PO Box 7820 Canberra BC ACT 2610
27 March 2023
Our reference: LEX 72134
Rex Banner
By email: xxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx
Dear Mr Banner
Freedom of Information Request – Internal Review Decision
I refer to your correspondence received by Services Australia (the Agency) on 27 February
2023, seeking an internal review of the decision made by the Agency on 20 February 2023 in
relation to your request for access to a document under the
Freedom of Information Act 1982
(FOI Act).
Background
On 27 January 2023, you requested access under the FOI Act to the following document:
I request the Privacy Impact Assessment:
Reference Number: 38354
Title: myGov Enhancement – Analytics
Apologies the reference number should be 38355
On 27 February 2023, the Agency notified you that it had decided to refuse your request as
the requested material was exempt under the FOI Act (original decision).
On 27 February 2023, you requested an internal review of the original decision.
Summary of my internal review decision
I am authorised to make decisions under section 23(1) of the FOI Act, including internal review
decisions under section 54C of the FOI Act. Consistent with the requirements of section 54C(2)
of the FOI Act, I have made a fresh decision.
I have decided to
refuse your request as it relates to material that is fully exempt under the
FOI Act.
Please refer to
Attachment A for further information regarding the reasons for my decision.
PAGE 1 OF 10
PO Box 7820 Canberra BC ACT 2610
You can ask for a review of our decision
If you disagree with any part of the decision, you can ask for a review by the Australian
Information Commissioner. See
Attachment B for more information about how to request a
review.
Further assistance
If you have any questions please email xxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxxxxxxxx.xxx.xx.
Yours sincerely
Lachlan
Authorised FOI Decision Maker
Freedom of Information Team
FOI and Ombudsman Branch | Legal Services Division
Services Australia
PAGE 2 OF 10
PO Box 7820 Canberra BC ACT 2610
Attachment A
REASONS FOR DECISION
What you requested
On 27 January 2023, you requested access under the FOI Act to the following document:
I request the Privacy Impact Assessment:
Reference Number: 38354
Title: myGov Enhancement – Analytics
Apologies the reference number should be 38355
On 27 February 2023, the Agency notified you of the original decision.
On 27 February 2023, you requested an internal review of the original decision, providing
written submissions in which you argued that:
I am writing to request an internal review of Services Australia's handling of my FOI
request '38355 myGov Enhancement - Analytics Privacy Impact Assessment'.
> I have applied the exemption in section 42 of the FOI Act to Document 1 in its entirety.
There is no way the entire document is subject to LPP, it's a privacy impact
assessment, we know what for, tenders show who it's from, so we know that the title
page can't be subject to LPP.
> Further, I am satisfied the Agency’s ability to obtain legal advice on issues would be
substantially prejudiced if this document were to be made publicly available through
FOI processes. In my view, real harm is likely to result from release of the document
as doing so would waive privilege and disclose the particular legal provider’s approach
to the interpretation, analysis and application of legislation, systems and processes
administered by the Agency.
This is not real harm, a simple Google search wil show plenty of PIAs that have been
either published after a FOI request or proactively published.
https:/ www.digitalidentity.gov.au/sites/default/files/2021-
11/DTA%20TDIF%20PIA3.pdf
https:/ www.digitalhealth.gov.au/sites/default/files/documents/adha-
my health record mobile applications project-privacy impact assessment.pdf
https:/ www.digitalhealth.gov.au/sites/default/files/2020-11/ADHA-
My Health Record Mobile Applications Project-Privacy Impact Assessment.pdf
https:/ www.righttoknow.org.au/request/559/response/2178/attach/3/MyGov%20PIA%
20with%20attachments%20Redacted%20for%20release.pdf?cookie passthrough=1
None of them have ever been marked as LPP or confidential.
PAGE 4 OF 10
PO Box 7820 Canberra BC ACT 2610
>The document identifies privacy and secrecy compliance risks for the Agency and
includes recommendations for managing or eliminating identified risks and maximising
opportunities for enhancing privacy protection.
[...]
> However, I also consider disclosure could reasonably be expected to prejudice the
Agency’s ability to obtain comprehensive legal advice in the future and would destroy
or diminish the commercial value of the provider’s PIA methodology and approach,
ultimately impede the full and frank disclosure between a lawyer and client to the benefit
of the effective administration of justice.
See above, this doesn't make sense if other PIAs (including a mygov one) have been
released. The MyGov PIA appears to have been proactively been released.
