Whether reasonable steps were taken to find documents – s 24A
Section 24A requires that an agency take ‘all reasonable steps’ to find a requested
document before refusing access to it on the basis that it cannot be found or does not
exist.
Section 24A provides:
Requests may be refused if documents cannot be found, do not exist or
have not been received
Document lost or non-existent
(1) An agency or Minister may refuse a request for access to
a document if:
(a) all reasonable steps have been taken to find the document; and
(b) the agency or Minister is satisfied that the document:
(i) is in the agency's or Minister's possession but cannot be
found; or
(ii) does not exist.
I have considered the search and retrieval efforts in processing your FOI requests. As
previously advised to you, this involved
Officers in the Legal Service team conducted a search of the OAIC’s case management
system Resolve and generated Resolve reports in scope.
I note that as part of your FOI request, you requested all documents concerning third
party consultation for OAIC file FOIREQ22/00356. As part of the search and retrieval
process, officers in the Legal Service team confirmed as of the date of your request, no
third-party consultation has been commenced in relation to that matter,.
Accordingly, on the basis of the searches conducted, I am satisfied that under s 24A of
the FOI Act that all reasonable steps have been taken by the OAIC to find the
documents that fall within the scope of your request and the attached 4 document are
the only documents relevant to your request.
Certain operations of agencies exemption- section 47E(d)
I have decided to give access in part to the
2 documents found within the scope of
your request under section 47E(d) of the FOI Act.
2
The material within the documents that I have found to be conditional y exempt is
material disclosing the network address of the OAIC’s IT system.
Under s 47E(d) of the FOI Act, a document is conditionally exempt if its disclosure
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the operations of an agency.
Section 47E(d) of the FOI Act states:
A document is conditional y exempt if its disclosure under this Act would, or could
reasonably be expected to, do any of the fol owing:
…
(d) have a substantial adverse effect on the proper and efficient conduct of the
operations of an agency.
The FOI Guidelines at [6.101] provides:
For the grounds in ss 47E(a)–(d) to apply, the predicted effect needs to be reasonably
expected to occur. The term ‘could reasonably be expected’ is explained in greater
detail in Part 5. There must be more than merely an assumption or al egation that
damage may occur if the document were to be released.
Additionally, at [6.103] the FOI Guidelines further explain:
An agency cannot merely assert that an effect would occur following disclosure. The
particulars of the predicted effect should be identified during the decision making
process, including whether the effect could reasonably be expected to occur. Where
the conditional exemption is relied upon, the relevant particulars and reasons should
form part of the decision maker’s statement of reasons, if they can be included
without disclosing exempt material (s 26, see Part 3).
The term ‘substantial adverse effect’ explained in the Guidelines [at 5.20] and it
broadly means ‘an adverse effect which is sufficiently serious or significant to cause
concern to a properly concerned reasonable person’.
The word ‘substantial’, taken in the context of substantial loss or damage, has been
interpreted as ‘loss or damage that is, in the circumstances, real or of substance and
not insubstantial or nominal’.
OAIC Network Address
The OAIC material that I have held to be exempt under section 47E(d) of the FOI Act in
this matter is material containing the network address of the OAIC’s IT system.
3
The OAIC collects and stores a range of personal and financial information about
members of the public. The network address contains information about the OAIC’s IT
system (including the network location and storage of information). I consider that
disclosure of this information could compromise the safety and security of the storage
of the information held by the OAIC. The impact of any compromise to the safety and
security of the OAIC’s information systems would result in a serious adverse impact on
the functions and responsibilities of the OAIC.
In the IC review case of
‘AW’ and Australian Taxation Office (Freedom of information)
[2014] AICmr 1 (‘AW’), the then Freedom of Information Commissioner considered the
decision by the Australian Taxation Office (ATO) to exempt user IDs under section
47E(d) of the FOI Act. The user IDs are used by ATO staff to access the ATO’s IT system.
The Commissioner found that disclosing the user IDs “would have an adverse effect
on the security of the ATO’s IT systems and could reasonably be expected to have a
substantial adverse effect on the proper and efficient conduct of the ATO”. In a series
of subsequent IC review decisions, the former Australian Information Commissioner
agreed with the reasoning given by the Commissioner in ‘AW’ to find that user IDs used
by ATO staff to access the ATO’s IT system were exempt under section 47E(d) of the
FOI Act.
