Wilson AM and Office of the Australian Information Commissioner (Freedom of Information)

Wilson AM and Office of the Australian Information Commissioner (Freedom of Information) [2023] AATA 458 (21 March 2023)
Division:FREEDOM OF INFORMATION DIVISION
File Number: 2021/2280
Re:John Wilson AM
APPLICANT

AndOffice of the Australian Information Commissioner
RESPONDENT

DECISION
Tribunal:Deputy President Britten-Jones
Date:21 March 2023
Place:Melbourne

The decision of the Tribunal is to affirm the decision under review.
..........................[sgd].............................................
Deputy President Britten-Jones
Catchwords
FREEDOM OF INFORMATION – access sought to documents consisting of correspondence and transcripts of meetings relating to a privacy complaint made to the Australian Information Commissioner – whether documents are exempt from disclosure under s 47E(d) – whether documents are exempt from disclosure under s 47F – Respondent bears onus under s 61 – access would involve unreasonable disclosure of personal information – public interest against disclosure significantly outweighs the public interest factors in favour of disclosure – decision under review affirmed
Legislation
Administrative Appeals Tribunal Act 1975 (Cth)
Australian Information Commissioner Act 2010 (Cth)
Freedom of Information Act 1982 (Cth)
Privacy Act 1988 (Cth)
Cases
Fisse v Secretary, Department of Treasury (2008) 172 FCR 513
Kline v Official Secretary to the Governor-General [2013] HCA 52; (2013) 249 CLR 645
New South Wales v Ryan (1998) 101 LGERA 246
Re James and Australian National University (1984) 2 AAR 327
Searle Australia v Public Interest Advocacy Centre (1992) 36 FCR 111
Secondary Materials
Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, July 2019
Office of the Australian Information Commissioner, Freedom of Information Guidelines – Guidelines issued by the Australian Information Commissioner under s 93A of the Freedom of Information Act1982 (Cth), February 2022
Office of the Australian Information Commissioner, Privacy Regulatory Action Policy, December 2022
Office of the Australian Information Commissioner, Guide to Privacy Regulatory Action, January 2023
REASONS FOR DECISION
Deputy President Britten-Jones
21 March 2023
INTRODUCTION

In May 2020, Mr John Wilson AM (Applicant) made a request to the Office of the Australian Information Commissioner (Respondent) pursuant to the Freedom of Information Act 1982 (Cth) (FOI Act)[1] to access documents relating to a privacy complaint made to the Australian Information Commissioner.
[1] References to legislation are to the FOI Act unless otherwise stated.
On 22 June 2020, the Respondent refused to grant the Applicant access to the entirety of the documents on the basis that the documents were exempt in full under s 47E(d) (FOI decision).
The Applicant applied to the Information Commissioner for review of the FOI decision under s 54L.
On 22 January 2021, a Review Adviser (Legal) from the Respondent identified ‘a perceived conflict of interest in the Information Commissioner reviewing a decision made by her own agency’.[2] The conflict of interest arose from the regulatory functions of the Respondent, which include conducting inquiries and investigations under the Privacy Act 1988 (Cth) (Privacy Act) and reviewing decisions made by Ministers and agencies under the FOI Act.
[2] T-Documents at T8 p 45.
Following the identification of the conflict of interest, a delegate of the Information Commissioner declined to undertake a review of the decision under s 54W(b).
On 13 April 2021, the Applicant lodged an application for review in the Tribunal, seeking review of the FOI decision.[3] The Respondent contends that the documents are not only exempt under s 47E(d), but also s 47F. The Respondent has the onus under s 61 of establishing that the decision refusing access is justified.
[3] In the course of the review, some documents were removed from scope by agreement between the parties.
BACKGROUND
The Applicant is a respiratory physician who became a director and board member of the Royal Australasian College of Physicians (RACP) in 2018. In 2020, the Applicant was subsequently elected as President and the Chair of the RACP Board.
In November 2019, the Applicant became aware that Professor Leslie Bolitho had made a privacy complaint to the Respondent about the RACP. The Applicant was provided with a letter dated 25 October 2019 from the Respondent to the RACP, which enclosed a copy of the complaint.[4] The purpose of the letter was to seek the RACP’s response to the complaint and to schedule a conciliation teleconference to resolve the matter. The letter said that it was claimed that the RACP had interfered with the complainant’s privacy and that the Applicant, ‘a senior member of the RACP, and possibly other individuals… used the personal email addresses of 21,000 members of the RACP on two separate occasions’.[5]
[4] A copy of the Respondent’s letter dated 25 October 2019 is marked ‘JWW-3’ and annexed to the affidavit of the Applicant sworn 12 May 2022.
