Covid Safe Schools Inc v NSW Ministry of Health

[2023] NSWCATAD 293

Civil and Administrative Tribunal

New South Wales

Medium Neutral Citation:

Covid Safe Schools Inc v NSW Ministry of Health [2023] NSWCATAD 293

Hearing dates:

6 October 2023

Date of orders:

7 November 2023

Decision date:

07 November 2023

Jurisdiction:

Administrative and Equal Opportunity Division

Before:

J D Little, Senior Member

Decision:

(1) Set aside the decisions and remit the matter for reconsideration.

(2) With respect to the reconsideration, the Applicant is to be given a reasonable opportunity to amend his application pursuant to s 60(4) of the Government Information (Public Access) Act 2009.

Catchwords:

ADMINISTRATIVE LAW – Government Information (Public Access) Act – GIPA – Decision that information not held – Decision that information publicly available – Decision to refuse to deal with application – Remittance to the agency

Legislation Cited:

Administrative Decisions Review Act 1997

Civil and Administrative Tribunal Act 2013

Government Information (Public Access) Act 2009

Cases Cited:

Dibb v Transport for NSW [2022] NSWCATAD 398

Evans v Chief Commissioner of State Revenue [2022] NSWCATAD 307

Ooi v Ministry of Health [2023] NSWCATAD 107

Redfern Legal Centre v Commissioner of Police [2021] NSWCATAD 288

Category:

Principal judgment

Parties:

Covid Safe Schools Inc (Applicant)
NSW Ministry of Health (Respondent)

Representation:

The People’s Solicitors (Applicant)
Crown Solicitor (Respondent)

File Number(s):

2023/00172579

Publication restriction:

None

REASONS FOR DECISION

Introduction

1. This is an application for administrative review of a decision of the Respondent concerning access to government information under the Government Information (Public Access) Act 2009 (the GIPA Act).

2. The Applicant is an association registered in New South Wales.

3. The Respondent is the Ministry of Health. It was not in dispute that:

1. the Epidemiology and Data Systems Branch of Health Protection, NSW (EDSB) is part of the Respondent-agency and is responsible for administering the Notifiable Conditions Information Management System (NCIMS); and

2. the NSW Data Analytics Centre (DAC) is not part of the Respondent-agency (being a part of the Department of Customer Service which is a separate agency).

4. The Applicant sought access to government information and specifically certain data used to display a graph related to COVID cases and posted on a NSW government website (the DAC Graph). As described below, the Graph was created by the DAC in the department of Customer Service by utilising data provided to it on a daily basis derived from the NCIMS and sent to DAC by the EDSB.

5. As described further below, the Respondent refused the request.

6. Following a review by the Tribunal, I have decided that the correct and preferable decision is to set aside the decision and remit the matter for reconsideration.

Background

The DAC Graph

7. The manner of compilation of data used to create the DAC Graph and the distribution of data to compile the DAC Graph is relevant to the resolution of the issues before this Tribunal. The Respondent’s witness gave evidence in this respect, which was not in dispute. The evidence in this respect is summarised below.

8. The NCIMS is a live data-base that it constantly updated as new information becomes available.

9. The EDSB created a daily snapshot of COVID-19 notifications from the NCIMS, which was saved as a “parquet file” (the Daily Snapshot). The parquet file is a data file like an excel spreadsheet, with a row for each notification and columns representing the characteristics of each notification, such as a patient’s name, address, date of birth and age. The parquet file exceeds the limit of what can be dealt with in Excel given the volume of information. For example, as at 17 July 2023, the current parquet file contains nearly 10 million unique notifications (reflected as “rows”) each with 199 columns of information.

10. EDSB created this Daily Snapshot to reflect the addition of new records and updates to historical records. From the Daily Snapshot, EDSB created a unit record file (URF Dataset) of the COVID-19 notification data that was then sent to DAC. The EDSB has retained copies of each of the URF Datasets sent to DAC since May 2021.

11. As for the character of the information provided to DAC:

1. The URF Dataset transmitted to DAC from EDSB contained “raw, patient-level data” including sensitive, personal and health information about individuals.

2. As the Daily Snapshot (and the URF Dataset) was created on a daily basis, they reflected the data in the NCIMS at the particular time at which it was taken. If, for example, the figures in each Daily Snapshot would be different to the figures that would be produced if data was to be extracted from the NCIMS now.

12. The DAC Graph was then created by the DAC “based on the raw data [from the URF Dataset received] from the NCIMS supplied by the EDSB”. However, the DAC took the “raw data” from the URF Dataset and applied its own “code, logic or methodology” to create the DAC Graph. No evidence from the DAC was relied upon in this regard, however it is self-evident by the fact that the DAC Graph aggregates the notification by age groups with these summary counts being completed by DAC. The Tribunal is informed and accepts that:

The Respondent does not hold, and has never received … the summary counts [created by DAC] that underly the graphs. Additionally, EDSB does not know, or have access to the code, logic or methodology used by DAC to create the graphs.

