Australian Government Solicitor FOI and Privacy Practitioners Update

Check against delivery. Presentation slides were used for delivery.

Thank you for inviting me to address you today at the AGS FOI and Privacy Practitioners Update.

I begin by acknowledging the Traditional Custodians of the land on which we meet today, Ngunnawal country, and pay my respects to their Elders past and present. I extend that respect to any Aboriginal and Torres Strait Islander peoples here today.

Today I speak on behalf of the Office of the Australian Information Commissioner, which has a purpose of promoting and upholding information access and privacy rights.

I have been asked to provide some observations on information access 3 months into my appointment as the FOI Commissioner. In that regard, I thought it would be useful to cover 4 topics:

1. the OAIC’s FOI work
2. my observations about the Commonwealth FOI landscape more generally
3. mechanisms for improving access to information
4. a few issues of relevance to all agencies, which I have dealt with in recent investigations of FOI complaints and IC review decisions.

The OAIC’s FOI work

The Freedom of Information Commissioner is an independent statutory office holder appointed under subsection 14(2) of the Australian Information Commissioner Act 2010.

My FOI functions, which are set out in section 8 of that Act, include oversight of the operation of the FOI Act and review of decisions made by agencies and ministers under that Act.

I can also consider complaints and undertake investigations into an agency’s actions in performing its functions or exercising its powers under the FOI Act.

Since commencing in the role of Freedom of Information Commissioner on 19 April 2022, my focus has been on understanding the OAIC’s increasing workload and how it can be best managed to produce positive outcomes for the public within our limited resources, while also exercising our other regulatory functions under the FOI Act.

OAIC workload and statistics

I would like to begin with some statistics to show how the work of our office has evolved over time and to highlight our increasing workload.

Our statistics tell us that there has been considerable increase in the FOI workload compared to previous years, in particular, a significant increase in Information Commissioner review applications, including applications that arise as a result of deemed access refusals.

In the 2021–22 financial year, the OAIC received approximately 1,955 applications for IC review, compared to 1,224 in the previous year. That is an increase of 60%.

At the same time, we are finalising more decisions each year. In 2021–22 we finalised approximately 1,384 decisions compared to 1,018 in 2020–21, a 26% increase.

Deemed access refusals comprise a significant number of IC review applications that are finalised by the OAIC. Approximately 47–50% are applications that were made following deemed access refusals.

The OAIC has experienced a noticeable trend of increasing numbers of deemed access refusals since 2019–20. This has impacted on the number of IC review applications we receive, with the number of applications referable to deemed access refusals nearly tripling from 348 applications in 2019–20 to 1,021 applications in 2021–22.

We have also seen an increase in FOI complaints. In 2021–22 we received approximately 214 FOI complaints, which is a 23% increase on the 174 received in 2020–21. At the same time, we closed approximately 223 complaints, a 22% increase on the previous financial year.

Applications for extensions of time have also increased significantly, in part driven by the COVID-19 pandemic. In 2021–22 the OAIC received approximately 4,925 requests for an extension of time. At the same time, we finalised approximately 4,959 requests, a 24% increase on the previous year.

Despite this increase in workload, our office has a fixed resource of approximately 22 ASL who are supported by one Assistant Commissioner, Rocelle Ago, and myself as FOI Commissioner.

We’ve made numerous changes to our processes to increase efficiencies. These changes include an increased use of technology for both agencies and applicants, such as automated communication tools, standardised electronic forms and standardised correspondence.

These process changes have led to the finalisation of more matters and, in particular, we have seen an improvement in early finalisation of IC review applications.

But we still have a way to go, with a need to manage within our resources a significant ongoing growth in IC reviews progressing to decision.

Like the OAIC, many agencies are dealing with significant numbers of FOI requests and/or resourcing constraints.

Agency FOI statistics

At the OAIC, we also collect FOI statistics lodged quarterly by agencies and ministers’ offices, which are published in our annual report and give a snapshot of agency performance.

These show that the success of agencies in meeting their FOI obligations varies fairy significantly across the Commonwealth.

We don’t yet have the final statistics for the 2021–22 financial year. But the statistics for the 2020–21 financial year tell us that the number of FOI requests made to Australian Government agencies actually decreased by 16% in 2020–21 to 34,797, which was 6,536 fewer than in 2019–20.