[5] Ibid.
In his affidavit, the Applicant referred to the letter and deposed further as follows:
[21] The alleged factual basis of the Privacy Complaint is totally false and I have always denied it.
[22] In or around February 2020, I was informed by the RACP’s Chief Executive Officer during an RACP Board meeting that a conciliation conference between the RACP and Professor Bolitho had been scheduled. During the course of the investigation, I was kept informed of what was occurring, as part of my role as Board Member until May 2020, then as President and Chair of the Board of the RACP until the present. I was also given access to communications with the Respondent and the OAIC as part of board papers, which, given the manner in which they were provided to me, I have not exhibited to this affidavit.
[23] I was not invited or directed to participate in the investigation or any conference conducted by the Respondent, even though I was clearly able, and clearly a person who was to provide information relevant to the matter to which the Privacy Complaint related, given the nature of the Privacy Complaint and the specific allegations against me that formed the basis of the alleged privacy breach.
[24] In or around April 2020, I was made aware that the Respondent had decided to exercise a discretion under section 41(1) of the Privacy Act 1988 (Cth) not to further investigate the Privacy Complaint, and the Privacy Complaint was finalized.
[25] At no point during the Respondent’s investigation of the Privacy Complaint was I invited by the Respondent to comment on the allegations made, to provide any information in answer of the allegations, or otherwise participate in the investigation. If I had been given the opportunity to comment and participate, I would have done so.
The Applicant’s knowledge of the privacy complaint is largely consistent with that of Mr David Stevens, who holds the position of Assistant Commissioner with the Respondent. Mr Stevens deposed in his affidavit of 11 February 2022 that:
(a)the complaint was made to the Respondent in August 2019;
(b)the respondent to the complaint was the RACP;
(c)the Applicant was not a party to the privacy complaint and was not involved in the complaint process, but a number of the documents in issue contain information about the Applicant; and
(d)the complaint was finalised on 28 April 2020.
The documents requested by the Applicant under the FOI Act are as follows:
(a)any correspondence from Drs Bolitho, O’Donnell, Lane, Beck or other parties relating to the alleged use of email addresses;
(b)any correspondence to these parties or others in relation to the matter;
(c)any opinions obtained from advisors in relation to the matter; and
(d)a transcript of any meetings in relation to the matter, including the meeting held on 21 January 2020.
The Respondent identified 139 documents within the scope of the request but refused access to them under s 47E(d). The documents in issue are contained in a privacy complaint investigation file held by the Respondent. The initial complaint was made under s 36 of the Privacy Act by Professor Bolitho against the RACP.[6]
[6] Applicant’s Statement of Facts, Issues and Contentions dated 28 April 2022.
Pursuant to s 60AA, by letters dated 4 January 2022, the Respondent notified ten affected third parties of the application for review. In response, Mr Muir, Dr Yelland, Professor Way and Ms Vandersluys indicated they had no objection to documents being provided to the Applicant.[7] The Respondent has given access to information in documents relating to these persons who had no objection. There were four persons who responded to the notice advising that they did object.
[7] Supplementary T Documents, at T21, T22 and T24.
On 21 April 2022, by consent of the parties, the decision refusing access to the documents was altered under s 26(1)(b) of the Administrative Appeals Tribunal Act 1975 (Cth), and documents in a redacted form were released to the Applicant.
The Applicant deposes in his affidavit that he seeks access to the documents because the privacy complaint contained allegations against him which were totally false, and which impugn his character and reputation in his profession. He wants to understand the accusations made against him and to correct them. The Applicant relies upon ‘open correspondence sent to the RACP in the form of the Complaint Letter, signed by Dr Yelland and Professors Talley, Bolitho and Kolbe on 20 August 2018’,[8] in which they expressed their concern about the same conduct of the Applicant which was later the subject of the privacy complaint. The Applicant believes that the information contained in the documents in issue includes his personal information and openly expressed opinions about him, which he is entitled to know and correct.[9]
LEGISLATIVE SCHEME
[8] Applicant’s affidavit dated 12 May 2022 [40].
[9] Ibid [34] to [42].