…

The EDSB did not undertake any aggregation or analysis of the daily COVID-19 URF files prior to their transmission to the DAC for the purpose of publishing the graphs to which the applicant’s access application referred.

The GIPA Application, the Determination and the Internal Review

13. On 21 April 2022, the Respondent received the Applicant’s GIPA Application which sought access to the following category of records including a category related to the DAC Graph:

(1) For each day since 1 Jan 2021 to date, for each person under 20 years of age admitted to a NSW hospital, the recorded cause(es) of admission.

(2) For each week since 1 Jan 2021 to date, the number of children 0-9 and 10-19 year admitted to hospital where COVID-19 is recorded as at least one cause of admission.

(3) For each week since 1 Jan 2021 to date, the number of children 0-9 years and 10-19 year admitted to hospital where respiratory disease is recorded as at least one cause of admission.

(4) For the whole time period available, the dataset including each day’s data, for each age group, used to display the graph titled “Causes from PCR and RAT tests by age group” seen at “COVID-19 WEEKLY SURVEILLANCE IN NSW Epidemiological week 33, ending 21 August 2021” reported the number of people ‘hospitalised due to COVID-19’. Commencing with ‘COVID-19 WEEKLY SURVEILLANCE IN NSW Epidemiological week 34, ending 28 August 2021’, the weekly reports include people hospitalised for other reasons not related to their COVID-19 diagnosis’.

“Please provide copies of documents discussing this change in reporting, the reason for this change, and any instructions to staff concerning the implementation of this change”.

14. The “age groups” for the purposes of the request at item 4 were 0-9; 10-19; 20-29; 30-39; 40-49; 50-59; 60-69; 70-79; 80-89; 90+ (Requested Age Grouping).

15. By Notice of Determination dated 14 February 2023, the Respondent determined that it did not hold any information responsive to items 1, 2, 3 and 5 requested by the Applicant. That determination was delayed by approximately five months.

16. In response to item 4, the Respondent decided that “… the only information held by the Ministry is publicly available information” and provided a link to the publicly available information. This is despite also stating the following (noting that the ESCB is part of the Respondent-agency):

“The [ESCB] searched for the information requested for this point within the [NCIMS]. The branch advised that data relating to the request is available in NCIMS dataset, however the data set includes potentially identifying information about cases. The Ministry is not required to create a new document to respond to this point of your request, pursuant to section 75(2) of the GIPA Act” [Emphasis added]

17. The hyperlink to which the Applicant was directed allowed access to a data-set titled “COVID-19 cases by notification date and age range aggregated”. This location charted daily notified COVID cases and allowed a dataset to be downloaded in excel that provided daily figures of confirmed COVID-19 cases, from 9 March 2020 through to the present. However, the information was aggregated by age groups 0-19; 20-24; 25-29; 30-34; 35-39; 40-44; 45-49; 50-54; 55-59; 60-64 and 70+ and, as such, condensed the 0-9 and 10-19 data making it impossible to break it down into the Requested Age Grouping for those ages.

18. The Applicant requested an internal review with respect to the decision related to item 4. The Applicant raised the issue identified at paragraph 11 with respect to the publicly available data for the 0-9 and 10-19 age groups and stated:

I believe the s 75(2) refusal was wrong because it would not require a new document to be created to respond to the request. It would only require the potentially identifying information to be redacted or omitted

19. By internal review decision dated 27 April 2023, the Respondent affirmed its earlier decision.

20. The reasoning in the internal review is difficult to follow. On the one hand, the Respondent expressly admits that “the dataset relating to the request is available in the NCIMS”, being the system administered by EDSB which is part of the Respondent-agency. While accepting that it possesses the dataset responsive to item 4, the Respondent simultaneously denies having records responsive other than publicly available information. In this respect, the internal review states:

“… the only information held by the Ministry is publicly available information”

21. The Respondent’s reasoning goes on to allege that:

1. it would be inappropriate for the dataset to be released in its current form because it contains identifiable information about individual cases and, on that basis,

… it would not be appropriate for the branch to provide data at a more granular level than what is already available in the public domain [Emphasis added]

2. in respect of the identifiable information, this was particularly true of the 0-9 year age range due to the small counts of cases;

3. the removal of the identifiable information from the dataset would be an inappropriate use of time and resources because it would require the use of “bespoke software” and would:

1. require 409 hours which would amount to a significant and substantial diversion of resources; and

2. would, in effect, be creating a new record of information and pursuant to s 75(2) of the GIPA Act, the Respondent’s obligation does not require it to make a new record of information.

