Freedom of Information Act 1982 (Cth)

15.2 The interrelationship between the FOI Act and the Privacy Act is significant. Both Acts regulate the way in which information is handled in government, but have different objectives. Freedom of information legislation is concerned mainly with transparency in government and protects privacy only to the extent that it prevents the unreasonable disclosure of personal information, and provides for the access and correction of personal information. In contrast, privacy legislation is primarily focused on data protection and provides for transparency only to the extent that it enhances the information privacy rights of individuals.^[1] The Privacy Act is designed to interact with the FOI Act. For example, the public sector exemptions under the Privacy Act largely mirror the exemptions under the FOI Act.^[2]

Disclosure of personal information

15.3 The FOI Act provides that every person has a legally enforceable right to obtain access to a document of an agency or an official document of a minister, other than an exempt document.^[3]

15.4 Section 41(1) of the FOI Act provides that a document is an exempt document if its disclosure under the Act would involve the unreasonable disclosure of personal information about any person (including a deceased person). The definition of ‘personal information’ in the FOI Act corresponds with that in the Privacy Act.^[4] The exemption under s 41(1) is subject to an exception that a person cannot be denied access to a document on the basis that it contains his or her own information.^[5] It does not prevent reliance on the exemption, however, where the information cannot be separated from personal information about another person.^[6] The exemption under s 41 has been the subject of criticism and commentary.^[7]

15.5 In Open Government: A Review of the Federal Freedom of Information Act 1982 (ALRC 77), the ALRC and the Administrative Review Council (ARC) concluded that the provision should be amended to clarify the relationship between the FOI Act and the Privacy Act. To this end, the review concluded that s 41 should be reworded to provide that a document is exempt if it contains personal information, the disclosure of which would constitute a breach of Information Privacy Principle (IPP) 11; and the disclosure would not, on balance, be in the public interest.^[8] The review also recommended that a Freedom of Information Commissioner^[9] should issue guidelines to assist agencies to determine whether information is exempt under s 41.^[10] These recommendations have not been implemented.^[11]

15.6 In the Discussion Paper, Review of Privacy (DP 72), the ALRC expressed the preliminary view that s 41 of the FOI Act should be amended to clarify the relationship between the FOI Act and the Privacy Act. The ALRC proposed that s 41(1) of FOI Act be amended to provide that a document is exempt if it:

• contains personal information, and the disclosure of that information would constitute a breach of the proposed ‘Use and Disclosure’ principle and disclosure would not, on balance, be in the public interest; or

• contains personal information of a deceased individual, and the disclosure of that information would constitute a breach of the proposed ‘Use and Disclosure’ principle and disclosure would not, on balance, be in the public interest. Where the ‘Use and Disclosure’ principle would require consent the agency must consider whether the proposed disclosure would involve the unreasonable disclosure of personal information about any individual including the deceased individual.^[12]

15.7 The ALRC also proposed that the definition of ‘personal information’ in the FOI Act should be aligned with the ALRC’s proposed definition in the Privacy Act as ‘information or an opinion, whether true or not, and whether recorded in a material form or not, about an identified or reasonably identifiable individual’;^[13] and that the FOI Act should be amended to require the body that is primarily responsible for administration of that Act to develop and publish guidelines on the interpretation and application of s 41 in consultations with the Office of the Privacy Commissioner (OPC).^[14]

Submissions and consultations

15.8 A number of stakeholders supported the proposal to amend s 41 to clarify the relationship between the FOI Act and the Privacy Act.^[15] Other stakeholders, however, raised a number of concerns about the proposed reform.^[16] For example, the Australian Government Department of Foreign Affairs and Trade (DFAT) submitted that the proposed reform would be problematic to the extent that it required DFAT to obtain the consent of an individual before disclosing his or her personal information. In circumstances where a document contained joint personal information the proposal would, in effect, enable one person to veto the release of a document to another person. Further, the proposed reform would increase the time required to process FOI requests, particularly given the fact that documents held by DFAT often contained personal information about DFAT employees.^[17]

15.9 Some stakeholders supported the ALRC’s proposal to amend the definition of ‘personal information’ in the FOI Act.^[18] Others raised various issues with the proposal.^[19] For example, the Public Interest Advocacy Centre (PIAC) did not support the inclusion of ‘an opinion’ in the definition of ‘personal information’ because it has the potential to make the definition too wide.^[20]A number of stakeholders supported the proposal for the development and publication of guidelines on the interpretation and application of s 41.^[21]

ALRC’s view

15.10 On 24 September 2007, following the release of DP 72, the then Attorney-General of Australia requested that the ALRC examine and report on the extent to which the FOI Act and related laws continue to provide an effective framework for access to information in Australia.^[22]

15.11 The ALRC acknowledges that a number of stakeholders addressed proposals to clarify the relationship between s 41 of the FOI Act and the Privacy Act. It is the ALRC’s view, however, that these issues should be considered as part of the ALRC’s review of the FOI Act. Section 41 primarily relates to access to personal information about third parties and not an individual’s access to his or her personal information. It is therefore more appropriate for this issue to be considered in the context of the FOI Act. The ALRC therefore makes no recommendations in relation to s 41 in this Report.

