Balancing the Treatment of ‘Personal Information’ Under FOI and Privacy Laws: A Comparative Australian Analysis – Part 2

BALANCING THE TREATMENT OF ‘PERSONAL INFORMATION’ UNDER FOI AND PRIVACY LAWS: A COMPARATIVE AUSTRALIAN ANALYSIS.

PART 2

Mick Batskos*

Part 1 of this paper, published in AIAL Forum 80, looked briefly at:

(a)What privacy regime, if any, exists in each Australian jurisdiction, and how is it manifested?

(b)What does each privacy regime protect? What falls within the protection offered – for example does it govern a broader concept of ‘personal information’,
or does it exclude certain matters, such as ‘health information’?

Part 2 of the paper addresses the treatment of personal privacy as a concept under Australia’s freedom of information laws.Each Australian jurisdiction
deals directly or indirectly with protection of personal privacy to some extent when disclosure of documents under freedom of information laws is being
considered. Despite this commonality of approach and the recognition that personal privacy deserves some protection, there appear to be sufficiently
divergent approaches taken in how exemptions are applied, and substantial differences in the features which apply to these exemptions, to warrant closer
examination and comparison.

In Part 2, I look at:

• (a)How each Australian jurisdiction deals with protection of personal privacy in relation to applications for access under their freedom of information/right
  to information legislation? What is the nature and scope of each relevant personal privacy related exemption provision or equivalent?
• (b)How the different jurisdictions manage the balance between privacy and freedom of information in how they treat personal information?

Commonwealth

The Freedom of Information Act 1982 (Cth) (Cth FOI Act) addresses personal privacy using a concept of ‘personal information’.[1]That
term has the same meaning as in the Privacy Act 1988 (Cth) (Cth Privacy Act):[2]

personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:

(a)whether the information or opinion is true or not; and

(b)whether the information or opinion is recorded in a material form or not.

Therefore, personal information can include information that identifies or could identify a person, says something about a person, it may be opinion (it
does not have to be factual), it might be false, but must relate to a natural person/individual. It includes names, addresses, telephone numbers, dates
of birth, medical records, taxation information, banking details, signatures, etc.

Under the Cth FOI Act, every person has a legally enforceable right to obtain access in accordance with the Act to documents of an agency or Minister
other than exempt documents.[3]The
right exists and is unaffected by the reasons for seeking access (or the perceived reasons for seeking access).[4]

The exemption under the Cth FOI Act dealing with personal privacy is s 47F.It provides that a document is conditionally exempt if its disclosure
under the Cth FOI Act would involve the unreasonable disclosure of personal information about any person (including a deceased person).

The Australian Information Commissioner suggests that generally, the individual’s identity needs to be reasonably ascertainable by the applicant.
The ability of an applicant to reasonably ascertain an individual’s identity will depend on the context and circumstances. It depends on whether it
is practically possible for an applicant to link pieces of information to identify an individual. If the agency or minister is aware of relevant information
that the applicant has (or could easily obtain) to ascertain the individual’s identity, this is to be taken into consideration. An agency or minister
must not, however, seek information from the applicant about what other information they have or could obtain. The Information Commissioner suggests
that, where an agency or minister is unaware of the other information the applicant may have, the question to be asked is what other information a
reasonable member of the public would be able to access.

This exemption does not apply if the personal information is only about the applicant.[5]However,
there are limitations to this in relation to certain health and well-being information.

Section 47F is one of the public interest conditional exemptions in the Cth FOI Act. This means that even if the requirements of s 47F are made
out, the document is only conditionally exempt and access must be provided to the document unless, in the circumstances, access would, on balance,
be contrary to the public interest.[6]

For the purposes of working out whether disclosure would on balance be contrary to the public interest, the Cth FOI Act sets out relevant factors
and irrelevant factors. It is not an exhaustive list. One of the factors favouring disclosure is whether access to a document would allow a person
to access his or her personal information.[7]Further,
in working out whether access would on balance be contrary to the public interest, an agency must have regard to any guidelines issued under s 93A
by the Information Commissioner for the purposes of s 11B(5) of the Cth FOI Act.

The Information Commissioner has issued a guideline on public interest factors for and against disclosure some of which might be more relevant to matters
involving personal information:[8]

Public interest factors favouring disclosure

(a)The personal information is that of a child, where the applicant is the child’s parent and disclosure of the information is reasonably considered to
be in the child’s best interests.

