Processing of non-routine FOI requests by the Department of Immigration and Citizenship

Report of an own motion investigation

Report No OM12/00001

Executive summary

In 2010–11 the Department of Immigration and Citizenship (DIAC) received 8057 document requests under the Freedom of Information Act 1982 (FOI Act) – the largest number received by any Australian Government agency. Over 96 per cent of those requests were for personal information, and DIAC complied with the time limits specified in the FOI Act in processing 88 per cent of those personal information requests.

DIAC's record of compliance with FOI time limits has not been as high in managing non-routine requests, particularly complex requests for non-personal information. This point is brought out by the findings of this own motion investigation into DIAC's handling of 27 FOI requests from 10 individual requesters. Each of the 27 requests had given rise either to a complaint to the Office of the Australian Information Commissioner (OAIC) or to an application for Information Commissioner review (IC review). In total, there were six complaints and nine IC review applications.

Seven of the requesters were journalists, one was a member of Parliament and one was made on behalf of a community organisation. They had made FOI requests for information that related to matters of public interest as to which there was some policy sensitivity – the development and operation of immigration detention centres, conditions of detention, the health and reported deaths of detainees in immigration detention centres and the Government's policies on multiculturalism and offshore processing of asylum claims.

One of the requesters was an individual applicant who sought access to documents relating to the handling of a claim against DIAC. Processing of the request was complex and involved a large number of documents.

The 27 FOI requests in this study were managed by DIAC's Central Office team located in Canberra. The great majority of FOI requests to DIAC that are routine in nature are handled in DIAC's state offices. This includes requests for personal information and requests to amend or annotate personal records. The DIAC Central Office processes the more complex or sensitive non-personal information FOI requests.

Each of the 27 complaints and IC review applications has been treated separately by the OAIC. In some cases the FOI request has already been finalised by DIAC, but not so in other cases. All the IC review applications concerned deemed refusal decisions by DIAC after it failed to meet the processing timeframes in the FOI Act. One of the recommendations made at the end of this report (Recommendation 1) is that DIAC should provide further information to the OAIC concerning the estimated time for finalising those cases on which a decision has not yet been made and the steps required to achieve that outcome.

While the individual resolution of each FOI request is a primary consideration for the OAIC, the Australian Information Commissioner decided to undertake an own motion investigation into processing delays that may be common to all 27 cases. The OAIC had formed the impression that DIAC's Central Office was encountering considerable difficulty in managing complex and sensitive FOI requests in a timely manner.

Unwarranted delay in FOI processing runs counter to the objectives of the FOI Act and to the reforms that commenced in November 2010. A declared object of the FOI Act is 'to facilitate and promote public access to information, promptly and at the lowest reasonable cost' (s 3(4)). The 2010 reforms introduced new procedures to constrain delay: agencies are to notify the OAIC of an applicant's written agreement to an extension of time (s 15AA); extensions to deal with complex and voluminous requests require OAIC approval (s 15AB); and an agency cannot impose a charge for providing access if the access decision is made beyond the permitted timeframes in the FOI Act.[1]

Another objective that lay behind the reforms in 2010 was to make it easier for the community generally – including journalists and members of Parliament – to make requests for non-personal information. This is recognised in a new statement in the FOI Act objects clause which declares the Parliament's intention to promote Australia's representative democracy by increasing public scrutiny, discussion, comment and review of the Government's activities (s 3(2)).

This report concludes that DIAC must address a number of matters that appear to have caused the significant delays that affected the processing of the 27 FOI requests studied in this investigation. The matters that require further consideration are listed in Recommendation 2, and include the resources allocated to the DIAC Central Office team, the performance of that team, the governance arrangements to ensure FOI compliance across DIAC, procedures for consultation with third parties, arrangements for retrieving documents from contractors, consultation with the Minister's office, the use of FOI extension of time options and liaison with the OAIC.

It is ultimately for DIAC at a management level to decide what improvements can be implemented that will best address the FOI processing problems discussed in this report. DIAC is required by Recommendation 2 of this report to provide a report to the Information Commissioner, three months from the date of publication of this report, on its consideration of the issues listed in Recommendation 2 and measures implemented to reduce FOI processing delay. This present report contains DIAC's interim response to the report.

The Information Commissioner is mindful that DIAC receives a high volume of FOI requests, that it has many other program functions to discharge, that immigration program pressures can be urgent and unpredictable, and that government funding restraints applying to all agencies can make it difficult to meet all program benchmarks (including FOI processing timeframes). It is also noted that DIAC had itself taken steps in 2011 to review its FOI backlog and delays by commissioning a report on FOI processing by Ernst and Young. DIAC was also in the process of appointing more staff to undertake FOI processing while this investigation was underway.

