Ridley and Chief Executive Officer, National Disability Insurance Agency (Freedom of information) - [2023] AATA 2956

Ridley and Chief Executive Officer, National Disability Insurance Agency (Freedom of information) [2023] AATA 2956 (11 September 2023)
Division:FREEDOM OF INFORMATION DIVISION
File Numbers: 2022/4290 and 2022/4295
Re:Mr Tony Ridley
APPLICANT

AndChief Executive Officer, National Disability Insurance Agency
RESPONDENT

DECISION
Tribunal:A G Melick AO SC, Deputy President
Date:11 September 2023
Place:Melbourne

For the reasons given orally at the hearing, the Tribunal affirms the decisions under review in matters 2022/4290 and 2022/4295.
..............[sgn]..........................................................
A G Melick AO SC, Deputy President
CATCHWORDS
FREEDOM OF INFORMATION – whether practical refusal reason exists – whether requests may be treated as a single request – whether adequate searches for documents undertaken – public interest conditional exemptions – whether disclosure would have a substantial adverse effect on the proper and efficient conduct of the operations of an agency – whether documents subject to legal professional privilege – decisions affirmed
LEGISLATION
Freedom of Information Act 1982 (Cth)
National Disability Insurance Scheme Act 2013 (Cth)
CASES
Langer and Telstra Corporation [2002] AATA 341
‘QO’ and Department of Human Services (Freedom of information) [2019] AICmr 46
VMQD and Commissioner of Taxation [2018] AATA 4619
‘WA’, ‘WB’ and Australian Human Rights Commission (Freedom of information) [2020] AICmr 58
SECONDARY MATERIALS
Australian Information Commissioner (FOI guidelines)
National Disability Insurance Scheme Rules
REASONS FOR DECISION
A G Melick AO SC, Deputy President

