Our reference: FOIREQ21/00002
Julie

By email: xxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Your freedom of information request - FOIREQ21/00002
Dear Julie
I refer to your request for access to documents made under the Freedom of
Information Act 1982 (Cth) (the FOI Act) and received by the Office of the Australian
Information Commissioner (OAIC) on 25 December 2020.
In your request you seek access to the fol owing:
“all records relating to RQ20/04150 and Veteran's Affairs FOI 39042 held by
your organisation.”
Decision
I am an officer authorised under s 23(1) of the FOI Act to make decisions in relation to
FOI requests.

I have identified 8 documents within the scope of your request. I have decided to grant
you access to the documents in full. A schedule describing the documents and access
decision I have made has also been provided with this decision.

OAIC’s network address (s 47E(d))
Substantial adverse effect on the operations of an agency (s 47E(d))
I have decided that part of document 1 is conditionally exempt from disclosure under
s 47E(d) of the FOI Act. The relevant material that I have found to be conditional y
exempt is the network address for the OAIC’s IT system.
As discussed in the FOI Guidelines and in IC review cases, for a document to be
conditional y exempt under s 47E(d) of the FOI Act, it needs to be shown that
disclosure would, or could reasonably be expected to, have a substantial adverse
effect on the proper and efficient conduct of the operations of an agency.
1300 363 992
T +61 2 9284 9749  GPO Box 5218
www.oaic.gov.au
xxxxxxxxx@xxxx.xxx.xx
F +61 2 9284 9666  Sydney NSW 2001  ABN 85 249 230 937

link to page 2 The FOI Guidelines at [6.101] and [6.103] explain:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be
reasonably expected to occur. The term ‘could reasonably be expected’ is
explained in greater detail in Part 5. There must be more than merely an
assumption or al egation that damage may occur if the document were to be
released.
…
An agency cannot merely assert that an effect would occur following disclosure.
The particulars of the predicted effect should be identified during the decision
making process, including whether the effect could reasonably be expected to
occur. Where the conditional exemption is relied upon, the relevant particulars
and reasons should form part of the decision maker’s statement of reasons, if
they can be included without disclosing exempt material (s 26, see Part 3).
The FOI guidelines explain that ‘substantial adverse effect’ means that the expected
effect needs to be both ‘substantial’ and ‘adverse’. The term ‘substantial adverse
effect’ broadly means ‘an adverse effect which is sufficiently serious or significant to
cause concern to a properly concerned reasonable person’.
In the Administrative Appeals Tribunal (AAT) case of Diamond and Chief Executive
Officer of the Australian Curriculum, Assessment and Reporting Authority [2014] AATA
707, Deputy President Forgie discussed that for a claim under s 47E(d) to succeed, the
substantial adverse effect that would, or could reasonably be expected to, occur must
be on the ‘proper and efficient conduct of the operations of an agency’. Deputy
President Forgie explains that the ‘ordinary meanings of the word “operation” in this
context’ includes ‘an act, method or process of working or operating.’1
In the Information Commissioner review (IC review) case of ‘AW’ and Australian
Taxation Office (Freedom of information) [2014] AICmr 1 (‘AW’), the then Freedom of
Information Commissioner considered the decision by the Australian Taxation Office
(ATO) to exempt user IDs under s 47E(d) of the FOI Act. The user IDs are used by ATO
staff to access the ATO’s IT system. The Commissioner found that disclosing the user
IDs ‘would have an adverse effect on the security of the ATO’s IT systems, and could

1 Diamond and Chief Executive Officer of the Australian Curriculum, Assessment and Reporting Authority [2014]
AATA 707 [119].