It is clear that change is required on how the DIAC Central Office handles complex and sensitive FOI requests, in addition to the appointment of extra staff. This report describes delays that have occurred in processing 27 FOI requests that point to a broader problem of delay. At 1 July 2012 the DIAC Central Office had 143 cases on hand, of which 114 were outside the statutory timeframe for processing. That is, only 20 per cent of applications being handled in the Central Office were being managed within the statutory timeframe.

DIAC's response to report

The response by the Acting Secretary of DIAC to the Information Commissioner's report is included at the end of this report. The response advises that both recommendations in the report are accepted, and acknowledges the unacceptable delays in FOI processing within DIAC's National Office team. DIAC provided up to date figures which showed some improvement. Twenty-one of the 27 FOI requests discussed in the draft report had since been finalised; and the number of matters being handled by the National Office team that were outside the FOI statutory timeframe had reduced from 114 to 70 between 1 July and 21 September 2012.

DIAC's response also advises that an independent review of FOI processing in DIAC was commissioned following the commencement of this own motion investigation. The review by Robert Cornall AO made 12 recommendations that are being implemented by DIAC. The recommendations are relevant to FOI processing in other Australian Government agencies, and can be generalised to the following four principles:

• Effective FOI processing requires cooperation and support between the business line areas of an agency and the section responsible for FOI processing.
• The culture of an agency must be attuned to effective FOI administration. Two ways of instilling that culture are for the chief executive officer of the agency to issue an instruction to all staff directing that FOI compliance is a responsibility of the entire agency, and to include FOI compliance as a key performance indicator in the performance agreements of senior officers.
• Agency processes and practices that support effective FOI processing are internal training and learning strategies, escalation of unresolved matters to senior officers, regular monitoring and review of FOI performance, and high quality records management.
• Agencies should benchmark their FOI performance against the practice and performance of other agencies that have a demonstrated record in effective FOI implementation and compliance.

Background to investigation

Under s 69 of the FOI Act the Information Commissioner may conduct an own motion investigation into actions taken by an agency in the performance of functions, or the exercise of powers, under the FOI Act. On 29 March 2012, the OAIC notified DIAC that it was commencing an own motion investigation into DIAC's handling and processing of non-routine FOI requests. An issues paper was prepared and sent to DIAC outlining 10 cases that raised four main areas of concern, which were DIAC's:

1. failure to comply with statutory timeframes
2. inefficient management of complex and sensitive FOI requests
3. inadequate communication with FOI applicants about delay in processing their requests
4. poor engagement with the OAIC in resolving complaints and IC reviews concerning deemed refusal decisions.

The issues paper asked a series of questions on each of those areas of investigation. DIAC provided a response on 26 April 2012.

At the conclusion of an investigation the Information Commissioner is required under s 86 of the FOI Act to provide a report – a 'notice on completion' – to the respondent agency. The report is to contain the Commissioner's investigation results and recommendations. The investigation results are the matters the Information Commissioner has investigated and the Commissioner's opinions, conclusions and suggestions on those matters (s 87). The report may include formal recommendations that the Commissioner believes an agency ought to implement (s 88).

If the Information Commissioner is not satisfied with an agency's response to the investigation recommendations in a report, a written 'implementation notice' may be issued, requiring an agency to explain the action it will take to implement the Commissioner's recommendations (s 89(2)). An agency must comply with the implementation notice within the time specified in it (s 89(3)). If not satisfied that an agency has taken adequate and appropriate action to implement the recommendations, the Information Commissioner may subsequently report to both the minister responsible for the agency and the Minister responsible for the FOI Act (ss 89A, 89B). The Commissioner's report is to be tabled in the Parliament.

Two formal investigation recommendations arising from this investigation are made at the end of this report.

Previous external reviews of DIAC's FOI processing

This own motion investigation follows two earlier external reviews of DIAC's FOI processing that are referred to in this report.

The first was by the Commonwealth Ombudsman in 2008, and arose from complaints to the Ombudsman about delays in FOI decision making in DIAC.[2] The report identified numerous causes of delay that remain relevant to the present investigation, including the high volume of requests received by DIAC, the complexity of requests, the number of locations at which documents were held, the diffusion of data across electronic and hard copy files, poor communication with FOI applicants, the centralisation of FOI processing, and document requests being processed under the FOI Act that could be dealt with administratively.

The Ombudsman later reported that action taken by DIAC in response to the investigation led to a substantial decrease in FOI delays and in document requests handled under the FOI Act. This experience showed, the Ombudsman commented, that 'difficulties in administering the FOI Act can be substantially reduced when there is a concerted and high level response from the agency. FOI must be treated as a core business activity that receives appropriate resourcing and managerial attention.'[3]

More recently, from June to August 2011, Ernst and Young conducted a management-initiated review of FOI processes within DIAC. This review was conducted in DIAC's Central, Parramatta and Melbourne offices. The review contained three objectives:

1. to determine how the number of FOI requests in DIAC could be reduced
2. to improve the efficiency of processing FOI requests
3. to identify what was required to move DIAC to a 'culture of disclosure'.