22. In this respect the internal review described the necessary process as follows:

The branch further advised that to redact the original datasets to conceal the identifiable information about individual cases would in fact be a creation of new dataset files which would require approximately 409 hours and therefore, is a significant and substantial diversion of resources for the branch to create a document with redactions and omissions where necessary. The branch noted that the data available in the NCIMS is saved in a special file format (parquet file) which currently contains over 9 million records and 199 columns. The branch is required to use a special statistical software to work on this parquet file as excel or any other format is not capable of handle the volume of data contained in the file. A parquet files is to be created every day and in order to replicate the information published daily, the branch would need to take parquet file for each day, remove all historical records to keep the records only for the required date, and remove 197 columns to keep 2 columns only for date and age group. The branch also advised that if they were to redact or remove the information from the existing parquet file, the redacted or removed information is lost to them. Creating a new file that contains only the information within the scope and saving the information in a format that a lay person could use (eg: excel spreadsheet) would require processing and analysing the data for each day requested in the access application.

23. The contentions related to the “inappropriateness” of the Respondent releasing data in its current form and the steps required to remove identifiable information sit uneasily with the contention that the Respondent does not contain records responsive to item 4 (other than publicly available information).

24. The internal review then reverts to the contention that the Respondent does not hold information other than publicly available information while simultaneously stating, again, that the EDSB (which as noted above is part of the Respondent-agency) possesses the information requested. The internal review states:

[EDSB] advised that the only information held by the Ministry is links to publicly available information which were provided to you in the initial determination, and they do not hold any further information or records within the scope of your internal review request.

I am satisfied that the [EDSB] of Health Protection NSW is the appropriate branch which would possess the information you have requested in your internal review

25. The decision then concludes with a suggestion that the Applicant contact DAC who, as noted above, published the DAC Graph. The internal review states:

You may wish to consider contacting Data Analytics Centre (DAC) in the department of Customer Service as they may hold a summary of counts of cases by date and age group that they use to create the published information within the scope of point 4 of your request.

26. On 30 May 2023, the Applicant filed an application in this Tribunal for administrative review of the Respondent’s decision in respect of item 4. The grounds for that application are stated as follows:

In relation to item 4:

(1) The s 75(2) refusal was wrong because it would not require a new document to be created to respond to the request. It would only require the potentially identifying information to be redacted or omitted.

(2) If creation of a new dataset would require 409 hours, or that redaction would result in information being lost to the Department, this is a reflection of the department’s incompetence and not that it would be unreasonable and substantial diversion of resources.

(3) The Ministry decided the request would involve a “significant and substantial diversion of an agency’s resources” whereas the GIPA Act refers to “unreasonable and substantial diversion of an agency’s resources”. The Ministry failed to show that the diversion of its resources would be either “unreasonable” or “substantial”.

Evidence and submissions

The Respondent’s evidence and submissions

27. In addition to the oral submissions made on behalf of the Respondent at the hearing and the oral evidence of the Respondent’s witness, the Respondent relied upon the following material:

1. Respondent’s written submissions in chief marked “R1”;

2. Statement of Ms Lee Taylor dated 17 July 2023 with Annexures. Ms Taylor is the Director of the EDSB marked “R2”;

3. Respondent’ written submissions in reply marked “R3”;

4. Further Statement of Ms Taylor dated 21 August 2023 marked “R4“; and

5. A copy of the Notice of Decision dated 14 February 2023 marked “R5”.

28. The Respondent’s position in summary was that the reviewable decisions the subject of the internal review were:

1. The information applied for by virtue of item 4 was already publicly available and therefore available to the Applicant: ss 58(1)(c) and 59(1)(e) (Information Already Available Decision);

2. The Respondent does not hold the information requested (Information Not Held Decision): s58(1)(b); and

3. In the alternate to (1) and (2), the refusal to provide access to the information in the manner requested by the Applicant because either (Alleged Refusal to Provide Access Decision):

1. there is an overriding public interest against disclosure of the information: s 58(1)(d); or

2. to do so would be detrimental to the proper preservation of the record, would interfere unreasonably with the operations of the agency or result in the agency incurring unreasonable additional costs: ss 80(i) and s 72(2)(a), (b) and (d).

29. The Respondent denied having made a determination to refuse to deal with the Applicant’s access application pursuant to s 60(1)(a) of the GIPA Act on the basis that doing so would require an unreasonable and substantial diversion of resources. Additionally, the Respondent contended that whether or not an agency exercises the discretion conferred by s 75(1) to create a new document in order to respond to a request is not a reviewable decision under s 80 of the GIPA Act.

30. In respect of the Information Already Available Decision, the Respondent relied upon the information available from various websites that the Applicant was directed to by the Respondent which the Respondent describes as “analogous information”. That information, published by the DAC, allows users to chart daily notified COVID cases and to access the underlying dataset in excel, provides daily figures of confirmed COVID and this is “substantially responsive to the applicant’s request for information”. However, the Respondent also acknowledged that the publicly available date is different to that which is responsive to the GIPA request made by the Applicant.

While it is acknowledged that the form of the chart and graph is different in some minor respects to that to which the applicant’s access application initially referred, it is submitted that this is substantially responsive to the applicant’s request for information.

