PO Box 7820 Canberra BC ACT 2610
6 February 2023
Our reference: LEX 71196
Rex Banner
By email:
xxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Sir / Madam,
Decision on your Freedom of Information Request
I refer to your request received by Services Australia (the Agency) dated 22 December 2022
for access under the
Freedom of Information Act 1982 (Cth) to the following documents:
...the Privacy Impact Assessment (PIA) #39159 for the "COVID-19 Immunisation
Readiness Project" under the Freedom of Information Act 1982 (Cth).
My decision
The Agency holds one document (totalling 62 pages) that meets the scope of your request.
I have decided to refuse your request in full on the basis that:
the material contained within the document is subject to legal professional privilege
(section 42 exemption), and
disclosure of the document would have a substantial and adverse effect on the
Agency’s operations, and disclosure is against the public interest (section 47E(d)
conditional exemption).
Please see the Schedule at
Attachment A to this letter for a detailed list of the documents and
the reasons for my decision, including relevant sections of the FOI Act.
You can ask for a review of our decision
If you disagree with any part of the decision you can ask for a review. There are two ways you
can do this. You can ask for an internal review from within the Agency, or an external review
by the Office of the Australian Information Commissioner. See
Attachment B for more
information about how to request a review.
Further assistance
If you have any questions please email
xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx.xxx.xx.
Yours sincerely
Sarah
Authorised FOI Decision Maker
Freedom of Information Team
Information Access Branch | Legal Services Division
Services Australia
PAGE 1 OF 8
PO Box 7820 Canberra BC ACT 2610
Attachment A
SCHEDULE OF DOCUMENTS FOR RELEASE
BANNER, Rex - LEX 71196
Doc
Pages
Date
Description
Decision
Exemption
Comments
No.
1.
1 - 62
28
Privacy Impact
Exempt in full
Section 42
Material subject to legal professional privilege
September Assessment – COVID-19
2022
Immunisation Readiness
Section 47E(d)
Disclosure would have substantial and adverse effect on
Project
Agency operations
PAGE 2 OF 8
PO Box 7820 Canberra BC ACT 2610
Attachment A
REASONS FOR DECISION
What you requested
On 22 December 2022, you requested:
…the Privacy Impact Assessment (PIA) #39159 for the "COVID-19 Immunisation
Readiness Project" under the Freedom of Information Act 1982 (Cth).
You agreed to an extension of time for the Agency to process your request on 22 December
2022 and the Agency acknowledged your request on 5 January 2023.
What I took into account
In reaching my decision I took into account:
your original request dated 22 December 2022
correspondence with you
the document falling within the scope of your request
whether the release of material is in the public interest
consultations with Agency officers about:
o the nature of the documents, and
o the Agency's operating environment and functions
guidelines issued by the Australian Information Commissioner under section 93A of the
FOI Act (the Guidelines), and
the FOI Act.
Reasons for my decision
I am authorised to make decisions under section 23(1) of the FOI Act.
I have decided to refuse access to the document in full. My findings of fact and reasons for
deciding the exemption applies to that document are discussed below.
Section 42 of the FOI Act – legal professional privilege
This section of the FOI Act allows the Agency to redact documents or parts of documents
subject to legal professional privilege (LPP). I have applied this exemption to the document in
full.
Section 42 of the FOI Act provides:
(1) A document is an exempt document if it is of such a nature that it would be privileged
from production in legal proceedings on the ground of legal professional privilege.
PAGE 3 OF 8
PO Box 7820 Canberra BC ACT 2610
(2) A document is not an exempt document because of subsection (1) if the person
entitled to claim legal professional privilege in relation to the production of the document
in legal proceedings waives that claim.
(3) A document is not an exempt document under subsection (1) by reason only that:
(a) the document contains information that would (apart from this subsection)
cause the document to be exempt under subsection (1); and
(b) the information is operational information of an agency.
Paragraphs 5.129 of the Guidelines provides the following guidance in relation to the
application of section 42:
At common law, determining whether a communication is privileged requires a
consideration of:
whether there is a legal adviser-client relationship
whether the communication was for the purpose of giving or receiving legal
advice, or use in connection with actual or anticipated litigation
whether the advice given is independent
whether the advice given is confidential.
(internal references omitted)
The document is legal advice provided to the Agency in the development of the COVID-19
Immunisation Readiness Project. I am satisfied the document is advice provided by legal
advisers acting with the required level of independence from the client and there is a clear
legal adviser-client relationship.
I am satisfied LPP attaches to this document and LPP has not been waived. The documents
have not been distributed further than reasonably necessary for internal operational purposes.
I am also satisfied the substance of the legal advice contained in the document has not been
used in any way which is inconsistent with the maintenance of the confidentiality of the advice.
I am satisfied there is a possibility of real harm resulting from release as the document contains
detailed legal analysis about the Agency’s cyber operations and environment. Disclosure of
this information creates the real risk of third party actors gaining insight into the Agency
systems and architecture, and exploiting this knowledge for malicious purposes.
Additionally, I am of the view that the Agency’s ability to obtain legal advice on issues (such as
COVID-19 projects) would be substantially prejudiced if these documents were to be made
publicly available through FOI processes. I am satisfied real harm is likely to result from release
of the documents as doing so would waive privilege and disclose the particular legal provider’s
approach to the interpretation, analysis and application of legislation administered by the
Agency.
Conclusion
I have decided to refuse you access to the document on the basis it is exempt in full under
section 42 of the FOI Act as it contains material subject to LPP.
