Advice about privacy impacts of contact tracing mobile phone apps

Concerned Citizen made this Freedom of Information request to Office of the Australian Information Commissioner

This request has been closed to new correspondence from the public body. Contact us if you think it ought be re-opened.

The request was successful.

Concerned Citizen

Dear Office of the Australian Information Commissioner,

Please provide any advice provided to the Department of Home Affairs, the Department of Health, the Department of the Prime Minister and Cabinet, or the Digital Transformation Agency about the privacy impacts of contact tracing mobile phone apps including but not limited to COVIDSafe.

Yours faithfully,

Concerned Citizen

Dear Office of the Australian Information Commissioner,

I have not received a reply to the request for information that I sent on the 12th of November. Could you please confirm that you received my request and indicate when I should expect to receive a response?

Yours faithfully,

Concerned Citizen

Legal, Office of the Australian Information Commissioner

2 Attachments

Dear Concerned Citizen,

 

Please find attached correspondence relating to your request for access to
documents under the Freedom of Information Act 1982 (Cth) (the FOI Act)
received on 12 November 2021.

 

Yours faithfully

[1][IMG]   Nora Truong | Paralegal

Legal Services

Office of the Australian Information Commissioner

GPO Box 5218 Sydney NSW 2001 | [2]oaic.gov.au

+61 2 9284 9707 | [3][email address]  

 

 

show quoted sections

References

Visible links
1. https://www.oaic.gov.au/
2. https://aus01.safelinks.protection.outlo...
3. mailto:[email address]

Dear Legal,

Thank you for your response. Perhaps you can help me narrow the scope of my request.

I am interested in what advice the OAIC provided to inform the development of COVIDSafe. In particular I would be interested in any advice that the OAIC provided that compared the privacy protections of the centralised model that COVIDSafe adopted with the privacy-preserving approach of the decentralised model of Google and Apple’s Exposure Notifications.

Does this help narrow the scope to a more manageable set of documents?

Yours sincerely,

Concerned Citizen

Legal, Office of the Australian Information Commissioner

2 Attachments

Dear Concerned Citizen,

Thank you for your prompt response of 10 December 2021 to our request
consultation process.

We have provided your response to the Regulation and Strategy Branch. We
note that your amended request seeks access to two sets of information:

Part 1

…what advice the OAIC provided to inform the development of COVIDSafe

Part 2

…any advice that the OAIC provided that compared the privacy protections
of the centralised model that COVIDSafe adopted with the
privacy-preserving approach of the decentralised model of Google and
Apple’s Exposure Notifications.

The relevant line area has advised that Part 1 of the request is much
broader in terms of the number of records required to be searched and
retrieved, involving approximately 985 records to be searched and
retrieved which would take approximately two weeks.

In contrast, Part 2 of the request is more specific to the particular
model that was adopted. Therefore, the relevant line area has advised that
limiting the scope of the request to only Part 2 would reduce the number
of records to be searched and retrieved to a more manageable amount.

Would you be agreeable to limiting the scope of your FOI request to Part 2
above?

We would be grateful for response before the end of the consultation
period, Friday 24 December 2021. You must do one of the following, in
writing:

o withdraw your request
o make a revised request
o tell us that you do not wish to revise your request.

 

If you do not do one of the three things listed above during the
consultation period or you do not consult me during this period, your
request will be taken to have been withdrawn.

Request for extension of time

At this stage, the due date of your request is 13 December 2021.

However, even if the request is amended as above, the relevant line area
still requires additional time to search, retrieve and collate the
relevant documents. We must then review and make a decision as to whether
any exemptions are applicable or any third party consultations are
required.

Given the circumstances, I now write to you seeking your agreement, under
s 15AA of the FOI Act, to extend the time to process your request by an
additional 30 days from the end of the request consultation period. I note
that even with the extension of time request, I still intend to process
your request as soon as possible.

Thank you for your understanding. If you would like to discuss your
revised request or have any further questions, please contact me via my
details below.

Yours sincerely

[1][IMG]   Nora Truong | Paralegal

Legal Services

Office of the Australian Information Commissioner

GPO Box 5218 Sydney NSW 2001 | [2]oaic.gov.au

+61 2 9284 9707 | [3][email address]  

 

Please note the OAIC will be closed from 25 December 2021 and will reopen
on 4 January 2022.

show quoted sections

References

Visible links
1. https://www.oaic.gov.au/
2. https://aus01.safelinks.protection.outlo...
3. mailto:[email address]

Dear Legal,

Thank you for your prompt response.

Yes, I am happy to reduce the scope of my request to part 2 as you have suggested. That is:

Any advice that the OAIC provided that compared the privacy protections of the centralised model that COVIDSafe adopted with the privacy-preserving approach of the decentralised model of Google and Apple’s Exposure Notifications

Yours sincerely,

Concerned Citizen

Legal, Office of the Australian Information Commissioner

Dear Concerned Citizen,

Thank you for your prompt response.