This matter originally concerned eight separate Freedom of Information requests as set out in the table at pages 1-2 of the Respondent’s Statement of Facts, Issues and Contentions.
On 28 May 2022 the Applicant lodged an application with the Tribunal pursuant to section 57A(1)(b) of the Freedom of Information Act 1982 (FOI Act). The Applicant sought review of a decision made by the Respondent following a decision of the Information Commissioner on 19 May 2022, made under section54W(b) of the FOI Act, not to undertake an Information Commissioner review, the effect of which was to allow the applicant to apply directly to the Tribunal, which he has done.
There was a substantial narrowing of the issues before the matter came to the Tribunal and throughout the course of the hearing. During the hearing, matters 2, 3, 4, 7 and 8 were resolved and are no longer before the Tribunal, leaving matters 1 and 6 for determination in this decision.
The matter was heard on 2, 3 and 4 May 2023. The Respondent was represented by Mr Justin Davidson of the Australian Government Solicitor and the Applicant appeared for himself.
The Applicant did not lead evidence as such, but did cross examine witnesses called by the Respondent: Employee 1, who tendered two affidavits, and Employee 12 who tendered one.[1]
[1] Exhibits 2, 4, 5.
BACKGROUND TO THE DOCUMENTS
The Respondent, who is the Chief Executive Officer (CEO) of the National Disability Insurance Agency (NDIA), is the Principal Officer of the NDIA, which is an agency for the purpose of the FOI Act.
The NDIA has independent statutory authority with responsibility for implementing the National Disability Insurance Scheme (NDIS). The NDIS provides funding for support and service to Australians who have permanent significant disabilities. The National Disability Insurance Scheme Act 2013 (NDIS Act) outlines the legislative requirements underpinning the scheme with some specific requirements including a suite of rules: the ‘National Disability Insurance Scheme Rules’.
The background of the Applicant’s employment was set out in the affidavit of Employee 1,[2] but I note he was a former labour-hire staff member who would have worked as a risk officer. His contract with the employer was terminated in 2021. The Applicant indicated that he was actually Assistant Director Operational Risk and submitted that the job description was not updated, and report lines were not updated from time to time. The Tribunal accepts this submission.
[2] Exhibit 5.
Matter 1
This request related to emails that are about, relate to, contain information, reference or mention Tony Ridley directly or indirectly. This includes any and all attachments that are about, relate to, contain information, reference or mention Tony Ridley:
·to/from Employee 10, Employee 2, Employee 3, Employee 9, Employee 4, Employee 5, Employee 6 and Employee 13 from the period of 1 January 2021 up to and including 7 June 2021;
·to/from Employee 7 from the period of 20 May 2020 up to and including 22 July 2020; and
·to or from Employee 10 from the period of 31 July 2020 up to and including 22 September 2020.
In short, any email correspondence relating to Tony Ridley or “Tony”, which relates to Tony Ridley and not others, with the same first name.
Matter 1 relates to practical refusal. It concerned a decision made under section 24(1) of the FOI Act to refuse a request for documents on the basis that a practical refusal reason under section 24AA(1)(a)(i) exists. That is, that the work involved in processing the request would substantively and unreasonably divert the resources of the agency from other operations.
Section 24AA(1)(a)(i) reads as follows:
(1) For the purposes of section 24, a practical refusal reason exists in relation to a request for a document if either (or both) of the following applies:
(a) the work involved in processing the request:
(i) in the case of an agency--would substantially and unreasonably divert the resources of the agency from its other operations;
Section 24 of the FOI Act provides a power to refuse a request. The Respondent bears the onus of satisfying the Tribunal that access should be refused, which is set out in section 61 of the FOI Act.
Section 24(1)(a) of the FOI Act requires the Respondent to undertake a consultation process before making a practical refusal decision. I accept, as set out in the affidavit of Employee 12 and as noted at T8, that the Applicant was notified that a practical refusal reason existed and was given the opportunity to revise the scope of the requests. The Applicant firstly objected to consolidating the request and did not agree to the revision of the scope. He submitted that a decision was imposed upon him and therefore there was no consultation.
However, when I look at section 24AB of the FOI Act, it says:
(2) The agency or Minister must give the applicant a written notice stating the following:
(a)an intention to refuse access to a document in accordance with a request;
(b)the practical refusal reason;
(c)the name of an officer of the agency or member or staff of the agency [sic] (the contact person) with whom the applicant may consult during a period;
(d)details of how the applicant may contact the contact person;
(e)and the period (the consultation period) during which the applicant may consult with the contact person is 14 days after the day the applicant is given the notice.
This section sets out what is a request consultation process for the purposes of section 24, being ‘14 days after the day the Applicant is given the notice’.
I am satisfied that the evidence given by Employee 12 at Exhibit 2, the processes set out under section 24AB of the FOI Act were followed and therefore that the consultation process had been undertaken.
Section 24AA, as set out below, also states that when a practical refusal reason exists, and there are several sections, and one has to read both the FOI Act and the FOI guidelines as well as some relevant case law to understand the full impact.
(1) For the purposes of section 24, a practical refusal reason exists in relation to a request for a document if either (or both) of the following applies.
(a) the work involved in processing the request:
