Our reference: FOIREQ22/00348
Attention: Mr Steven Roddis
By Email:
xxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Your internal review application– FOIREQ22/00348
Dear Mr Roddis
I am writing to advise you of my decision in response to your application for internal
review of a decision made on 26 October 2022 under the
Freedom of Information Act
1982 (FOI Act), by the original decision maker Ms Emily Elliott.
An internal review is a fresh decision made by a person other than the person who
made the original decision (s 54C of the FOI Act). All materials available to the
original decision maker have been made available to me. I have also undertaken
further consultation before making my decision.
Scope of your application for internal review
On 25 September 2022 you sought access on the following terms:
“In similar vein to
https://www.righttoknow.org.au/request/9038/response/26878/attach/7/FOI%2021.2
2%201800%20Decision%20Document.pdf?cookie_passthrough=1
Please provide a summary of how many times the string: "api.www.optus.com.au" or
"http://api.www.http://optus.com.au" or "https://api.www.optus.com.au" are
mentioned or cited across all OAIC records and communications since January 2016
On the same date, you wrote to the OAIC clarifying your request as fol ows:
Correction:
please substitute "http://api.www.http://optus.com.au" with
"http://api.www.optus.com.au"
1300 363 992
T +61 2 9284 9749
GPO Box 5218
www.oaic.gov.au
oaic.gov.au/enquiry
F +61 2 9284 9666
Sydney NSW 2001
ABN 85 249 230 937
On 25 October 2022 the OAIC provided you with a decision in FOIREQ22/00303. Your
request was refused under section 24A of the FOI Act on the basis that all reasonable
steps had been taken to identify relevant documents and I am satisfied the
documents do not exist or cannot be found. The original decision maker also decided
that a document could not be produced under s17 of the FOI Act.
On 26 October 2022, you applied for internal review of the original decision:
“Please pass this on to the person who conducts Freedom of Information reviews.
I am writing to request an internal review of Office of the Australian Information
Commissioner's handling of my FOI request 'Optus API mentions'.
Specifically emails were not searched because OAIC determined in their response to
my FOI request:
"It is not possible to do a global search of OAIC email accounts since 2016 to the date of
your request. Each individual officer would need to conduct a search of their individual
email accounts. Each officer who left the OAIC would require engagement with OAIC’s
ICT provider to conduct the search. "
"To create a document with the information you have requested would require a staff
member to manually review every email sent or received by the OAIC, and every
document created or received by the OAIC, since 2016 up until the date of your FOI
request, and manual y record the frequency of the occurrences of the terms contained
in your request in a new document."
I posit that al reasonable steps were not taken to find the documents requested
because:
The implication of what was stated above is that OAIC cannot view their emails
without the cooperation of "individual officer would need to conduct a search of
their individual email accounts".
Which would mean OAIC would have no reasonable eDiscovery system in place for
email.
In my opinion searching OAIC's email corpus has been wrongly determined to be a
manual process…”
I have taken the above information into consideration in making my internal review
decision.
2
Decision
I am an officer authorised under s 23(1) of the FOI Act to make decisions in relation to
FOI requests.
I have decided to affirm the decision made in FOIREQ22/00303 to refuse your request
under s 24A of the FOI Act on the basis that all reasonable steps have been taken to
identify relevant documents and I am satisfied the documents do not exist or cannot
be found. I have also affirmed the that a document cannot be produced under s17 of
the FOI Act in answer to your request.
Reasons for decision
Material taken into account
In making my decision, I have had regard to the following:
• your freedom of information request FOIREQ22/00303 and subsequent
correspondence, as outlined above,
• your application for internal review dated 26 October 2022,
• correspondence and discussions with relevant OAIC line areas regarding your
request,
• searches undertaken in the course of processing your original request
• additional searches undertaken by the OAIC’s IT provider, the Department of
Employment and Workplace Relations (DEWR) in the course of processing this
internal review,
• the FOI Act, in particular s 24A and s 17 of the FOI Act,
• relevant case law, and
• the Guidelines issued by the Australian Information Commissioner under s
93A of the FOI Act.
Whether reasonable steps were taken to find documents – s 24A
Section 24A requires that an agency take ‘all reasonable steps’ to find a requested
document before refusing access to it on the basis that it cannot be found or does
not exist.
