information because
disclosure of this information would reasonably identify the individuals to which the
information relates.
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:

8

FOIREQ24/00134 178

•  the extent to which the information is well known
•  whether the person to whom the information relates is known to be
associated with the matters in the document
•  the availability of the information from publicly accessible sources
•  any other matters the agency or Minister considers relevant.

The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:

•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.

The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals’.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
•  any detriment that disclosure may cause to the person to whom the
information relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s collection and use of the information
•  the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
•  any submission an FOI applicant chooses to make in support of their
application as to their reasons for seeking access and their intended or
likely use or dissemination of the information, and
•  whether disclosure of the information might advance the public interest in
government transparency and integrity
In consideration of these factors and the material contained within the documents, I
am satisfied that the release of this personal information would be unreasonable
because, although the relevant personal information may have previously been
released to you in the course of the matter to which your request relates, I have
taken into consideration the fact that there is no limit to what an applicant may do
with released documents.
9

FOIREQ24/00134 179

I am satisfied that the relevant material is not public information and is not well
known. I am also satisfied that if this information were disclosed publicly it would
unreasonably impact on the privacy of the relevant individuals.
The FOI Guidelines at paragraph 6.171 state:

An agency or minister must have regard for any submissions made before
deciding whether to give access to the document (ss 27A(3) and 27A(4)). The
third party does not, however, have the right to veto access and agencies
should take care that the third party is not under such a misapprehension.

I have also had regard to the submissions of relevant third parties in respect of the
release of the personal information contained within the document. Those third
parties raised concerns as to release of the personal information at issue.
For the reasons given above, I consider the relevant documents identified in the
schedule contain conditionally exempt material under section 47F of the FOI Act.
As section 47F is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject
to conditional exemption under  sections 47E(d) and 47F.

Section 11A(5) provides that where a document  is considered to be conditionally
exempt, an agency must give the person access to that document unless the FOI
decision maker would, on balance, would be contrary to the public interest.

This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not
be taken into account.
6.5
The public interest test is considered to be:
10

FOIREQ24/00134 180

•  something that is of serious concern or benefit to the public, not merely
of individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter will often depend
on a balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to all members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole.  It
may be sufficient that the matter is in the interest of a section of the public
bounded  by  geography  or  another  characteristic  that  depends  on  the
particular situation.  A matter of public interest or benefit to an individual or
small group of people may also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:

… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest.  Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.

The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, I consider the following to be relevant:
•  promote the objects of the FOI Act generally.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in , which I have had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the follow factors do not favour disclosure:
•  Disclosure would have an adverse effect on the OAIC’s proper and efficient
operations relating to its IT security.
11

FOIREQ24/00134 181

•  Disclosure of the personal information contained in the documents could
reasonably be expected to interfere with the affected individual’s right to
privacy.
In balancing these factors for and against, I have placed greater weight on factors in
relation to the OAIC’s IT security, and an individual’s right to privacy.

On balance, I consider the public interest factors against disclosure to be more
persuasive than the public interest factors favouring disclosure. I am satisfied that
the public interest is to withhold the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
The documents subject to this decision contain personal information.
Accordingly, I have determined that it would be unreasonable to publish the
documents subject to this request on the disclosure log.
Release of documents
The documents are enclosed for release.
The documents are identified in the attached schedule of documents.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
19 February 2024
12

FOIREQ24/00134 182

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

13

FOIREQ24/00134 183
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.
14

FOIREQ24/00134 184

FOIREQ24/00134 185

I would be willing to revise my request to a random sample of 10 as per your
suggestion, under the same requirements as my initial request (i.e. notifications
submitted to the OAIC, and communications from/to the OAIC in relation to said
notifications).
Request timeframe
Your  request  was  made  on  20  January  2024.  This  means  that  a  decision  on  your
request is due by 19 February 2024.
Decision
I  am  an  officer  authorised  under  section  23(1)  of  the  FOI  Act  to  make  decisions  in
relation to FOI requests on behalf of the OAIC.
I  have  identified  52  documents  relevant  to  your  request.  Subject  to  the  following
provisions of the FOI Act, I have made a decision to:
•  create and grant access in part to 1 document;
•  grant access in part to 8 documents; and
•  refuse access in full to 43 documents.
In accordance with section 26(1)(a) of the FOI Act, the reasons for my decision and
findings on material questions of fact are provided below.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to your request:
•  Notifiable data breaches team.
Searches  were  conducted  across  the  OAIC’s  various  document  storage  systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
2

FOIREQ24/00134 186

•  general computer files
•  paper files
Having consulted with the relevant line area and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 20 January 2024 and subsequent revised scope dated
1 February 2024;
•  the FOI Act, in particular, including sections 3, 11, 11A, 15, 24AB, 26, 47E(d) and
47G of the FOI Act;
•  the  Guidelines  issued  by  the  Australian  Information  Commissioner  under
section 93A of the FOI Act to which regard must be had in performing a function
or exercising a power under the FOI Act (FOI Guidelines); and
•  consultation with the relevant line area of the OAIC in relation to your request.
Access to edited copies with irrelevant and exempt matter deleted (section 22)
In  accordance  with  section  22  of  the  FOI  Act,  an  agency  must  consider  whether  it
would be reasonably practicable to prepare an edited copy of documents subject to
an  FOI  request  where  material  has  been  identified  as  exempt  or  irrelevant  to  the
request. I have determined that FOI Act exemptions apply to this material.
Accordingly, I have made an edited copy of the documents which removes this exempt
material and otherwise grants you full access to the material in scope of your request.
Creation of a document in response to your FOI request (section 17)
Pursuant to section 17 of the FOI Act, I have made a decision to create 1 document in
response  to  your  request.  I  have  made  a  decision  to  grant  partial  access  to  this
document.
Under section 17 of the FOI Act, if an FOI request is made for a document that could be
produced  by  using  a  computer  ordinarily  available  to  the  agency  for  retrieving  or
3

FOIREQ24/00134 187

collating stored information, an agency is required to deal with the request as if it was
a request for written documents to which the FOI Act applies.
The FOI Guidelines [at 3.204] explain that section 17 may require an agency to produce
a written document of information that is stored electronically and not in a discrete
written form, if it does not appear from the request that the applicant wishes to be
provided  with  a  computer  tape  or  disk  on  which  the  information  is  recorded.  The
obligation to produce a written document arises if:
•  the agency could produce a written document containing the information by
using a computer or other equipment that is ordinarily available’ to the agency
for retrieving or collating stored information (section 17(1)(c)(i)), or making a
transcript from a sound recording (section 17(1)(c)(ii)); and
•  producing  a  written  document  would  not  substantially  and  unreasonably
divert the resources of the agency from its other operations (section 17(2)).
If those conditions are met, the FOI Act applies as if the applicant had requested access
to the written document and it was already in the agency’s possession.
Part of your FOI request sought access to data breach reports.  The Notifiable Data
Breach  team  advised  me  that  this  material  is  not  available  in  a  discrete  form  but
instead  is  able  to  be  produced  in  a  written  document  through  the  use  of  a
computer.  In light of this, a document has been created under section 17 in response
to your request and is included in the schedule of documents attached.
Proper and efficient conduct of the OAIC’s operations (s 47E(d))
In accordance with section 47E(d) of the FOI Act, I have made a decision to exempt
material on the basis that disclosure would or could reasonably be expected to have
a  substantial  adverse  effect  on  the  proper  and  efficient  conduct  of  the  OAIC’s
operations.
Paragraph 6.101 of the FOI Guidelines explains that:
For  the  grounds  in  ss  47E(a)–(d)  to  apply,  the  predicted  effect  needs  to  be
reasonably  expected  to  occur.  The  term  ‘could  reasonably  be  expected’  is
explained  in  greater  detail  in  Part  5.  There  must  be  more  than  merely  an
assumption or allegation that damage may occur if the document were to be
released.
Additionally, at 6.103 the FOI Guidelines further explain:
4