Freedom of Information Act
The High Court of Australia considered the legislative framework of the FOI Act in Kline v Official Secretary to the Governor-General:[10]
… The statutory scheme is complex in achieving a balance between the exposure of some government processes and activities to increased public participation and scrutiny, by making information freely available to persons on request, and exempting other government processes and activities from public participation and scrutiny, in order to secure a competing or conflicting public interest in non-disclosure…
[10] [2013] HCA 52; (2013) 249 CLR 645, 661 [37].
The general objects of the FOI Act are set out in s 3 as follows:
(1)The objects of this Act are to give the Australian community access to information held by the Government of the Commonwealth, by:
(a)requiring agencies to publish the information; and
(b)providing for a right of access to documents.
(2)The Parliament intends, by these objects, to promote Australia’s representative democracy by contributing towards the following:
(a)increasing public participation in Government processes, with a view to promoting better-informed decision-making;
(b)increasing scrutiny, discussion, comment and review of the Government’s activities.
(3)The Parliament also intends, by these objects, to increase recognition that information held by the Government is to be managed for public purposes, and is a national resource.
(4)The Parliament also intends that functions and powers given by this Act are to be performed and exercised, as far as possible, to facilitate and promote public access to information, promptly and at the lowest reasonable cost.
To promote the objects in s 3(1)(b), s 11 provides:
(1) Subject to this Act, every person has a legally enforceable right to obtain access in accordance with this Act to:
(a)a document of an agency, other than an exempt document; or
(b)an official document of a Minister, other than an exempt document.
Section 11A(3) provides that where a person makes a request in accordance with s 15(2) to an agency or Minister for access to a document and pays the required charge, the agency or Minister must give the person access to the document in accordance with the FOI Act ‘subject to this section’.
Section 11A(4) provides that the agency or Minister is not required to give the person access to the document if, at that time, the document is an exempt document.
Relevantly, an ‘exempt document’ is one that is exempt for the purposes of Part IV of the FOI Act and encompasses documents subject to claims governed by ss 47E(d) and 47F, otherwise known as public interest conditional exemptions.
If the documents are conditionally exempt, s 11A(5) provides that access must be given to them unless access at that time would, on balance, be contrary to the public interest.
Section 11B(3) provides:
Factors favouring access
(3) Factors favouring access to the document in the public interest include whether access to the document would do any of the following:
(a)promote the objects of this Act (including all the matters set out in sections 3 and 3A);
(b)inform debate on a matter of public importance;
(c)promote effective oversight of public expenditure;
(d)allow a person to access his or her own personal information.
Section 11B(4) sets out those factors, to which regard may not be had:
Irrelevant factors
(4) The following factors must not be taken into account in deciding whether access to the document would, on balance, be contrary to the public interest:
(a)access to the document could result in embarrassment to the Commonwealth Government, or cause a loss of confidence in the Commonwealth Government;
(b)access to the document could result in any person misinterpreting or misunderstanding the document;
(c)the author of the document was (or is) of high seniority in the agency to which the request for access to the document was made;
(d)access to the document could result in confusion or unnecessary debate.
Freedom of Information Guidelines: Public Interest
Section 93A requires the Tribunal to have regard to any guidelines issued by the Information Commissioner. Paragraph 6.5 of the Freedom of Information Guidelines (Guidelines)[11] sets out the general principles regarding what is in the public interest:
·something that is of serious concern or benefit to the public, not merely of individual interest;
·not something of interest to the public, but in the interest of the public;
·not a static concept, where it lies in a particular matter will often depend on a balancing of interests;
·necessarily broad and non-specific, and
·related to matters of common concern or relevance to all members of the public, or a substantial section of the public.
Footnotes omitted.
[11] Office of the Australian Information Commissioner, Freedom of Information Guidelines – Guidelines issued by the Australian Information Commissioner under s 93A of the Freedom of Information Act 1982 (Cth), February 2022.
Paragraph 6.6 of the Guidelines goes on to state that:
It is not necessary for a matter to be in the interest of the public as a whole. It may be sufficient that the matter is in the interest of a section of the public bounded by geography or another characteristic that depends on the particular situation. A matter of particular interest or benefit to an individual or small group of people may also be a matter of general public interest.
Footnotes omitted.
The Guidelines consider further the four factors identified in s 11B(3) as favouring access:
6.18 For example, disclosure of a document that is conditionally exempt under s 47G(1)(a) might, in the particular circumstances, both inform debate on a matter of public importance, and promote effective oversight of public expenditure. These would be factors in favour of disclosure in the public interest. Similarly, it would be a rare case in which disclosure would not promote the objects of the FOI Act, including by increasing scrutiny, discussion, comment and review of the government’s activities.