PAGE 4 OF 8
PO Box 7820 Canberra BC ACT 2610
Section 47E(d) of the FOI Act – operations of the Agency
This section of the FOI Act provides a document is conditionally exempt if it would have a
substantial adverse effect on the Agency’s ability to conduct its operations efficiently and
properly.
The requested document contains detailed analysis about the Agency’s cyber operations and
its measures to securely protect the information it stores in line with legislative requirements.
The Agency holds a vast amount of private and personal information relating to its own staff
and members of the Australian community, and I am satisfied the protection of this information
is clearly related to the Agency’s operations.
I consulted with Agency officers in the Health Programmes Division who advised me that
disclosure of the document poses a real and substantial risk of compromising the Agency’s
cybersecurity measures and exposing the Agency to greater risk of cyber-attacks. I am of the
view that disclosure of the material would have a substantial and adverse effect on the
Agency’s proper and efficient conduct of operations as the security of the information the
Agency holds would be severely jeopardised.
Whilst I am not suggesting that you would misuse this information, the FOI Act does not control
or restrict the use or spread of information once released through FOI. I must therefore take
the perspective that the information could enter the public domain and create the identified
risk.
I am satisfied that disclosure of this material would have a substantial and adverse effect on
the proper and efficient conduct of the Agency’s operations.
Public interest considerations
Access to conditionally exempt material must be given unless I am satisfied it would not be in
the public interest to do so.
I acknowledge there is public interest in favour of disclosure to promote the objects of the FOI
Act, and inform debate on a matter of public importance. However I consider that the integrity
of Agency systems and the protection of the private and personal information the Agency holds
about members of the public and its staff weigh heavier against disclosure. Given the
heightened risk environment regarding cyber-attacks, I consider that on balance, disclosure
would be contrary to the public interest,
Conclusion
I am of the view that disclosing the material in the document would have a substantial and
adverse effect on the proper conduct of the Agency’s operations. I am further satisfied that the
public interest against disclosure outweighs the public interest in favour of disclosure.
Summary of decision
I have decided to refuse your request in full on the basis that:
the material contained within the document is subject to legal professional privilege
(section 42 exemption), and
disclosure of the document would have a substantial and adverse effect on the Agency’s
operations, and disclosure is against the public interest (section 47E(d) conditional
exemption)
PAGE 5 OF 8
PO Box 7820 Canberra BC ACT 2610
I have not taken into account any of the irrelevant factors set out in section 11B(4) of the FOI
Act in making this decision.
PAGE 6 OF 8
PO Box 7820 Canberra BC ACT 2610
Attachment B
INFORMATION ON RIGHTS OF REVIEW
FREEDOM OF INFORMATION ACT 1982
Asking for a full explanation of a Freedom of Information (FOI) decision
Before you ask for a formal review of a FOI decision, you can contact us to discuss your
request. We will explain the decision to you. This gives you a chance to correct
misunderstandings.
Asking for a formal review of a FOI decision
If you still believe a decision is incorrect, the
Freedom of Information Act 1982 (FOI Act) gives
you the right to apply for a review of the decision. Under sections 54 and 54L of the FOI Act,
you can apply for a review of an FOI decision by:
1. an Internal Review Officer in Services Australia (the Agency), and/or
2. the Australian Information Commissioner.
Applying for an internal review by an Internal Review Officer
If you apply for internal review, a different decision maker to the Agency delegate who made
the original decision will carry out the review. The Internal Review Officer will consider all
aspects of the original decision and decide whether it should change. An application for internal
review must be:
made in writing
made within 30 days of receiving this letter
sent to the address at the top of the first page of this letter.
Note: You do not need to fill in a form. However, it is a good idea to set out any relevant
submissions you would like the Internal Review Officer to further consider, and your reasons
for disagreeing with the decision.
Applying for external review by the Australian Information Commissioner
If you do not agree with the original decision or the internal review decision, you can ask the
Australian Information Commissioner to review the decision.
If you do not receive a decision from an Internal Review Officer in the Agency within 30 days
of applying, you can ask the Australian Information Commissioner for a review of the original
FOI decision.
You will have 60 days to apply in writing for a review by the Australian Information
Commissioner.
PAGE 7 OF 8
PO Box 7820 Canberra BC ACT 2610
You can
lodge your application:
Online:
www.oaic.gov.au
Post:
Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Email:
xxxxxxxxx@xxxx.xxx.xx
Note: The Office of the Australian Information Commissioner generally prefers FOI applicants
to seek internal review before applying for external review by the Australian Information
Commissioner.
Important:
If you are applying online, the application form the 'Merits Review Form' is available at
www.oaic.gov.au.
If you have one, you should include with your application a copy of the Services
Australia decision on your FOI request
Include your contact details
Set out your reasons for objecting to the Agency's decision.
Complaints to the Australian Information Commissioner and Commonwealth
Ombudsman
Australian Information Commissioner
You may complain to the Australian Information Commissioner concerning action taken by an
agency in the exercise of powers or the performance of functions under the FOI Act, There is
no fee for making a complaint. A complaint to the Australian Information Commissioner must
be made in writing. The Australian Information Commissioner's contact details are:
Telephone: 1300 363 992
Website:
www.oaic.gov.au
Commonwealth Ombudsman
You may also complain to the Commonwealth Ombudsman concerning action taken by an
agency in the exercise of powers or the performance of functions under the FOI Act. There is
no fee for making a complaint. A complaint to the Commonwealth Ombudsman may be made
in person, by telephone or in writing. The Commonwealth Ombudsman's contact details are:
Phone: 1300 362 072
Website:
www.ombudsman.gov.au
PAGE 8 OF 8