2

link to page 3 link to page 3 reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the ATO’.2
In a series of subsequent IC review decisions, the former Australian Information
Commissioner agreed with the reasoning given by the Commissioner in ‘AW’ to find
that user IDs used by ATO staff to access the ATO’s IT system are exempt under s
47E(d).3
In deciding whether disclosure of the network address of the OAIC’s IT system, would
or could reasonably be expected to, have a substantial adverse effect on the operation
of the OAIC, I have had regard to the OAIC’s functions and responsibilities.
The OAIC collects and stores a range of personal and financial information about
members of the public. The network address contains information about the OAIC’s IT
system (including the network location and storage of information). I consider that
disclosure of this information could compromise the safety and security of the storage
of the information held by the OAIC. The impact of any compromise to the safety and
security of the OAIC’s information systems would result in a serious adverse impact on
the functions and responsibilities of the OAIC.
I consider that the disclosure of the network address of the OAIC’s computer system
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the OAIC’s operations.
I have decided that the network address of the OAIC’s IT system in document 1 is
conditionally exempt from disclosure under s 47E(d) of the FOI Act.
The public interest (s 11A(5))
I have found that part of document 1 is conditionally exempt under s 47E(d).
An agency cannot refuse access to a conditionally exempt document unless giving
access would, on balance, be contrary to the public interest (s 11A(5)).
Section 11B(3) of the FOI Act lists four factors which favour disclosure. The public
interest factor favouring disclosure in this case is that disclosure would promote the
objects of the FOI Act. Against these factors I must balance the factors against

2 ‘AW’ and Australian Taxation Office (Freedom of information) [2014] AICmr 1 [21].
3 ‘EC’ and Department of Human Services [2014] AICmr 142 [29], ‘JD’ and Australian Taxation Office [2016] AICmr
48 [23] and John Quinn and Australian Taxation Office [2016] AICmr 94 [34].

3

disclosure. The FOI Act does not specify any factors against disclosure, however the
FOI Guidelines provide a non-exhaustive list of factors against disclosure. This includes
factors such as when disclosure could;
•  reasonably be expected to have an adverse effect on the safety and security of the
OAIC’s IT system.
•  reasonably be expected to prejudice the privacy rights of members of the public. If
the OAIC’s network address is disclosed this may expose the personal information
of members of the public who make privacy complaints to the OAIC to unauthorised
access, modification and disclosure.
•  reasonably be expected to harm the interests of an individual or group of
individuals.
On balance, I consider that the factors against disclosure outweigh the factor in favour
of disclosure. I have therefore decided that it would be contrary to the public interest
to give you access to the information that I have found to be conditional y exempt
under s 47E(d) of the FOI Act.
Please see the fol owing page for your review rights and information about the OAIC’s
disclosure log.

Yours sincerely
Joseph Gouvatsos
Lawyer

21 January 2021

4

If you disagree with my decision
Internal review
You have the right to apply for an internal review of my decision under Part VI of the FOI Act.
An internal review will be conducted, to the extent possible, by an officer of the OAIC who was
not involved in or consulted in the making of my decision. If you wish to apply for an internal
review, you must do so in writing within 30 days. There is no application fee for internal
review.
If you wish to apply for an internal review, please mark your application for the attention of
the FOI Coordinator and state the grounds on which you consider that my decision should be
reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax on
02 9284 9666.
Further Review
You have the right to seek review of this decision by the Information Commissioner and the
Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC review). If you
wish to apply for IC review, you must do so in writing within 60 days. Your application must
provide an address (which can be an email address or fax number) that we can send notices to,
and include a copy of this letter. A request for IC review can be made in relation to my
decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of the
administration of the FOI Act to conduct an IC review of a decision, or an internal review
decision, made by the agency that the Information Commissioner heads: the OAIC. For this
reason, if you make an application for IC review of my decision, and the Information
Commissioner is satisfied that in the interests of administration of the Act it is desirable that
5

my decision be considered by the AAT, the Information Commissioner may decide not to
undertake an IC review.
Section 57A of the FOI Act provides that, before you can apply to the AAT for review of an FOI
decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR_10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please
contact xxxxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.
Disclosure log
Section 11C of the FOI Act requires agencies to publish online documents released to members
of the public within 10 days of release, except if they contain personal or business information
that would be unreasonable to publish.
The documents I have decided to release to you contains personal information that would be
unreasonable to publish. As a result, the documents wil not be published on our disclosure
log.

6

Document Outline