6.19     The four factors favouring disclosure are broadly framed but they do not constitute an exhaustive list. Other factors favouring disclosure may also be relevant in the particular circumstances. A non-exhaustive list of factors is below.
Public interest factors favouring disclosure
(a)promotes the objects of the FOI Act, including to:
(i)     inform the community of the Government’s operations, including, in particular, the policies, rules, guidelines, practices and codes of conduct followed by the Government in its dealings with members of the community
(ii)     reveal the reason for a government decision and any background or contextual information that informed the decision
(iii)   enhance the scrutiny of government decision making
(b)inform debate on a matter of public importance, including to:
(i)     allow or assist inquiry into possible deficiencies in the conduct or administration of an agency or official
(ii)    reveal or substantiate that an agency or official has engaged in misconduct or negligent, improper or unlawful conduct
(iii)   reveal deficiencies in privacy or access to information legislation
(c)promote effective oversight of public expenditure
(d)allow a person to access his or her personal information, or
(i)     the personal information of a child, where the applicant is the child’s parent and disclosure of the information is reasonably considered to be in the child’s best interests
(ii)    the personal information of a deceased individual where the applicant is a close family member (a close family member is generally a spouse or partner, adult child or parent of the deceased, or other person who was ordinarily a member of the person’s household)
(e)contribute to the maintenance of peace and order
(f)contribute to the administration of justice generally, including procedural fairness
(g)contribute to the enforcement of the criminal law
(h)contribution to the administration of justice for a person
(i)advance the fair treatment of individuals and other entities in accordance with the law in their dealings with agencies
(j)reveal environmental or health risks of measures relating to public health and safety and contribute to the protection of the environment
(k)contribute to innovation and the facilitation of research.
Footnotes omitted.
The Guidelines note that the FOI Act does not list any factors weighing against disclosure:
6.20 … However, the inclusion of the exemptions and conditional exemptions in the FOI Act recognises that harm may result from the disclosure of some types of documents in certain circumstances; for example, where disclosure could prejudice an investigation, unreasonably affect a person’s privacy or reveal commercially sensitive information. Such policy considerations are reflected in the application of public interest factors that may be relevant in a particular case.
6.21 Citing the specific harm defined in the applicable conditional exemption is not of itself sufficient to conclude that disclosure would be contrary to the public interest. However, the harm is an important consideration that the decision maker must weigh when seeking to determine where the balance lies.
6.22 A non-exhaustive list of factors against the disclosure is provided below.
Public interest factors against disclosure
(a)could reasonably be expected to prejudice the protection of an individual’s right to privacy …
(b)could reasonably be expected to prejudice the fair treatment of the individuals and the information is about unsubstantiated allegations of misconduct or unlawful, negligent or improper conduct
(c)could reasonably be expected to prejudice security, law enforcement, public health or public safety
(d)could reasonably be expected to impede the administration of justice generally, including procedural fairness
(e)could reasonably be expected to impede the administration of justice for an individual
(f)could reasonably be expected to impede the protection of the environment
(g)could reasonably be expected to impede the flow of information to the police or another law enforcement or regulatory agency
(h)could reasonably be expected to prejudice an agency’s ability to obtain confidential information
(i)could reasonably be expected to prejudice an agency’s ability to obtain similar information in the future
(j)could reasonably be expected to prejudice the competitive commercial activities of an agency
(k)could reasonably be expected to harm the interests of an individual or group of individuals
(l)could reasonably be expected to prejudice the conduct of investigations, audits or reviews by the Ombudsman or Auditor-General
(m)could reasonably be expected to discourage the use of the agency’s access and research services …
(n)could reasonably be expected to prejudice the management function of an agency
(o)could reasonably be expected to prejudice the effectiveness of testing or auditing procedures.
Footnoted omitted.