31. In respect of the Information Not Held Decision, the Respondent maintained this contention despite the admissions in the Notice of Decision and the Internal Review that EDSB possesses the information responding to the Applicant’s request. At the hearing, the Respondent submitted that it did not hold the information responsive to item 4 because the GIPA request, properly construed, is for daily COVID figures for the relevant period aggregated by the age groups provided in the graph (i.e. 0-9 and 10-19). That aggregation was compiled by DAC and not the Respondent and based on this, the Respondent submitted that no such record aggregating by age-group is held by the Respondent. In making this submission, the Respondent sought to draw a distinction as between the “raw dataset” provided to DAC (which the Respondent contended was not responsive to the Applicant’s GIPA request) and the use of that dataset by DAC to produce the DAC Graph and the aggregated age ranges.

32. The Respondent’s alternative submission was if the request is construed as pertaining to the “raw data” in the NCIMS or the daily COVID notifications extracted from the NCIMS, there would be an overriding public interest against disclosure of patient level information which contains personal and health information of individuals.

33. With respect to the removal or redaction of that personal and health information, the Respondent submitted that:

1. no such record currently exists and the Respondent does not hold such information; or

2. to the extent the Applicant requests redacted information, then this is a request as to the form or manner in which access to a record is provided. According to the Respondent, new versions of the URF Datasets would need to be created (so as not to lose existing data) and this would take somewhere between 119 and 238 hours to complete. As such, the request as to form should be rejected pursuant to s 72(2)(a) and (b) of the GIPA Act which provide:

(2) The agency must provide access in the way requested by the applicant unless—

(a) to do so would interfere unreasonably with the operations of the agency or would result in the agency incurring unreasonable additional costs, or

(b) to do so would be detrimental to the proper preservation of the record,

…

3. alternatively, to redact the information, new versions of the URF Datasets would need to be created (so as not to lose existing data) which, according to the Respondent would be the creation of a new document and the agency is not required to create new documents to respond to a request pursuant to s 75(2) of the GIPA Act.

34. Lastly, as for adopting a potential methodology to obtain a data-set of daily COVID-19 notifications aggregated by age based upon the current data in the NCIMS – while the Respondent accepted that such a process could be conducted simply and easily consistent with the expert evidence relied upon by the Applicant (as described below), the Respondent maintained that the resulting information would not be responsive to the Applicant’s GIPA request. That is because it would not be the same data used for the purposes of the DAC Graph because of the character of the NCIMS as a “live system” which is continuously updated.

35. In support of these contentions, the Applicant sought to rely upon Redfern Legal Centre v Commissioner of Police [2021] NSWCATAD 288 (Redfern Legal Centre) and Evans v Chief Commissioner of State Revenue [2022] NSWCATAD 307 (Evans) and Ooi v Ministry of Health [2023] NSWCATAD 107 (Ooi), that "government information" is limited to information contained in records that exist at the time that an application is made.

The Applicant’s evidence and submissions

36. In addition to the oral submissions made on behalf of the Applicant at the hearing and the cross-examination of the Respondent’s witness, the Applicant relied upon the following material:

1. The Administrative review application form filed 30 May 2023 attaching a copy of the internal review dated 27 April 2023 marked “A1”;

2. Statement of Dr Emily Hackett-Jones dated 2 August 2023 marked “A2”;

3. Applicant’s written submissions filed 10 August 2023 marked “A3”;

4. Affidavit of Dr Hackett-Jones dated 5 October 2023 marked “A4”; and

5. A copy of the Graph marked “A5”.

37. The Applicant’s position as submitted, in summary was first, in characterising the decision for review, the Applicant contended:

The Ministry conceded that “the dataset requested was within the [NCIMS] however the dataset contained potentially identifying information about cases”. It claimed that to respond to the request, it would need to “create a new document”, which it refused to do so because it would be an unreasonable diversion of resources.

38. The Applicant’s challenges to this decision were summarised as follows:

1. Removing identifying information does not constitute a new record in terms of GIPA Act s 75;

2. Any identifying information could be removed by redaction of the existing record or by creating a new record under s 75(1); and

3. Neither of these options would involve an unreasonable and substantial diversion of the agency’s resources, provided the agency complies with its obligation under s 53 to do so efficiency.

39. With respect to the removal of information, the Applicant:

1. argues that this ground does not question the discretion to create a new document rather, it is based on the contention that no new document is required to satisfy the request given the concessions made by the Respondent that it possesses the dataset responding to the request.

2. further contends that the authorities cited by the Applicant are distinguishable because each held that the agency did not hold information responding to the request (unlike this case).

40. With respect to the Applicant’s submissions that the process of redaction would not be an unreasonable and substantial diversion of resources – these were based upon the expert evidence of Dr Hackett-Jones who gave evidence that the redaction and removal of information need not be a manual process but could be completed easily, by a junior staff member and would take less than 30 minutes to program. The Applicant contended that such a process was consistent with the Respondent’s obligation pursuant to s 53(2) and (3) of the GIPA Act.

41. With respect to the Applicant’s submissions related to s 53(5) which states:

An agency is not required to undertake any search for information that would require an unreasonable and substantial diversion of the agency’s resources.