Section 24A provides as follows:
(1) An agency or Minister may refuse a request for access to a document if:
(a) all reasonable steps have been taken to find the document; and
3
link to page 4
(b) the agency or Minister is satisfied that the document:
(i) is in the agency’s or Minister’s possession but cannot be found; or
(i ) does not exist
The FOI Guidelines state at [3.89]
Agencies and ministers should undertake a reasonable search on a flexible and
common-sense interpretation of the terms of the request. What constitutes a
reasonable search will depend on the circumstances of each request and will be
influenced by the normal business practices in the agency’s operating environment or
the minister’s office. At a minimum, an agency or minister should take comprehensive
steps to locate documents, having regard to:
•
the subject matter of the documents
•
the current and past file management system and the practice of
destruction or removal of documents
•
the record management system in place
•
the individuals within the agency who may be able to assist with the
location of documents, and
•
the age of the documents.1
Searches undertaken
Searches undertaken in the course of processing your original request
As previously communication to you, in the course of processing your original
request, a member of the OAIC’s Legal Services team sought advice from a member
of the Privacy Regulation and Strategy team regarding whether any summary
document containing the key terms within the scope of your request would be in
existence. They advised that no such document existed in their records and
confirmed that no other area of the OAIC in their view would hold such a document.
In order to undertake a search of the OAIC records more broadly, a search and
retrieval request was sent to the OAIC’s Information Management & Governance
1 Office of the Australian Information Commissioner,
Guidelines issued by the Australian Information
Commissioner under s 93A
of the Freedom of Information Act 1982 (
FOI Guidelines) [3.89], footnotes
omitted.
4
Officer to search for any documents held within the OAIC’s records containing any of
the key terms specified within your request.
Searches were undertaken across the OAIC’s record storage systems Resolve
(including Resolve summary fields), Content Manager, as well as network drives for
the following terms specified in your request.
o
“api.www.optus.com.au”
o
“http://api.www.optus.com.au”
o
"https://api.www.optus.com.au”
These searches failed to locate any documents that contained any of the above
terms. We noted that were a number of limitations to the searches conducted:
• Not all documents are able to be searched for content (for instance, PDF
documents cannot be searched for content if they are not saved in a readable
format, so unless the search terms appear in the title, documents in
‘unreadable’ formats will not appear in searches undertaken.
• It is not possible to do a global search of OAIC email accounts since 2016 to
the date of your request. Each individual officer would need to conduct a
search of their individual email accounts. Each officer who left the OAIC
would require engagement with OAIC’s ICT provider to conduct the search.
While I note these search limitations, having regard to the subject matter of the
documents you have requested, being a document that contains a summary of the
times your requested key terms have been “mentioned or cited across all OAIC
records and communications since January 2016”, the fact that not a single
document containing any of your requested key terms was able to be located, as well
as the above-outlined advice from the relevant Privacy line area regarding their
belief that no such document would exist, I remain satisfied that the documents are
not held by the OAIC internally.
Additional searches undertaken for this internal review
Noting the concerns expressed by you in your request for internal review regarding
the email searches undertaken, in undertaking this internal review, the Department
of Employment and Workplace Relations (DEWR) ICT Service Desk (
Service Desk)
was contacted by the OAIC to confirm as to whether they would be able to conduct
searches across all OAIC mailboxes, including those of all past and present
5
link to page 6
employees.
2 The DEWR’s IT Forensics team (
Forensics team) conducted searches
for emails containing addresses:
o “api.www.optus.com.au”
o “http://api.www.optus.com.au”
o
https://api.www.optus.com.au
The Forensics team completed searches across all OAIC staff members mailboxes,
dating back to January 2016 to which they had access.
On 3 November 2022 the Forensics team informed the OAIC that they had completed
searches across all OAIC staff member mailboxes dating back to January 2016 that
they had access to, and that no additional documents were able to be located
containing any of your search terms. The only emails that were located was the
emails containing your initial FOI request, which are outside the scope of your
request.
Regarding limitations on the searches conducted, The Forensics team advised that
searches were only able to be conducted on email accounts stored within the
Outlook 365 environment, which they advised would only be the email accounts of
individuals working for OAIC in April 2022.