(b)The personal information id that of a deceased individual where the applicant is a close family member (generally a spouse or partner, adult child or
parent of the deceased, or other person who was ordinarily a member of the person’s household).

(c)It will contribute to the administration of justice for a person.

(d)It will advance the fair treatment of individuals in accordance with the law in their dealings with agencies.

Public interest factors against disclosure

(a)The personal information is that of a child, where the applicant is the child’s parent, and disclosure of the information is reasonably considered not
to be in the child’s best interests.

(b)The personal information is that of a deceased individual where the applicant is a close family member (like a spouse or partner, adult child or parent
of the deceased, or other person who was ordinarily a member of the person’s household) and the disclosure of the information could reasonably be expected
to affect the deceased person’s privacy if they were alive.

(c)It could reasonably be expected to prejudice the fair treatment of individuals and the information concerns unsubstantiated allegations of misconduct
or unlawful, negligent or improper conduct.

(d)It could reasonably be expected to impede the administration of justice for an individual.

(e)It could reasonably be expected to harm the interests of an individual or group of individuals.

One of the more challenging aspects for decision makers is that, when weighing where the public interest balance lies, the decision maker must explain
the relevance of the factors and the relative weight given to those factors in any statement of reasons for decision.

There are some safeguards built into the Cth FOI Act to enable persons whose personal information is in documents to have some input into the
decision about whether or not to disclose such information. Section 27A(1) applies if access is sought to a document containing personal information
about a person (including a person who has died) and it appears to the person (or dead person’s legal representative) that the person (or representative)
might reasonably wish to contend that:[9]

(a)the document is conditionally exempt under s 47F; and

(b)access would be contrary to the public interest under s 11A(5) (‘exemption contention’).

Where s 27A applies, the agency must not make a decision to give access unless the person concerned in relation to the personal information has been given
a reasonable opportunity to make submissions in support of the exemption contention, and the agency has had regard to any such submissions, provided
it is reasonably practicable in all the circumstances to give the person concerned that opportunity.[10]

There are also protections for individuals who make submissions about the exemption depending on the decision outcome. If the agency decides to give access
to the document containing the relevant personal information, it must give notice of that decision to the person concerned (as well as the applicant).In
the meantime, the agency is not to give access to the applicant until all review or appeal opportunities have run out and the decision remains unchanged.
[11]

If such a decision is made, then as an affected third party, the person whose personal information is involved has review rights to:

(a)seek internal review of the access grant decision;[12] or

(b)seek review from the Information Commissioner[13] (in which case the onus is on the affected third party individual to establish that a decision refusing access should be made);[14] and

(c)seek review from the Administrative Appeals Tribunal of a decision of the Information Commissioner which is adverse to the affected third party (in
which case the third party individual has the onus of establishing that a decision to refuse access is justified).[15]

Specific provisions provide for some caution when it comes to disclosing to an applicant a document containing information about the applicant that was
provided by a ‘qualified person’ acting in that capacity, and it appears to the principal officer of the agency[16] that disclosure to the applicant might be detrimental to the applicant’s physical or mental health or well-being.[17]

A ‘qualified person’ is a person who carries on, and is entitled to carry on, an occupation that involves the provision of care for the physical or mental
health of people or for their well-being.[18]That
includes but is not limited to a medical practitioner, psychiatrist, psychologist, counsellor, or social worker.

Where the principle officer considers that detriment might occur, the principal officer can direct that, to the extent the document contains such information,
it is not to be given to the applicant directly, but rather to a qualified person nominated by the applicant, who carries on the same occupation as
the qualified person who provided the information.

Some concessions are made to applicants seeking their own personal information. There is no charge payable for provision of access to a document that contains
personal information about the applicant.[19]

Victoria

The Freedom of Information Act 1982 (Vic) (Vic FOI Act) addresses personal privacy using a concept of personal affairs information, or
more accurately, ‘information relating to the personal affairs of any person’. Even so, a definition of that term only occurs in the context of and
for the purposes of a specific exemption, even though the phrase appears in other provisions of the Vic FOI Act.