42. The Applicant pointed out that the Notice of Decision refers to “significant and substantial diversion of an agency’s resources” whereas the GIPA Act refers to “unreasonable and substantial diversion of the agency’s resources.” The Applicant urged the Tribunal to reject that the searches would be unreasonable.

43. Lastly, the Applicant contended that Division 6 of the GIPA Act (and specifically ss 72 and 75 as relied upon by the Respondent) related to how access is provided. The Applicant submits that the reliance on these provisions was misconceived because:

1. The Applicant has not requested any particular form of access;

2. The sections are limited to consideration of the method of access, not whether access is granted at all;

3. In any case, the expert evidence relied upon by the Applicant supports that access can be granted simply and easily; and

4. With specific reference to s 75:

1. The Applicant disputed that the discretion to create a new document under s 75 was not a reviewable decision under s 80; and

2. Redaction of irrelevant information, no matter how it is performed, cannot make a document a “new record” noting that if such an interpretation was correct, an agency could deny production if any deletion or redaction was required.

Legislation

44. The object of the GIPA Act as set out in s 3 is to open government to the public. This is done by authorising and encouraging the proactive release of information by agencies and by giving members of the public an enforceable right to access government information. Access to government information is to be restricted only when there is an overriding public interest against disclosure

45. An "access application" means "an application for access to government information under Part 4 that is a valid application under that Part": GIPA Act, s 4(1).

46. "Government information" is "information contained in a record held by an agency": GIPA Act, s 4(1). A "record" means "any document or other source of information compiled, recorded or stored in written form or by electronic process, or in any other manner or by any other means": GIPA Act, Sch. 4, cl. 10.

47. Where the GIPA Act refers to "government information" that is "held" by an agency, this "includes a reference to information contained in a record held by the agency": GIPA Act, Sch 4, cl 12(1)(a).

48. Section 53 of the GIPA Act sets out the obligations of agencies to undertake searches for information held by the agency. Relevantly, s 53(1) limits the agency's obligation to provide access to "government information" to "information held by the agency when the application" is received. Agencies are to undertake searches "using the most efficient means reasonably available": s 53(2).

49. Section 58 of the GIPA Act sets out various ways in which an agency can decide an access application including by:

1. Deciding that the information is not held by the agency: s 58(1)(b);

2. Deciding that the information is already available to the applicant: s 58(1)(c). Section 59(1)(e) provides that information is already available to an applicant in certain prescribed circumstances, including where information is "publicly available on a website"

3. Deciding to refuse to provide access to the information because there is an overriding public interest against disclosure of the information: s 58(1)(d);

4. Deciding to refuse to deal with the access application: s 58(1)(e).

50. In respect of the refusal to deal with the access application, an agency may do this in accordance with the discretion conferred by s 60(1)(a) that dealing with the application would require an unreasonable and substantial diversion of resources.

51. Section 60, relevantly provides:

(1) An agency may refuse to deal with an access application (in whole or in part) for any of the following reasons (and for no other reason)--

(a) dealing with the application would require an unreasonable and substantial diversion of the agency's resources,

(b) …

(2) In deciding whether dealing with an application would require an unreasonable and substantial diversion of an agency's resources, the agency is not required to have regard to any extension by agreement between the applicant and the agency of the period within which the application is required to be decided.

(3) ...

(3A) In deciding whether dealing with an application would require an unreasonable and substantial diversion of an agency's resources, the agency may, without limitation, take into account the following considerations--

(a) the estimated volume of information involved in the request,

(b) the agency's size and resources,

(c) the decision period under section 57.

(3B) Any consideration under subsection (3A) must, on balance, outweigh--

(a) the general public interest in favour of the disclosure of government information, and

(b) the demonstrable importance of the information to the applicant, including whether the information--

(i) is personal information that relates to the applicant, or

(ii) could assist the applicant in exercising any rights under any Act or law.

52. With respect to the how access is to be provided, s 72(2) of the GIPA Act provides that an agency must provide access to information in the way requested by an applicant except, relevantly, where:

"(a) to do so would interfere unreasonably with the operations of the agency or would result in the agency incurring unreasonable additional costs, or

(b) to do so would be detrimental to the proper preservation of the record, or

(d) there is an overriding public interest against disclosure of the information in the way requested by the applicant.

53. Section 75 of the GIPA Act deals with providing access to information by creating a new record. Section 75(1) provides that an agency "is not prevented from providing access in response to an access application" by "making and providing access to a new record of that information". Section 75(2) confirms, however, that:

2) An agency’s obligation to provide access to government information in response to an access application does not require the agency to do any of the following—

(a) make a new record of information held by the agency,

(b) update or verify information held by the agency,

(c) create new information, or produce a new record of information, by deduction, inference or calculation from information held by the agency or by any other use or application of information held by the agency.