That decrease in the number of FOI requests was principally the result of decreases in requests made to the agencies that receive the highest number of FOI requests for personal information, in particular, the Department of Home Affairs, Services Australia, the Department of Veterans’ Affairs and the National Disability Insurance Agency (NDIA).

In terms of requests granted:

• The proportion of FOI requests granted in full in 2020–21 was 41%, down from 47% in 2019–20.
• The proportion of FOI requests granted in part increased to 41% in 2020–21, up from 38% in 2019–20.
• The number of FOI requests refused in 2020–21 increased to 18%, compared with 15% in 2019–20.

The statistics show that timeliness of processing FOI requests is a concern.

In 2020–21, 77% of all FOI requests determined were processed within the applicable statutory time period.

This represents a reduction in the timeliness of decision making from 2019–20, when 79% of all FOI requests were decided within time, and from 2018–19, when 83% of all FOI requests were decided within time.

The timeliness figures, in particular, show that some agencies are clearly finding it difficult to meet their FOI obligations.

Observations

This is no doubt due to a range of factors including, but not limited to, in my early observations:

• the size and nature of an agencies’ FOI workload
• the level of FOI knowledge/expertise, not only in an agency’s FOI area, but more broadly across the agency
• resources available to manage FOI requests within an agency, including the availability of business areas or decision makers in the context of competing priorities/business as usual and the current pandemic environment
• the level of leadership commitment to FOI

It seems to me that in some cases, in a resource-constrained environment, some agencies are immediately resorting to process and not focusing on a bigger picture approach to access. This leads to increased workload for both agencies and the OAIC, and delays in access.

Some examples of potentially counter-productive process driven actions are:

• not thinking upfront about what an applicant’s real concerns are and what can be offered by way of access administratively, perhaps with a view to an FOI request being withdrawn
• imposing charges where there is little or no utility in doing so
• not seeking extensions of time in appropriate circumstances, resulting in large numbers of deemed decisions and increased numbers of IC review applications.

Practical steps

In terms of practical steps agencies that are experiencing resource constraints can take, I make the following suggestions.

• Think upfront about whether resorting to strict FOI processes is the best way to resolve a request for access or whether, in the particular case, there is an alternative and more efficient option for resolution available.
• Where relevant, provide access to personal information through self-service portals and publish policies and data sets on websites with an aim of reducing the number of FOI requests made to an agency.
• Take an open by design approach right from the start when developing projects, services and programs.
• As I’ll mention shortly, adopt a more pragmatic and financially sensible approach to charges.
• Appoint an information champion (however styled) who has an understood role of providing the leadership, oversight and accountability necessary to promote and operationalise compliance by an agency with the FOI Act.
• Ensure there is training for all staff on their FOI Act obligations, which includes business area staff as decision makers.
• Implement an operational manual for processing FOI requests, which specifies the steps that will be taken to ensure compliance with the statutory processing requirements in the FOI Act.

I acknowledge that some agencies are experiencing resourcing restraints in relation to the processing of FOI requests. The OAIC is committed to open engagement with agencies with respect to their FOI functions. We acknowledge, for example, that some agencies have expressed difficulty in meeting the timeframes the OAIC proposes for providing submissions and documents in some contexts.

Internally, the OAIC has been considering the current timeframes that are generally set out in the FOI Guidelines and the directions we issue to agencies. We are doing this with a view to some adjustment of these timeframes in some cases, depending on the nature of the information requested and the age of the matter, so as to facilitate better quality responses from agencies and achieve greater overall efficiency of the IC review and complaints processes.

We are also considering engaging in roundtable discussions with agencies to enable us to better understand and address intra-Commonwealth issues in the management of FOI .

Mechanisms for improving access and transparency

The FOI Act also has mechanisms to foster greater openness and transparency in government, with a view to reducing the need for formal requests for access.

Firstly, the Information Publication Scheme requires agencies to publish specific categories of information online and encourages agencies to proactively release other information to the public wherever possible. We are currently reviewing Part 13 of the FOI Guidelines, relating to the IPS, as the scheme matures.

Secondly the publication of a disclosure log on an agency or minister’s website makes available to the world at large information that has been requested under the FOI Act. A disclosure log reduces the need for repeated access requests under the Act.