FOIREQ24/00134 188

An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).
The  material  that  I  have  decided  is  subject  to  conditional  exemption  comprises  of
details  of  the  affected  organisation  and  data  breaches  (including  communication
between the OAIC and the organisation) that may allow the affected organisation and
the particular breach to be identified.
Functions and Powers of the OAIC
In  order  to  determine  whether  disclosure  of  the  documents  would,  or  could
reasonably  be  expected  to,  have  a  substantial  adverse  effect  on  the  proper  and
efficient conduct of the operations of the OAIC, I have taken into consideration the
functions and activities of the OAIC.
Due to the nature of the relevant documents and material, I have had regard to:
•  the  Australian  Information  Commissioner’s  investigative  powers  under  the
Privacy Act 1988 (Cth) (Privacy Act); and
•  the OAIC’s Notifiable Data Breaches investigation processes.
The OAIC is an independent statutory agency within the Attorney-General’s portfolio,
established under the Australian Information Commissioner Act 2010 (Cth) (AIC Act).
The  OAIC  comprises  the  Australian  Information  Commissioner  and  the  Privacy
Commissioner, the FOI Commissioner and the staff of the OAIC.
The  OAIC  is  established  under  s  5  of  the  AIC  Act.  Section  5  also  provides  that  the
Information  Commissioner  is  the  Head  of  the  OAIC  for  the  purposes  of  the  Public
Service Act 1999 (Cth). Section 5 further provides that for the purposes of the Public
Governance,  Performance  and  Accountability  Act  2019  (Cth)  the  Information
Commissioner is the accountable authority of the OAIC.
Under the AIC Act and the Privacy Act, the Information Commissioner has a range of
functions and powers under the Notifiable Data Breaches (NDB) scheme, including to:
•  receive notifications of eligible data breaches;
•  encourage  compliance  with  the  scheme,  including  by  handling  complaints,
conducting investigations and taking other regulatory action;
5

FOIREQ24/00134 189

•  offer advice and guidance to regulated organisations; and
•  provide information to the community about the operation of the NDB scheme.
While  organisations  are  required  to  report  data  breach  incidents  to  the  OAIC,  the
extent  of  information  provided  is  voluntary.  At  a  minimum,  organisations  must
provide the following information:
•  the organisation or agency’s name and contact details;
•  a description of the data breach;
•  the kinds of information involved; and
•  recommendations about the steps individuals should take in response to the
data breach.
However,  as  noted  on  the  OAIC’s  website, 1  the  OAIC  recommends  reporting
organisations provide the following information to assist the OAIC to fully investigate
the breach:
•  the circumstances of the data breach;
•  what the organisation has done to contain the data breach; and
•  whether any remedial action has been taken.
The OAIC website also advises reporting organisations that “…The more information
you tell us about the circumstances of the data breach, what you’ve done to contain
the data breach and any remedial action you’ve taken, will help us respond to your
notification”.  The  OAIC  relies  on  the  information  provided  by  the  organisations  in
order to consider whether further regulation action, if any, is required.
In  these  circumstances,  I  find  it  is  likely  that  disclosure  of  the  documents  would
decrease  the  willingness  of  organisations  affected  by  data  breaches  to  make  full
disclosure to the OAIC. If organisations reporting a data breach to the OAIC believe
their sensitive business information may be publicly disclosed, they will be less likely
to  engage  with  the  OAIC  and  provide  the  necessary  information  for  the  OAIC  to
conduct its NDB scheme functions. This will have a substantial adverse effect on the
proper and efficient conduct of the OAIC as the body responsible for overseeing the
NDB scheme.

1 Report a data breach - Home (oaic.gov.au)
6

FOIREQ24/00134 190

Accordingly, based on the information before me at this time, I am satisfied that the
disclosure of the relevant documents in a notifiable data breach reported to the OAIC
at this time, where the FOI applicant is not the reporting organisation, would, or could
be  reasonably  expected  to  have  a  substantial  adverse  effect  on  the  proper  and
efficient operations of the OAIC in investigating NDBs.
For  these  reasons,  I  am  satisfied  that  the  relevant  documents  and  material  are
conditionally exempt.
As  section  47E  is  a  conditional  exemption,  I  am  also  required  to  consider  the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Business information conditional exemption (section 47G(1)(a))
In  the  alternative,  I  have  made  a  decision  to  redact  material  contained  within  the
documents in accordance with section 47G(1)(a) of the FOI Act.
Section 47G(1) of the FOI Act provides:
(1)
A document is conditionally exempt if its disclosure under this Act would disclose
information concerning a person in respect of his or her business or professional
affairs  or  concerning  the  business,  commercial  or  financial  affairs  of  an
organisation or undertaking, in a case in which the disclosure of the information:
(a)
would,  or  could  reasonably  be  expected  to,  unreasonably  affect  that
person adversely in respect of his or her lawful business or professional
affairs  or  that  organisation  or  undertaking  in  respect  of  its  lawful
business, commercial or financial affairs; or
(b)
could  reasonably  be  expected  to  prejudice  the  future  supply  of
information to the Commonwealth or an agency for the purpose of the
administration  of  a  law  of  the  Commonwealth  or  of  a  Territory  or  the
administration of matters administered by an agency.
In  undertaking  an  assessment  of  this  conditional  exemption,  I  have  had  regard  to
relevant and recent AAT and Information Commissioner decisions including ‘ABH’ and
Australian Transport Safety Bureau (Freedom of information) [2022] AICmr 27, Bell and
Secretary, Department of Health (Freedom of information) [2015] AATA 494 and ‘E’ and
National Offshore Petroleum Safety and Environmental Management Authority [2012]
AICmr 3.
7

FOIREQ24/00134 191

I also note the AAT case of Re Secretary, Department of Employment and Besser and
Others (2017) 166 ALD 343 which discussed the exemption of material which identified
businesses who were the subject of investigation. I consider this case relevant to my
consideration  of  the  business  material  identified  in  the  documents  subject  to  this
request, which relate to investigations undertaken by the OAIC. I note at paragraph
[28] the Tribunal found:
[28]
A hypothetical  neutral  reader of  the documents might not ascribe any
weight to those unsubstantiated allegations. But I think that disclosure of
the documents could reasonably be expected to have an adverse effect
on providers by naming them as having been the subject of allegations to,
or investigations by, the Department. That effect would be a reduction in
the  number  of  employers  or  unemployed  people  seeking  to  use  a
provider’s  services,  and  a  consequential  reduction  in  the  provider’s
access  to  funding  under  the  program.  The  documents  do  not  reveal
whether  the  allegations  have  been  substantiated.29 In  those
circumstances,  I  think  that  the  adverse  effect,  upon  the  providers,  of
disclosure would be unreasonable for the purposes of s 47G.
Under s 47G(1)(a) of the FOI Act, a document is conditionally exempt from disclosure
if  its  release  would  disclose  information  concerning  the  business,  commercial  or
financial affairs of an organisation or undertaking, in circumstances where disclosure
of such information would unreasonably affect an organisation in the undertaking of
its  lawful  business  or  commercial  affairs.  As  noted  in  Seven  Network  Operations
Limited and Australian Human Rights Commission [2021] AICmr 66 [156-157]:
… the business information exemption is intended to protect the interests of third
parties  dealing  with  the  government.  The  operation  of  s  47G  depends  on  the
effect  of  disclosure  rather  than  the  precise  nature  of  the  information  itself.
Notwithstanding this, the information must have some relevance to a person in
respect of their business or professional affairs or to the business, commercial
and financial affairs of the organisation… The term ‘business affairs’ has been
interpreted to mean ‘the totality of the money-making affairs of an organisation
or undertaking as distinct from its private or internal affairs’.
In this instance, the exempt documents contain information from several third-party
organisations including software used within the organisation’s internal systems and
network  environments,  the  cause  of  the  data  breach,  and  internal  organisational
emails sent to affected persons.
I am therefore satisfied that this is information concerning the business affairs of the
affected third-party organisations.
8

FOIREQ24/00134 192

As  section  47G  is  a  conditional  exemption,  I  am  also  required  to  consider  the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Prejudice future supply of information (s 47G(1)(b))
Section 47G(1)(b) applies where disclosure could reasonably be expected to prejudice
the future supply of information to the OAIC for the purpose of the administration of
matters administered by the OAIC. The FOI Guidelines provide, at [6.198]:
This limb of the conditional exemption comprises two parts:
•  a  reasonable  expectation  of  a  reduction  in  the  quantity  or  quality  of
business affairs information to the government
•  the reduction will prejudice the operations of the agency
The FOI Guidelines further provide, at [6.200] – [6.201]:
Where the business information in question can be obtained compulsorily, or is
required  for  some  benefit  or  grant,  no  claim  of  prejudice  can  be  made.  No
prejudice will occur if the information in issue is routine or administrative (that is,
generated as a matter of practice).
The agency will usually be best placed to identify, and be concerned about the
circumstances where the disclosure of documents might reasonably be expected
to prejudice the future supply of information to it.
The  term  ‘prejudice’  is  not  defined  in  the  FOI  Act.  The  FOI  Guidelines  provide  the
following definition, at [5.22] – [5.23]:
… The Macquarie Dictionary definition of ‘prejudice’ requires:
a.  disadvantage resulting from some judgement or action of another
b.  resulting injury or detriment
A prejudicial effect is one which would cause a bias or change to the expected
results  leading  to  detrimental  or  disadvantageous  outcomes.  The  expected
outcome does not need to have an impact that is ‘substantial and adverse’.
9

