PO Box 7820 Canberra BC ACT 2610
19 December 2025
Our reference: LEX 88705
LEX 87723
Mr Steven Roddis
By email: xxxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Mr Roddis,
Freedom of Information Request – Internal Review Decision
I refer to your correspondence received by Services Australia (the Agency) on 19 November
2025 seeking an internal review of the original decision (LEX 87723) made by the Agency on
19 November 2025 in relation to your request for access to documents under the
Freedom of
Information Act 1982 (FOI Act).
Background
On 30 September 2025, you requested access under the FOI Act to the following documents:
"Copilot - MS Teams and transcription use cases" Reference Number: 57785
I request that access be provided in electronic format.
Pursuant to section 29(5) of the FOI Act, I request a waiver of any applicable charges on
the grounds that providing access to this document is in the general public interest.
Services Australia collects very sensitive personal, financial, and health information for
a vast majority of Australians. The use of generative AI tools like Microsoft Copilot to
process or transcribe internal communications raises significant questions about data
security, privacy risks, and the potential for inadvertent disclosure of citizen information.
Disclosure of this PIA is essential for public understanding and scrutiny of the agency's
risk assessment processes. It allows the public to see how Services Australia is
identifying and mitigating the privacy risks associated with foreign AI technology and the
public's very sensitive personal information, thereby promoting accountability.
On 19 November 2025, the Agency notified you it had decided to
refuse access your request
in full as the document requested was exempt on the basis it contained:
• material that is subject to legal professional privilege (section 42 exemption);
• commercially valuable information (section 47(1)(b) exemption), and
• deliberative matter (section 47C conditional exemption).
On 19 November 2025, you requested an internal review of the original decision.
PAGE 1 OF 8
Summary of my internal review decision
I am authorised to make decisions under section 23(1) of the FOI Act, including internal review
decisions under section 54C of the FOI Act.
Consistent with the requirements of section 54C(3) of the FOI Act, I have made a fresh
decision.
Having considered the material before me, I have decided to affirm the original decision, and
refuse access your request in full, as the document requested is exempt on the basis it
contains material that is subject to legal professional privilege (section 42 exemption).
Please see the schedule at Attachment A
to this letter for a description of the document and
the reasons for my decision, including the relevant sections of the FOI Act.
You can ask for a review of the decision
If you disagree with any part of the decision, you can ask for an external review by the
Australian Information Commissioner. See Attachment B for more information about how to
request an external review.
Further assistance
If you have any questions, please email xxx.xxxxx.xxxx@xxxxxxxxxxxxxxxxx.xxx.xx.
Yours sincerely
Sonya
Authorised FOI Decision Maker
Freedom of Information Team
FOI and Reviews Branch | Legal Services Division
Services Australia
PAGE 2 OF 8
PO Box 7820 Canberra BC ACT 2610
Attachment A
REASONS FOR DECISION
What you requested
On 20 September 2025, you requested access under the FOI Act to the following documents:
"Copilot - MS Teams and transcription use cases" Reference Number: 57785
I request that access be provided in electronic format.
Pursuant to section 29(5) of the FOI Act, I request a waiver of any applicable charges on
the grounds that providing access to this document is in the general public interest.
Services Australia collects very sensitive personal, financial, and health information for
a vast majority of Australians. The use of generative AI tools like Microsoft Copilot to
process or transcribe internal communications raises significant questions about data
security, privacy risks, and the potential for inadvertent disclosure of citizen information.
Disclosure of this PIA is essential for public understanding and scrutiny of the agency's
risk assessment processes. It allows the public to see how Services Australia is
identifying and mitigating the privacy risks associated with foreign AI technology and the
public's very sensitive personal information, thereby promoting accountability.
Your internal review request
On 19 November 2025, you requested an internal review of the original decision, providing
written submissions in which you argued:
I am writing to request an internal review of Services Australia's handling of my FOI
request 'PIA 57785 Copilot - MS Teams and transcription use cases'.
Regarding Section 42:
The decision claims the document is exempt in full because it contains legal advice.
However, the document is a Privacy Impact Assessment for Microsoft Copilot.
While legal advice regarding privacy compliance is privileged, the underlying factual
descriptions of the technology, the data flows, the specific "use cases," and the
administrative framework within which Copilot operates are not legal advice. These are
operational facts.
If the document describes the functional operation of Microsoft Copilot (ie. what the
software does, what data it ingests, and where that data goes), that information exists
for an administrative and operational purpose, not solely for the dominant purpose of
providing legal advice.
Regarding 47(1)(b)
Privacy Impact Assessments are standard compliance tools governed by the Privacy Act
1988 and guided extensively by the OAIC. The methodology for conducting a PIA is
largely standardised across the Commonwealth.
It is difficult to accept that a law firm’s specific "approach" to a standard government
compliance exercise is a trade secret of such value that it overrides the public’s right to
PAGE 4 OF 8
know how their sensitive data is being processed. Even if specific proprietary
methodology text exists, it does not permeate the entire 57-page document. The
substantive content, ie. the analysis of Services Australia’s specific risk belongs to the
Agency and the public, not the commercial vendor.