DIAC is to be commended for initiating this review soon after the impact of the 2010 FOI Act reforms became apparent. The Ernst and Young report acknowledged that the DIACFOI teams were under significant and increasing pressure as a result of an increase in the number of FOI requests generally, as well as an increase in more complex types of FOI requests[4] (the type managed by the DIAC Central Office). Among the recommendations in the report were that DIAC should publish frequently requested information through the FOI Act Information Publication Scheme, address poor records management across the department and better integrate FOI responsibilities with other DIAC business lines.

The report proposed that DIAC promote a pro-disclosure culture through:

• allocating more resources and implementing a more coordinated and integrated approach to the delivery of FOI functions
• provide better leadership support for the FOI reform agenda to address a 'fear of releasing information' culture
• improve records management practices.

Investigation results

The remainder of this report contains an analysis of the 27 cases by reference to the four areas of concern outlined in the OAIC issues paper provided to DIAC. The appendixes to this report contain more detail about each of the cases. Specifically:

• Appendix A contains some illustrative case studies
• Appendix B lists the date on which each FOI request was received and finalised by DIAC
• Appendix C notes the delay in allocating some of the requests to a DIAC decision maker
• Appendix D compares average processing times in DIAC with those in nine other agencies that received a large number of FOI requests in 2010–11.

A general point emerging in this investigation is that DIAC's FOI processing is not as timely or trouble-free as that of many other large agencies. This adverse comparison cannot be explained or excused by reference only to the complexity or sensitivity of the FOI requests DIAC receives. While DIAC receives more FOI requests than any other agency, some other agencies with a high number of non-routine requests deal with them more expeditiously. This is partly shown in Appendix D, which lists the 10 agencies that received the highest number of non-personal requests in 2010–11. At the beginning of the 2010–11 reporting year DIAC had 303 open non-personal requests; it received a further 274 non-personal requests that year (3.4 per cent of its total number of 8057 requests).[5] Of that combined total of 577 open requests, it finalised 219 during 2010–11, or 38 per cent. The other nine agencies listed in Appendix D finalised between 72 and 88 per cent of the non-personal requests on hand during the year.

The Acting Secretary of DIAC, in responding to the issues paper that commenced this investigation, commented that DIAC took its FOI obligations seriously and was very conscious of its FOI backlog. The OAIC's findings on the following four investigation issues point to the measures that can be implemented by DIAC to improve its processing of non-routine FOI requests that are complex or sensitive.

Issue 1: Failure to comply with statutory timeframes

DIAC failed to make a decision within the statutory timeframe in each of the 27 FOI requests examined in this investigation. The initial FOI Act processing period is 30 days (s 15(5)). That period can be extended by up to 30 days by agreement with the applicant (s 15AA), for 30 days to facilitate consultation with a third party (s 15(6)), or for a period approved by the Information Commissioner for complex or voluminous requests (s 15AB).

The quickest decision was made by DIAC within 83 days of receiving the request. The slowest decisions for finalised cases were made after 507 days in one case, and after 521 days for one request to be merged with another under s 24(2) of the FOI Act.

As at 21 September 2012, 21 of the 27 requests had been finalised by DIAC and six were outstanding. The requests that were finalised took an average of 296 days to finalise from receipt. The requests that were outstanding had been with DIAC for an average of 471 days. The oldest outstanding request has been with DIAC for 556 days.

On the basis of the information provided by DIAC, the delays in those cases cannot be isolated to any particular step in FOI processing, and the cause of delay can be different in each case. In some cases, for example, there was delay in allocating an FOI request to a decision maker; in other cases there was delay after allocation; and in a number of cases there was delay in third party consultation. Four factors that appear to contribute to the delays are examined below.

a. Delay in allocating requests to decision makers

The procedure that has applied in the DIAC Central Office can be summarised as follows.[6] An Executive Level 1 officer receives and assesses the FOI request and is responsible for the 'call out'. This involves an email being sent to the relevant business line informing them of the request, the scope of the request and alerting them to a timeframe in which to identify, collate and provide the DIAC Central Office team with the documents that are the subject of the FOI request. Issues regarding the scope of the request are handled by the DIAC Central Office team in liaising between the FOI applicant and the business line area.

Once the documents are returned to the Central Office team the matter is allocated to a decision maker. In the majority of non-routine and complex cases the decision maker is located within the Central Office team. In rare instances where the FOI request is particularly complex and sensitive, a decision maker outside the team may be appointed. The decision maker is responsible for assessing the documents and preparing the decision and making any redactions to documents that are required.