FOIREQ24/00134 193

As  above,  although  reporting  eligible  data  breaches  is  compulsory,  the  extent  of
information  provided  by  an  organisation  is  voluntary.  The  OAIC  recommends  the
reporting organisation provide additional information relating to the circumstances
of the data breach, what the organisation has done to contain the data breach and
what, if any, remedial action has been taken to assist the OAIC to investigate the data
breach.
As  previously  mentioned  above,  the  documents  contain  details  third-party
organisations’ software used to provide business services, the storage of data relating
to business operations, and affected persons within the organisations’ clientele. In my
view, disclosure of the relevant documents in this case could reasonably be expected
to prejudice the future supply of information to the OAIC if third-party organisations’
sensitive  business  information  which  was  provided  to  the  OAIC  for  the  purpose  of
assisting OAIC in assessing a NDB incident is disclosed. I also consider disclosure of
such information could reduce the quantity or quality of information regarding the
data breach provided to the OAIC by reporting organisations in the future and could
hinder the ability of the OAIC to conduct a full investigation, which may lead to the
disadvantageous outcome that an appropriate determination is not made.
For the above reasons, based on the information before me at this time, I am satisfied
that  disclosure  of  the  documents  at  this  time  could  reasonably  be  expected  to
prejudice the future supply of information to the OAIC for the purposes of reporting
NDBs.
As  section  47G  is  a  conditional  exemption,  I  am  also  required  to  consider  the
application  of  a  public  interest  test.  My  consideration  of  the  public  interest  test  is
discussed below.
Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject to
conditional exemption under s 47E(d) and s 47G(1) of the FOI Act.
Section  11A(5)  provides  that  where  a  documents  is  considered  to  be  conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision maker would, on balance, would be contrary to the public interest.
This means that I must balance factors for and against disclosure in light of the public
interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
10

FOIREQ24/00134 194

exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not
be taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely
of individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter will often depend
on a balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to all members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole.  It
may be sufficient that the matter is in the interest of a section of the public
bounded  by  geography  or  another  characteristic  that  depends  on  the
particular situation.  A matter of public interest or benefit to an individual or
small group of people may also be a matter of general public interest.
In  the  AAT  case  of  Utopia  Financial  Services  Pty  Ltd  and  Australian  Securities  and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:
… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so
is, on balance, contrary to the public interest.  Where the balance lies may vary
from time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.
The  FOI  Act  sets  out  four  factors  favouring  access,  which  must  be  considered  if
relevant. Of these factors, I consider the relevant factors to be that disclosure would:
•  promote the objects of the FOI Act; and
•  inform debate on a matter of public importance.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in ,  which I have had  regard  to.  Section  11B  does not  further  prescribe the  factors
11

FOIREQ24/00134 195

against  disclosure  to  be  considered.  In  considering  the  documents  subject  to  this
request, I consider that the follow factors do not favour disclosure:
•  disclosure  of  the  affected  third-party  organisations’  business  information
could  reasonably  be  expected  to  have  a  substantial  adverse  effect  on  the
investigative functions of the OAIC by discouraging organisations impacted by
eligible data breaches from providing the OAIC all information relating to the
breach.
•  disclosure  of  the  affected  third-party  organisations’  business  information
could reasonably be expected to prejudice the future supply of confidential
information  to  the  OAIC  for  the  purpose  of  the  administration  of  matters
administered by the OAIC.
•  disclosure could reasonably be expected to reduce the quantity of information
provided to the OAIC in the future by reporting organisations who have been
affected by a data breach.
In particular, I have given significant weight to the fact that the documents in scope
have been submitted by third-party businesses or information provided to the OAIC
by third-party businesses, regarding their business information and affairs associated
with  a  NDB  which  could  impact  on  the  future  supply  of  this  information  and  the
cooperation of the organisations involved in future data breaches.
Whilst I acknowledge the public interest in informing the public about data breaches
and their impact on both the individuals involved and the community as a whole, I
consider that public interest is outweighed in this instance by the need to ensure the
flow of information from organisations to the OAIC to allow the effective oversight of
significant data breaches.
On  balance,  I  consider  the  public  interest  factors  against  disclosure  to  be  more
persuasive  than the public interest factors  favouring disclosure. I am satisfied  that
disclosing the conditionally exempt material would be contrary to the public interest.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
I have made a decision to publish the redacted version of the documents subject to
your request on the OAIC’s disclosure log.
12

FOIREQ24/00134 196

Release of documents
The documents are enclosed for release and are identified in the attached schedule of
documents.
Please see the following page for information about your review rights.
Yours sincerely
Emily Elliott
Senior Lawyer
19 February 2024
13

FOIREQ24/00134 197

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There is
no application fee for internal review.
If  you  wish  to  apply  for  an  internal  review,  please  mark  your  application  for  the
attention of the FOI Coordinator and state the grounds on which you consider that my
decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC review).
If  you  wish  to  apply  for  IC  review,  you  must  do  so  in  writing  within  60  days.  Your
application must provide an address (which can be an email address or fax number)
that we can send notices to, and include a copy of this letter. A request for IC review
can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the Act
it  is  desirable  that  my  decision  be  considered  by  the  AAT,  the  Information
Commissioner may decide not to undertake an IC review.

14

FOIREQ24/00134 198
Section 57A of the FOI Act provides that, before you can apply to the AAT for review of
an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page on
our website.
15

FOIREQ24/00134 199

FOIREQ24/00134 200
On 22 January 2024 you wrote to the OAIC requesting an internal review of this
decision.
Your internal review request was on the following terms:
s 47F
A decision on your internal review decision is due on 21 February 2024.
Decision
I am an officer authorised under s 23(1) of the FOI Act to make decisions in relation to
FOI requests on behalf of the OAIC.
I have made a decision to affirm the original FOI decision and refuse you access to
the 7 documents in full.
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
As part of the internal review process I reviewed the searches performed in the
course of processing your original request.
Based on the information before me, the Privacy Dispute Resolution branch
conducted searches for the documents which may fall in scope of your FOI request.
Searches were conducted across the OAIC’s various document storage systems
including:
• the OAIC’s case management system - Resolve
• the OAIC’s document holding system – Content Manager
• OAIC’s email system

FOIREQ24/00134 201
• general computer files
• MS Teams.
The following search terms were used when undertaking electronic records
searches:
s 47F
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request. and that all relevant documents have
been located and no additional documents other than the 7 documents identified as
being in scope of the request, exist.
Reasons for decision
Materials taken into account
In making my decision, I have had regard to the following:
• your FOI request dated 21 December 2023
• Original decision of Molly Cooke, Lawyer, dated 18 January 2024
• your internal review request dated 22 January 2024
• the FOI Act, in particular s 3, 11, 11A, 15, 26 and 47F of the FOI Act
• the Guidelines issued by the Australian Information Commissioner under s
93A of the FOI Act to which regard must be had in performing a function or
exercising a power under the FOI Act (FOI Guidelines).
Personal privacy conditional exemption (section 47F)
I have decided to refuse you access to the 7 documents identified as being in scope
of your request.
Whether the documents contain personal information
Based on my review of the 7 documents, the documents at issue contain the names,
email addresses, contact details, and other personal information including nature of
their complaint relating to a privacy complaint made by a third-party individual to
the OAIC, that is not related to you.

FOIREQ24/00134 202
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) also applies to the FOI Act. The term personal information is
defined in section 6 of the Privacy Act to be:
… information or an opinion about an identified individual, or an individual who is
reasonably identifiable:
(a)
whether the information or opinion is true or not;
(b)
whether the information or opinion is recorded in a material form or not.
I am satisfied that this material meets the definition of personal information because
the material relates to the personal matters of individuals, and disclosure of the
material would reasonably identify these individuals.
Whether disclosure would involve an unreasonable disclosure of personal
information
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:
•
the extent to which the information is well known
•
whether the person to whom the information relates is known to be associated
with the matters in the document
•
the availability of the information from publicly accessible sources
•
any other matters the agency or Minister considers relevant.
The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:
•
the author of the document is identifiable
•
the documents contain third party personal information
•
release of the documents would cause stress on the third party
•
no public purpose would be achieved through release.

