Published 21 March 2024
Opening statement delivered by Australian Information Commissioner Angelene Falk to the Legal and Constitutional Affairs Legislation Committee on 19 March 2024
Thank you for the opportunity to provide an opening statement to convey some brief but important points.
First and foremost, the OAIC is resolutely focused on delivering our important work to promote and protect Australians’ information access and privacy rights in the most effective and efficient manner possible.
I acknowledge the dedication to public service each person at the OAIC brings to deliver on our purpose.
The OAIC is now greatly strengthened by the appointment of two new Commissioners who appear this evening.
Ms Elizabeth Tydd commenced on 19 February as Freedom of Information Commissioner, and Ms Carly Kind on 26 February as Privacy Commissioner. Commissioner Tydd was formerly the Information Commissioner and CEO of the Information and Privacy Commission of NSW. Ms Kind was formerly the head of the Ada Lovelace Institute, an independent research institute in the UK focused on ensuring that data and AI work for people and society. The new commissioners equip the OAIC with an exceptional depth of expertise across access to information and privacy functions.
That brings me to the three commissioner model. Significant work has been undertaken to support reinstatement of the three commissioner model through developing governance arrangements and protocols. The arrangements both recognise the independent roles of each commissioner and reflect a commitment to collective leadership and collaboration.
Next to case trends.
Privacy complaints made to the OAIC increased significantly last financial year, up 34%. This has resulted in an increase to the numbers of ongoing privacy complaints before the OAIC, with 2,422 on hand as at the end of February 2024. Of those 422 or 17% are over 12 months old, up from 14% at the end of last financial year.
We have implemented a number of strategies to acquit this increased workload.
We are also focused on major commissioner-initiated privacy investigations and have taken enforcement action.
Since the last estimates hearing, the OAIC filed proceedings in the Federal Court seeking civil penalties against Australian Clinical Labs (ACL). We allege that ACL seriously interfered with the privacy of approximately 21.5 million individuals by failing to take reasonable steps to protect their personal information and through breaches of Australia’s data breach notification laws.
Notifiable data breaches are also up 7% year to date with malicious or criminal attack remaining the dominant cause of breaches.
We are also preparing to regulate the privacy aspects of the Digital Identity system.
Turning to freedom of information (FOI), following from the significant 60% increase in applications for Information Commissioner review (IC review) of FOI decisions made by agencies and ministers in 2021–22, last financial year saw applications decrease for the first time since 2015, by 16%. We have received less applications compared to the same period last year.
As at end of February, we have 2,213 IC review applications on hand. Consistent with last year, approximately 60% are over 12 months old. However, we have significantly increased our full merits review decision making up from 68 decisions in 2022–23 to 113 in 2023–24 year to date.
We continue to implement strategies to deal with this workload.
We also remain focused on proactive measures to strengthen information access.
We have finalised 160 complaints year to date compared to 124 for 2022–23 notwithstanding the 17% increase in complaints received year to date. We have made recommendations to improve agency practice. We have worked with government agencies to complete the five year mandated review of their compliance with the Information Publication Scheme, an important proactive publication measure contained in the Freedom of Information Act 1982 (Cth). These obligations increase the amount of information provided to the public proactively and can reduce reliance on FOI applications.
Finally, resources and the future. The OAIC is funded by a combination of terminating and ongoing measures. Several of these terminating measures are due to end at the conclusion of this financial year. We are in discussion with the Government about the OAIC’s resourcing needs.
A strategic review of the OAIC was conducted between October 2023 and February 2024, and an implementation plan will be provided in April. The review examined the operations of the OAIC and helps us take stock for an organisation that has grown and changed significantly since it was established.
The review is currently being considered by the OAIC and Government in the context of budget processes.
That concludes my opening statement. Thank you.