The longest delays appear to have occurred in initially allocating requests to FOI decision makers. In nine of the 27 requests it took on average 250 days after receipt to allocate the request to a decision maker. Some other requests took far longer: one was allocated 512 days after receipt, while another remained unallocated after 433 days: see Case study 1 in Appendix A. DIAC explains that delays arose because existing staff in the Central Office team were at capacity and there was a shortage of resources and a lack of FOI decision-makers within that team. In all but two of the 27 cases the allocated decision maker was located in the team.

The DIAC Central Office team has other functions in addition to processing FOI requests. It is also responsible for providing policy advice about FOI and privacy to DIAC, including conducting privacy impact assessments and investigating privacy complaints.

DIAC advised that at 1 July 2012 the Central Office team was processing 143 FOI requests, of which 114 (79.7 per cent) were outside the statutory timeframe. This is significantly higher than DIAC's overall figure of 12 per cent of requests resolved outside the statutory timeframe.[7]

DIAC advised the OAIC that it was conscious of this backlog and was undertaking recruitment to reduce it. At 31 December 2011 there were 11 staff in the DIAC Central Office who were all authorised decision makers; six staff undertook only FOI processing and five staff processed requests in addition to other duties. A further five staff were recruited to the Central Office team between January and July 2012, bringing the total staff complement to 16, of whom nine worked solely on FOI processing. DIAC informed the OAIC that it hopes to recruit a further five decision makers for the Central Office team.

b. Delay in conducting internal consultations

Internal consultation on FOI requests is a regular feature of FOI processing in many agencies. It has, however, given rise to significant delay in some of the DIAC cases studied in this investigation. In one case, for example, the internal consultation had been underway for over 12 months without resolution of the request: see Case study 2 in Appendix A. In another case the internal consultation was continuing after 133 days.

The DIAC procedures on internal consultation are set out in three guidelines provided to FOI decision makers that were made available to the OAIC: the FOI Significant Case Register (SCR) Protocol, which outlines the timeline and procedure for sensitive or significant FOI cases; an FOI Checklist, which lists activities a decision maker may undertake in processing an FOI request; and the Consultation Protocol for Sensitive FOI Cases, which contains largely the same information as the FOI SCR Protocol.

The SCR Protocol states that the FOI decision-maker, the DIAC Executive and the Minister's office expect that documents covered by an FOI request will be 'considered by officers of at least Band 1 level who can provide informed advice' and that 'Branch Heads and Division Heads are fully aware of the material proposed to be released'. This process is intended to ensure that the authorised decision maker consults with relevant officers within DIAC regarding the proposed release of documents and information.

The FOI Guidelines issued by the Australian Information Commissioner under s 93A of the Freedom of Information Act 1982 acknowledge that internal agency consultation can be undertaken, but not to the detriment of complying with FOI Act requirements. Specifically, paragraph 8.10 of the Guidelines advises agencies to ensure that a sufficient number of officers are authorised at appropriately senior levels to make both original and internal review decisions. Authorised decision makers may obtain assistance from other officers, and take advice and recommendations into account, but they are nevertheless responsible for reaching an independent decision and exercising any discretion.

This issue was also raised in the Ernst and Young report. It observed that 'FOI staff report that many DIAC staff are not comfortable with the new disclosure environment where there is a widespread fear of releasing information and a failure to recognise that FOI is everyone's responsibility'.[8] Further, 'there is a lack of consistent leadership support for the FOI reform agenda, particularly at the operational level'. Ernst and Young recommended that DIAC take a program management approach to address weak governance arrangements including the appointment of a program manager to coordinate and oversee the delivery of an 'FOI' program.

DIAC could address these concerns by ensuring that its internal governance arrangements do not permit unacceptable delays arising through internal consultation. For example, existing DIAC processes do not require that cases either in breach of statutory timeframes or at risk of serious non-compliance are brought to the attention of a senior DIAC officer in the relevant business line or the SES officer responsible for FOI administration. This is an essential measure for regulating the processing of complex and sensitive FOI requests.

c. Delay from internal clearance procedures

The DIAC procedures for internal consultation appear to go a step further and require that senior officers either clear or at least acknowledge the FOI release of documents. The FOI SCR Protocol states that, following consultation by the FOI decision maker with the business area (a step that should be completed by day 23), 'positive acknowledgement of the material proposed for release must be provided by the relevant Branch and Division heads'.

At one level this requirement is understandable. The business area may better understand the contents of a document and whether release under the FOI Act is appropriate. Nevertheless, there is a high risk that this requirement will add delay to FOI processing, given the workload and various other demands on Branch and Division heads. It is not apparent from the information provided by DIAC to the OAIC that measures are in place to prevent delay at this stage of the process. If the FOI decision-maker is an APS 6 level officer, it would be reasonable to assume they may be inhibited about negotiating timeframes with senior staff of the department or the Minister's office.

