LEX 72136 Decision Internal Review Decision Letter.pdf

If not delivered return to PO Box 7820 Canberra BC ACT 2610




16 March 2023

Our reference:  LEX 72136
Rex Banner
By email: xxxxxxxxxxxxxxxxxxxxxxxxx@xxxxxxxxxxx.xxx.xx


Dear Mr Banner
Freedom of Information Request – Internal Review Decision
I refer to your correspondence dated 27 February 2023 seeking internal review of the
decision made by Services Australia (the Agency) under the Freedom of Information Act
1982 (the FOI Act) on 20 February 2023 (original decision).
Original decision

The original decision refused access to the relevant document in its entirety on the basis that
it contained:
•  material subject to legal professional privilege (section 42 of the FOI Act), and

•  deliberative matter, the disclosure of which would be contrary to the public interest
(section 47C of the FOI Act).
My decision on review
I am authorised to make decisions under section 23(1) of the FOI Act, including internal
review decisions under section 54C of the FOI Act. Consistent with the requirements of
section 54C(2) of the FOI Act, I have made a fresh decision.
Having carefully examined the material before me, I have decided to affirm the original
decision and refuse your request as it relates to material that is fully exempt under the FOI
Act.
The reasons for my decision, including the relevant sections of the FOI Act, are set out at
Attachment A.
You can ask for a review of my decision
If you disagree with any part of this decision you can ask for an external review by the Office
of the Australian Information Commissioner. See Attachment B for more information about
how to request a review.
Further assistance
If you have any questions please email xxx.xxxxx.xxxx@xxxxxxxxxxxxxxxxx.xxx.xx.

PAGE 1 OF 10

Yours sincerely

Verity
Authorised FOI Decision Maker
Freedom of Information Team
FOI and Ombudsman Branch | Legal Services Division
Services Australia

PAGE 2 OF 10

Attachment A
REASONS FOR DECISION
Background
On 27 January 2023, the Agency received your request for access to the following document
under the FOI Act:
I request the Privacy Impact Assessment:

Reference Number: 38356
Title: myGov Enhancement – search tasks and payment features
On 20 February 2023, the Agency notified you of the original decision.

On 27 February 2023, you requested an internal review of the original decision, providing
written submissions in which you argued that:

I am writing to request an internal review of Services Australia's handling of my FOI
request '38356 myGov Enhancement - search tasks and payment features Privacy
Impact Assessment'.

> I have applied the exemption in section 42 of the FOI Act to Document 1 in its
entirety.

There is no way the entire document is subject to LPP, it's a privacy impact
assessment, we know what for, tenders show who it's from, so we know that the title
page can't be subject to LPP.

> Further, I am satisfied the Agency’s ability to obtain legal advice on issues would
be substantially prejudiced if this document were to be made publicly available
through FOI processes. In my view, real harm is likely to result from release of the
document as doing so would waive privilege and disclose the particular legal
provider’s approach to the interpretation, analysis and application of legislation,
systems and processes administered by the Agency.

This is not real harm, a simple Google search wil  show plenty of PIAs that have
been either published after a FOI request or proactively published.

https:/ www.digitalidentity.gov.au/sites/default/files/2021-
11/DTA%20TDIF%20PIA3.pdf

https:/ www.digitalhealth.gov.au/sites/default/files/documents/adha-
my health record mobile applications project-privacy impact assessment.pdf

https:/ www.digitalhealth.gov.au/sites/default/files/2020-11/ADHA-
My Health Record Mobile Applications Project-Privacy Impact Assessment.pdf

https:/ www.righttoknow.org.au/request/559/response/2178/attach/3/MyGov%20PIA
%20with%20attachments%20Redacted%20for%20release.pdf?cookie passthrough
=1

PAGE 3 OF 10

None of them have ever been marked as LPP or confidential.

>The document identifies privacy and secrecy compliance risks for the Agency and
includes recommendations for managing or eliminating identified risks and
maximising opportunities for enhancing privacy protection.

[...]

> However, I also consider disclosure could reasonably be expected to prejudice the
Agency’s ability to obtain comprehensive legal advice in the future and would
destroy or diminish the commercial value of the provider’s PIA methodology and
approach, ultimately impede the full and frank disclosure between a lawyer and
client to the benefit of the effective administration of justice.

See above, this doesn't make sense if other PIAs (including a mygov one) have
been released. The MyGov PIA appears to have been proactively been released.

> The document identifies privacy and secrecy compliance risks for the Agency and
includes recommendations for managing or eliminating identified risks and
maximising opportunities for enhancing privacy protection. I am also satisfied the
document is not operational information or purely factual information.

Furthermore, a PIA contains purely factual information, that is discussing the state of
such a project and privacy and secrecy compliance risks for the Agency and
includes recommendations for managing or eliminating identified risks and
maximising opportunities for enhancing privacy protection.

In addition, whilst PIAs can be conducted for any project, a PIA is required for high
risk projects. Service Australia is required to do a PIA for projects that involve a
significant change to how they manage personal information, or, might have a
significant impact on the privacy of individuals; or if directed to by OAIC.