The Regulatory Regime for Investigations of Complaints by the Information Commissioner

The Australian Information Commissioner Act 2010 (Cth) establishes the Respondent as an independent statutory agency which includes the Information Commissioner. The Respondent’s functions include protecting the privacy of individuals. The Information Commissioner has regulatory powers under the Privacy Act, including powers relating to investigations under Part V. This Part deals with complaints and investigations about acts or practices that may interfere with the privacy of an individual. An individual may complain to the Information Commissioner about an act or practice that may be an interference with the privacy of the individual. If a complaint is made, the Commissioner is required to investigate the act or practice. Under s 36 of the Privacy Act, the complaint must be in writing and must specify the respondent to the complaint. If the complaint is about an act or practice of an organisation, the organisation is the respondent. Section 40A of the Privacy Act provides for the conciliation of complaints. Under s 41(1) of the Privacy Act, the Information Commissioner may decide not to further investigate if satisfied that there is, inter alia, no interference with the privacy of an individual; or the complaint is frivolous, vexatious, misconceived, lacking in substance, not made in good faith; or further investigation is not warranted. Further, the Information Commissioner may decide not to further investigate if satisfied that the respondent to the complaint has dealt, or is dealing, adequately with the complaint. Under s 44 of the Privacy Act, the Information Commissioner has power to issue a written notice requiring a person to produce documents or to attend before the Commissioner to answer questions relevant to the investigation.
The Information Commissioner has published guidelines pursuant to s 28 of the Privacy Act, including a Guide to Privacy Regulatory Action (Guide).[12] It provides at [1.32] that:
The OAIC is bound by the APPs when handling complaint related personal information, and managers complaints confidentially. As such, the OAIC does not disclose the particulars of a complaint during the complaint handling process to persons other than the parties to a complaint or third parties with information relevant to the enquiry that can assist the enquiry. This is to ensure the parties will participate fully and frankly complaint process.
[12] Office of the Australian Information Commissioner, Guide to Privacy Regulatory Action, January 2023.
With respect to conciliations conducted under the Privacy Act, the Guide notes:
… conciliation, where that is occurring, works best in an atmosphere where parties can raise issues in a frank way without fear of the information being disseminated further and the OAIC encourages parties not to disseminate information while involved in the conciliation process.[13]
[13] Ibid [1.34].
In addition to the Guide, the Respondent has published the Privacy Regulatory Action Policy (Policy),[14] which explains the Respondent’s approach to communicating information publicly and using its regulatory powers under the Privacy Act and other legislation. This includes the considerations the Respondent will take into account in deciding when to take privacy regulatory action, and what action to take. The Policy also explains the principles which will guide the Respondent when taking regulatory action, and the circumstances in which information about regulatory activity may be communicated publicly. The Guide should be read in conjunction with the Policy.
[14] Office of the Australian Information Commissioner, Privacy Regulatory Action Policy, December 2022.
The Policy provides that the goal of the Respondent in taking privacy regulatory action is to promote and ensure the protection of personal information, consistent with the objects of the Privacy Act. The Policy says at [11] that regulatory action may also aid the Respondent’s role as privacy regulator by, inter alia, instilling public confidence in the Respondent’s role of ensuring the protection of personal information.
Taking into account the regulatory obligations which govern the practices of the Respondent, notably those contained in the Privacy Act, the Guide and the Policy, I conclude that there is an expectation of confidentiality with respect to documents and information on the privacy complaint investigation file held by the Respondent. The expectation is that any information provided to the Respondent as part of the investigation will be disclosed to the other party but will otherwise be kept confidential.
CONSIDERATION
The Effect on Operational Conduct of the Respondent – s 47E(d)
Section 47E(d) relates to documents which disclose certain operations of agencies and provides:
A document is conditionally exempt if its disclosure under this Act would, or could
reasonably be expected to, do any of the following:
…
(d) have a substantial adverse effect on the proper and efficient conduct of
the operations of an agency.
The Guidelines provide guidance on the interpretation of the words ‘would’

and ‘could’ in s 47E(d) at [5.17]:
The use of the word ‘could’ in this qualification is less stringent than ‘would’, and requires analysis of the reasonable expectation rather than certainty of an event effect or damage occurring. It may be a reasonable expectation that an effect has occurred, is presently occurring, or could occur in the future.
Footnotes omitted.
The Guidelines further advise on the meaning of ‘substantial adverse effect’ at [5.20]:
The term ‘substantial adverse effect’ broadly means ‘an adverse effect which is sufficiently serious or significant to cause concern to a properly concerned reasonable person’ [see Re Thies and Department of Aviation [1986] AATA 141 [24]). The word ‘substantial’, taken in the context of substantial loss or damage, has been interpreted as ‘loss or damage that is, in the circumstances, real or of substance and not insubstantial or nominal’ [see Tillmanns Butcheries Pty Ltd v Australasian Meat Employees Union & Ors (1979) 27 ALR 367 383].