(i) in the case of an agency--would substantially and unreasonably divert the resources of the agency from its other operations; or
(ii) in the case of a Minister--would substantially and unreasonably interfere with the performance of the Minister's functions;
(b) the request does not satisfy the requirement in paragraph 15(2)(b) (identification of documents).
(2) Subject to subsection (3), but without limiting the matters to which the agency or Minister may have regard, in deciding whether a practical refusal reason exists, the agency or Minister must have regard to the resources that would have to be used for the following:
(a) identifying, locating or collating the documents within the filing system of the agency, or the office of the Minister;
(b) deciding whether to grant, refuse or defer access to a document to which the request relates, or to grant access to an edited copy of such a document, including resources that would have to be used for:
(i) examining the document; or
(ii) consulting with any person or body in relation to the request;
(c) making a copy, or an edited copy, of the document;
(d) notifying any interim or final decision on the request.
(3) In deciding whether a practical refusal reason exists, an agency or Minister must not have regard to:
(a) any reasons that the applicant gives for requesting access; or
(b) the agency's or Minister's belief as to what the applicant's reasons are for requesting access; or
(c) any maximum amount, specified in the regulations, payable as a charge for processing a request of that kind.
As noted by the Respondent in their submission, which I accept as being correct, a practical refusal reason exists if the work involved in processing a request would substantially and unreasonably divert the resources of the agency for from its other operations. This is to be assessed based on the agency’s ability to deploy its resources efficiently and pursue its principal statutory objectives and obligations. And that appears at paragraph 87 of VMQD and Commissioner of Taxation, set out below (emphasis added):[3]
The ATO is of course, a large and well-resourced agency and cannot claim that it lacks capacity, nevertheless the Act is based upon it being able to deploy its resources efficiently in pursuit of its principal statutory objectives and obligations.
[3] [2018] AATA 4619.
Section 93 of the FOI Act obliges the Tribunal to have regard to the guidelines issued by the Australian Information Commissioner (FOI guidelines). Those guidelines provide guidance in the following terms for the purposes of assessing, sampling or determining a practical refusal reason. Section 93 reads as follows:
(1) This section applies to:
(a) an agency, in relation to documents of the agency; and
(b) each Minister, in relation to his or her official documents.
(2) The agency or Minister must give to the Information Commissioner the information that the Information Commissioner requires to prepare reports mentioned in section 30 of the Australian Information Commissioner Act 2010(3) The agency or Minister must comply with any requirements prescribed by the regulations regarding:
(a) the giving of the information; and
(b) the keeping of records for the purposes of this section.
Guidelines 3.119, 3.120 and 3.121 read as follows:
3.119 Whether a practical refusal reason exists will be a question of fact in the individual case. Bearing in mind the range of matters that must and can be considered, it is not possible to specify an indicative number of hours of processing time that would constitute a practical refusal reason. Agencies should not adopt a ‘ceiling’ in relation to processing times; for example, deciding that a practical refusal reason exists once the estimated processing time exceeds 40 hours. Rather, each case should be assessed on its own merits, and the findings in individual AAT and IC review decisions which discuss estimated processing times should be viewed in that light.
3.120 It is nevertheless expected that an agency or minister will provide a breakdown of the time estimated for each stage in processing a request. As discussed in Part 4 of the Guidelines, a commonly used tool for estimating processing time is a ‘charges calculator’. Some versions of charges calculators contain a number of predetermined parameters based on assumptions as to how long an FOI request should take to process. Agencies should be mindful that the use of a ‘charges calculator’ with these predetermined parameters only provides a rough estimate of how long FOI decision-making will take and is not suitable for estimating the processing time for the purposes of practical refusal decision.
3.121 An estimate of processing time is only one consideration to be taken into account when deciding whether a practical refusal reason exists. It is recommended that agencies examine a sample of the documents to assess the complexity of the material against whether the work involved in processing the request would constitute a substantial and unreasonable diversion of resources from the agency’s other operations. A representative sample of between 10 to 15% of the documents within the scope of the request has been considered to be an appropriate sample size for the purposes of calculating processing time when deciding whether a practical refusal reason exists. A person with appropriate knowledge or expertise should assess the sample of the documents, looking at each document as if they were making a decision on access, including indicating the number of documents that could be released in an edited form. The assessment of the sample would provide an indication of the complexity of the potential decision, that is, the number of exemptions required, the topic and content of the documents, and the number of consultations required and effort required to contact third parties based on available contact details.
In the matter of Langer and Telstra Corporation at paragraph [47], the then Deputy President Forgie concluded that section 24, which was a similar provision to the current section 24AAA ‘required only that the diversion of the resources of the agency be real or of substance rather than at large’.[4]