FOIREQ24/00134 203
The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals’.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•
the nature, age and current relevance of the information
•
any detriment that disclosure may cause to the person to whom the information
relates
•
any opposition to disclosure expressed or likely to be held by that person
•
the circumstances of an agency’s collection and use of the information
•
the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
•
any submission an FOI applicant chooses to make in support of their application
as to their reasons for seeking access and their intended or likely use or
dissemination of the information, and
•
whether disclosure of the information might advance the public interest in
government transparency and integrity
In consideration of these factors and the material contained within the documents, I
am satisfied that the release of this personal information would be unreasonable
because:
• none of the personal information within the documents at issue is publicly
known, or appears to be available from publicly available sources;
• the individual to whom the information relates is not known to be associated
with the matters dealt with in the documents at issue. If this information was
disclosed publicly it would unreasonably impact on the privacy of the
affected individual
• the personal information was collected and used by the OAIC to respond to a
privacy complaint made by that individual;
• the individual to which the personal information relates would not
reasonably expect their personal information to be released by the OAIC, and
would likely be distressed by the release of the personal information
• there is no evidence that the individual has provided you with consent for the
information to be released.
Further, your internal review request suggested that “…Where the documents a as to
the request are understood as to be solely internal…” There is no evidence before
me, either through my review of your original FOI request and subsequent dealings

FOIREQ24/00134 204
with the OAIC in FOIREQ23/00298, or during the course of this internal review, that
you have made any indication to the OAIC that your FOI request is limited to internal
documents. In any event, any documents relating to the complaints the OAIC
received from other individuals not related to you, will be subject to the same
considerations and assessments required under s 47F of the FOI Act, that is, whether
disclosure of this material to you, who is not the complainant, is unreasonable in the
circumstances.
The recent decision of Knight v Commonwealth Ombudsman [2021] AATA 2504
discusses personal information collected in the course of a complaint or
investigation. At paragraph [32] the Tribunal found that:
In the circumstances where the information is highly sensitive and has been
disclosed on a confidential basis, it would be unreasonable to disclose that
information to the applicant.
I consider the collection of the material contained in this document to be of a similar
nature, in that it was collected during the course of an OAIC privacy complaint. I
consider that it would be unreasonable to disclose this information.
For the reasons given above, I am satisfied that disclosure of the documents to you in
this case is unreasonable.
I consider the relevant documents identified in the schedule are conditionally
exempt under section 47F of the FOI Act.
Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material within the documents is subject
to conditional exemption under section 47F.
Section 11A(5) provides that where documents are considered to be conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision maker is satisfied that disclosure would, on balance, be contrary to the
public interest.
This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There  is  a  single  public  interest  test  to  apply  to  each  of  the  conditional
exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not be

FOIREQ24/00134 205

taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely of
individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter will often depend on a
balancing of interests
•  necessarily broad and non-specific, and
•  related  to  matters  of  common  concern  or  relevance  to  all  members  of  the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole.  It may
be sufficient that the matter is in the interest of a section of the public bounded by
geography or another characteristic that depends on the particular situation.  A
matter of public interest or benefit to an individual or small group of people may
also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:
… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest.  Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.
The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, I consider the relevant factor to be that disclosure would
generally promote the objects of the FOI Act.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account,
which I have not had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the follow factors do not favour disclosure:
•  disclosure of the personal information contained in the documents could
reasonably be expected to interfere with an individual’s right to privacy.

FOIREQ24/00134 206

In balancing these factors for and against, I have placed greater weight on the
importance of protecting an individual’s right to privacy, particularly in the context
of a privacy complaint made by that individual to the OAIC.
In this case, I am satisfied that the public interest factor against disclosure outweighs
the public interest factor in favour of disclosure.
I have decided that at this time, giving you access to the documents which I have
found to be conditionally exempt under s 47F of the FOI Act, would, on balance, be
contrary to the public interest.
Other issues
s 47F
As outlined above in the body of my decision, there is no evidence either in your
original FOI request subject to this internal review, or during the course of this
internal review, that you indicated as such to the OAIC of this scope.
s 47F
We encourage you to read the decision provided to you and the documents released
which may already contain the information you are seeking.
Next steps
Please see the following page for information about your review rights.
Yours sincerely
Margaret Sui
Principal Lawyer

20 February 2024

FOIREQ24/00134 207
If you disagree with my decision
Further Review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You have the right to seek review of this decision by the Information Commissioner.
(IC review). If you wish to apply for IC review, you must do so in writing within 30
days. Your application must provide an address (which can be an email address or
fax number) that we can send notices to and include a copy of this letter.
It is the Information Commissioner's view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR_
10
Alternatively, you can post your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or apply by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.

FOIREQ24/00134 208

FOIREQ24/00134 209

Your request was made on 24 December 2023. You agreed to a 14-day extension on 3
January 2024. The clock was stopped in relation to your request under s.24AB of the
FOI Act when a consultation request was sent to you on 15 January 2024. The clock
was restarted when you responded on 28 January 2024. A decision in relation to
your request is due on 20 February 2024.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
I have identified 22 documents relevant to your request. Subject to the following
provisions of the FOI Act, I have made a decision to:
•  grant full access to 17 documents, and
•  grant access in part to 5 documents.
In accordance with section 26(1)(a) of the FOI Act, the reasons for my decision and
findings on material questions of fact are provided below.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 24 December 2023;
•  the FOI Act, in particular sections 3, 11, 11A, 15, 22, 24A, 26, 42, 47C and 47E(c)
of the FOI Act;
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines).
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following business units of the OAIC conducted reasonable searches for
documents relevant to you request:
•  Legal Services
2

FOIREQ24/00134 210

Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
Having consulted with the relevant staff members of the OAIC and undertaken a
review of the records of the various search and retrieval efforts, I am satisfied that a
reasonable search has been undertaken in response to your request.
Access to edited copies with irrelevant and exempt material deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that FOI Act exemptions apply to this material.
I have also identified the following material within the documents to be irrelevant or
out of scope of your request:
•  Some emails refer to matters which are not regarding the processing of
FOIREQ23/00173.
Accordingly, I have made an edited copy of the documents which removes this
irrelevant and exempt material and otherwise grants you full access to the material
in scope of your request.
Documents subject to legal professional privilege (section 42)
I have identified material contained within the documents that contain legal advice
in relation to the subject matter of FOIRE23/00173, being Leo Hardiman’s testimony.
In accordance with section 42 of the FOI Act, I have made a decision to redact
material on the basis that it is subject to legal professional privilege.

Section 42(1) of the FOI Act provides that

A document is an exempt document if it is of such a nature that it would be
privileged from production in legal proceedings on the ground of legal
professional privilege.

3

FOIREQ24/00134 211

In determining whether or not these documents could be privileged from production
in legal proceedings I have considered:

•  whether there is a legal adviser-client relationship,
•  whether the communication was for the purpose of giving or receiving,
•  legal advice, or use in connection with actual or anticipated litigation,
•  whether the advice given is independent, and
•  whether the advice given is confidential.

Generally, privilege may be claimed in legal proceedings in relation to advice sought
from and given by an in-house lawyer, where the professional relationship between
the lawyer and the agency seeking advice has the necessary quality of independence,
as per Taggart and Civil Aviation Safety Authority (Freedom of information) [2016] AATA
327 at [32].

Having regard to this material, I am satisfied that there is a legal adviser - client
relationship between OAIC General Counsel and the Executive.

The OAIC legal team is part of the corporate branch and is separate from the
Executive which requested the legal advice.  Although not a determinative factor, all
members of the legal team hold practising certificates and are subject to all
professional obligations of legal practitioners.

I consider that the separation of the General Counsel from the Executive reinforces
the independence of the legal advice and made the relationship a legal adviser –
client relationship.

Whether privilege attaches to a document depends on the purpose for which the
communication in the document was created. The High Court has confirmed that the
common law requires a dominant purpose test rather than a sole purpose test, as
per Esso Australia Resources Ltd v Commissioner for Taxation (1999) 201 CLR 49. The
relevant documents, including the request for legal advice and the legal advice
provided in response to that request were all created for the dominant purpose of
providing legal advice to the Executive in relation to Mr Hardiman’s testimony.

Finally, I have turned my mind to whether the advice was given in confidence. In
relation to the relevant documents, the legal advice was clearly marked legal in
confidence, and it was only distributed to a limited number of OAIC staff who were
involved in the matter. I have not been able to identify any express or implied waiver
of the privilege and am satisfied that the advice was provided in confidence.

4

FOIREQ24/00134 212

Waiver

Section 42(2) of the FOI Act provides that a document is not exempt under
section 42(1) if ‘the person entitled to claim legal professional privilege in relation to
the production of the document in legal proceedings waives that claim’. As such, I
have also considered whether the privilege attached to the relevant documents has
been waived. Waiver of privilege may be express or implied.