It’s important to remember that the FOI Act does not restrict the circumstances in which government information can be released.

Proactive release of information – through administrative access schemes, self-service portals, information publication schemes, and other means – as well as providing more efficient service to the community, can assist you in your work, by making the system work more efficiently.

For example, on 1 June 2020, the NDIA made changes to improve NDIS participants’ access to their personal information through a Participant Information Access Scheme, which gives participants administrative access to their personal information outside of the FOI process. Our FOI statistics tell us that the NDIA received 40% fewer FOI requests in 2020–21 compared with 2019–20.

Open by design

The principles of proactive release reflected in the FOI Act were further highlighted last year when Australian information access commissioners and ombudsmen published new open by design principles. The principles promote the proactive release of information by the Australian Government and public institutions and, in doing so, support open government.

The principles recognise that:

• information held by government and public institutions is a public resource
• a culture of transparency within government is everyone’s responsibility
• appropriate, prompt and proactive disclosure of government-held information supports the community, decision makers and builds trust.

I strongly encourage you to commit to being open by design by building a culture of transparency and by prioritising, promoting and resourcing proactive disclosure. Agencies should embrace the idea that all government agency staff have a role to play in ensuring the successful operation of access to information legislation.

Some practical measures that agencies could take in this regard include:

• preparing records in a form that supports prompt and inexpensive disclosure or publication when access requests are received
• proactive publication of information of significant public interest, for example, health information during the pandemic
• developing and maintaining good records – because effective record keeping underpins open government.

Issues arising from recent investigations of complaints and IC review decisions

I would now like to talk about recent IC review decisions and complaint investigation outcomes.

Complaint concerning inclusion of names in reasons for access refusal decisions

The OAIC received a complaint about a department under s 70 of the FOI Act. The complaint was about the department’s practice of removing the names, signatures and titles from official FOI correspondence and replacing them with a position number and the words ‘authorised officer’ or position location.

Upon the completion of an investigation, I reached the following conclusions.

Section 26(1)(b) of the FOI Act requires that the statement of reasons must include the name and designation of the person making the decision. The department has accepted that its previous practice of not including the decision maker’s name at all was deficient. It has since changed its practices so that FOI decisions and consultations now include the first name, position number and designation of the relevant staff member and continues to follow this practice.

As a matter of pure statutory construction, in my view the Act contemplates the inclusion of a full name – that is, first and surname – in a statement of reasons. Consistently with this, as a general rule, a statement of reasons should include a decision maker’s full name.

I acknowledged, however, that including something less than a full name in a statement of reasons is unlikely to give rise to any particular outcome of legal invalidity.

Accordingly, notwithstanding that the terms of the Act appear to contemplate the inclusion of a full name in a statement of reasons, there may be some very limited circumstances in which inclusion of other sufficient identifying information – such as a name and position number – will be sufficient.

This requires, however, a strong and rational justification for not including a decision maker’s last name in a decision. A justification of that kind might exist where an agency, by reference to sufficient evidence, is able to establish that the disclosure of a decision maker’s full name (and therefore identity) would give rise to a real and increased risk of harm to the mental and/or physical wellbeing of staff who are making decisions.

In relation to the particular department in this complaint, I accepted that prior incidents of targeting and harassment occurred when the full names of staff were disclosed and therefore the altered practice of only disclosing first names together with other identifying information was justified.

Importantly, I was also satisfied that the additional information included with a decision maker’s first name – specifically their position number and designation – was sufficient to enable the objective identification of each decision maker as a person authorised in accordance with s 23 of the FOI Act.

Complaint concerning failure to comply with statutory timeframe for access due to records management failures

The OAIC received a complaint in relation to an agency under s 70 of the FOI Act. The complaint was about the agency’s failure to make an FOI decision within the statutory timeframe; the agency’s failure to appropriately store documents and retain backups; and that the agency may have tampered with or destroyed documents in breach of the Archives Act and relevant secrecy provisions.

Upon completion of the investigation, I reached the following conclusions.

The document subject to the complainant’s FOI request was personally retained by an officer of the agency and stored at a secure location known to that officer. The agency did not hold a backup copy of this document and this impacted the ability of the agency to process the complainant’s FOI request within the statutory processing period. These deficiencies resulted in undue delay in processing the request, impacting on the claimant’s legally enforceable right to obtain access to documents of an agency under s 11 of the FOI Act.