[4] [2002] AATA 341.
The Information Commissioner has accepted that between 30 seconds and five minutes per page is a reasonable estimate of a time required for an agency to assess and edit documents that form the scope of the request. This is set out at paragraph 55 of ‘QO’ and Department of Human Services (Freedom of Information) which reads as follows:[5]
In previous IC review decisions, it has generally been accepted that between 30 seconds per page, to 5 minutes per page is a reasonable estimate of the time required for an agency to assess and edit documents, except where the documents contain a substantial amount of sensitive information. Generally, where it has been accepted that an estimate at the higher end of that range is reasonable, the documents at issue have been complex or sensitive.
[5] [2019] AICmr 46.
I refer again to VMQD and Commissioner of Taxation where Senior Member Puplick found that what constitutes a valid practical refusal ground is agency-specific and resource-dependent. However, he found that a burden in excess of 200 hours would almost certainly meet the threshold of a rational objective test. Also noted at paragraph [5] of that decision is the fact that the Information Commissioner has repeatedly determined a processing time in excess of 70 hours amounts to a substantial use of resources.
One also has to consider what would be a reasonable sample size to try to estimate the amount of time necessary to consider or deal with the information requested and in ‘WA’, ‘WB’ and Australian Human Rights Commissioner,[6] the Information Commissioner found a sample size of 82 of over 2000 electronic complaint files were a large representative that justified the estimate for search and retrieval.
[6] [2020] AICmr 58.
I note from the information provided at paragraphs 34 to 64 of the affidavit of Employee 12 that the agency assessed the work involved would require 292 hours.[7] The Applicant, to the contrary, contended in effect that the people carrying out the searches had not done it in the most efficient manner and I note in the Applicant’s Statement of Facts, Issues and Contentions (ASFIC) that the NDIS FOI department processing assurance appear to have been a matter of concern for some time, including his own risk analysis advice to the FOI Branch Manager. He stated in his contentions:[8]
The NDIS FOI department is not staffed by lawyers, nor is an FOI request predominantly managed by individuals with legal experience or qualifications. The document search and request procedures are vastly inconsistent, for example, (a) A document search for an artefact known to the individuals (Employee 8), was located on a local drive (C: Drive) within 2 minutes. …(b) In contrast, a document commissioned by a known to the individual, Stuart Fisher, Branch Manager Risk Advisory, could not be found on the first attempt claiming thousands of possible matches and hours of search time required.
[7] Exhibit 2.
[8] ASFIC, at [17].
The Applicant referred to an email by Employee 10 which read ‘could I please ask that all copies be destroyed?’. He then submitted that the search practices guidelines within the NDIA are extremely rudimentary and grossly inefficient.[9] As a result, searches often returned similarly large examples and false behaviours were associated with the key terms and documentation. He then set out an example which shows by narrowing the search criteria, hits can be reduced from 4,060,000 to just 764,000.
[9] ASFIC, at [18].
I note the Applicant, who is obviously highly intelligent, understands these systems extremely well, but there is no direct evidence before me other than the Applicant’s submissions. He also noted that children are taught more effective and refined search techniques such as the fundamentals of Boolean Operators and that by comparison, the NDIA appear to be unaware and unskilled in more practical professional search practices, distorting and overstating, leaving the simplest searches with constrained data sets. As a result, it remains highly improbable that search volume declarations by NDIA are remotely accurate or reliable.[10]
[10] ASFIC, at [19].
Some of these matters were put in cross-examination to Employee 12 but she was not in a position to agree with the Applicant and I accept that in relation to some of the detailed matters put to her by the Applicant, she did not have sufficient expertise to be able to respond in an appropriate manner.
The Applicant then continued to submit that FOI search results routinely fail to engage, or deliberately avoid asking the recipient who copied addresses on emails, preferring to search data files aimlessly, guided by incomplete or undocumented processes and approvals. He then gave some examples. He then submitted, ‘the submissions and affidavit of ‘lay witnesses’ representing the NDIA’ remain ‘largely unrelated to my request’.[11] However, the layperson observations and anecdotal narratives include a third-party hearsay, lack specific research evidence or context in the regards to security, privacy and risk to individuals being named.
[11] ASFIC, at [21].
The Applicant also submitted that considerable duplication occurred when emails were converted from an email form to a PDF format. The Tribunal does not have any evidence of this before it, although a document was put to Employee 12 that showed that emails were recovered in a PDF format. However, when Employee 12 carried out a second search, bearing in mind that there seemed to be some evidence that suggests the first search was not carried out in the best way possible, she eventually turned up the same number of hits, that was 5,820, as did the combined efforts of the first search or the first two searches. I note the first search found 4,000-odd documents and there were additional items found which made up a total of 5,820. Employee 12 then did a check search, being the senior member of the team and came up with the same number as the previous search, that is 5,820 plus one, being able to recover a further item because a person’s email address had been incorrectly entered. I refer specifically to paragraphs 35 to 45 of Exhibit 2.

