OFFICIAL
PO Box 457
CANBERRA ACT 2601
dta.gov.au
16 June 2020
Ben Frengley
xxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Ben
Freedom of Information Request – FOI 188/2019
Thank you for your email to the Digital Transformation Agency (DTA) on 12 May 2020 in which you
sought access to the fol owing under the
Freedom of Information Act 1982 (FOI Act).
List of documents requested:
As set out in the Trusted Digital Identity Framework Accreditation Process documentation, for
the identity services provided by the Australian Tax Office and Australia Post, as wel as for
any existing accredited Identity Exchanges:
- TDIF Application Letters
- Statements of Applicability
- Completed Accreditation Plans
- Assessor Findings reports
- Reports covering technical integration testing and service operations readiness
- TDIF Memorandum of Understanding
- Assessment Plans, Assessment Reports, and Qualifying Attestation Letters provided as part
of annual assessments
- Exemption requests and related evidence
- Formal responses to or acknowledgement of any of the above documents
- Compliance and remediation advisories
- Requests for access to Restricted Attributes and related evidence
DTA advised you on 13 May 2020 that a practical refusal reason existed and our intention to refuse
your application. Following consultation over the phone, you wrote to us on 20 May 2020 and revised
the scope of your application to:
List of documents requested:
As set out in the Trusted Digital Identity Framework Accreditation Process documentation for
the accredited identity services (identity providers and/or identity exchanges) provided by the
Australian Tax Office:
- Assessor Findings reports
1
OFFICIAL
OFFICIAL
- Reports covering technical integration testing
- Assessment Reports provided as part of annual assessments
- Exemption requests and related evidence
Decision
In accordance with subsection 23(1) of the FOI Act, I am authorised to make a decision regarding
access under the FOI Act.
A search for records held by the agency identified 11 documents within scope of your request. I have
decided to deny access to the documents under section 47E of the FOI Act.
Material taken into account
• The terms of your revised request
• Documents identified within scope of the request
• Advice provided by the officers with relevant business knowledge
• The
Freedom of Information Act 1982 (Cth)
• Guidelines issued by the Office of the Information Commissioner (the Guidelines)
Reasons for my decision Section 47E
Public interest conditional exemptions—certain operations of agencies
A document is conditional y exempt if its disclosure under this Act would, or could reasonably be
expected to, do any of the fol owing:
a) prejudice the effectiveness of procedures or methods for the conduct of tests, examinations
or audits by an agency;
b) prejudice the attainment of the objects of particular tests, examinations or audits conducted
or to be conducted by an agency;
c) have a substantial adverse effect on the management or assessment of personnel by the
Commonwealth or by an agency;
d) have a substantial adverse effect on the proper and efficient conduct of the operations of an
agency.
Reviewing the documents in scope of this application identified they contain material meeting the
above criteria as they detail the way the DTA regulates services under the Trusted Digital Identity
Framework.
The Guidelines advise that, where a document relates to certain operations of agencies, the decision
maker must address whether the predicted effect must bear on the agency’s proper and efficient
operations, that is, the agency is undertaking its expected activities in an expected manner.
The release of this material at this time would erode trust the community and agencies have in the
DTA that would have a substantial adverse effect on the continuing work DTA are undertaking on the
framework. Therefore, I find the documents conditional y exempt under section 47E(d) of the FOI Act.
Public interest consideration
Having formed the view that the documents identified are conditional y exempt under section 47E(d)
of the FOI Act, I am now required to consider whether disclosure of the information would be
contrary to the public interest. I have considered:
2
OFFICIAL
OFFICIAL
Factors favouring release:
• The applicant’s authority to exercise their rights under the FOI Act
• Disclosure would promote the objects of the FOI Act as information held by Government is a
national resource
• Accountability of Commonwealth agencies in the discharge of functions
Factors against release:
• Disclosure could reasonably be expected to prejudice DTA’s ability to obtain confidential
information
• Disclosure could reasonably be expected to prejudice DTA’s ability to obtain similar
information in the future
• Disclosure would prejudice the effectiveness of DTA’s expected regulatory activities
The Trusted Digital Identity Framework is the overarching system which regulates the accreditation
and operation for organisations providing digital identity services. A Digital identity provides
Australian people and businesses a single, secure way to use government services online without the
requirement to present or copy original documents in person. The system would be undermined if it
was generally known the details of the framework, which would in turn affect public confidence in the
Digital Identity system. I accept that there is a public interest in the documentation so that that
accredited digital identity services is undertaken in a transparent and proper manner.
However, disclosure of the information contained in the 11 documents at this time could reasonably
be expected to have an adverse impact on the continual development and implementation of the
framework. The documents in question would reveal confidential information on how the DTA
regulates providers under the TDIF, as well as possibly revealing vulnerabilities and operations of a
provider accredited under this system. Disclosure at this time would not increase public scrutiny of
Government’s processes or activities.
On balance, I gave the reasons against disclosure greater weight than the reasons in favour of release
and deem the documents exempt under section 47E(d) of the FOI Act.
Review rights
If you are dissatisfied with this decision, you have certain rights of review available to you.
Firstly, under section 54 of the FOI Act, you may apply to DTA for an internal review of the decision.
Your application must be made in writing within 30 days of receiving this notice.
An internal review will be conducted by a different officer from the original decision-maker. No
particular form is required to apply for review although it will assist your case to set out in the
application the grounds on which you believe that the original decision should be overturned. An
application for a review of the decision should be addressed to:
xxx@xxx.xxx.xx
If you choose to seek an internal review, you will subsequently have a right to apply to the Australian
Information Commissioner for a review of the internal review decision.
3
OFFICIAL
OFFICIAL
Review by the Australian Information Commissioner
Alternatively, under section 54L of the FOI Act, you may seek review of this decision by the Australian
Information Commissioner without first going to internal review. Your application must be made
within 60 days of you receiving this notice.
The Australian Information Commissioner is an independent office holder who may review decisions
of agencies and Ministers under the FOI Act. More information is available on the Australian
Information Commissioner's website www.oaic.gov.au.
You can contact the Information Commissioner to request a review of a decision online or by writing
to the Information Commission at:
Director of FOI Dispute Resolution
GPO Box 5218
SYDNEY NSW 2001
Complaints to the Australian Information Commissioner
You may complain to the Australian Information Commissioner about action taken in relation to your
request.
Your enquiries to the Australian Information Commissioner can be directed to:
Phone 1300 363 992 (local call charge)
Email xxxxxxxxx@xxxx.xxx.xx
There is no particular form required to make a complaint to the Australian Information Commissioner.
The request should be in writing and should set out the grounds on which it is considered that the
action taken in relation to the request should be investigated and identify the DTA as the relevant
agency.
Contacts
If you have any queries about this notice, please contact the FOI team by email
xxx@xxx.xxx.xx. Yours sincerely
Juleigh Cook
a/g Head of Identity and myGov
4
OFFICIAL
Document Outline