The agency’s delay in processing the complainant’s FOI request was caused by the agency’s failure to ensure documents were stored in accordance with their records management procedures. The reasons put forward by the agency for the delays in processing the complainant’s FOI request could not, and did not, alter the agency’s obligation to make a decision within the statutory processing period.

At the time the complaint was made, the agency did not have sufficient escalation processes and procedures in place to address the circumstances and this impacted the processing of the FOI request. The agency has since made amendments to its guidance and has consolidated the management of information resources in a handbook, which will assist in preventing the recurrence of processing failures of the kind raised in the complaint.

Application of charges for production of document containing information in a discrete form

The applicant sought IC review of a decision of a department to impose a charge of $403.45 to process an FOI request.

In this decision I considered:

• whether, in relation to an access request, a charge should be imposed where the cost of calculating and collecting a charge is likely to exceed the amount of the charge itself
• the circumstances in which it may be appropriate for a charge for the production of a document by use of a computer to be assessed on an actual cost basis in accordance with the applicable Charges Regulations.

In considering these issues, I noted a number of broad considerations relevant to the exercise of the discretionary powers conferred by s 29 of the FOI Act on agencies and ministers with respect to the imposition of charges.

First, that the powers are to be exercised having regard to the ‘lowest reasonable cost objective’ in s 3(4) of the FOI Act. I noted that, related to this consideration:

• The exercise of s 29 discretionary charging powers is not undertaken to the exclusion, and without consideration, of statutory obligations such as those relating to the proper use of Commonwealth resources which are imposed on agency heads by s 15 of the Public Governance, Performance and Accountability Act 2013.
• The lowest reasonable cost objective is s 3(4) is concerned not only with cost but also with the facilitation and promotion of prompt access to information.
• Having regard to these matters, it would generally be appropriate to not impose a charge where the cost to the Commonwealth of doing so is likely to be greater than the amount of the charge itself. In that circumstance, the only apparent outcome of imposing a charge, apart from imposing a net cost on the Commonwealth, would be to either delay the processing of a request for access or discourage an applicant from continuing with their request contrary to the objects of the FOI Act.

Secondly, the FOI charges regime is not designed as a full cost-recovery regime. Consistently with this, where an access request is clearly confined and appears unlikely to involve a significant processing burden, careful consideration should be given to whether the imposition of a charge is justifiable; in many cases it may not be.

Thirdly, the FOI Act and related regulations do not provide for the imposition of taxation; a charge accordingly cannot be validly imposed if the amount of the charge exceeds the actual cost of carrying out a relevant decision making or access provision activity in the particular case.

In this particular matter, the department had decided:

1. that the applicant should be liable to pay a charge
2. that the charge should be calculated in accordance with an ‘actual cost’ item relating to the production of a document by a computer, which was set out in the applicable Charges Regulations.

The department calculated the actual costs as $403.45 on the basis that a certain number of hours of work would be required to locate and manipulate data into a discrete form and that this work would need to be done, within available resources, by an EL 1 level officer.

On the information before me, however, it was apparent that the amount of $403.45 exceeded the actual cost of preparing a document including the information sought by the applicant. Even applying an ‘actual cost’ EL 1 officer rate, the actual cost would have been less than $300. It followed that the charge was unlikely to have been validly imposed.

Further, the information before me indicated that, while a computer would be used to extract data stored digitally and to compile that data in a document, the relevant task was in practical terms akin to a ‘search and retrieval’ task. In those circumstances, the fair and reasonable approach to calculating a charge would have been to apply the fixed $15 hourly rate for search and retrieval provided for in the applicable Charges Regulations. Applying that rate would have led to a charge of $73.20.

In either case – that is, whether the charge was calculated as an amount less than $300 or as $73.20 – the department should have considered whether the cost involved in assessing, imposing and collecting the charge would have exceeded the amount of the charge itself. In my view, that would have been the case on either charge calculation basis but, in any case, would have very clearly been the case had the charge been calculated on what I considered to be the most fair and reasonable basis.

Given the cost in assessing, imposing and collecting the charge was likely to exceed the amount of the charge, my decision was that the applicant should not be made liable to a charge.

That concludes my formal presentation.