54. Section 80 prescribes those decisions that are "reviewable decisions" for the purposes of Part 5 of the GIPA Act. Relevantly, the following are reviewable decisions:

1. to refuse to provide access to information in response to an access application;

2. that government information is not held by the agency; and

3. that information is already available to the applicant.

55. The Tribunal has administrative review jurisdiction in relation to reviewable decisions under the GIPA Act: ss 30(1), (3) of the Civil and Administrative Tribunal Act 2013 (CAT Act); ss 7, 9, 65 of the Administrative Decisions Review Act 1997 (ADR Act).

56. In determining an application for an administrative review, the Tribunal is to decide what the correct and preferable decision is having regard to the material then before it, including any relevant factual material and "any applicable written or unwritten law": ADR Act, s 63(1).

57. The Respondent in these proceedings bears the burden of establishing that the decision under review is justified: GIPA Act, s 105(1).

58. In determining an application for administrative review, the Tribunal may decide to: affirm the decision; vary the decision; set aside the decision and make a decision in substitution for it; or set aside the decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal: ADR Act, s 63(3).

59. Where the Tribunal varies, or makes a decision in substitution for, the administrator's decision, then the Tribunal's decision is taken to be the decision of the administrator and to have had effect as the decision of the administrator on and from the date of the administrator's actual decision, unless the Tribunal orders otherwise: ADR Act, s 66(2).

Issues

Structure of consideration

60. There is considerable dispute as to the characterisation of the decisions that have been made and the relevant issues to be determined. As such, in considering this application, it is necessary to:

1. Determine the substance of the decisions the subject of this review

2. Consider the decisions the subject of this review in the context of the GIPA request

3. Consider what is the correct and preferable decision in respect of each decision.

The decisions the subject of this review

61. There is an obvious importance to ensuring that the decisions that have been made by an agency are properly identified for the purposes of a review. This is particularly true where an agency has refused to deal with an application pursuant to s 58(e) of the GIPA Act with reference to s 60 given that for an agency to decide to refuse to deal with an application pursuant to s 58(e), an agency must give the applicant a reasonable opportunity to amend the application prior to making that decision. It would be unfair to mischaracterise a decision to refuse to deal with an application as something else where the obligations of the agency and the rights of the applicant differ depending upon the character of the decision.

62. I accept the Respondent’s submissions that the decisions the subject of this review include:

1. The decision that the government information requested is not held by the Respondent; and

2. The decision that the information is already available as it is publicly available.

63. However, I do not accept the Respondent’s submissions in respect of the “decisions” made based upon Division 6 of the GIPA Act (and specifically ss 72 and 75 as relied upon by the Respondent). That Division relates to how access is provided and not whether the obligation arises or subsists. In this respect, the Respondent’s reliance on these provisions in the Notice of Decision, the Internal Review and in these proceedings was misconceived because:

1. The Applicant has not requested any particular form of access; and

2. The sections are limited to consideration of the method of access, not whether access is granted at all.

64. With specific reference to s 75 of the GIPA Act, this section does not create an exemption with respect to an agency’s obligation to comply with the GIPA Act where the agency otherwise possesses the information the subject of the GIPA information request. That section provides a discretion to create a new record to respond to the request but does not obligate an agency to create a new record if it can otherwise comply.

65. This interpretation is supported by the authorities cited by the Respondent. In those cases the agency did not hold information responding to the request (unlike this case for the reasons below). As for the authorities relied upon by the Respondent, I find that the authorities cited by the Applicant are distinguishable because each held that the agency did not hold information responding to the request (unlike this case for the reasons below). For example, in Redfern Legal Centre and Ooi, the information responding to the request would need to be compiled with reference to multiple “data marts” or by linking information from different systems. With respect to Evans, the information was held not to exist given that the request for the information asked that it be in a particular format when it was not.

66. In this way, those cases are consistent with the proposition that “s 75 refusals” are premised on the agency not holding the information at all.

67. Conversely, I find that the decision made by the Respondent which was made in the alternate to the decision that the government information requested is not held by the Respondent and the decision that the information is already available as it is publicly available was:

1. A decision to refuse to provide access to the personal, sensitive and health information contained in the information requested by the Applicant because there is an overriding public interest against disclosure of the information pursuant to s 58(d) of the GIPA Act.

68. I do not accept, as contended by the Respondent, that the decision to refuse to provide access to this information and the process of redacting or deleting that information had the effect of creating a “new record”. Whether the removal of such information is done electronically using bespoke software or manually, redaction is not a “new record”. Such a conclusion is consistent with s 74 of the GIPA Act which provides for deletion of information:

Deletion of information from copy of record to be accessed

An agency can delete information from a copy of a record to which access is to be provided in response to an access application (so as to provide access only to the other information that the record contains) either because the deleted information is not relevant to the information applied for or because (if the deleted information was applied for) the agency has decided to refuse to provide access to that information.

69. In any case, that decision is not subject to the review as it is not in dispute that such redaction is necessary given the character of the information the subject of the GIPA request. In this respect, I reject the Respondent’s contention that the Applicant’s acceptance of the Respondent’s decision to refuse access to individual’s personal and sensitive health information amounts to a request by the Applicant to access the information in a particular “form”.