The General Counsel has not waived privilege in relation to this advice and the advice
was only distributed within a limited number of staff who were required to know the
outcome of the advice. As such, I do not consider privilege has been waived in
relation to this advice.

Finally, I have considered the ‘real harm’ test. The FOI Guidelines provide at
paragraph 5.150 that:

Agencies are advised not to claim exemption for a document under s 42 unless it
is considered that ‘real harm’ would result from releasing the document. A ‘real
harm’ criterion is not an element of the common law doctrine of LPP, but has
been acknowledged within government as a relevant discretionary test to apply
in FOI administration. The phrase ‘real harm’ distinguishes between substantial
prejudice to the agency’s affairs and mere irritation, embarrassment or
inconvenience to the agency.

I consider ‘real harm’ would result in the release of this legal advice. It would
prejudice the affairs of the OAIC if it was not able to seek confidential legal advice in
responding the Mr Hardiman’s testimony.
For the reasons given above, I consider the relevant documents identified in the
schedule are exempt under section 42 of the FOI Act.
As section 42 is not a conditional exemption, I am not required to consider the
application of a public interest test.
Public interest conditional exemption-deliberative processes (section 47C)
Section 47C of the FOI Act provides for the exemption of deliberative matter as
follows:
(1)
A document is conditionally exempt if its disclosure under this Act would
disclose matter (deliberative matter) in the nature of, or relating to,
opinion, advice or recommendation obtained, prepared or recorded, or
5

FOIREQ24/00134 213

consultation or deliberation that has taken place, in the course of, or for
the purposes of, the deliberative processes involved in the functions of:

(a)
an agency; or

(b)
a Minister; or

(c)
the Government of the Commonwealth.

Exceptions

(2)
Deliberative matter does not include either of the following:

(a)
operational information (see section 8A);

(b)
purely factual material.

Paragraph [6.55] of the FOI Guidelines confirms that section 47C of the FOI Act is not
a harm provision and that the only consideration is whether the document does or
does not contain deliberative matter. As explained in the decision of Parnell &
Dreyfus and Attorney-General’s Department [2014] AlCmr 71 (30 July 2014) at [38],
deliberative matter is a shorthand term for ‘opinion, advice and recommendation’
and ‘consultation and deliberation’.
The documents subject to the request contain material in relation to a draft response
to Mr Hardiman’s testimony. The material I have considered exempt is deliberative in
nature for the purpose of section 47C of the FOI Act, because it relates to different
opinions expressed in drafting a media response to Mr Hardiman’s testimony.
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47C of the FOI Act. As section 47C is
a conditional exemption, I am also required to consider the application of a public
interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Section 47E(c) – Management or assessment of personnel
In accordance with section 47E(c) of the FOI Act, I have made a decision to exempt
material on the basis that disclosure would or could reasonably be expected to have
6

FOIREQ24/00134 214

a substantial adverse effect on the management or assessment of personnel by the
Commonwealth or an agency.
Paragraph 6.101 of the FOI Guidelines explains that:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or allegation that damage may occur if the document were to be
released.

At 6.103 the FOI Guidelines further explain:

An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).

Paragraph 6.144 the FOI Guidelines confirms that for 47E(c) to apply the documents
must relate to either the management or assessment of personnel. Having
considered the material within the document, I consider the relevant material relates
to the management of personnel, including the broader human resources policies
and activities, particularly occupational health and safety.
As a Commonwealth employer the OAIC has duties and obligations under the Work
Health and Safety Act 2011. This includes a duty to manage workplace health and
safety by eliminating and minimising risks as much as is reasonably practicable.
Psychosocial hazards are any occupational hazard that affects the psychological and
physical wellbeing of employees. I note that the public testimony of Mr Hardiman on
29 August 2023 including criticism of the OAIC Executive, culture, systems and
processes. This testimony was provided after Mr Hardiman had resigned as the FOI
Commissioner. For staff, these criticisms were heard for the first time and staff used
the instant messaging system Teams to discuss the testimony as it unfolded. A
number of wellbeing checks were undertaken with staff particularly effected by the
testimony. While I have released in most instances the messages themselves, to
ensure the OAIC manages the psychosocial hazards associated I have removed staff
names, including SES and above. I consider that the removal of the names is
consistent with the OAIC’s obligation under the Work Health and Safety Act 2011 to
7

FOIREQ24/00134 215

eliminate the risks associated with psychosocial hazards as much as reasonably
practical.
I note that although OAIC generally releases all staff names in response to an FOI
request, I would distinguish this scenario with this request, in so far as that these
messages do not relate to the work of the OAIC or how it has managed a particular
matter or issue. These messages relate to staff responses to a Senate Committee
hearing that was critical of the work and culture at the OAIC. In my view, releasing
the names of the staff associated with particular messages could be reasonably
expected to have a substantial adverse impact on the OAIC’s ability to manage
psychosocial hazards.
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47E(c) of the FOI Act.
As section 47E is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Public interest conditional exemption – operations of the agency (section 47E(d))
In accordance with section 47E(d) of the FOI Act, I have made a decision to exempt
mobile phone numbers of OAIC staff and material relating to open and ongoing IC
matters with the OAIC, on the basis that disclosure would or could reasonably be
expected to have a substantial adverse effect on the proper and efficient conduct of
the OAIC’s operations.
Paragraph 6.101 of the FOI Guidelines explains that:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or allegation that damage may occur if the document were to be
released.
Additionally, at 6.103 the FOI Guidelines further explain:
An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
8

FOIREQ24/00134 216

and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).
In order to determine whether disclosure would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the
operations of agencies, I have taken into consideration the functions and activities of
the relevant agency being the OAIC.
Mobile phone numbers of OAIC staff
In the IC review decision of ‘PX’ and Australian Federal Police (Freedom of information)
[2019] AICmr 8 at [64], it was found that, since the agency in this matter had in place
“…procedures in place to manage their contact with members of the public”, the
release of direct contact details of staff “…would have a substantial adverse effect
on the proper and efficient conduct…” of the relevant agency.
Similarly, in In ‘WN’ and Inspector General of Taxation [2020] AICmr 70 at [34] the
Information Commissioner accepted that:
…unsolicited calls to IGT employees’ direct telephone numbers and work
mobile telephone numbers will fall outside will fall outside the integrated
service platform and would not be electronically recorded, adversely affecting
accountability, transparency, quality assurance and the provision of support to
employees in relation to those calls…on balance I find that this circumstance
could reasonably be expected to have a substantial adverse effect on the
proper and efficient conduct of the IGT’s operations.
Noting the above, the mobile phone numbers of the OAIC staff is not publicly
available. As part of the documents released to you, the general work number
associated with the staff member has been disclosed. I therefore consider that
release of the OAIC staff mobile number would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the OAIC’s
operations. This is on the basis that the release of this information is likely to result in
a high volume of unsolicited communications to the staff, which would divert
resources from the ordinary functions of the OAIC.
Open and ongoing IC reviews
In order to determine whether disclosure would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the operations
of the OAIC, I have taken into consideration the functions and activities of the OAIC. In
particular, I have had regard to the Australian Information Commissioner’s privacy
9

FOIREQ24/00134 217

powers, freedom of information powers and regulatory powers, under the Australian
Information Commissioner Act 2010 (Cth) (AIC Act), the Privacy Act 1988 (Cth) (‘The
Privacy Act’) and the Freedom of Information Act 1982 (Cth) (‘The FOI Act’). Under the
AIC Act and the FOI Act, the Information Commissioner has a range of functions and
powers  promoting  access  to  information  under  the  FOI  Act,  including  making
decisions on Information Commissioner reviews and investigating and reporting on
freedom  of  information  complaints,  as  well  as  assessing  and  making  decisions  on
vexatious applicant declarations.
The AAT has recognised in Telstra Australian Limited and Australian Competition and
Consumer Commission [2000] AATA 71 (7 February 2000) [24] that the conduct of an
agency’s  regulatory functions can  be  adversely affected in a  substantial way  when
there  is  a  lack  of  confidence  in  the  confidentiality  of  the  investigative  process.
Similarly, in this instance, the OAIC’s ability to carry out its regulatory functions would
be affected if there was a lack of confidence in the confidentiality of this process.
I have refused access in part to documents that relate to Information Commissioner
reviews that are current and ongoing. Given that these reviews remain open, I consider
that while the matter is on foot, disclosure of the relevant material at this stage can
impede the efficient conduct of the case. Specifically, review officers are still in the
process of formulating their views, and gathering facts and evidence, and no decisions
or  findings  have  been  made  regarding  these  reviews.  Parties  to  the  review  will  be
provided  an  opportunity  to  respond  if  an  adverse  finding  is  likely  to  be  made,  for
procedural fairness reasons. The fact that an Information Commissioner review has
been lodged in relation to certain FOI requests, is not public knowledge and is only
known by the parties. The OAIC’s Freedom of Information Regulatory Action Policy
advises  at  paragraph  73  that  the  Information  Commissioner  will  generally  not
comment publicly about ongoing IC review applications.
The release of this information at this time to a third party who is not a party to these
reviews  would,  or  could  reasonably  be  expected  to,  adversely  impact  on  both  the
ability of the OAIC to manage the specific matters referred to and future matters if
parties cannot be confident that their information will be kept confidential while their
reviews are still being investigated.
Accordingly, I am satisfied that disclosure of this material to you at this time will have
a substantial and adverse effect on the proper and efficient operations of the OAIC in
conducting Information Commissioner review. I have found this material to be exempt
under s 47E(d) of the FOI Act.
For the reasons given above, I consider the relevant documents identified in the
schedule are conditionally exempt under section 47E(d) of the FOI Act. As section
10