On 7 November 2022, the Forensics team contacted us informing that they were able
to identify a backup of emails of departed OAIC staff held by them, and that they
would commence extracting this data for analysis and searching.
On 10 November 2022 they informed us that the data had been extracted, and that
the total data was 3.58 terabytes. The Forensics team have attempted to complete a
search of this data but have run into unexcepted technical difficulties and delays in
processing this data and as at 25 November 2022, have not been able to complete
these searches. However, in my view further searches of these backup files is not
reasonable in the circumstances.
As per the FOI guidelines at [3.93]:
“…if an agency or minister is aware that its backup
system may contain relevant documents not otherwise available…a search of the
backup system may be required.” I note that extensive searches have already been
undertaken to find documents within the scope of your request, with over 130 OAIC
2 The Department of Education and Workplace Relations provides the OAIC’s IT Services. We have
previously been advised that the OAIC’s previous IT provider, the Human Rights Commission, do not
hold a backup of the email accounts of OAIC staff members. This material has been migrated to DEWR.
6
mailboxes having been searched in full and not a single reference to any of the terms
in your FOI request able to be found.
In light of this, and in light of the earlier searches carried out, as detailed above, I am
satisfied that the OAIC does not hold any documents within the scope of your
request. I am satisfied that all reasonable searches have been conducted in
response to your FOI request, and the documents you are seeking do not exist or
cannot be found.
Document created under s 17 of the FOI Act
As I am satisfied that the documents do not exist or cannot be found, I have
considered whether the OAIC may produce a document under s 17 of the FOI Act
containing the information that you have requested. Relevantly, the FOI Guidelines
at [3.212] state that the obligation to produce a written document arises if:
•
the agency could produce a written document containing the information by
using a ‘computer or other equipment that is ordinarily available’ to the agency
for retrieving or col ating stored information (s 17(1)(c)(i)), or making a
transcript from a sound recording (s 17(1)(c)(ii)), and
•
producing a written document would not substantial y and unreasonably divert
the resources of the agency from its other operations (s 17(2)).
As discussed above, no documents were able to be located that contained any of the
terms the subject of your request across these systems
Based on this advice, it appears that it is not possible to use any computer system or
equipment ordinarily available to the OAIC to generate a report with the information
that you have requested, due to us being unable to locate any documents containing
any of the terms the subject of your request.
Conclusion
Please see the following page for information about your review rights and
information about the OAIC’s disclosure log.
Yours sincerely
Emma Liddle
Director, Legal
25 November 2022
7
If you disagree with my decision
Further Review
You have the right to seek review of this decision by the Information Commissioner
and the Administrative Appeals Tribunal (AAT).
You may apply to the Information Commissioner for a review of my decision (IC
review). If you wish to apply for IC review, you must do so in writing within 60 days.
Your application must provide an address (which can be an email address or fax
number) that we can send notices to, and include a copy of this letter. A request for
IC review can be made in relation to my decision, or an internal review decision.
It is the Information Commissioner’s view that it will usually not be in the interests of
the administration of the FOI Act to conduct an IC review of a decision, or an internal
review decision, made by the agency that the Information Commissioner heads: the
OAIC. For this reason, if you make an application for IC review of my decision, and the
Information Commissioner is satisfied that in the interests of administration of the
Act it is desirable that my decision be considered by the AAT, the Information
Commissioner may decide not to undertake an IC review.
Section 57A of the FOI Act provides that, before you can apply to the AAT for review
of an FOI decision, you must first have applied for IC review.
Applications for IC review can be submitted online at:
https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR_
10
Alternatively, you can submit your application to:
Office of the Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Or by email to xxxxx@xxxx.xxx.xx, or by fax on 02 9284 9666.
Accessing your information
If you would like access to the information that we hold about you, please contact
xxx@xxxx.xxx.xx. More information is available on the Access our information page
on our website.
8
Disclosure log
Section 11C of the FOI Act requires agencies to publish online documents released to
members of the public within 10 days of release, except if they contain personal or
business information that would be unreasonable to publish.
Due to no documents being located, there are no documents to publish on the
disclosure log.
9
Document Outline
