COVID-19 Immunisation Readiness Project Privacy Impact Assessment

The request was refused by Services Australia.

Dear Services Australia,

I am requesting access to the Privacy Impact Assessment (PIA) #39159 for the "COVID-19 Immunisation Readiness Project" under the Freedom of Information Act 1982 (Cth). Please send the PIA in electronic format, if possible.

Yours faithfully,

Rex Banner

FREEDOMOFINFORMATION, Services Australia

Thank you for contacting the Freedom of Information (FOI) team in Services
Australia (the Agency).

 

This email acknowledges your correspondence and provides some general
information in relation to FOI.

 

FOI – Extension of time request

Under the Freedom of Information Act 1982 (FOI Act) you have a right, with
limited exceptions, to access documents the Agency holds. The Agency has
30 days to process an FOI request. Please note this period may be extended
if we need to consult third parties or for other reasons. We will advise
you if this happens.

 

Due to the Agency’s reduced activity period over 22 December 2022 through
3 January 2023, we are seeking your agreement to extend the processing
time by an additional 15 days. If you agree to this additional time we
would appreciate if you could reply to this email with ‘I agree’.

 

Charges

The Agency will advise you if a charge is payable to process your request
and the amount of any such charge as soon as practicable. No charge is
payable for providing a person with their own personal information.

 

Your address

The FOI Act requires you to provide us with an address which we can send
notices to. We will send correspondence and notices to your email address.
Please advise us as soon as possible if you wish correspondence to be sent
to another address or if your email address changes.

 

Administrative release of documents

The Agency has administrative access arrangements in place for the release
of certain documents without the need for a formal FOI request. These
arrangements do not extend to information or material of third parties.

 

Exclusion of staff details

The Agency is working towards ensuring all staff have a choice about
whether they provide their full name, personal logon identifiers and
direct contact details in response to FOI requests. Where such details are
included in documents they will be redacted. If you request staff details
as part of your FOI application, this may add to processing time and
applicable charges as it will be necessary to consider whether these
details are exempt under the FOI Act.

            

**********************************************************************
IMPORTANT: This e-mail is for the use of the intended recipient only and
may contain information that is confidential, commercially valuable and/or
subject to legal or parliamentary privilege. If you are not the intended
recipient you are notified that any review, re-transmission, disclosure,
dissemination or other use of, or taking of any action in reliance upon,
this information is prohibited and may result in severe penalties. If you
have received this e-mail in error please notify the sender immediately
and delete all electronic and hard copies of this transmission together
with any attachments. Please consider the environment before printing this
e-mail
**********************************************************************

hide quoted sections

I agree

FREEDOMOFINFORMATION, Services Australia

2 Attachments

Dear Mr Banner

 

Please find attached the decision letter and document relating to your
request for access to documents held by Services Australia.

 

Kind regards,
Cherie

Information Access Branch

LEGAL SERVICES DIVISION

[1]cid:image002.jpg@01D6BC07.2D63B370

Please note: This email and any attachments may contain information
subject to legal professional privilege or information that is otherwise
sensitive or confidential. If you are not the intended recipient of this
email, you are prohibited from using or disseminating this communication.
If you have received this communication in error please notify the sender
immediately and permanently delete this email.

 

**********************************************************************
IMPORTANT: This e-mail is for the use of the intended recipient only and
may contain information that is confidential, commercially valuable and/or
subject to legal or parliamentary privilege. If you are not the intended
recipient you are notified that any review, re-transmission, disclosure,
dissemination or other use of, or taking of any action in reliance upon,
this information is prohibited and may result in severe penalties. If you
have received this e-mail in error please notify the sender immediately
and delete all electronic and hard copies of this transmission together
with any attachments. Please consider the environment before printing this
e-mail
**********************************************************************

References

Visible links

hide quoted sections

Dear Services Australia,

Please pass this on to the person who conducts Freedom of Information reviews.

I am writing to request an internal review of Services Australia's handling of my FOI request 'COVID-19 Immunisation Readiness Project Privacy Impact Assessment'.

If I read correctly there are two issues that are preventing the release of 1 document.