FOIREQ24/00134 218

47E(d) is a conditional exemption, I am also required to consider the application of a
public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Public interest conditional exemptions--personal privacy (section 47F)
In accordance with section 47F of the FOI Act, I have made a decision to exempt
material on the basis that disclosure would constitute an unreasonable disclosure of
personal information.
A document is conditionally exempt under section 47F(1) of the FOI Act where
disclosure would involve the unreasonable disclosure of personal information of any
person, including a deceased person. This exemption is intended to protect the
personal privacy of individuals.
Section 4 of the FOI Act provides that the definition of personal information in the
Privacy Act 1988 (Cth) also applies to the FOI Act. The term personal information is
defined in section 6 of the Privacy Act to be:
… information or an opinion about an identified individual, or an individual
who is reasonably identifiable:

(a)
whether the information or opinion is true or not;

(b)
whether the information or opinion is recorded in a material form or
not.
The documents contain the name and contact information of a person seeking
access to information under the Freedom of Information Act. I am satisfied that this
material meets the definition of personal information.
In determining whether disclosure of other personal information in the documents
would involve an unreasonable disclosure of personal information, the FOI
Guidelines provide the following considerations at paragraph 6.140:

•  the extent to which the information is well known
•  whether the person to whom the information relates is known to be
associated with the matters in the document
•  the availability of the information from publicly accessible sources
•  any other matters the agency or Minister considers relevant.

11

FOIREQ24/00134 219

The FOI Guidelines further describes the key factors for determining whether
disclosure is unreasonable at paragraph 6.143:

•  the author of the document is identifiable
•  the documents contain third party personal information
•  release of the documents would cause stress on the third party
•  no public purpose would be achieved through release.

The FOI Guidelines explain at paragraph 6.138 that the test of ‘unreasonableness’ in
section 47F ‘implies a need to balance the public interest in disclosure of
government-held information and the private interest in the privacy of individuals’.
Consistent with FG and National Archives of Australia [2015] AICmr 26, the FOI
Guidelines at paragraph 6.143 explain that other relevant factors include:
•  the nature, age and current relevance of the information
•  any detriment that disclosure may cause to the person to whom the
information relates
•  any opposition to disclosure expressed or likely to be held by that person
•  the circumstances of an agency’s collection and use of the information
•  the fact that the FOI Act does not control or restrict any subsequent use or
dissemination of information released under the FOI Act
•  any submission an FOI applicant chooses to make in support of their
application as to their reasons for seeking access and their intended or
likely use or dissemination of the information, and
•  whether disclosure of the information might advance the public interest in
government transparency and integrity
This information is not publicly available, and I do not consider the disclosure of the
name and contact details of the individual who made the original request would
advance the public interest in government transparency and integrity. In my view, it
may cause the individual undue stress to be publicly associated with the request.
For the reasons given above, I am satisfied that the disclosure of the personal
individual would be unreasonable and I consider the relevant documents identified
in the schedule are conditionally exempt under section 47F of the FOI Act.
As section 47F is a conditional exemption, I am also required to consider the
application of a public interest test.
My consideration of the public interest test, in respect of all the material subject to
conditional exemption in this document is discussed below.
Application of the public interest test – (section 11A and 11B)
12

FOIREQ24/00134 220

As provided above, I have considered that material within the documents is subject
to conditional exemption under s.47C, s. 47E(c) and s.47E(d) of the FOI Act.

Section 11A(5) provides that where a document is considered to be conditionally
exempt, an agency must give the person access to that document unless the FOI
decision maker would, on balance, would be contrary to the public interest.

This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not
be taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely
of individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter will often depend
on a balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to all members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole.  It
may be sufficient that the matter is in the interest of a section of the public
bounded  by  geography  or  another  characteristic  that  depends  on  the
particular situation.  A matter of public interest or benefit to an individual or
small group of people may also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:

… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so is,
on balance, contrary to the public interest.  Where the balance lies may vary from
time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.
13

FOIREQ24/00134 221

The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, we consider the following to be relevant:
•  promote the objects of the FOI Act, and
•  inform debate on a matter of public importance
In addition to these factors favouring disclosure, I have also considered that the
following factors in favour of disclosure apply:
•  promote effective oversight of public expenditure
•  inform debate on a matter of public importance, including to:
o  allow or assist inquiry into possible deficiencies in the conduct or
administration of an agency or official

Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in , which I have had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the factor against disclosure of the information is that it
could reasonably be expected to prejudice the management function of the agency.

In relation to the removal of staff names from instant messages, I acknowledge the
importance of public oversight of government agencies and recognise the public
interest in the current Senate Committee inquiry. However, I have balanced this with
the need to manage psychosocial hazards of staff. I note that access to the content
of most documents have been provided in full and only removed those parts of the
documents necessary to ensure this balance. For the material I have decided is
exempt I have put a significant weight on the management of psychosocial hazards
of staff.

In relation to the removal of staff mobile numbers, I note that the OAIC has available
a number of avenues to contact staff including publicly available phone numbers
and direct staff phone numbers are provided in relation to specific matters. Mobile
numbers are not generally provided to members of the public and I consider that the
release of these mobile numbers could be expected to prejudice the operations of
the OAIC. In relation to the open IC reviews, I have put significant weight on the
importance of allowing the regulatory functions to be undertaken in an efficient and
confidential process.

In relation to the material exempt in draft media response, I have considered FOI
Guideline material provided at paragraphs [6.52] to [6.88], relevant AAT decisions
including Secretary, Dept of Prime Minister and Cabinet and Secretary, Dept of
14

FOIREQ24/00134 222

Infrastructure and Regional Development and Sanderson [2015] AATA 361, and the
recent Information Commissioner decisions of Seven Network Operations Limited and
Australian Human Rights Commission [2021] AICmr 66 (10 November 2021) which
discuss the application of this conditional exemption provision. In both decisions
whilst the material itself was identified as deliberative, there was not sufficient
evidence to prove that disclosure of the material would be contrary to the public
interest, particularly in circumstances where a significant passage of time had
passed since the material was the subject of active deliberation.  I note that although
the inquiry has now been finalised, many of the recommendations are under
consideration by government.