Another requirement that applies before a final decision is implemented is that a hard copy of any documents to be released is provided to the Minister's office. DIAC advise that this is a 'heads up' process so that the Minister's office can understand the nature of the documents intended to be released and comment can be given. Again, there is nothing untoward in principle in a department advising a minister's office of documents that it will be releasing publicly under the FOI Act. However, all involved must clearly understand that the decision to release documents is being made by the decision maker authorised under s 23 of the FOI Act, that the Minister's office cannot override that decision, and accordingly that release will not necessarily be deferred until there is a response from the Minister's office.

It is not apparent to the OAIC that the DIAC procedures are sufficiently explanatory on this point. Moreover, it appears that this 'heads up' process has the potential to cause delay.

The Ernst and Young report noted 'the majority of FOI requests result in the disclosure of fairly routine issues and material that has been processed through a heavily controlled legal framework'. The OAIC questions whether these clearance layers are necessary and whether DIAC has considered a more efficient and streamlined clearance process with greater active involvement or personal handling by a Senior Executive officer with discrete and clear responsibility for FOI.[9] A senior officer would bring to the role the authority to assess risk, manage the relevant stakeholders and address delays by making use of the extension of time provisions and practical refusal grounds in the FOI Act.

d. Delay in conducting external consultations

Consultation with third parties was undertaken in a majority of the 27 FOI requests examined in this investigation. The third parties consulted included contract immigration detention service providers, individuals and other Australian Government agencies. This consultation was undertaken pursuant to provisions in the FOI Act that require an agency to consider consulting a third party before releasing personal or business information about that third party or information obtained from a State or Territory government (ss 26A, 26AA, 27 or 27A). The FOI processing time can be extended by 30 days to facilitate that consultation (s 15(6)).

In two of the FOI requests where DIAC undertook s 27 consultations with a third party, the average time taken to finalise both these FOI requests was 214 days. In the case of another FOI request by a member of Parliament in relation to the Inverbrackie detention centre, DIAC advised that ss 27 and 27A consultations were required, however 15 months after the request was received by DIAC, no steps had been taken to commence external consultation with the third parties. This FOI request was finalised on 14 September 2012, 498 days after receipt, without any consultations occurring.

The Information Commissioner's FOI Guidelines encourage agencies and ministers to build into their FOI process an early and quick assessment of whether consultation may be required.[10] The Guidelines further advise that a third party who is consulted should be advised that if a response is not received within the specified timeframe the agency or minister will assume the person does not object to release of the documents.[11] It appears that DIAC is not complying with this guidance and that FOI requests have been delayed in the consultation stage with no effective oversight or intervention.

The Ernst and Young report also commented on a related third party liaison issue. It found that difficulties DIAC experienced in accessing information held by contractors ran counter to the FOI environment of increased disclosure.[12] This information could be required, for example, so that DIAC could better understand whether a requested document would qualify for exemption. This has also been apparent to the OAIC in this investigation.

Issue 2: Inefficient management of FOI requests

a. Extension of time and practical refusal provisions

Non-routine FOI requests that are complex or sensitive can be expected to require more careful consideration in an agency and potentially take longer to process. The FOI Act facilitates added work by allowing for the 30 day timeframe to be extended. An agency can apply to the Information Commissioner under s 15AB of the FOI Act for extra time 'to deal adequately with a request because the request is complex or voluminous'.

Another relevant mechanism is the 'practical refusal' mechanism in ss 24, 24AA and 24AB. If an agency considers that 'the work involved in processing [a] request ... would substantially and unreasonably divert the resources of the agency from its other operations', the agency can commence a 'request consultation process' requiring an applicant to revise a request or it will be refused.

If an agency fails to notify a decision on a request to the FOI applicant within the statutory timeframe (including any extension either agreed to by the applicant, granted by the Information Commissioner or allowed for third party consultation) the agency is deemed to have made a decision refusing the request (s 15AC(3)). However, the agency can apply to the Information Commissioner for further time to deal with the request (s 15AC(4)). If an extension is granted and the agency makes a decision within that period, the deemed refusal is taken never to have occurred (s 15AC(7)).

It is important that agencies heed those mechanisms for regulating FOI processing. Once there is a deemed refusal the FOI applicant is entitled to apply for IC review of the agency's decision (ss 15AC(3), 53A, 54L). Further, the agency cannot charge for providing access,[13] and thereby loses another mechanism that may assist in regulating the scope of a request.

In the 27 cases in this investigation, DIAC obtained the FOI applicant's agreement to an extension of time under s 15AA in a number of cases. It has made less use of other extension of time mechanisms. DIAC requested an extension of time from the OAIC under s 15AB for complex and voluminous requests in only two cases. In none of the 27 cases did it seek an extension of time from the OAIC under s 15AC, which applies when an agency is already outside the statutory timeframe. In six of the 27 cases the OAIC canvassed with DIAC the option of seeking a s 15AC extension of time, but DIAC declined to do so because of its reluctance to 'commit to a timeframe'. DIAC's reluctance to use these mechanisms probably explains why there are proportionately more applications for IC review of deemed refusals of its decisions than for other agencies.