> The document identifies privacy and secrecy compliance risks for the Agency and
includes recommendations for managing or eliminating identified risks and maximising
opportunities for enhancing privacy protection. I am also satisfied the document is not
operational information or purely factual information.
> Furthermore, a PIA contains purely factual information, that is discussing the state of
such a project and privacy and secrecy compliance risks for the Agency and includes
recommendations for managing or eliminating identified risks and maximising
opportunities for enhancing privacy protection.
> In addition, whilst PIAs can be conducted for any project, a PIA is required for high
risk projects. Service Australia is required to do a PIA for projects that involve a
significant change to how they manage personal information, or, might have a
significant impact on the privacy of individuals; or if directed to by OAIC.
Unless Services Australia has done the PIA on their on accord, this is a high risk project
or (OAIC has determined that a PIA is required) and this is a project that the Australian
public uses, a high risk project for all Australians sounds like it would be in the public
interest that the public knows any privacy and secrecy compliance risks for the Agency
and includes recommendations for managing or eliminating identified risks and
maximising opportunities for enhancing privacy protection.
Lastly, I request Services Australia proactively release the document as it is in the
public interest to do so.
What I took into account
In reaching my decision I took into account:
• your original request dated 27 January 2023
• your internal review request dated 27 February 2023
• other correspondence with you
• the document falling within the scope of your request
• whether the release of material would be in the public interest
• consultations with Agency officers about:
o the nature of the document, and
PAGE 5 OF 10
PO Box 7820 Canberra BC ACT 2610
o the Agency's operating environment and functions
• guidelines issued by the Australian Information Commissioner under section 93A of the
FOI Act (the Guidelines), and
• the FOI Act.
Reasons for my decision
I am authorised to make decisions under section 23(1) of the FOI Act, including internal review
decisions under section 54C of the FOI Act.
I have decided to refuse access to the document in full. My findings of fact and reasons for
deciding the exemptions apply to the document are discussed below.
Section 42 of the FOI Act – legal professional privilege
I have applied the exemption in section 42 of the FOI Act to the document in its entirety.
This section of the FOI Act allows the Agency to redact documents or parts of documents
subject to legal professional privilege (LPP).
The FOI Act does not define LPP. However, courts have decided whether a communication is
privileged requires a consideration of:
• whether there is a legal adviser-client relationship
• whether the communication was for the purpose of giving or receiving legal advice, or
use in connection with actual or anticipated litigation
• whether the advice given is independent, and
• whether the advice given is confidential.
The document you requested is a Privacy Impact Assessment (PIA) prepared by an
independent external legal provider for the purpose of providing the Agency confidential
professional legal advice in relation to data analysis in enhancements made to the myGov
platform.
Accordingly, I am satisfied LPP attaches to this document. I am also satisfied LPP has not
been waived, as the document has not been distributed further than reasonably necessary for
internal operational purposes, and the substance of the legal advice contained in the document
has not been used in any way which is inconsistent with the maintenance of the confidentiality
of the advice.
Further, I am satisfied there is a possibility of real harm resulting from release of the document.
In particular, I consider the Agency’s ability to obtain independent external legal advice on
issues would be substantially prejudiced if it were to waive privilege over this document (which
sets out the particular legal provider’s PIA methodology, together with their approach to the
interpretation, analysis and application of legislation, systems and processes administered by
the Agency) and make it publicly available through FOI processes.
In your submissions, you have provided examples of other PIAs released under the FOI Act or
proactively published. However, each FOI decision made by a decision maker is on its own
merits. As such, while LPP may have been waived with respect to other PIAs, whether in
PAGE 6 OF 10
PO Box 7820 Canberra BC ACT 2610
response to FOI requests or otherwise, it has not been waived in this instance and I consider
there is a possibility of real harm resulting from release of the document.
For the reasons set out above, I am satisfied the document is exempt in full under section 42
of the FOI Act.
Section 47C of the FOI Act – deliberative material
I have applied the conditional exemption in section 47C of the FOI Act to the document in its
entirety.
This section of the FOI Act provides a document is conditionally exempt if it would disclose
deliberative matter. Deliberative matter is an opinion, advice or recommendation, or a
consultation or deliberation that has taken place in the course of, or for the purposes of, the
deliberative processes of an agency. Material which is operational or purely factual information
is not deliberative matter. The deliberative exemption also does not apply to reports of scientific
or technical experts, reports of a body or organisation prescribed by the regulations, or a formal
statement of reasons.