On balance, I consider the public interest factors against disclosure to be more
persuasive than the public interest factors favouring disclosure. I am satisfied that
the public interest is to withhold the exempt material.
Disclosure log decision
Section 11C of the FOI Act requires agencies to publish online document released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
I have made a decision to publish the documents subject to your request on the
OAIC’s disclosure log.
Release of document
The documents are currently being prepared for release and will be provided to you
tomorrow, Wednesday 21 February 2024. The documents are identified in the
attached schedule of documents. Please note that where documents that are
relevant to your request would be a duplicate of the documents released to you, we
have provided a single copy of these documents at document 2.
Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
20 February 2024
15

FOIREQ24/00134 223

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5288
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

16

FOIREQ24/00134 224
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5288
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.
17

FOIREQ24/00134 225

FOIREQ24/00134 226

Request timeframe
Your request was made on 22 January 2024.
This means that a decision on your request is due by 21 February 2024.
Decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
Subject to the following provisions of the FOI Act, I have made a decision to:
•  refuse access in full to 135 documents
Searches Undertaken
The FOI Act requires that all reasonable steps have been taken to locate documents
within scope of an FOI request.
The following line areas of the OAIC conducted reasonable searches for documents
relevant to you request:
•  Privacy Dispute Resolution
Searches were conducted across the OAIC’s various document storage systems
including:
•  the OAIC’s case management system - Resolve
•  the OAIC’s document holding system – Content Manager
•  OAIC’s email system
•  general computer files
Having consulted with the relevant line areas and undertaken a review of the records
of the various search and retrieval efforts, I am satisfied that a reasonable search has
been undertaken in response to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
•  your FOI request dated 22 January 2024
2

FOIREQ24/00134 227

•  the FOI Act, in particular sections 3, 11, 11A, 15, 26, 37(1)(a) and 47E(d) of the
FOI Act
•  the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
•  consultation with relevant line areas of the OAIC in relation to your request
Access to edited copies with irrelevant and exempt matter deleted (section 22)
In accordance with section 22 of the FOI Act, an agency must consider whether it
would be reasonably practicable to prepare an edited copy of documents subject to
an FOI request where material has been identified as exempt or irrelevant to the
request.
I have determined that FOI Act exemptions apply to this material. However, due to
these exemptions covering the entirety of substantive material within the documents
at issue, I have decided that it is not reasonably practicable to prepare an edited
copy of the documents at issue for release.
Investigation of a possible breach of law (s 37(1)(a))
I have found the documents subject to your request are exempt under s 37(1)(a) of
the FOI Act.
Under s 37(1)(a), a document is exempt if its disclosure would, or could reasonably
be expected to, prejudice the conduct of a current investigation.
Section 37(1)(a) of the FOI Act states:
37 Documents affecting enforcement of law and protection of public safety
(1) A document is an exempt document if its disclosure under this Act
would, or could reasonably be expected to:
(a) prejudice the conduct of an investigation of a breach, or
possible breach, of the law, or a failure, or possible failure, to
comply with a law relating to taxation or prejudice the
enforcement or proper administration of the law in a particular
instance;

3

FOIREQ24/00134 228

The FOI Guidelines at [5.82] provide:
To be exempt under ss 37(1)(a) or 37(1)(b), the document in question should
have a connection with the criminal law or the processes of upholding or
enforcing civil law or administering a law… This is not confined to court action
or court processes, but extends to the work of agencies in administering
legislative schemes and requirements, monitoring compliance, and
investigating breaches
The FOI Guidelines at [5.86] – [5.87] further explain:
Section 37(1)(a) applies to documents only where there is a current or pending
investigation and release of the document would, or could reasonably be
expected to, prejudice the conduct of that investigation. Because of the phrase
‘in a particular instance’, it is not sufficient that prejudice will occur to other or
future investigations: it must relate to the particular investigation at hand. In
other words, the exemption does not apply if the prejudice is about
investigations in general.
(…)
The exemption is concerned with the conduct of an investigation. For example,
it would apply where disclosure would forewarn the applicant about the
direction of the investigation, as well as the evidence and resources available to
the investigating body — putting the investigation in jeopardy. The section will
not apply if the investigation is closed or if it is being conducted by an overseas
agency.
In order to determine whether disclosure of documents would, or could reasonably
be expected to prejudice the conduct of a current investigation, the FOI Guidelines at
[5.16] - [5.17] note:
The test requires the decision maker to assess the likelihood of the predicted or
forecast event, effect or damage occurring after disclosure of a document. The
use of the word ‘could’ in this qualification is less stringent than ‘would’, and
requires analysis of the reasonable expectation rather than certainty of an
event, effect or damage occurring. It may be a reasonable expectation that an
effect has occurred, is presently occurring, or could occur in the future.
It was relevantly noted in the recent IC review decision at AFR and Department of
Home Affairs (Freedom of information) [2023] AICmr 120 at [90] – [91]:
4

FOIREQ24/00134 229

The FOI Act does not define prejudice. The FOI Guidelines instead describe a
‘prejudicial effect’ as ‘one which would cause a bias or change to the expected
results leading to detrimental or disadvantageous outcomes.
Whether disclosure would prejudice the Department’s investigation will depend
upon the nature and context of the particular document or information at issue.
Noting the above, I am satisfied that the material within the scope of your request
relates to issues that are currently being investigated by the OAIC, and release of
such material prematurely could impact the flow of information to the OAIC in this
matter, through reducing confidence in the confidentiality of the OAIC’s investigative
processes. I am satisfied that this would constitute a prejudicial effect for the
purposes of s 37(1)(a) of the FOI Act.
Accordingly, I have decided that the documents at issue are exempt under s 37(1)(a)
of the FOI Act. I consider that disclosure of these documents would, or could
reasonably be expected to, prejudice the conduct of an open OAIC investigation.
Section 47E(d) – Proper and efficient conduct of the OAIC’s operations
I have decided that the documents at issue which I have found exempt under s
37(1)(a) are in the alternative exempt under s 47E(d) of the FOI Act.
Under s 47E(d) of the FOI Act, a document is conditionally exempt if its disclosure
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the operations of an agency.
Paragraph 6.101 of the FOI Guidelines explains that:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or allegation that damage may occur if the document were to be
released.

Additionally, at 6.103 the FOI Guidelines further explain:

An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).
5

FOIREQ24/00134 230

In order to determine whether disclosure would, or could reasonably be expected to,
have a substantial adverse effect on the proper and efficient conduct of the
operations of the OAIC, I have taken into consideration the functions and activities of
the OAIC.
The OAIC is an independent statutory agency within the Attorney-General’s portfolio,
established under the Australian Information Commissioner Act 2010 (Cth). The OAIC
consists of the Australian Information Commissioner, the Privacy Commissioner, the
FOI Commissioner, and the staff of the OAIC.
The OAIC has a range of functions and powers directed towards protecting the
privacy of individuals by ensuring the proper handling of personal information.
These functions and powers are conferred by the Privacy Act 1988 (Privacy Act) and
by other legislation containing privacy protection provisions. Investigating privacy
breaches, either in response to a complaint from a member of the public or on the
Commissioner’s own initiative, is one of the OAIC’s primary functions.
Consideration

The documents at issue relate to an ongoing OAIC investigation. I am satisfied that,
as this investigation remains open, the release of the documents at issue at this time
would be reasonably likely to disrupt and prejudice the OAIC’s ability to exercise its
regulatory functions. I consider that at this time, disclosure of the documents at
issue could reasonably be expected to have an adverse substantial impact on the
proper and efficient conduct of the OAIC’s operations, through reducing confidence
in the confidentiality of the OAIC’s investigative processes.
Relevantly, paragraph 6.122 of the FOI Guidelines provides:
The exemption may also apply to documents that relate to a complaint made
to an investigative body. The disclosure of this type of information could
reasonably affect the willingness of people to make complaints to the
investigative body, which would have a substantial adverse effect on the
proper and efficient conduct of the investigative body’s operations. [footnotes
omitted].
In the decision of Knight v Commonwealth Ombudsman [2021] AATA 2504, the
Tribunal upheld the application of section 47E(d) to material relating to the Defence
Abuse Response Taskforce (DART) which was an administrative body established in
2012. The Ombudsman contended that release of certain material would have a
substantial adverse effect on its functions. In respect of the application of
section 47E(d) the Tribunal found as follows (emphasis added):
6

FOIREQ24/00134 231

[40] I consider that the ongoing maintenance of confidentiality is critical to
the effective management of the defence abuse response program.
Individuals may be discouraged from participating in meaningful
engagement with the respondent if the documents sought were
disclosed. A failure to protect confidentiality would undermine the
reputation of, and the trust in, the respondent. The operations of the
respondent would be compromised.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269 at [103], Deputy
President Forgie found documents concerned with ASIC’s investigation and
surveillance functions to be exempt under s 47E(d). Deputy President Forgie found
that the subject-matter of the documents was directed to the investigations
associated with Utopia and that:
… disclosure would give insight into an aspect or aspects of the way in which
ASIC goes about its task of investigating or conducting surveillance on those
who come within its regulatory responsibilities. Utopia itself might have some
idea of them as it has been the subject of such surveillance and examination of
its affairs. Others would not. To disclose them under the FOI Act would, I find,
have an adverse effect on the proper and efficient conduct of ASIC’s operations.
I am also satisfied that the adverse effect would be substantial.
I further note that the importance of protecting information collected during an
investigation process was upheld in the recent IC decision of ‘YU’ and Bureau of
Meteorology (Freedom of Information) [2021] AICmr75.
I consider these decisions to be of relevance to the material subject to this FOI
request which comprises of confidential material obtained in the course of the
OAIC’s investigations. As part of its investigative function, it is vitally important that
investigations are able to be undertaken in a timely and efficient manner and that
participants fully engage in this process which at times is often because of an
understanding of confidentiality.
I consider that release of material relating to an investigation part way through the
investigation itself would likely undermine or interfere with the outcome of the
investigation. I consider that release of this material would also likely mean that
individuals are less included to fully engage with the OAIC and its investigative
functions.
Accordingly, in this case, I am satisfied that giving you access to the documents at
issue would, or could reasonably be expected to, substantially adversely affect the
7

FOIREQ24/00134 232

proper and efficient conduct of the operations of the OAIC. In light of this, I find that
the material at issue is conditionally exempt under section 47E(d) of the FOI Act.
Application of the public interest test – (section 11A and 11B)
As provided above, I have considered that material at issue is subject to conditional
exemption under section 47E(d).