1: "I am satisfied there is a possibility of real harm resulting from release as the document contains
detailed legal analysis about the Agency’s cyber operations and environment. Disclosure of
this information creates the real risk of third party actors gaining insight into the Agency
systems and architecture, and exploiting this knowledge for malicious purposes. "

This is not real harm. This is purely hypothetical, unless, that is, Service Australia is operating such a system that purely knowing Agency systems and architecture would give a actor access; In which case Services Australia has an obligation to report this to https://www.cyber.gov.au/acsc/report

Keeping systems secret might be an argument in a time bound way to fix a problem or in the case of Trade Secrets.

Security measures are part of Privacy Impact Assessments that have been routinely disclosed. eg https://help.abc.net.au/hc/en-us/article...

"I consulted with Agency officers in the Health Programmes Division who advised me that
disclosure of the document poses a real and substantial risk of compromising the Agency’s
cybersecurity measures and exposing the Agency to greater risk of cyber-attacks"

Could you please release what the advice was?

2 Legal Privilege:
Legal Privilege is not conferred purely by labelling a document as such. There is a bar that must be met.
I obviously haven't seen the document, however I ask two related questions:

Would Services Australia release *any* of their Primacy Impact Assessments or are they considered legally privileged?

Is the entire document subject to LPP?

Was the Privacy Impact Assessment done by a lawyer?

A full history of my FOI request and all correspondence is available on the Internet at this address: https://www.righttoknow.org.au/request/c...

Yours faithfully,

Rex Banner

FREEDOMOFINFORMATION, Services Australia

Thank you for contacting the Freedom of Information (FOI) team in Services
Australia (the Agency).

 

This email acknowledges your correspondence and provides some general
information in relation to FOI.

 

Charges

The Agency will advise you if a charge is payable to process your request
and the amount of any such charge as soon as practicable. No charge is
payable for providing a person with their own personal information.

 

Your address

The FOI Act requires you to provide us with an address which we can send
notices to. We will send correspondence and notices to your email address.
Please advise us as soon as possible if you wish correspondence to be sent
to another address or if your email address changes.

 

Administrative release of documents

The Agency has administrative access arrangements in place for the release
of certain documents without the need for a formal FOI request. These
arrangements do not extend to information or material of third parties.

 

Exclusion of staff details

The Agency is working towards ensuring all staff have a choice about
whether they provide their full name, personal logon identifiers and
direct contact details in response to FOI requests. Where such details are
included in documents they will be redacted. If you request staff details
as part of your FOI application, this may add to processing time and
applicable charges as it will be necessary to consider whether these
details are exempt under the FOI Act.

            

**********************************************************************
IMPORTANT: This e-mail is for the use of the intended recipient only and
may contain information that is confidential, commercially valuable and/or
subject to legal or parliamentary privilege. If you are not the intended
recipient you are notified that any review, re-transmission, disclosure,
dissemination or other use of, or taking of any action in reliance upon,
this information is prohibited and may result in severe penalties. If you
have received this e-mail in error please notify the sender immediately
and delete all electronic and hard copies of this transmission together
with any attachments. Please consider the environment before printing this
e-mail
**********************************************************************

hide quoted sections

FOI.LEGAL.TEAM, Services Australia

2 Attachments

Dear Mr Banner

 

RE: LEX 71778 - Your FOI Request - Internal Review decision

 

Please find attached correspondence relating to your internal review
request of an Agency decision under the Freedom of Information Act 1982.

 

Kind regards

 

Damien, Senior Lawyer

FOI and Ombudsman Branch

LEGAL SERVICES DIVISION

[1]cid:image003.jpg@01D6B8DA.4DF87C40

 

Services Australia acknowledges the Traditional Owners of the land now
called Australia. We pay our respect to all Elders, past, present and
emerging of all Aboriginal and Torres Strait Islander nations.

 

Please note: This email and any attachments may contain information
subject to legal professional privilege or information that is otherwise
sensitive or confidential. If you are not the intended recipient of this
email, you are prohibited from using or disseminating this communication.
If you have received this communication in error please notify the sender
immediately and permanently delete this email.

 

**********************************************************************
IMPORTANT: This e-mail is for the use of the intended recipient only and
may contain information that is confidential, commercially valuable and/or
subject to legal or parliamentary privilege. If you are not the intended
recipient you are notified that any review, re-transmission, disclosure,
dissemination or other use of, or taking of any action in reliance upon,
this information is prohibited and may result in severe penalties. If you
have received this e-mail in error please notify the sender immediately
and delete all electronic and hard copies of this transmission together
with any attachments. Please consider the environment before printing this
e-mail
**********************************************************************

References

Visible links

hide quoted sections