FOIREQ20 00032 s 24AB letter to A.pdf

Our reference: FOIREQ20/00032
Ms Lisa Nagi
By email: xxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Freedom of Information Request
Dear Ms Nagi,
I refer to your request for access to documents, made under the Freedom of Information Act
1982 (Cth) (the FOI Act), dated 6 February 2020 and received by the Office of the Australian
Information Commissioner (OAIC) on the same date.
In your FOI request you are seeking access to:

the data breach notifications submitted for 2019
I am an officer authorised under s 23(1) of the FOI Act to make decisions in relation to
freedom of information requests.
I am writing to tell you that I believe that the work involved in processing your request in its
current form will substantially and unreasonably divert the resources of the OAIC from its
other operations due to its size and scope. This is called a ‘practical refusal reason’ (under
s 24AA of the FOI Act).
On this basis, I intend to refuse access to the documents you have requested. However,
before I make a final decision to do this, you have an opportunity to revise your request. This
is called a ‘request consultation process’ as set out under s 24AB of the FOI Act. You have
14 days to respond to this notice in one of the ways set out at the end of this letter.
Why I intend to refuse your request
Calculation of the processing time
I estimate it will take the OAIC at least 1860 hours to process your FOI request in its current
form.
In the period between 1 January 2019 and 31 December 2019, the OAIC received over 980
Notifiable Data Breach (NDB) notifications. I have assessed your request based on primary
notifications only and taking your request as a request for the notification only and not any
other documents associated with the initial notification.
1300 363 992
T +61 2 9284 9749
GPO Box 5218
www.oaic.gov.au
xxxxxxxxx@xxxx.xxx.xx
F +61 2 9284 9666
Sydney NSW 2001
ABN 85 249 230 937

I have estimated that your whole request would cover approximately 980 documents. We
have estimated that on average there are 10 pages per document. Therefore, I estimate that
your request covers approximately 9800 pages.
To calculate the processing time, I have taken the following factors into account:
•  To locate, convert to PDF and collate 980 documents from the OAIC’s database will
take approximately 358 hours.
•  I estimate it will take 2 minutes per document to prepare a document schedule
listing the document number, date, number of pages and a description of each
document. I therefore estimate it will take at least 32 hours to prepare a schedule for
980 documents.
•  The documents relate to a number of third parties who would need to be consulted
in relation to the request under s 27 of the FOI Act.  On the face of it, it appears that
there are at least 980 notifiers involved. I estimate that it will take one hour to
prepare and send a consultation notice and consider the entity’s response. On this
basis, consultation will take a minimum of 980 hours.
•  On the basis that at least half the consulted entities will object to disclosure of the
requested information, and that preparing an access grant decision, as required by
s 27(6) of the FOI Act, will take approximately one hour per party, I estimate that
drafting decisions for the affected third parties will take at least 490 hours.
•  I estimate it will take two minutes to examine each page to decide whether it can be
released or whether it will be subject to an exemption (either in full or in part) and
prepare an edited copy of the documents. On the basis that there will be at least
9800 pages within the scope of the request this task will take at least 19600 hours.
•  To update the schedule to record the FOI decision and write a decision statement for
the FOI applicant will take approximately 490 hours.
I have therefore calculated it will take at least 1860 hours to process your FOI request.
Diversion of resources
An estimate of processing time is only one of the considerations to be taken into account
when deciding whether a practical refusal reason exists. As well as requiring a request to
substantially divert an agency’s resources, s 24AA also requires the request to unreasonably
divert an agency’s resources from its other functions before it can be refused under s 24.
The Guidelines issued by the Australian Information Commissioner under s 93A of the Freedom
of Information Act 1982 (FOI Guidelines) identify matters that may be relevant when deciding
whether processing the request will unreasonably divert an agency’s resources from its
other functions. These include:
2

•  the staffing resources available to the agency for FOI processing
•  the impact that processing a request may have on other work in the agency,
including FOI processing
•  whether an applicant has cooperated in framing a request to reduce the processing
workload
•  whether there is a significant public interest in the documents requested
•  other steps taken by an agency or minister to publish information of the kind
requested by an applicant.
The OAIC is a small agency, employing approximately 130 (head count) staff. Processing a
request of this size would substantially impact on the OAIC’s operations because of the
limited number of people the OAIC has available to process FOI requests. This makes it likely
that staff will be diverted from their other work in the OAIC, including undertaking regulatory
functions in both FOI and privacy along with undertaking activities set out in the OAIC’s
2019/2020 Corporate Plan.
I have calculated it will take 1860 hours to process your FOI request. This equates to
approximately 45 working weeks.
Request consultation process
You now have an opportunity to revise your request to enable it to proceed.
Revising your request can mean narrowing the scope of the request to make it more
manageable or explaining in more detail the documents you wish to access. For example, by
providing more specific information about exactly what documents you are interested in, we
will be able to pinpoint the documents more quickly and avoid using excessive resources to
process documents you are not interested in.
Before the end of the consultation period, you must do one of the following, in writing:
•  withdraw your request
•  make a revised request
•  tell us that you do not wish to revise your request.
The consultation period runs for 14 days and starts on the day after you receive this notice.
Therefore, you must respond to this notice by 13 March 2020.
During this period, you can ask the contact person (see below) for help to revise your
request. If you revise your request in a way that adequately addresses the practical refusal
grounds outlined above, we will recommence processing it. (Please note that the time taken
3

to consult you regarding the scope of your request is not taken into account for the purposes
of the 30-day time limit for processing your request.)
If you do not do one of the three things listed above during the consultation period or you do
not consult the contact person during this period, your request will be taken to have been
withdrawn.
Ways you can reduce the scope of your request
There are a number of ways that you can reduce the scope of your request to enable us to
process it without unreasonably diverting our resources from our other operations. These
can include reducing the number of notifications requested by, for example:
•  specifying a shorter timeframe, or
•  requiring only a specified sample of the representative complaints.
Contact officer
If you would like to revise your request or if you have any questions, you can contact me on
(02) 9284 9606 or by sending an email to xxxxxxx.xxxxx@xxxx.xxx.xx.
Yours sincerely,

Delaney Smith
Legal Services Officer

27 February 2020

4