I consider that the disclosure of the network address of the OAIC’s computer system
could reasonably be expected to have a substantial adverse effect on the proper and
efficient conduct of the OAIC’s operations. I have decided that the network address
of the OAIC’s IT system is conditional y exempt from disclosure under section 47E(d)
of the FOI Act.
The public interest test- section 11A(5)
An agency cannot refuse access to conditional y exempt documents unless giving
access would, on balance, be contrary to the public interest (s 11A(5)). The FOI
Guidelines explain that disclosure of conditionally exempt documents is required
unless the particular circumstances at the time of decision reveal countervailing harm
which overrides the public interest in giving access.
In the AAT case of
Utopia Financial Services Pty Ltd and Australian Securities and
Investments Commission (Freedom of information) [2017] AATA 269, Deputy President
Forgie explained that:
… the time at which I make my decision for s 11A(5) requires access to be given
to a conditionally exempt document “
at a particular time” unless doing so is,
on balance, contrary to the public interest. Where the balance lies may vary
4
from time to time for it is affected not only by factors peculiar to the particular
information in the documents but by factors external to them.1
In this case, I must consider whether disclosure of the material subject to section
47E(d) at this time would be contrary to the public interest.
The FOI Act sets out at s11B(3) four factors favouring access, which must be
considered if relevant. They are that disclosure would:
• promote the objects of the Act
• inform debate on a matter of public importance
• promote effective oversight of public expenditure
• allow a person to access his or her personal information
The FOI Guidelines provide a further non-exhaustive list of factors favouring
disclosure (see [6.19]). These factors include when disclosure will reveal the reason
for a government decision and any background or contextual information that
informed the decision and when disclosure will enhance the scrutiny of government
decision making.
In my view, the public interest factors favouring disclosure in this case are that
disclosure would promote the objects of the FOI Act generally.
Against these factors, I must balance the factors against disclosure. The FOI Act does
not specify factors against disclosure, however the FOI Guidelines at paragraph [6.22]
provides a non-exhaustive list of factors against disclosure.
I consider that the relevant factors against disclosure in this instance are as follows:
• disclosure of the network address of the OAIC’s IT system could
compromise the safety and security of the storage of the information held
by the OAIC.
On balance, I consider that the factor against disclosure outweighs the factor in favour
of disclosure. I have therefore decided that at this point in time, it would be contrary
to the public interest to give you access to the information that I have found to be
conditional y exempt under s47E(d) of the FOI Act.
1
Utopia Financial Services Pty Ltd and Australian Securities and Investments Commission (Freedom of
information) [2017] AATA 269 [133].
5
Conclusion
Please find attached a document schedule and documents released to you as part of
this decision. As noted above, I have decided to provide you partial access to the
2
documents identified within the scope of your request. The other 2 documents have
been released in full.
Please see the following page for information about your review rights.
Yours sincerely
Alessia Mercuri
Lawyer
Legal Services
3 January 2023
6
If you disagree with my decision
Internal Review
You have the right to apply for an internal review of my decision under Part VI of the
FOI Act. An internal review will be conducted, to the extent possible, by an officer of
the OAIC who was not involved in or consulted in the making of my decision. If you
wish to apply for an internal review, you must do so in writing within 30 days. There
is no application fee for internal review.
If you wish to apply for an internal review, please mark your application for the
attention of the FOI Coordinator and state the grounds on which you consider that
my decision should be reviewed.
Applications for internal reviews can be submitted to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Alternatively, you can submit your application by email to xxx@xxxx.xxx.xx, or by fax
on 02 9284 9666.
Further Review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
7
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx , or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxxxx@xxxx.xxx.xx . More information is available on the Access our information
page on our website.
Disclosure log
Section 11C of the FOI Act requires agencies to publish online documents released
to members of the public within 10 days of release, except if they contain personal
or business information that would be unreasonable to publish.
The documents I have decided to release to you contain personal information
that would be unreasonable to publish. As a result, the documents will not be
published on our disclosure log.
8