Another shortcoming is that DIAC does not appear to have any guidelines for staff in relation to when it is appropriate to consider refusal of an FOI request on practical refusal grounds. The OAIC has discussed this issue with DIAC and pointed out that DIAC takes a more conservative view of the mechanism than some other agencies. DIAC has advised that it will reconsider its approach to practical refusal, but that until now its 'capacity to develop a framework to handle voluminous or vague requests in a consistent manner has been negatively impacted by a need for FOI officers in the Canberra office to work on processing FOI requests'.

b. Poor record keeping practices and arrangements

Problems locating and accessing information on its databases were raised by DIAC to explain FOI delays. The Ernst and Young report identified that poor record keeping practices and an increasing trend in requests for electronic information were impacting on the efficient handling of requests and compliance with timeframes. In one request examined by the OAIC, DIAC advised 11 months after the request was lodged that the information sought by the applicant had been located after DIAC performed 'a data cleanse which has filtered information from a heritage system'.

The OAIC notes the recent findings of the Australian National Audit Office (ANAO) in a report, Records Management in the Australian Public Service, which assessed the records management practices of DIAC and two other departments. The ANAO found that across the three departments:

... information and records access was impeded by existing information and records management arrangements. For example, information and records for a business activity were often held in a variety of locations and electronic business systems. Staff did not have access to all locations and systems, and generally had limited understanding of information holdings that fell outside of their day‐to‐day responsibilities. Staff often stored information in a variety of places, but did not have consistent rules about the records that needed to be created and where they would be captured. This means information is captured, managed and accessible on a silo basis. The agencies did not have a widespread culture of consistently using approved records management systems, including the EDRMS and electronic business systems, to support efficient and comprehensive searches for information.[14]

This issue requires ongoing attention within DIAC. If left unaddressed it will continue to undermine efforts to improve the timely management of non-routine FOI requests that are complex or sensitive. However, no specific recommendation is made in this report, as DIAC has advised that it is responding to the ANAO report and using the audit's findings, observations and recommendations to ensure improved records management.

Issue 3: Inadequate communication with FOI applicants about delay in processing their requests

The 10 FOI applicants in this investigation each expressed frustration that DIAC did not keep them updated about the progress of their FOI request. They complained that more often than not they had to initiate contact with DIAC to obtain progress reports. The explanation given by DIAC to the OAIC in one case was that 'any further contact would not have provided any further information than [the FOI applicant] has obtained through her regular contact'. The same complaint about inadequate communication has been made to the OAIC in other cases not included in this investigation.

DIAC has also been unwilling to provide applicants or the OAIC with a definite timeframe for a decision, even in some cases when several months have passed since the due date. The explanation given to the applicant in one case in this investigation was that 'it is difficult to predict how much time a given request will take'. Another example is given in Case study 4 in Appendix A. This runs counter to the scheme of the FOI Act since the 2010 amendments, which impose specific time periods for all stages of FOI processing and enable agencies to request an extension for a specific period.

The OAIC looked in this investigation at DIAC's procedures and guidelines for staff regarding FOI processing and communication with FOI applicants about delays and expected timeframes. DIAC has issued a number of procedural documents and template emails for communication with applicants, but there are gaps. For example, there is no guidance on keeping an applicant informed when it is apparent that their FOI request may take longer than usual to process. This is an important step if it is likely that consultation with a third party will delay a decision on a request.

Effective communication with applicants can make it easier to manage expectations and to gain an applicant's cooperation in refining or managing a request. It is also good administrative practice to remind decision makers in writing that they are accountable for their decisions and any delays in the process.

The Commonwealth Ombudsman report in 2008[15] made a similar observation about lack of effective communication between DIAC decision makers and applicants. Following that report, DIAC advised that it had implemented a new processing model whereby requests were acknowledged within 24 hours and if documents were not received from the business unit by day 21 of the processing period the case officer would contact the applicant and negotiate a new timeframe. At least in respect of the 27 more complex requests examined in this investigation, this practice has not been followed.

Issue 4: Poor engagement with the OAIC in resolving complaints and IC reviews concerning deemed access refusal decisions

a. Cooperative approach to resolving complaints and IC reviews

The IC review process is underpinned by several key principles: that it should be as informal as possible, non-adversarial and timely.[16] The FOI Act requires agencies to use their best endeavours to assist the Information Commissioner to make the correct or preferable decision in a case (s 55DA). The Information Commissioner also encourages agencies to work with applicants to explore ways of resolving issues without the need for formal IC review decisions.