We acknowledge that your request to the OAIC has been amended as follows:

"Any advice that the OAIC provided that compared the privacy protections of the centralised model that COVIDSafe adopted with the privacy-preserving approach of the decentralised model of Google and Apple's Exposure Notifications"

As you have revised your request in a way that adequately addresses the practical refusal grounds outlined in our notice of 10 December 2021, we will forward your amended request to the relevant line area and recommence processing it.

Yours faithfully,

Nora Truong | Paralegal
Legal Services
Office of the Australian Information Commissioner
GPO Box 5218 Sydney NSW 2001 | oaic.gov.au
+61 2 9284 9707 | [email address]

show quoted sections

Legal, Office of the Australian Information Commissioner

1 Attachment

Our reference: FOIREQ21/00284

Dear Concerned Citizen,

I refer to your request to access documents made under the Freedom of
Information Act 1982 (Cth) (FOI Act) and received by the Office of the
Australian Information Commissioner (OAIC) on 12 November 2021.

On 10 December 2021, following preliminary consultation with the relevant
line area, I notified you that I intended to refuse access to the
documents you requested as processing your request in its current form
would substantially and unreasonably divert the resources of the OAIC from
its other operations due to its size and broad scope (s 24AA(1)(a)(i) FOI
Act).

On 13 December 2021, following further consultation you agreed to revise
the scope of your request to the following:

Any advice that the OAIC provided that compared the privacy protections of
the centralised model that COVIDSafe adopted with the privacy-preserving
approach of the decentralised model of Google and Apple’s Exposure
Notifications.

On the same day, I notified you that a practical refusal reason no longer
exist and that we have recommenced processing your request accordingly on
13 December 2021.

Following receipt of your revised request, I informed the line area of the
revised scope of the request and requested new searches to be conducted.
The line area then provided me with documents potentially within the scope
of your request. While reviewing the relevant documents, I have identified
documents which contain personal information of third party individuals of
a private organisation.

As your request covers documents containing personal information of
third-party individuals, the OAIC is required to consult the individuals
and their organisations under s 27A of the FOI Act before making a
decision on the release of the documents. In this case, the documents
contain names and contact details of several individuals within a private
organisation, and accordingly, under s 27A(3) of the FOI Act, the OAIC
must not decide to give access to the document unless the person concerned
is given a reasonably opportunity to make submissions in support of the
exemption contention, and the OAIC has had regard to any submissions so
made.

In making my decision to undertake consultation with these individuals,
and whether the individuals concerned might reasonably wish to make an
exemption contention because of personal information, I have had regard to
the following matters in accordance with s 27A(2) of the FOI Act:

 a. The extent to which the information is well known;
 b. Whether the person to whom the information relates is known to be (or
have been) associated with the matters dealt with in the information;
 c. The availability of the information from publicly accessible sources;
 d. Any other matters that the OAIC considers relevant.

For the above reasons, I have decided to undertake third party
consultation under the FOI Act. Accordingly, the period for processing
your request has been extended by 30 days to allow time to consult (see s
15(6) of the FOI Act). Your request is now due on 10 January 2022.

The consultation mechanisms under ss 27 and 27A apply when we believe the
person or organisation concerned may wish to contend that the requested
documents are exempt for reasons of personal privacy, or adverse effect to
their business or financial affairs. We will consider any comments we
receive, however the final decision about whether to grant you access to
the documents you requested rests with the OAIC.

We will not identify you as the FOI applicant during any consultation
process.

If you have any questions, please do not hesitate to contact me on my
details below.

Yours faithfully

[1][IMG]   Nora Truong | Paralegal

Legal Services

Office of the Australian Information Commissioner

GPO Box 5218 Sydney NSW 2001 | [2]oaic.gov.au

+61 2 9284 9707 | [3][email address]  

 

 

show quoted sections

References

Visible links
1. https://www.oaic.gov.au/
2. https://aus01.safelinks.protection.outlo...
3. mailto:[email address]

Legal, Office of the Australian Information Commissioner

8 Attachments

OAIC ref: FOIREQ21/00284

 

Dear Concerned Citizen

 

I refer to your request for access to documents made under the Freedom of
Information Act 1982 (Cth) (the FOI Act) received on 12 November 2021.

 

Please find attached the following documents:

 1. FOI Decision of today’s date
 2. Schedule of documents, and
 3. Redacted documents.

 

As the documents released to you do not contain personal or business
information, they will be published on the OAIC’s disclosure log within 10
days of their release.

 

Kind regards

Margaret

 

 

[1]O A I C logo   Margaret Sui |  Senior Lawyer

Legal Services

Office of the Australian
Information Commissioner

GPO Box 5218 Sydney NSW 2001  |
 [2]oaic.gov.au

+61 2 9284 9879  |
[3][email address]
[7]Subscribe [8]Subscribe to
[4]Facebook | [5]LinkedIn | [6]Twitter |   icon Information
Matters

 

 

 

show quoted sections

References

Visible links
1. https://www.oaic.gov.au/
2. https://aus01.safelinks.protection.outlo...
3. mailto:[email address]
4. https://aus01.safelinks.protection.outlo...
5. https://aus01.safelinks.protection.outlo...
6. https://aus01.safelinks.protection.outlo...
8. https://aus01.safelinks.protection.outlo...