Under the Vic FOI Act, every person has a legally enforceable right to obtain access in accordance with that Act to a document of an agency other
than an exempt document.^[20]In
relation to protection of personal privacy, s 33 is the relevant exemption provision. Section 33(1) of the Vic FOI Act is headed ‘Document
affecting personal privacy’ and provides that:

A document is an exempt document if its disclosure under this Act would involve the unreasonable disclosure of information relating to the personal affairs
of any person (including a deceased person).

Section 33(9) of the Vic FOI Act provides that in s 33 the phrase ‘information relating to the personal affairs of any person’ has an inclusive
meaning. That is, it includes information:

(a)that identifies any person or their address or location; or

(b)from which any person’s identity, address or location can reasonably be determined.

That definition was introduced in late 1999, after a series of decisions of the Victorian Civil and Administrative Tribunal (VCAT) and its predecessor
were divided as to the application of the phrase ‘information relating to the personal affairs of any person’ to staff and other officers of agencies.
This culminated in the Frankston Hospital Case,^[21] in which a convicted triple murderer was granted access to the nursing rosters for an outer suburban hospital, on the basis that the nursing rosters
did not contain information about the nurses’ ‘personal affairs’ information for the purposes of s 33 of the Vic FOI Act.

As a consequence of the resulting furore, the Vic FOI Act was amended to introduce in s 33(9) a broad definition of ‘personal affairs’ information,
making it clear that s 33 could apply to information about any individual, regardless of whether or not they were an officer or staff
member of an agency.

Another by-product of the Frankston Hospital Case was the introduction of an additional factor that must be considered as part of the balancing
exercise in determining whether disclosure of personal affairs information would be unreasonable. Section 33(2A), introduced at the same time as s
33(9), provides:

An agency or Minister, in deciding whether the disclosure of a document under this Act would involve the unreasonable disclosure of information relating
to the personal affairs of any person, must take into account, in addition to any other matters, whether the disclosure of the information would, or
would be reasonably likely to, endanger the life or physical safety of any person.

Even if an applicant is unlikely to take violent action against a person whose personal information would be revealed by disclosure of the documents, the
mere fact that release of the information could create apprehension in the mind of the person concerned may be enough to render disclosure unreasonable.
[22]

More generally, determining whether granting access to personal affairs information would involve ‘unreasonable’ disclosure requires competing interests
to be balanced. On one hand are the interests of the person seeking access to information and, on the other, the legitimate interests of a person whose
privacy may be invaded by disclosure of a document.[23]The
range of factors that may be considered is not limited in any way and can include, in addition to the s 33(9) requirement:[24]

• the nature of the information;
• the circumstances in which the agency holds the information;
• the likelihood that the individual would wish to have his/her information disclosed without consent;
• whether disclosure may cause any person stress, anxiety or embarrassment;
• the motives of the applicant and whether or not they are commendable;
• the identity of the applicant and his/her interest in the information;
• whether there is any public interest in disclosure; and
• the current relevance of the information.

In short, in determining whether disclosure is unreasonable, the decision-maker must identify all facts and matters relevant to the question to be determined,
and make an evaluative judgment based upon them. What amounts to unreasonable disclosure will necessarily vary from case to case. It includes having
regard to a range of factors beyond the privacy of the persons whose affairs will be disclosed in determining whether disclosure is unreasonable.
[25]

Any matter which, as a matter of relevance, logic and proof informs the decision of whether the statutory condition is satisfied must be taken
into account. In the end, the proper application of s 33(1) of the Vic FOI Act will require a decision-maker to consider all matters relevant,
logical and probative to the existence of conditions upon which the section depends.[26]

In Victoria, the application of the exemption is determined on the basis of disclosure to the particular applicant, but potentially to the world because
the agency cannot control what happens to a document once it is disclosed to the applicant. There is no such concept as conditional disclosure under
the Vic FOI Act and an agency cannot rely on any assurances by applicants that they will not disclose the information more widely.[27]Therefore,
consideration of the likelihood of wider dissemination beyond the applicant is relevant.[28]

Agencies are not legally required to consult a person before determining whether or not disclosure of his/her personal affairs information would be unreasonable.
However, a government practice note encourages consultation on the basis that it may be required by the existence of s 33(2A), as the individual concerned
would be in the best position to advise whether the disclosure would, or would be reasonably likely to, endanger their life or physical safety.[29]

It should also be noted that if an agency decides that disclosure of an individual’s personal affairs information would not be unreasonable, it is required
if practicable to notify the person who is the subject of that information (or in the case of a deceased person, that person’s next-of-kin) of the
decision, and of the right to seek review of such a decision.[30]Review
is available from the VCAT, not the FOI Commissioner.[31]

Apart from a narrow exception in relation to certain health information, the exemption in s 33(1) does not apply where a person seeks a document containing
information relating to their own personal affairs.