70. However, as a result of the decision to refuse to provide identifying personal and sensitive information, the Respondent formed a view as to the time required to deal with the request and the following decision was also made:

1. A decision to otherwise refuse to deal with the application pursuant to s 58(e) of the GIPA Act with reference to s 60.

71. Accordingly, I reject the Respondent’s submissions that the reviewable decisions did not include a refusal to deal with the application. Properly construed and irrespective of the reference to s 75 of the GIPA Act in the Internal Review, the Respondent refused to deal with the application initially on the basis that it would require 409 hours to delete or redact the personal and sensitive information. In this hearing, the Respondent relies upon evidence that such redaction will take between 119 to 238 hours. The decision was made by the Respondent relying upon s 60(1)(a) that to provide the information to the Applicant in the context of the necessary redaction and deletion would be a “significant and substantial diversion of the Ministry’s resources” and, as such, an unreasonable and substantial diversion of the agency’s resources. I accept, as identified by the Applicant, that the Respondent did not use the word “unreasonable” as is stated in s 60(1)(a) however it is self-evident given the description of the steps necessary to redact the information, the resources required and the time it would take that this was the basis relied upon by the Respondent in respect of the refusal.

The decision that the information requested is not held by the Respondent and is already available to the Applicant as publicly available information

72. Item 4 of the Applicant’s GIPA request is as follows

For the whole time period available, the dataset including each day’s data, for each age group, used to display the graph titled “Causes from PCR and RAT tests by age group” seen at start="73">

Contrary to the submissions of the Respondent, I do not find any ambiguity with respect to the ambit of that request. It is self-evident that the Applicant is requesting the dataset used to display the DAC Graph for each age group in that graph. The dataset responding to that request are the URF Datasets transmitted to DAC from EDSB. Irrespective of whether this represents “raw data” that was then the subject of DAC’s analysis, logic or methodologies - the URF Datasets falls within this request and is information held by the Respondent.

I do not accept, as contended by the Respondent, that the reference to “age group” only captures data that has been aggregated in accordance with the aggregated age ranges in the DAC Graph. The un-aggregated data covers each of the “age groups” in that Graph being ages 0 to 90+ and falls within the request. The fact that it is more granular does not mean it does not fall within item 4.

This aggregated versus non-aggregated/raw data contention of the Respondent’s made in these proceedings does not appear to be the basis of the Information Not Held Decision as far as the Notice of Decision and Internal Review were concerned in any case. There was no distinction made in either of those decisions as between “raw data” and methodologies applied by DAC. Rather, the error appears to arise because the delegate of the Respondent assumed the obligation under the GIPA Act was per “branch” as opposed to per “agency” and was treating EDSB as a separate entity to that of the Ministry of Health. This explains the following statement in the Internal Review:

[EDSB] advised that the only information held by the Ministry is links to publicly available information which were provided to you in the initial determination, and they do not hold any further information or records within the scope of your internal review request.

I am satisfied that the [EDSB] of Health Protection NSW is the appropriate branch which would possess the information you have requested in your internal review

76. However, I also do not accept the Applicant’s alternate submission that data obtained from the NCIMS system as it currently stands being the subject of the Applicant’s expert evidence, would produce information responsive to this request. For such information to be responsive, the Applicant’s request would need to be amended. This is because the data now held within the NCIMS would not produce figures used by the DAC to produce the DAC Graph and item 4 is referrable to the dataset utilised for the creation of that graph. I accept the evidence relied upon by the Respondent in this respect.

77. Lastly with respect to the claim that the information responsive to the request is already in the public domain and is available, I reject this contention. The information to which the Respondent refers is weekly information, not daily and aggregates 0 to 19 age groups so that the data for each age group cannot be discerned which is an express part of the information requested.

78. I therefore reject the Respondent’s submissions that the Respondent does not hold the information requested and the decision that the information is already available because it is publicly available.

The decision to otherwise refuse to deal with the application pursuant to s 58(e) of the GIPA Act with reference to s 60(1)(a).

Factors relevant

79. In Dibb v Transport for NSW [2022] NSWCATAD 398, Senior Member Mulvey summarised the factors relevant to a review of a refusal to deal pursuant to s 58(e) of the GIPA Act:

The burden is upon the Respondent of establishing the Decision is justified s 105(1) of the GIPA Act.

In Commission of Police v Danis [2017] NSWCATAP 7, the Tribunal said:

[49] In our view, the Tribunal when reviewing decision to invoke a s 60(1) should examine the matter, at least in part, by reference to systemic considerations such as the role provisions of this kind play in promoting the efficient administration of the GIPA Act, and the avoidance of wasteful deployment of limited resources. In the case of decisions founded on s 60(1)(d), the restrictions that apply to party use of subpoenaed material might be relevant, as well agency considerations in relation to respect for court orders. This is not intended to be an exhaustive statement of the matters to be taken into account in any particular case. We accept that there may be factors of a personal kind, related to the particular application and the access applicant’s personal circumstances, that may also be relevant.