Required or authorised by or under law

15.12 The current IPP 11 and the recommended ‘Use and Disclosure’ principle impose a general obligation on agencies not to disclose personal information to persons or organisations other than the individual concerned or his or her agent, unless one of the stated exceptions apply. A release of personal information under the FOI Act is unlikely to breach IPP 11 or the recommended ‘Use and Disclosure’ principle, as it would be ‘authorised’ by or under law.^[23] As noted in Open Government: A Review of the Federal Freedom of Information Act 1982 (ALRC 77), however, the meaning of ‘authorised’ in this context is not clear.

On one view, any release of information pursuant to a request made under the FOI Act is an ‘authorised’ release of information. On another view, the FOI Act does not ‘authorise’ the release of information because s 14 of the Act makes it quite clear that nothing in the Act prevents the release quite apart from the Act of information that can be properly released.^[24]

15.13 In ALRC 77, the ALRC and the ARC recommended that the Privacy Act be clarified to provide that a release of personal information under the FOI Act constitutes a release that is ‘required or authorised by law’ for the purpose of IPP 11.1(d).^[25] This recommendation has not yet been implemented.

15.14 In DP 72, the ALRC expressed the view that, in the interest of certainty, this issue should be clarified in the FOI Act. The ALRC proposed that the FOI Act be amended to provide that disclosure of personal information in accordance with the FOI Act is a disclosure that is required or authorised by or under law for the purposes of the ‘Use and Disclosure’ principle.^[26]

Submissions and consultations

15.15 A number of stakeholders supported the ALRC’s proposal in DP 72.^[27] Other stakeholders questioned the utility of the proposal. For example, the Australian Communications and Media Authority questioned whether such an amendment was required as there is ‘no doubt’ that disclosure under the FOI Act would be authorised by or under law for the purposes of the Privacy Act.^[28]

15.16 The OPC supported the proposal but noted that it referred to a disclosure that was ‘required or authorised’ under the proposed ‘Use and Disclosure’ principle. The OPC submitted that it supports the adoption of a ‘required or specifically authorised’ test in the ‘Use and Disclosure’ principle.^[29]

ALRC’s view

15.17 In the interest of certainty, the FOI Act should be amended to provide that disclosure of personal information in accordance with the FOI Act is a disclosure that is required or authorised by or under law for the purposes of the ‘Use and Disclosure’ principle under the Privacy Act. The ALRC considered whether this issue should be dealt with in the ALRC’s review of the FOI Act and related laws, but concluded that it directly affected the operation of the Privacy Act and should be considered as part of this Inquiry. To eliminate any possible confusion about the meaning of the exception so far as it relates to a release of information under the FOI Act, this issue should also be addressed in guidance issued by the OPC on the ‘Use and Disclosure’ principle.

An exemption for the functions of the Privacy Commissioner?

15.18 In its submission to this Inquiry, the OPC raised the issue of whether its complaint files should be exempt from disclosure under the FOI Act. The OPC submitted that such complaints deal with the issue of privacy itself. It also noted that the Office of the NSW Privacy Commissioner’s complaint-handling, investigative and reporting functions are exempt under the Freedom of Information Act 1989 (NSW).^[30]

15.19 The OPC noted that it is currently possible under the FOI Act to exempt, on a case-by-case basis, documents that may unreasonably disclose personal information.^[31] The OPC submitted, however, that a ‘cover-all’ exemption would be consistent with public expectations of privacy, heighten the trust of complainants, and reinforce the OPC’s commitment to leadership in good privacy practice.^[32]

15.20 In DP 72, the ALRC asked whether the OPC’s complaint-handling, investigative and reporting functions should be exempt under the FOI Act.^[33]

Submissions and consultations

15.21 Privacy NSW submitted that any information relating to OPC complaint and ‘own motion’ investigation files should be exempt from access under FOI law because the subject of privacy complaints and investigation relates to personal information. Accordingly, disclosure to third parties could, in itself, give rise to complaints about interferences with privacy.^[34] Other stakeholders did not support an exemption in relation to the OPC’s complaint-handling, investigative and reporting functions. For example, PIAC submitted that such a provision could undermine public confidence in the transparency and accountability of the OPC.^[35]

ALRC’s view

15.22 The ALRC does not recommend in this Inquiry that the OPC’s complaint-handling, investigative and reporting functions be exempt under the FOI Act. As noted above, the ALRC has received Terms of Reference to review the FOI Act and related laws to determine whether they continue to provide an effective framework for access to information in Australia.^[36] Consideration of an exemption under the FOI Act for the OPC’s complaint-handling, investigative and reporting functions would be more appropriately considered as part of that review.