Unless Services Australia has done the PIA on their on accord, this is a high risk
project or (OAIC has determined that a PIA is required) and this is a project that the
Australian public uses, a high risk project for all Australians sounds like it would be
in the public interest that the public knows any privacy and secrecy compliance risks
for the Agency and includes recommendations for managing or eliminating identified
risks and maximising opportunities for enhancing privacy protection.

Lastly, I request Services Australia proactively release the document as it is in the
public interest to do so.

What I took into account
In reaching my decision I took into account:
•  your original request dated 27 January 2023

•  your internal review request dated 27 February 2023

•  other correspondence with you

•  the document that falls within the scope of your request

•  whether the release of material is in the public interest
PAGE 4 OF 10

•  consultations with Agency officers about:
  o  the nature of the document, and

o  the Agency’s operating environment and functions

•  guidelines issued by the Australian Information Commissioner under section 93A of
the FOI Act (the Guidelines), and

•  the FOI Act.
Reasons for my decision
I am authorised to make decisions under section 23(1) of the FOI Act, including internal
review decisions under section 54C of the FOI Act.
I have decided to refuse access to the document in full. My findings of fact and reasons for
deciding the exemptions apply to the document are discussed below.
Section 42 of the FOI Act - legal professional privilege
I have applied the exemption in section 42 of the FOI Act to the document in its entirety.
This section of the FOI Act allows the Agency to redact documents or parts of documents
subject to legal professional privilege (LPP).
Section 42 of the FOI Act relevantly provides:
(1) A document is an exempt document if it is of such a nature that it would be privileged
from production in legal proceedings on the ground of legal professional privilege.
(2) A document is not an exempt document because of subsection (1) if the person
entitled to claim legal professional privilege in relation to the production of the
document in legal proceedings waives that claim.
(3) A document is not an exempt document under subsection (1) by reason only that:
(a) the document contains information that would (apart from this subsection)
cause the document to be exempt under subsection (1); and
(b) the information is operational information of an Agency.
The FOI Act does not define LPP. However, courts have decided whether a communication is
privileged requires a consideration of:
•  whether there is a legal adviser-client relationship

•  whether the communication was for the purpose of giving or receiving legal advice, or
use in connection with actual or anticipated litigation

•  whether the advice given is independent, and

•  whether the advice given is confidential.
PAGE 5 OF 10

The document you requested is a  Privacy Impact Assessment (PIA)  prepared by an
independent  external legal provider for the  purpose of providing the Agency confidential
professional legal advice in relation to feature enhancements made to the myGov platform.
Accordingly, I am satisfied that LPP attaches to the entirety of the document.
I am also satisfied that privilege in these communications has not been waived. The document
has not been distributed further than is reasonably necessary for internal operational purposes
and the substance of the legal advice contained within the document has not been used in
any way which is inconsistent with the maintenance of the confidentiality of the advice.
Further, in my view, there is a possibility of real harm resulting from release of the document.
In particular, I consider the Agency’s ability to obtain independent external legal advice on
issues would be substantially prejudiced if it were to waive privilege over this document (which
sets out the particular legal provider’s PIA methodology, together with their approach to the
interpretation, analysis and application of legislation, systems and processes administered by
the Agency) and make it publicly available through FOI processes.
I acknowledge in your request for internal review you provide examples of other PIAs released
either proactively or in response to an FOI request. However, each decision made under the
FOI Act should be considered on its own merits. As such, while LPP may have been waived
in relation to other PIAs, it has not been waived in this instance and I consider real harm would
result from release of the document.
For the reasons set out above, I am satisfied the document is exempt in full under section 42
of the FOI Act.
Section 47C of the FOI Act - deliberative matter
I have applied the conditional exemption in section 47C of the FOI Act to the document in its
entirety.
This section of the FOI Act allows the Agency to redact documents or parts of documents
relating to opinion, advice, recommendation obtained, or deliberation for the purposes of the
deliberative processes involved in the functions of the Agency.
Section 47C of the FOI Act provides:
(1) A document is conditionally exempt if its disclosure under this Act would disclose
matter (deliberative mat er) in the nature of, or relating to, opinion, advice or
recommendation obtained, prepared or recorded, or consultation or deliberation that
has taken place, in the course of, or for the purposes of, the deliberative processes
involved in the functions of:
(a) an Agency; or
(b) a Minister; or
(c) the Government of the Commonwealth.
Exceptions
(2) Deliberative matter does not include either of the following:
(a) operational information (see section 8A);
(b) purely factual material.
PAGE 6 OF 10