Footnotes included.
The phrase ‘could reasonably be expected’ requires more than a mere assumption or allegation that damage may occur. The Guidelines provide at [6.103]:
…The particulars of the predicted effect should be identified during the decision making process, including whether the effect could reasonably be expected to occur. Where the conditional exemption is relied upon, the relevant particulars and reasons should form part of the decision maker’s statement of reasons, if they can be included without disclosing exempt material (s 26, see Part 3).
The first question for the Tribunal is whether the disclosure of the documents in issue would, or could reasonably be expected to, have a substantial adverse effect on the proper and efficient conduct of the operations of the Respondent. To determine the effect, if any, on the Respondent’s operations if the documents are disclosed, it is necessary to understand the practices of the Respondent in the context of the regulatory regime (set out above) which governs how the Respondent operates. As was stated in Re James and Australian National University,[15] the expression ‘the conduct of the operations of an agency’ extends to the way in which an agency discharges or performs any of its functions.[16]
[15] (1984) 2 AAR 327, 340.
[16] See Searle Australia v Public Interest Advocacy Centre (1992) 36 FCR 111, 116.
Evidence from Assistant Commissioner Stevens
Mr Stevens deposes that parties to a complaint are advised that any information provided to the Respondent during an investigation will be shared with the other party,[17] but that otherwise, the Respondent maintains confidentiality over documents and information provided by the parties for the duration of the privacy complaint investigation, as this allows parties to participate fully and frankly in the process.[18] I note that this is consistent with [1.32] of the Guide. He says that conciliations are conducted confidentially between the parties to a complaint.[19] Further, he says that, in his experience, even after a complaint investigation has been finalised, the Respondent’s practice is to maintain confidentiality over information that was provided in confidence during the complaint process.[20]
[17] Affidavit of David Stevens [19] and [26].
[18] Ibid [28].
[19] Ibid [27].
[20] Ibid [29].
Mr Stevens deposes that:[21]
In accordance with the usual procedure for the conduct of privacy complaint investigations, and as occurred in this particular matter, the parties to this complaint provided information to the OAIC in confidence in the expectation that their communications would not be disclosed outside the complaints process…
[21] Ibid [33].
I accept this evidence from Mr Stevens. It is consistent with the expectation of confidentiality arising from the Privacy Act, the Guide and the Policy.
The documents in issue comprise documents contained within a privacy complaint investigation file held by the Respondent. The file is the documentary record of the investigation which the Information Commissioner was obliged to carry out by operation of Part V of the Privacy Act. Mr Stevens has had access to the documents in issue and states that they include: [22]
… information setting out the substance of the complaint, documents provided confidentially by the parties, the parties’ frank and candid views on the issues raised by the privacy complaint, and the OAIC’s planning, consideration and summary of those issues.
[22] Ibid [34].
Mr Stevens deposed in his affidavit to the consequences if the documents in issue were disclosed. With respect to the consequences for the participation of parties in the investigation, he said:
[35] I would be very concerned if the OAIC is unable to protect information provided on the understanding of confidentiality. I believe it would have serious consequences for the effective and efficient conduct of the complaints investigations procedures and its regulatory functions more generally.
[36] If it became known that the OAIC could no longer protect documents provided in confidence as part of a complaints process, I would be concerned that members of the public would be less likely to make privacy complaints. I also would be concerned that parties to complaints would be less willing to participate fully and frankly in the OAIC’s privacy complaint processes in the future, or would be deterred from readily and willingly participating in those processes, as they could not expect the information and documents they provide to be kept confidential.
[37] If parties are less willing to participate fully in the OAIC’s process or are deterred from doing so, I consider this would substantially limit the respondent’s ability to obtain all information that is relevant to a complaint, which would undermine the respondent’s ability to conduct its privacy complaints investigation function efficiently and effectively. This in turn would have a substantial adverse effect on the ability of the OAIC to undertake its regulatory functions.
With respect to the consequences for the person making the complaint giving rise to the investigation, Mr Stevens said:
[38] I also believe that there is a not insubstantial risk that the public may be deterred from making privacy complaints to the OAIC at all, if they learn that information provided in confidence to the OAIC may later be released to the public under the FOI Act. This is especially the case because the very thing that people complain of is a breach of their privacy, which may include other people having had access to their personal information.