The issues paper for this investigation drew DIAC's attention to approaches that might lead to more timely resolution of non-routine requests, noting that other large agencies successfully used these approaches. This included facilitating release of documents outside the FOI Act, negotiating the scope of requests with applicants, providing alternative forms of information to applicants and educating applicants about the type of information they can expect DIAC to hold and to release. These approaches can require greater engagement and negotiation with applicants, but can be effective.

DIAC has not provided a specific response to the OAIC on these suggested alternative approaches to handling non-routine FOI requests.

b. Inadequate responses to requests for information

The OAIC has not always obtained prompt and explanatory responses from DIAC's Central Office team in relation to the 27 cases in this investigation. This has impeded the OAIC's ability to finalise the complaint investigations and IC reviews more efficiently.

OAIC requests for status updates sometimes require multiple emails and phone calls. In one case, for example, the OAIC sought information on DIAC's handling of a particular FOI request on 20 February, 29 February and 13 March 2012, and on 14 March 2012 received a one line response, 'a draft decision has been made and the decision maker is undertaking consultation with internal business areas'. In another case the FOI Commissioner issued DIAC with formal notices to produce both a statement of reasons (s 55E) and documents (s 55R) after DIAC had failed to meet earlier requests for information: see Case study 5 in Appendix A.

Similarly, when the OAIC requested more up to date information on the progress of 12 outstanding requests in this investigation, DIAC responded briefly that '11 requests remain outstanding' and 'four of the 12 are expected to be finalised in May 2012, with remainder yet to be allocated'. Details of the finalised requests were not provided, although some of the requests have since been finalised, as shown in Appendix B. The OAIC was also disappointed that DIAC did not elaborate on its disagreement with some of the observations in the issues paper that commenced this investigation, noting only that 'recollections and understanding of FOI staff in the Central Office team do not match the content of the assertions of applicants relayed in the issues paper, nor the context in which our staff have been quoted'.

DIAC has not engaged strongly with the OAIC in exploring options for processing non-routine FOI requests more efficiently, including by informal resolution of FOI disagreements. This concern is taken up in Recommendation 2, requiring DIAC to report in three months on its consideration of the issues listed in that recommendation.

Information Commissioner's recommendations

Recommendation 1

DIAC should provide the OAIC with the following information about each FOI request covered by this investigation that has not been finalised:

1. the stage DIAC has reached in processing the FOI request
2. the estimated date of finalising the FOI request
3. details of any external consultation that will be required to finalise the FOI request, and the projected timeframe for that consultation
4. the estimated number of documents or folios within the scope of the FOI request
5. any explanation as to why the FOI request could not have been finalised at an earlier date.

Recommendation 2

DIAC should consider the following matters, that are discussed in this report as possible factors that have caused unnecessary delay in DIAC's Central Office team in processing non-routine FOI requests that are complex or sensitive, and provide a report to the Information Commissioner within three months of the date of publication of this report dealing with each of the following:

1. Inadequate resources allocated to processing non-routine FOI requests in the DIAC Central Office team
2. Delay in allocating non-routine FOI requests to DIAC decision makers
3. Delay in initiating and concluding internal consultation on non-routine FOI requests
4. Inadequate internal governance arrangements for controlling delays in processing non-routine FOI requests and for ensuring senior executive supervision of those requests
5. Unclear internal clearance procedures for access grant decisions
6. Delay in obtaining documents from DIAC contractors when required for FOI processing
7. Delay in initiating or concluding third party consultations
8. Failure to consider applying to the OAIC for extensions of time to process requests under FOI Act s 15AB or s 15AC
9. Inadequate staff guidance on practical refusal procedures under FOI Act s 24
10. FOI processing being impeded by poor record keeping
11. Inadequate communication with FOI applicants about progress in finalising requests
12. Unsatisfactory engagement with the OAIC during the conduct of IC reviews and investigation of FOI complaints.

Response to the Information Commissioner's report by the Secretary, Department of Immigration and Citizenship

Attachment A to Secretary's response – Recommendations made by Robert Cornall following review of DIAC's FOI procedures between May–July 2012

Recommendation 1

That the department acknowledge that successful management of its FOI function requires DIAC's business areas to accept their share of the responsibility for meeting the department's obligations under the Freedom of Information Act.

Recommendation 2

That the Secretary issue a Secretary's Instruction directing that compliance with the requirements of the Freedom of Information Act is a whole of department responsibility and every area is required to play its part in responding to FOI requests in a timely and cooperative manner.

Recommendation 3

That the Secretary include freedom of information compliance as a key performance indicator in senior officers' performance agreements.

Recommendation 4

That DIAC develop a chart comparable to the Department of Defence's Freedom of Information Standard 30-day Timeline chart and display it on all of the department's notice boards.

Recommendation 5

That the Freedom of Information and Privacy Policy Section establish a constructive and mutually supportive working relationship with the department's business areas and nominate one of its staff as Business Area Liaison Officer.