In Feeney v Secretary, Department of Communities and Justice [2020] NSWCATAD 269, the Tribunal said:

[95] There are many provisions of the GIPA Act which seek to limit access to government information, and whilst s 3(1)(c) provides an out for withholding information on the basis of its content, s 3(2) uses the language ‘as far as possible’ when referring to the exercise of discretions under the GIPA Act.

[96] As I have previously observed the purpose of the statute was to progress the matter beyond the limitations of the former Freedom of Information Act but not in every instance. Whilst the discretion remains with the agency, it must exercise the discretion consistent with the objects and the purpose of the statute as a whole, as well as the specific provision. This includes having regard to the available evidence when deciding to exercise a discretion.

While the systemic consideration is Danis continue to be relevant to s 60(1)(a) of the GIPA Act, the discretion is to be exercised according to the statutory tests in ss 60(3A) and 60(3B).

As submitted by the Information Commission, which I accept “The discretion in s 60(1)(a) may only be claimed on the basis of the s 58(1)(e) decision, and justified on review under s 105(1) of the GIPA Act, if the considerations are demonstrated to outweigh the consideration in s 60(3B).”

In Ruyters v Commissioner of Police [2020] NSWCATAD 223 at [24], SM Ransome said, which I also adopt:

34 The tasks to be undertaken in considering whether dealing with an application would require an unreasonable and substantial diversion of the agency’s resources are to identify and take into account any matters falling within s 60(3A) and then to determine whether, on balance, those matters outweigh the factors set out in s 60(3B). It is only where the matters in s 60(3A) outweigh those in s 60(3B) that an agency can refuse to deal with an access application on the basis that it would require an unreasonable and substantial diversion of an agency’s resources.

80. The GIPA Act's objective of public access requires the s 60(1)(a) discretion to consider matters directly concerned with the nature of the information sought. This is both generally, according to the "general public interest in favour of the disclosure of government information" (s 60(3A)(a)); and specifically, according to the "demonstrable importance of the information to the applicant" (s 60(3B)(b)). The factors to be considered pursuant to s 60(3A) is the estimated volume of information involved in the applicant’s request, the agency's size and resources, and the decision period under section 57 of the GIPA Act.

81. However, as identified above, a pre-requisite to an agency’s ability to decide to refuse to deal with an application is to give to the applicant a reasonable opportunity to amend the application. Section 60(4) of the GIPA Act states:

Before refusing to deal with an access application because dealing with it would require an unreasonable and substantial diversion of an agency’s resources, the agency must give the applicant a reasonable opportunity to amend the application. The period within which the application is required to be decided stops running while the applicant is being given an opportunity to amend the application.

82. There is no evidence before me that the Respondent gave the Applicant this opportunity prior to refusing to deal with its application. This is unsurprising given that the Applicant characterised its decision as something other than a refusal to deal with the application (which for the reasons above was incorrect) and in respect of which that obligation of notice and right of amendment is not afforded.

83. In any case, as the Applicant did not comply with s 60(4) of the GIPA Act, it did not have the power to refuse to deal with the application. Nor did the Applicant have the opportunity of amending its application.

84. In this respect, on the evidence and submissions before me, that opportunity created at least a possibility that the issues as between the parties could have been resolved. It is not disputed that certain searches could be performed on the NCMIS system that would be easy to perform and produce a quick result, contain information that meets the Applicant’s purposes while removing the personal and sensitive health identifying information. While I have found that the resulting information would not be responsive to the Applicant’s current request (for the reasons above), that conclusion may be different if the application is amended considering the Respondent’s concerns regarding time and resources to deal with the Applicant’s current request. This observation does not fetter the Respondent’s discretion with regard to any future decision based upon an amended application. Any amendment to the application proposed by the Applicant will need to be considered on its merits.

85. However, for present purposes, pursuant to s 63 of the Administrative Decisions Review Act 1997, this Tribunal must decide what the correct and preferable decision is having regard to the material before it . For this purpose, the Tribunal may exercise all of the functions that are conferred or imposed by any relevant legislation on the administrator who made the decision.

86. In determining an application, the Tribunal may decide, inter alia, to set aside the administratively reviewable decision and remit the matter for reconsideration by the administrator in accordance with any directions or recommendations of the Tribunal.

87. Based upon the materials before me, the correct and preferable decision is to set aside the decisions and remit the matter for reconsideration. In respect of the remittance, the Applicant is to be given a reasonable opportunity to amend his application pursuant to s 60(4) of the GIPA Act.

88. I so find.

Orders

89. The orders are:

1. Set aside the decisions and remit the matter for reconsideration.

2. With respect to the reconsideration, the Applicant is to be given a reasonable opportunity to amend his application pursuant to s 60(4) of the Government Information (Public Access) Act 2009.

**********

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales.

Registrar

Decision last updated: 07 November 2023