I am satisfied the document comprises deliberative matter, being advice and
recommendations, which have been prepared by the Agency’s legal services provider in the
course of undertaking the PIA. The document identifies privacy and secrecy compliance risks
for the Agency and includes recommendations for managing or eliminating identified risks and
maximising opportunities for enhancing privacy protection. I am also satisfied the document is
not operational information or purely factual information, and is otherwise not of a kind
specifically excluded by the FOI Act.
Accordingly, I find the document is conditionally exempt, in full, under section 47C(1) of the
FOI Act.
Public interest considerations
Access to conditionally exempt material must be given unless I am satisfied it would not be in
the public interest to do so.
When weighing up the public interest for and against disclosure under section 11A(5) of the
FOI Act, I have taken into account relevant factors in favour of disclosure. In particular, I have
considered the extent to which disclosure would promote the objects of the FOI Act.
I have also considered relevant factors weighing against disclosure, indicating access would
be contrary to the public interest. In particular, I have considered the extent to which disclosure
could reasonably be expected to:
• destroy or diminish the commercial value of the provider’s PIA methodology approach
• impede the full and frank disclosure between a lawyer and client, which assists the
effective administration of justice, and
• prejudice the Agency’s ability to obtain comprehensive legal advice in the future.
Based on these factors, I have decided, in this instance, the public interest in disclosing this
document is outweighed by the public interest against disclosure.
I have not taken into account any of the irrelevant factors set out in section 11B(4) of the FOI
Act in making this decision.
PAGE 7 OF 10
PO Box 7820 Canberra BC ACT 2610
Conclusion
I am satisfied the document sought is conditionally exempt under section 47C of the FOI Act.
Further, I have decided that on balance it would be contrary to the public interest to release
the document.
Summary of decision
I have decided to refuse your request on the basis:
• the document is subject to legal professional privilege and therefore exempt in full under
section 42 of the FOI Act, and
• the document comprises deliberative material, and disclosure would be contrary to the
public interest and the document is therefore exempt in full under section 47C of the FOI
Act.
PAGE 8 OF 10
PO Box 7820 Canberra BC ACT 2610
Attachment B
INFORMATION ON RIGHTS OF REVIEW
FREEDOM OF INFORMATION ACT 1982
Asking for a ful explanation of a Freedom of Information decision
Before you ask for a formal review of a FOI decision, you can contact us to discuss your
request. We wil explain the decision to you. This gives you a chance to correct
misunderstandings.
Asking for a formal review of an Freedom of Information internal review decision
If you stil believe a decision is incorrect, the FOI Act gives you the right to apply for a review
of the internal review decision. Under section 54M of the FOI Act, you can apply for a review
of an FOI decision by the Australian Information Commissioner. There are no fees for this
review.
You wil have 60 days to apply in writing for a review by the Australian Information
Commissioner.
You can
lodge your application:
Online:
www.oaic.gov.au
Post:
Australian Information Commissioner
GPO Box 5218
SYDNEY NSW 2001
Email:
xxxxxxxxx@xxxx.xxx.xx
Important:
• If you are applying online, the application form the 'Merits Review Form' is available at
www.oaic.gov.au.
• If you have one, you should include with your application a copy of the Services
Australia decision on your FOI request
• Include your contact details
• Set out your reasons for objecting to the Agency's decision.
Complaints to the Australian Information Commissioner and Commonwealth
Ombudsman
Australian Information Commissioner
You may complain to the Australian Information Commissioner concerning action taken by an
agency in the exercise of powers or the performance of functions under the FOI Act, There is
no fee for making a complaint. A complaint to the Australian Information Commissioner must
be made in writing. The Australian Information Commissioner's contact details are:
PAGE 9 OF 10
PO Box 7820 Canberra BC ACT 2610
Telephone: 1300 363 992
Website: www.oaic.gov.au
Commonwealth Ombudsman
You may also complain to the Commonwealth Ombudsman concerning action taken by an
agency in the exercise of powers or the performance of functions under the FOI Act. There is
no fee for making a complaint. A complaint to the Commonwealth Ombudsman may be made
in person, by telephone or in writing. The Commonwealth Ombudsman's contact details are:
Phone: 1300 362 072
Website: www.ombudsman.gov.au
The Commonwealth Ombudsman generally prefers applicants to seek review before
complaining about a decision.
PAGE 10 OF 10