Recommendation 6

That each business area nominate one of its officers as an FOI Liaison Officer as a point of first contact for the Business Area Liaison Officer and the Freedom of Information and Privacy Policy Section.

Recommendation 7

That the escalation of an FOI request to higher levels of authority should be initiated quite quickly if there is a delay in a business area's response to the request and that delay is not promptly rectified.

Recommendation 8

That the Freedom of Information and Privacy Policy Section, in conjunction with the department's Human Resources section, prepare and implement an annual training plan for all FOI officers and the business area FOI Liaison Officers.

Recommendation 9

That the department develop a mandatory FOI e-learning package specifically for business area officers whose files could be subject to an FOI request.

Recommendation 10

That the department improve its file and records management to better support its freedom of information function, including in particular in understanding national security and non-national security classifications and the more effective and consistent use of the Client of Interest field in the Department's Integrated Client Service Environment.

Recommendation 11

That the department's Chief Lawyer, Assistant Secretary responsible for FOI and Director of the Freedom of Information and Privacy Policy Section establish a direct relationship with their counterparts in the freedom of information areas in the Departments of Human Services and Defence to discuss and share ideas about the development and improvement of DIAC's FOI function on a continuing basis.

Recommendation 12

That the department:

1. closely monitor the implementation of the recommendations made in this report

2. review its progress in implementing the recommendations in March 2013, and
3. as part of that review (if not earlier), consider doing away with DIAC's additional sign off processes involving a Deputy Secretary and the Minister's office and, instead, moving to the briefing procedure adopted by the Department of Defence.

Appendix A – Case studies

Case study 1: Delay in third party consultation (Request 27)

The FOI applicant, a member of Parliament, made a request to DIAC on 5 May 2011 for all records of contact between Serco, DIAC's service provider at the Inverbrackie detention facility, and four third parties. On 22 June 2011 the applicant complained to the OAIC about DIAC's delay in handling this request.

DIAC took five months to identify and locate the documents relevant to the request and then determine that consultation with third parties was required. On 11 July 2012 – 433 days after the request was received – DIAC advised the OAIC that the request had not been allocated to a decision maker and DIAC did not have an expected timeframe for finalising the request.

The request was finalised on 14 September 2012 – 498 days after receipt – after the request was deemed to be withdrawn under s 24AB(7) of the FOI Act, as the applicant had not responded to DIAC's notice of intent to make a practical refusal decision within the consultation period.

Case study 2: Delay in conducting internal consultation (Request 16)

The FOI applicant, a journalist, made a request to DIAC on 5 April 2011 for all audits of the Movement Alert List and International Movement Records since 1 January 2008. On 1 August 2011 DIAC advised the OAIC that a decision had been drafted and consultation with the relevant business areas within DIAC was ongoing. On 2 December 2011, 18 January 2012, 5 May 2012 and 11 July 2012 DIAC advised that consultations with internal business areas were still ongoing. The request was finalised on 24 August 2012, 507 days after it was received.

Case study 3: Delay in conducting external consultation (Request 11)

The FOI applicant, a journalist, made a request to DIAC on 16 May 2011 for information received by DIAC from Serco, a detention service provider, about overcrowding in detention centres. The FOI applicant complained five months later to the OAIC about the delay in processing this request and four others.

Consultation with Serco was not commenced until four months after the request was received. The consultation was further extended as not all documents relevant to the request had been assembled. The request was not finalised until February 2012, nine months after it was received.

Case study 4: Inadequate communication with FOI applicant (Request 12)

The FOI applicant, a journalist, made a request to DIAC on 20 May 2011 for documents analysing the number of unlawful visitors or 'overstayers' in Australia. The applicant agreed to a 30 day extension to process the request on 11 June 2011. DIAC advised the OAIC in January 2012 that it had not communicated with the FOI applicant since June 2011 because the 'only information we could have advised [the applicant] was 'still consulting''.

Case study 5: Inadequate response to the OAIC (Request 1)

The FOI applicant made an FOI request to DIAC on 4 January 2011 for his own case records. After not receiving a decision, he applied on 9 March 2011 for IC review of DIAC's deemed access refusal decision. DIAC advised the OAIC that '[d]ue to the large amount of work involved, actioning [his] request is not currently a priority for DIAC'.

On 29 June 2011 the Freedom of Information Commissioner sent DIAC a formal notice under s 55E of the FOI Act to produce a statement of reasons by 27 July 2011. DIAC did not respond until 12 August 2011, when it sought refuse the FOI request under s 24 of the FOI Act for the reason that processing the request would result in a substantial and unreasonable diversion of the department's resources. The FOI Commissioner then issued a formal notice under s 55R of the FOI Act requiring DIAC to produce documents relevant to the request.

Appendix B – Dates of receipt and finalisation of requests

Appendix C – Time taken to allocate requests to decision makers

Appendix D – Finalisation of non-personal requests by 10 agencies