The Applicant submitted that if further procedures had been followed, the time taken would be less, but provided no direct evidence in relation to that. He also provided no evidence as to what methods should have been used, although he did make submissions he relied upon the narrowing of the scope set out in his ASFIC as I referred to above.
The document search and review format is set out at page 209 of Exhibit 1 and that was at T66. I am not satisfied one way or the other as to whether or not this form was used, but I regard the use of the form as a tool, not an obligation. I am not satisfied that its use would have produced a different result. I note that when I regard the use of the tool not as an obligation, I take into account the Applicant’s referral to the FOI Induction Training Manual, especially at 4.6, which sets out that when searching for documents, documents are often located from the following sources: NDIA email server, network drives (share point), HPRM, PDMS plus, a participant CRM file (for personal matters), through consultation with line areas. Where documents exist on CRM, the CRM training guide should be referred to for guidance in saving documents. Line areas may be consulted using appropriate email template where a request seeks to access documents not uploaded to CRM, or where advice is sought regarding exemptions. Consultations must be in writing using appropriate templates and must provide a specified date for the return of documents and advice.
One thing that seems to arise is that it may be possible that (if I accept the Applicant’s submissions that the searches were carried out inappropriately), there are two things that may flow from this: that it was possible the search at times may have been limited, or the number of documents recovered may have been reduced as per the Applicant’s submissions. As I have already noted, I am not satisfied as to that, especially bearing in mind that after three searches, a combination of the first two and the third search, the same number of documents were recovered.
I also note that the Applicant had the opportunity to raise these matters at the consultation process, which he failed to do when he did not effectively engage in the process. I was not satisfied by the Applicant’s submissions, nor did he raise any direct evidence of what further reasonable steps the agency should have conducted and therefore, I am satisfied that all reasonable steps have been taken to find the relevant documents. I say that in relation to the comment the Applicant made, that some of the documents may have been destroyed.
The Applicant complained that the documents or the requests should not have been combined together, but section 24(2) of the FOI Act provides that an agency may treat two or more requests as a single request if it’s satisfied that the request relates to the same document or documents, or the requests relate to documents the subject matter of which is substantially the same.
Section 24(2) reads as follows:
(2) For the purposes of this section, the agency or Minister may treat 2 or more requests as a single request if the agency or Minister is satisfied that:
(a) the requests relate to the same document or documents; or
(b) the requests relate to documents, the subject matter of which is substantially the same.
The FOI guidelines also consider section 24(2) of the FOI Act, 3.123 of the guideline states:
Multiple requests can only be combined as a single request under section 24(2) if there is a clear connection between the subject matter of the requested documents. Straightforward examples where one request is for folios 1 – 100 of a file, another request for folios for 101 – 200 of the same file. Where three requests relate to three different chapters of one report.
The Explanatory Memorandum also states and supports that view when dealing with multiple requests ‘the new provisions are intended to have the same scope as existing section 24, with the qualification that new section 24 may be invoked for the purpose of two or more applications seeking access to the same documents, or the documents were the subject matter are substantially the same’.[12]
[12] Revised Explanatory Memorandum, Freedom of Information Amendment (Reform) Bill 2010, at [56]-[57].
When I look at these documents, they all relate to copies of any and all emails from or to a named individual, in one set of documents, from the period of 1 January 2021 and up to and including 7 June 2021, although two requests in respect of Employee 9 and Employee 10 where the period specified was 31 July 2020 and 22 September 2020, and one request in relation to Employee 11, where the period specifies 20 May 2020 to 22 July 2020. I also note that all of the email requests are about, relate to, or contain information relating to Tony Ridley in a direct or indirect manner because they refer to any email correspondence related to ‘Tony Ridley’ or ‘Tony’. All the requests were lodged on the same day and I find there is a clear nexus between the subject matter of each individual request as they all seek emails where the Applicant is referred to in some manner and also adopt very similar wording.
In relation to the reasonable request, I accept the estimates of time given by Employee 12 and I consider such an amount of time to be in excess of what is reasonable and therefore I uphold the determination in relation to Matter 1.
Matter 6
Matter 6 relates to or is covered by section 47E(d) of the FOI Act ‘Public interest conditional exemptions – certain operations of agencies’. The section outlines that a document is conditionally exempt if its disclosure under this Act could reasonably expect it to ‘have a substantial adverse effect of the proper efficient conduct of the operation of an agency’.