[39] Reducing the public’s confidence in the OAIC’s ability to protect information provided on a confidential basis, could have the consequence that members of the public are less likely to make complaints, or will reduce the level and quality of information provided. Examples include situations of access to information where domestic violence is involved, or suspected; where there is a criminal investigation in relation to information; and where there were concerns a complainant would publish a response online. These adverse consequences would also likely extend to third parties who would be less likely to participate in a complaints process in the future.
[40] Disclosure of documents provided in confidence would undermine the purpose of a complaints process, which is to allow parties to engage openly and frankly to enable early resolution of a complaint. This would serve to compound the very privacy breach which is the source of the complaint.
[41] If individuals are deterred from making privacy complaints about acts or practices that are suspected interferences with their privacy, I consider that this would substantially and adversely diminish the OAIC’s ability to perform its privacy, and other regulatory, functions in the future. Not only would it make it more difficult to investigate complaints, it could also reduce the willingness of persons to make complaint at all. It is an essential aspect of the function of the OAIC to be aware of possible interferences with privacy, to be able to investigate and determine whether they raise systemic issue of broader public concern.
I note that Mr Stevens deposes that an expected consequence if the documents in issue were disclosed was ‘a substantial adverse effect on the ability of the [Respondent] to undertake its regulatory functions’.[23] It is, of course, a question for the Tribunal to determine itself whether disclosure would, or could reasonably be expected to, have a substantial adverse effect pursuant to s 47E(d). Insofar as Mr Stevens may be giving evidence as to this ultimate issue, I do not rely upon that evidence.[24] However, Mr Stevens has significant experience and holds a senior position as Assistant Commissioner, Dispute Resolution in the Respondent. I consider that Mr Stevens has given probative evidence as to the consequences of disclosure and I give significant weight to his evidence. His evidence is also relevant to the question of the public interest and can be relied upon.[25]
[23] Ibid [37].
[24] See Fisse v Secretary, Department of Treasury (2008) 172 FCR 513 per Buchanan J at 535 [71] and per Flick J at 550 [130].
[25] New South Wales v Ryan (1998) 101 LGERA 246.
Conclusion as to operational conduct
It is my finding based upon the evidence from Mr Stevens that disclosure of the documents in issue would be a breach of the expectation of confidentiality for those participating in the investigation. The consequences of such a breach would be very significant in the future for complainants and other persons who had expected their information to be kept confidential between the parties. Those persons would be less likely to come forward to bring a complaint or to provide information relevant to a complaint if they knew that their information would not be kept confidential between the parties. My finding in this regard is supported by the fact that four of the persons notified of the Applicant’s application for review objected to the release of their information held on the investigation file. I note that the Respondent was established to, inter alia, protect the privacy of individuals. If people are deterred from coming forward to complain about the misuse of their personal information, then the Respondent would not be able to achieve its purpose. In particular, the Respondent’s ability to obtain all information relevant to a complaint would be undermined. Further, if people are deterred from making complaints, then the Respondent will be unaware of possible interferences with privacy. I conclude that disclosure of the documents in issue would have a substantial adverse effect on the proper and efficient conduct of the operations of the Respondent; confidence in the Respondent would be eroded, and the achievement of its objectives would be significantly diminished. The documents in issue are conditionally exempt under s 47E(d).
Applicant’s Contention in relation to s 47E(d)
The Applicant contends that the documents should be released because the complaint, although made against the RACP, named and identified the Applicant as the person alleged to have engaged in the conduct which was complained about and subsequently investigated. This gives the Applicant a different status compared to persons who, for example, have no interest in the complaint and the investigation. The Applicant relies upon the definition in s 4(1) of the expression ‘personal information’, which provides that it has the same meaning as it does in the Privacy Act, namely:[26]
personal information means information or an opinion about an identified individual, or an individual who is reasonably identifiable:
(a) whether the information or opinion is true or not; and
(b) whether the information or opinion is recorded in a material form or not.
[26] Privacy Act 1988 (Cth) s 6.
It follows that the Applicant’s personal information contained in the investigation file extends beyond his own personal details to any expressions of opinion by others relating to the Applicant. I note that it is not in dispute that the investigation file includes documents recording ‘the parties’ frank and candid views on the issues raised by the privacy complaint’.[27] Further, I note that the issues raised by the privacy complaint are based upon the claim which, in the Respondent’s own words, is that the Applicant, and possibly other individuals, used the personal email addresses of 21,000 members of the RACP on two separate occasions.
[27] Affidavit of David Stevens [34].