Section 11A(5) provides that where documents are considered to be conditionally
exempt, an agency must give the person access to those documents unless the FOI
decision maker would, on balance, would be contrary to the public interest.

This means that I must balance factors for and against disclosure in light of the
public interest.
In Chapter 6, the FOI Guidelines provide the following guidance:
6.4
There is a single public interest test to apply to each of the conditional
exemptions.  This public interest test is defined to include certain factors that
must be taken into account where relevant, and some factors which must not
be taken into account.
6.5
The public interest test is considered to be:
•  something that is of serious concern or benefit to the public, not merely
of individual interest
•  not something of interest to the public, but in the public interest
•  not a static concept, where it lies in a particular matter will often depend
on a balancing of interests
•  necessarily broad and non-specific, and
•  related to matters of common concern or relevance to all members of the
public, or a substantial section of the public.
6.6
It is not necessary for a matter to be in the interest of the public as a whole.  It
may be sufficient that the matter is in the interest of a section of the public
bounded  by  geography  or  another  characteristic  that  depends  on  the
particular situation.  A matter of public interest or benefit to an individual or
small group of people may also be a matter of general public interest.
In the AAT case of Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, at paragraph 133
of the Decision Deputy President Forgie explained that:

8

FOIREQ24/00134 233

… the time at which I make my decision for section 11A(5) requires access to be
given to a conditionally exempt document “at a particular time” unless doing so
is, on balance, contrary to the public interest.  Where the balance lies may vary
from time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.

The FOI Act sets out four factors favouring access, which must be considered if
relevant. Of these factors, I consider the following to be relevant:
•  promote the objects of the FOI Act, and
•  inform debate on a matter of public importance.
Section 11B(4) of the FOI Act provides factors which are not to be taken into account
in , which I have had regard to. Section 11B does not further prescribe the factors
against disclosure to be considered. In considering the documents subject to this
request, I consider that the following factors do not favour disclosure:
•  disclosure could reasonably be expected to impede the flow of information
to the OAIC in its capacity as a privacy regulator,
•  disclosure could reasonably be expected to prejudice the OAIC’s ability to
obtain confidential information in the future,
•  disclosure could reasonably be expected to prejudice an ongoing OAIC
investigation, and
•  disclosure could reasonably be expected to prejudice the OAIC’s ability to
obtain and deliberate regarding sensitive information.
I have also taken into account that refusing to release the document at issue is in line
with the OAIC’s Regulatory Action Policy, which relevantly states the following at
[58]:
The OAIC generally will not comment publicly about ongoing complaint
investigations, complaint conciliations, CIIs, the content of data breach
notifications or the exercise of investigative powers.
In balancing these factors for and against, I have placed greater weight on factors in
relation to the importance of preserving the functioning of the OAIC’s investigatory
functions.

In this case, I am satisfied that the public interest factor against disclosure outweighs
the public interest factor in favour of disclosure.

9

FOIREQ24/00134 234

I have decided that at this time, giving you access to the documents which I have
found to be conditionally exempt under s 47E(d) of the FOI Act, would, on balance,
be contrary to the public interest.

Please see the following page for information about your review rights.
Yours sincerely,
Emily Elliott
Senior Lawyer
21 February 2024
10

FOIREQ24/00134 235

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.

11

FOIREQ24/00134 236
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.
12

FOIREQ24/00134 237

FOIREQ24/00134 238
linked it to their accounts (but have previously had access to their accounts through the
usual, user-name/password method)?
(3) Has the Australian Government ever recommended, instructed or mandated its
executives, officers, contractors or suppliers employ methods to restrict, block or
tighten online access to those trying to set up new government accounts such as
Centrelink or My Gov and who do not have a Digital Identity?
(4) Is the Australian Government, its contractors or suppliers currently employing
methods to restrict, block or tighten online access to those trying to set up new
government accounts such as Centrelink or My Gov and who do not have a Digital
Identity?
Request timeframe
Your request was made on 29 January 2024.
This means that a decision on your request was due to be decided by 28 February
2024.
Reasons for decision
I am an officer authorised under section 23(1) of the FOI Act to make decisions in
relation to FOI requests on behalf of the OAIC.
In making my decision, I have had regard to the following:
• your FOI request dated 29 January 2024
• the FOI Act, in particular section 24A, 26
• the Guidelines issued by the Australian Information Commissioner under
section 93A of the FOI Act to which regard must be had in performing a
function or exercising a power under the FOI Act (FOI Guidelines)
• consultation with line areas of the OAIC in relation to your request
Documents cannot be found, do not exist or have not been received – Section 24A of
the FOI Act
Section 24A(1) of the FOI Act provides that an agency may refuse a request for access
to a document requested under the FOI Act if all reasonable steps have been taken to
find the document and the agency is satisfied that the document cannot be found or
do not exist.
2

FOIREQ24/00134 239
Searches Undertaken
In response to your request, the following line areas of the OAIC conducted
reasonable searches for relevant documents:
• Dispute Resolution
• Regulation and Strategy
Searches were conducted across the following document storage systems at the
OAIC:
• the OAIC’s document holding system – Content Manager
• the OAIC’s email system
The following search terms were used when undertaking electronic records
searches:
• “MyGov account digital ID”
• “MyGov account digital identity”
• “MyGov account policy”
• “Centrelink account digital ID”
• “Centrelink account digital identity”
The line areas provided the following information as to why documents could not be
found or do not exist:
I have searched CM and my inbox using the terms such as “MyGov account digital ID”,
“MyGov account digital identity”, “MyGov account policy”, “Centrelink account digital
ID” and “Centrelink account digital identity” but could not identify any documents
within the scope of the request.
I also discussed the request with Jim Kormas Director Assessments. We are not aware
of any documents within the scope of the request and could not identify other search
terms that may assist.
I note that Services Australia may be better placed to assist with requests for
documents relating to the creation of MyGov and Centrelink accounts. The Department
of Finance is responsible for policy in relation to Digital ID and the development of
legislation in this area and may also hold relevant documents.
And
I have also conducted searches (“MyGov account digital ID”, “MyGov account digital
identity”, “MyGov account policy”, “Centrelink account digital ID” and “Centrelink
account digital identity”) across Content Manager and Microsoft Outlook and have not
3

FOIREQ24/00134 240
returned any results. I agree with … comments below, that the search scope seems
directed at operational matters for MyGov and Centrelink accounts and the agencies
she has identified below are likely to better placed to receive this request.
Having consulted with the relevant line areas and having undertaken a review of the
records of the various search and retrieval efforts, I am satisfied that all reasonable
steps have been taken to find documents in response to your request and that no
relevant documents were identified.
Conclusion
For the reasons outlined above, I have made the decision to refuse your request
under section section 24A(1) of the FOI Act on the basis that all reasonable steps
have been taken to find the documents you are requesting and I am satisfied the
documents cannot be found or do not exist.
Services Australia
You may wish to consider making your FOI request to Services Australia, as I am of
the view that they may hold the documents you are seeking. Please find their contact
details below:
Post:
Freedom of Information
Services Australia
PO Box 7820
Canberra BC ACT 2610
Email:
xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx.xxx.xx
You may make your request by completing the form found at the following link:
Freedom of Information - access or change document(s) form (SI031) - Services
Australia.
Alternatively, you may compose a written letter which must:
• state that it is a request for the purposes of the Freedom of Information Act
1982 (Cth)
• specify the documents requested or provide such information as is
reasonably necessary to enable a responsible officer of the agency or the
minister to identify the document that is requested
4

FOIREQ24/00134 241
• specify details of how notices under the FOI Act may be sent to you, such as a
postal or email address
Please see the following page for information about your review rights in relation to
this FOI request.
Yours sincerely,
Emily Elliott
Senior Lawyer
21 February 2024
5

FOIREQ24/00134 242
If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.
6

FOIREQ24/00134 243
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.
7