I note the Applicant submitted that he was one of the authors of this document and therefore there is no reason why it could not be released. The problem I have to consider in this matter is that the Act generally assumes that if released, the document would be at large and possibly released to members of the public.
Pursuant to section 64 of the FOI Act, I had to assess the documents, but the Applicant was not given the opportunity to see them. I accept, having seen the documents that the details given by Employee 1 are correct, in that the documents contain significant detail about the Agency’s ICT, including detailed processes and specifics around types of controls NDIA has in place regarding validation of payment claims, sensitive detail regarding the development and implementation of PACE including the foundational cyber security principles the agency has used to develop the network in which the PACE sits. I also note the commentary by the Applicant and two other members of the Agency staff regarding reported concerns about PACE. Now, although the Applicant did not give evidence, I am prepared to accept from his submissions that the environment may have changed and that the concerns raised by him and the co-authors of that document, if it is exactly the same document, are no longer relevant. It may no longer be relevant, however, having read the document, it sets out some serious concerns about the security of the information and information systems employed by the NDIA. I cannot be satisfied despite having looked at Exhibits 6, 7, and 8 that all of the matters contained in that report are in the public domain and even if they were, I further find that the release of those documents would damage public confidence in the scheme and of the NDIA more broadly. As it is, there are many reports these days about information security, matters being ransomed by organised criminals, that to release such a report or make such a report available runs a substantial risk of damaging the public confidence in the operation of the NDIA and I cannot be satisfied that it would not increase the risk of cyber-attack on the NDIA systems.
I note that Employee 1, at Exhibit 4 notes that the release of material that identifies the types of controls that the NDIS has in place regarding the validation of payment claims and reveals factors the agency considers to be of a relevant risk profile and can reasonably be expected to have a substantial adverse effect on the proper and efficient conduct of the operations of the agency and administration of the scheme. I do not recall it being put to Employee 1 that all that information was out in the public domain, but even if it was, I would not be satisfied it was appropriate to release the documents, particularly in relation to possible damage to public confidence in the Scheme.
For those reasons, I am satisfied the specified information is conditionally exempt under section 47E(d) of the FOI Act.
Having found that, I must consider the public interest test in section 11A(5) of the FOI Act which reads:
(5) The agency or Minister must give the person access to the document if it is conditionally exempt at a particular time unless (in the circumstances) access to the document at that time would, on balance, be contrary to the public interest.
The Applicant seems to be suggesting that disclosing the material regarding the development and problems with the PACE implementation will promote the object of the FOI Act to inform debate on matters of public importance, especially as it involves significant public expenditure.
I also note, as I previously have, that the Applicant submitted that much of this material if not all of it, is available to the public because of the articles and other matters in Exhibits 6, 7, and 8. However, I find that any factors that may be in favour for the disclosure of the problems of PACE, although in its previous form, would be outweighed by the potential harm which could be caused to the system, and more generally, the Agency.
I note that matters articulated by witnesses for the Respondent, to the effect that the material discloses controls and risk profiling used by the Agency, and that once those controls were disclosed the Agency would have to develop alternative means to mitigate the risk of fraud, and the compromising of controls in their payment schemes. The disclosure about problems with the Agency’s procedures could damage the reputation of the NDIA. I agree that embarrassment itself is not a public interest factor, but it is contrary to the public interest that people are unnecessarily discouraged from participating fully in the scheme, by reason of heightened concern about its operations.
I consider the loss of confidence of the public in the scheme in itself would be sufficient to outweigh any relevant factors in favour of disclosure and on top of that, as I have already indicated, I am not convinced at all of the problems with the scheme, or potential problems or vulnerabilities, are in the public domain. For both of those reasons, I determine that access to the item requested under Matter 6 would be contrary to the public interest.
For the reasons set out above, Matter 1, which is AAT 2022/4290, and Matter 6, which is AAT 2022/4295 are affirmed.

I certify that the above 52 (fifty-two) paragraphs are a true copy of the reasons for the decision herein of A G Melick AO SC, Deputy President

......[sgn]..................................................................
Associate
Dated: 11 September 2023

Date of hearing: 2, 3, 4 May 2023

Applicant: Mr Tony Ridley (self-represented)

Counsel for the Respondent: Mr Justin Davidson

Solicitors for the Respondent: Australian Government Solicitor

Date of hearing:	2, 3, 4 May 2023
Applicant:	Mr Tony Ridley (self-represented)
Counsel for the Respondent:	Mr Justin Davidson
Solicitors for the Respondent:	Australian Government Solicitor