Regarding 47C
The subject of the PIA involves the application of Generative AI (Microsoft Copilot) to the
sensitive personal, financial, and health data of millions of Australians. There is a
profound public interest in transparency regarding:
Whether citizens' data is being retained by Microsoft or used for model training.
The accuracy and reliability risks identified by the Agency.
The safeguards in place to prevent hallucinations or data leakage.
Promoting public scrutiny of how the Agency manages these specific, novel
technological risks significantly outweighs the generic interest in protecting a consultant’s
"methodology."
Severance
The document totals 57 pages. The decision maker refused access in full.
It is highly improbable that every sentence of a 57-page document constitutes privileged
legal advice or commercially sensitive methodology.
The Agency has a statutory obligation under section 22 of the FOI Act to consider
whether an edited copy can be provided.
What I took into account
In reaching my decision I took into account:
• your original request dated 30 September 2025
• your internal review request dated 19 November 2025
• the documents falling within the scope of your request
• consultations with Agency officers about:
o the nature of the documents
o searches conducted for the documents requested, and
o the Agency's operating environment and functions
• guidelines issued by the Australian Information Commissioner under section 93A of the
FOI Act (the Guidelines), and
• the FOI Act.
Reasons for my decision
I am authorised to make decisions under section 23(1) of the FOI Act, including internal review
decisions under section 54C of the FOI Act.
I have decided the document is exempt under the FOI Act. My findings of fact and reasons for
deciding the exemptions under sections 42, section 47(1)(b) and section 47C of the FOI Act
applies to the document is discussed below.
PAGE 5 OF 8
Section 42 of the FOI Act – Legal professional privilege (LPP)
I have applied the exemption in section 42 of the FOI Act to Document 1 in full.
This section of the FOI Act allows the Agency to redact material from a document if it is
subject to legal professional privilege (LPP). Of note, the FOI Act does not define LPP.
Courts have held that deciding whether a communication is privileged requires a
consideration of:
• whether there is a legal adviser-client relationship,
• whether the communication was for the purpose of giving or receiving legal
advice, or use in connection with actual or anticipated litigation,
• whether the advice given is independent, and
• whether the advice given is confidential.
Document 1 contains correspondence between the Agency and its external lawyers for the
purposes of obtaining professional legal advice. I am satisfied that privilege over these
communications has not been waived, as the document has not been distributed further than
is reasonably necessary for internal operational purposes. I am also satisfied the substance
of the legal advice contained within the document has not been used in any way inconsistent
with maintaining the confidentiality of that legal advice.
Further, I am satisfied the Agency’s ability to obtain legal advice on issues affecting how the
Agency operates would be substantially prejudiced if this document was to be made publicly
available through FOI processes.
In my view, real harm is likely to result from release of the document, as doing so would
waive privilege and disclose the Agency’s legal provider and their approach to the
interpretation, analysis and application of legislation administered by the Agency.
Consequently, the Agency’s ability to obtain comprehensive and independent legal advice in
the future would be substantially prejudiced if external legal firms become aware the Agency
is expressly waiving privilege over documents by making its legal advice publicly available
via FOI processes.
For the reasons set out above, I am satisfied that Document 1 is exempt under section 42 of
the FOI Act.
PAGE 6 OF 8
PO Box 7820 Canberra BC ACT 2610
Attachment B
INFORMATION ON RIGHTS OF REVIEW
FREEDOM OF INFORMATION ACT 1982
Asking for a full explanation of a Freedom of Information (FOI) decision
Before you ask for a formal review of a FOI decision, you can contact us to discuss your
request. We will explain the decision to you. This gives you a chance to correct
misunderstandings.
Asking for a formal review of an FOI internal review decision
If you still believe a decision is incorrect, the FOI Act gives you the right to apply for an external
review of the internal review decision. Under section 54M of the FOI Act, you can apply for a
review of an FOI decision by the Australian Information Commissioner. There are no fees for
this review.
You have 60 days to apply in writing for review by the Australian Information Commissioner.
You can
lodge your application:
Online:
www.oaic.gov.au
Post:
Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Email:
xxxxx@xxxx.xxx.xx
Important:
• If you are applying online, the FOI Review form is available at OAIC Web Form
• If you have one, you should include with your application a copy of the Agency’s
decision on your FOI request
• Include your contact details
• Set out your reasons for objecting to the Agency's decision.
Complaints to the Australian Information Commissioner and Commonwealth
Ombudsman
Australian Information Commissioner
You may complain to the Australian Information Commissioner concerning action taken by an
agency in the exercise of powers or the performance of functions under the FOI Act. There is
no fee for making a complaint. A complaint to the Australian Information Commissioner must
be made in writing. The Australian Information Commissioner's contact details are:
Telephone: 1300 363 992
Website: www.oaic.gov.au
Smart Form: OAIC Web Form
PAGE 7 OF 8
Commonwealth Ombudsman
You may also complain to the Commonwealth Ombudsman concerning action taken by an
agency in the exercise of powers or the performance of functions under the FOI Act. There is
no fee for making a complaint. A complaint to the Commonwealth Ombudsman may be made
in person, by telephone or in writing. The Commonwealth Ombudsman's contact details are:
Phone: 1300 362 072
Website: www.ombudsman.gov.au
The Commonwealth Ombudsman generally prefers applicants to seek review before
complaining about a decision.
PAGE 8 OF 8