(3) This section does not apply to any of the following:
(a) reports (including reports concerning the results of studies, surveys or tests)
of scientific or technical experts, whether employed within an Agency or not,
including reports expressing the opinions of such experts on scientific or
technical matters;
(b) reports of a body or organisation, prescribed by the regulations, that is
established within an Agency;
(c) the record of, or a formal statement of the reasons for, a final decision given
in the exercise of a power or of an adjudicative function.
As detailed in this section  of the FOI Act, material which is operational or purely factual
information is not deliberative matter. The deliberative exemption also does not apply to
reports of scientific or technical experts, reports of a body or organisation prescribed by the
regulations, or a formal statement of reasons.
I am satisfied the document  comprises deliberative matter, being advice and
recommendations, which have been prepared by the Agency’s external legal services provider
in the course of undertaking the PIA. The document identifies privacy and secrecy compliance
risks for the Agency and includes recommendations for managing or eliminating identified
risks and maximising opportunities for enhancing privacy protection. As such, I am satisfied
the document is not operational information or purely factual information, and is not otherwise
of a kind specifically excluded by the FOI Act.
Accordingly, I find the document is conditionally exempt, in full, under section 47C(1) of the
FOI Act.
Public interest considerations
Section 11A(5) of the FOI Act provides that access to conditionally exempt material must be
given unless I am satisfied it would not be in the public interest to do so.
When weighing up the public interest for and against disclosure under section 11A(5), I have
taken into account relevant factors in favour of disclosure. In particular, I have considered the
extent to which disclosure would:
•  promote the objects of the FOI Act, and
•  allow a person access to their own personal information, such as data held by the
Agency on the myGov platform.
I also acknowledge that in your internal review request you submit ed the project the subject
of the PIA in question has been identified as posing a ‘high privacy risk’. You stated it would
be in the public interest to know the privacy and compliance risks posed by the project.
I have also considered relevant factors weighing against disclosure, indicating access would
be contrary to the public interest. In particular, I have considered the extent to which disclosure
could reasonably be expected to:
•  destroy or diminish the commercial value of the provider’s PIA methodology and
approach
PAGE 7 OF 10

•  impede the full and frank disclosure between a lawyer and client, which assists the
effective administration of justice, and
•  prejudice the Agency’s ability to obtain comprehensive legal advice in the future.
Based on the above considerations, I have decided, in this instance, the public interest in
disclosing this document is outweighed by the public interest against disclosure.
I have not taken into account any of the irrelevant factors set out in section 11B(4) of the FOI
Act in making this decision.
Conclusion
I am satisfied the document sought is conditionally exempt under section 47C of the FOI Act.
Further, I have decided that on balance it would be contrary to the public interest to release
the document.
Summary of decision
I have decided to refuse your request on the basis:
•  the document is subject to LPP and therefore exempt in full under section 42 of the
FOI Act, and

•  the document comprises deliberative material, and disclosure would be contrary to the
public interest and the document is therefore exempt in full under section 47C of the
FOI Act.

PAGE 8 OF 10

Attachment B

INFORMATION ON RIGHTS OF REVIEW

FREEDOM OF INFORMATION ACT 1982
Asking for a ful  explanation of a Freedom of Information (FOI) decision
Before you ask for a formal review of a FOI decision, you can contact us to discuss your
request. We wil  explain the decision to you. This gives you a chance to correct
misunderstandings.
Asking for a formal review of a FOI decision
If you stil believe a decision is incorrect, the Freedom of Information Act 1982 (FOI Act)
gives you the right to apply for a review of the decision. Under sections 54 and 54L of the
FOI Act, you can apply for a review of an FOI decision by the Australian Information
Commissioner.
Note 1: There are no fees for these reviews.
Applying for external review by the Australian Information Commissioner
If you do not agree with the original decision or the internal review decision, you can ask
the Australian Information Commissioner to review the decision. If you do not receive a
decision from an Internal Review Officer in the Agency within 30 days of applying, you can
ask the Australian Information Commissioner for a review of the original FOI decision. You
wil  have 60 days to apply in writing for a review by the Australian Information
Commissioner.
You can lodge your application:

Online:
www.oaic.gov.au
Post:
Australian Information Commissioner

GPO Box 5218
SYDNEY NSW 2001
Email:
xxxxxxxxx@xxxx.xxx.xx
Note 2: The Office of the Australian Information Commissioner generally prefers FOI
applicants to seek internal review before applying for external review by the Australian
Information Commissioner.
Important:
•  If you are applying online, the application form the 'Merits Review Form' is available
at www.oaic.gov.au.
•  If you have one, you should include with your application a copy of the Agency’s
decision on your FOI request
•  Include your contact details
•  Set out your reasons for objecting to the Agency's decision.
PAGE 9 OF 10

Complaints to the Australian Information Commissioner and Commonwealth
Ombudsman
Australian Information Commissioner
You may complain to the Australian Information Commissioner concerning action taken by
an agency in the exercise of powers or the performance of functions under the FOI Act,
There is no fee for making a complaint. A complaint to the Australian Information
Commissioner must be made in writing. The Australian Information Commissioner's contact
details are:
Telephone:      1300 363 992
Website:          www.oaic.gov.au
Commonwealth Ombudsman
You may also complain to the Commonwealth Ombudsman concerning action taken by an
agency in the exercise of powers or the performance of functions under the FOI Act. There is
no fee for making a complaint. A complaint to the Commonwealth Ombudsman may be
made in person, by telephone or in writing. The Commonwealth Ombudsman's contact
details are:
Phone:             1300 362 072
Website:          www.ombudsman.gov.au
The Commonwealth Ombudsman generally prefers applicants to seek review before
complaining about a decision.
PAGE 10 OF 10