The specific exception about health information applies where an applicant seeks access to documents containing the applicant’s health information. Section
33(4) requires the agency’s principal officer to determine whether, on reasonable grounds, granting access to such a document would pose a serious
threat to the life or health of the applicant. If so, access must not be given to the document as it is exempt; review procedures incorporated from
the Health Records Act 2001 (Vic) apply to the refusal decision.[32]

Where the principal officer of the agency is not a doctor registered to practice as a medical practitioner under the Health Practitioner Regulation National
Law, the agency must appoint a registered person to stand in the shoes of the principal officer when considering whether disclosure of the health information
would pose a serious threat to the life or health of the applicant.[33]This
is a mandatory procedure.[34]

Some concessions are made to applicants seeking documents containing their own personal affairs information. Although they must pay an application fee
to request access,[35] they may not be charged certain access charges (which are reduced even further if the applicant is suffering financial hardship).[36]But
it should be noted that some charges are probably inescapable whether or not the information is about the applicant, and whether or not the applicant
is impecunious.[37]

A unique and, some would say, peculiar provision relating to personal affairs in the Vic FOI Act is s 33(6).In effect, it enables agencies
to neither confirm nor deny the existence of documents where to include this information in a hypothetical document would cause the hypothetical document
to itself be exempt on the basis of an unreasonable disclosure of personal affairs information. It applies mostly where an applicant seeks documents
about another named individual, in circumstances where merely acknowledging whether or not such documents exist would unreasonably disclose information
about the named person’s personal affairs.

Australian Capital Territory

The Freedom of Information Act 1989 (ACT) (ACT FOI Act) deals with personal privacy using the concept of ‘personal information’, defined
as:

personal information means information or an opinion (including information forming part of a database), whether true or not,
and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information
or opinion.[38]

This has been held to include dates of birth, occupations, private phone numbers, direct work phone numbers, private addresses and email addresses, and
official titles.[39]

Under the ACT FOI Act, every person has a legally enforceable right to obtain access in accordance with that Act to a document of an agency or
Minister, other than an exempt document.[40]

In relation to protection of personal privacy, s 41 is the relevant exemption provision. It provides that a document is an exempt document if its disclosure
under the Act would involve the unreasonable disclosure of personal information about any person (including a deceased person).

As in Victoria, apart from a narrow exception in relation to certain health information, the exemption in s 41(1) does not apply where a person seeks a
document containing his/her own personal information.

The health related exception applies where a requested document contains information of a medical or psychiatric nature concerning the applicant. Where
the agency’s principle officer considers that disclosure of this information might be prejudicial to the applicant’s physical or mental health or wellbeing,
the principal officer may direct that the information in question not be provided to the applicant directly, but rather to a doctor nominated by the
applicant.[41]

As in the Cth FOI Act, s 27A of the ACT FOI Act applies if access to a document containing personal information about person (including
a person who has died) is requested, and it appears to the agency that that person (or their legal representative if deceased) might reasonably wish
to submit that the document is exempt under s 41.[42]

In those circumstances, and if practicable, the agency must not grant access to personal information in a document unless the person concerned (or the
legal representative of a deceased person) is given a reasonable opportunity to make a submission that the document is exempt (in so far as it contains
personal information), and the decision-maker has considered that submission.

If such submissions are made, but the agency nevertheless decides to release the document, it must notify the person making the submission of the decision
to disclose. The person concerned (or the legal representative of a deceased person) can apply to the ACT Civil and Administrative Tribunal (ACAT))
for review of a decision to release a document containing that person’s personal information.[43] The agency must not give access to the personal information until the time permitted for seeking review has ended and no application to the ACAT has
been made, or unless the ACAT has dismissed the application, made a decision with the agreement of the parties, or affirmed the original decision.
[44]

Further, if the agency decides that a document is exempt under s 41 and the FOI applicant applies to the ACAT for revi