The Applicant relies upon the definition of ‘interested party’ in s 43A(3) of the Privacy Act, which would include himself because he is ‘the person that engaged in the alleged act or practice that was being investigated’. As an ‘interested party’, the Applicant was entitled, under s 43A of the Privacy Act, to request a hearing before any determination is made in relation to the investigation. He is also a person who the Respondent could have compelled to participate in the investigation or any conference under s 46(1)(c) of the Privacy Act.
The Applicant contends that his status, when properly considered in the factual evaluation required to be undertaken, impacts upon the factual or legal conclusion under ss 47E(d) and 11A(5).
The Applicant further sought to rely upon the Australian Privacy Principles Guidelines (APP Guidelines)[28] to support his request for access to personal information in accordance with APP 12.1.
[28] Office of the Australian Information Commissioner, Australian Privacy Principles Guidelines, July 2019.
Response to the Applicant’s Contention in relation to s 47E(d)
In response to the Applicant’s contention, I note that s 47E(d) does not contain a reference to ‘personal information’, and I fail to see how it has any relevance to what must be considered when determining whether a document is conditionally exempt under s 47E(d). Even if ‘personal information’ does have the extended meaning in accordance with its definition in the Privacy Act, it does not impact the interpretation of the words in s 47E(d) nor does it impact on the hypothetical that is required when considering the effect of disclosure. That hypothetical must be carried out as at the time that I make my decision in this matter based upon the facts known at that time. The known facts include that the investigation by the Respondent has been finalised because the Information Commissioner decided not to investigate the complaint any further under s 41(1) of the Privacy Act. The hypothetical does not require consideration of the potential for a hearing arising from any entitlement under s 43A of the Privacy Act, nor the potential for the Applicant to be compelled to participate under s 46(1)(c) of the Privacy Act.
With respect to the Applicant’s reliance on APP 12.1 of the APP Guidelines, APP 12.1 is not enlivened in these circumstances because APP 12.25 provides that agencies are not required to give the access to personal information if the agency is not required to do so by or under the FOI Act. Subsequently, APP 12 does not impact the analysis undertaken in this decision under the FOI Act.
Unreasonable disclosure of personal information – s 47F

Section 47F relates to documents which disclose personal privacy of individuals and provides:
General rule
(1) A document is conditionally exempt if its disclosure under this Act would involve the unreasonable disclosure of personal information about any person (including a deceased person).
(2) In determining whether the disclosure of the document would involve the unreasonable disclosure of personal information, an agency or Minister must have regard to the following matters:
(a)the extent to which the information is well known;
(b)whether the person to whom the information relates is known to be (or to have been) associated with the matters dealt with in the document;
(c)the availability of the information from publicly accessible sources;
(d)any other matters that the agency or Minister considers relevant.
The Guidelines at 6.138 say that the personal privacy exemption is designed to prevent the unreasonable invasion of third parties’ privacy. The Guidelines at 6.142 say that the key factors for determining whether disclosure is unreasonable include:
(a) the author of the document is identifiable
(b) the documents contain third party personal information
(c) release of the documents would cause stress on the third party
(d) no public purpose would be achieved through release.
Footnotes omitted.
Other matters that have been considered relevant include:[29]
·      the nature, age and current relevance of the information
·     any detriment that disclosure may cause to the person to whom the information relates
·     any opposition to disclosure expressed or likely to be held by that person
·     the circumstances of an agency’s collection and use of the information
·     the fact that the FOI Act does not control or restrict any subsequent use or dissemination of information released under the FOI Act
·     any submission an FOI applicant chooses to make in support of their application as to their reasons for seeking access and their intended or likely use or dissemination of the information, and
·     whether disclosure of the information might advance the public interest in government transparency and integrity.
Footnotes omitted.
[29] Freedom of Information Guidelines [6.143].
Mr Stevens gave affidavit evidence in relation to the disclosure of personal information as follows:
[43] From my review of the documents in issue, I am satisfied that they contain the personal information of a large number of third party individuals. The types of personal information contained in the documents in issue includes individuals’ names, email addresses, phone numbers, positions, and their opinions about various alleged acts and practices.
[44] I am informed by Ms Elena Arduca, AGS lawyer, that nine individuals and one organisation were notified of this review under s 60AA of the FOI Act.
[45] I am informed by Ms Arduca that four of the individuals objected to the release of their information on the basis that:
[45.1] their personal information is contained in the documents by virtue of them having provided documents to the OAIC in good faith
[45.2] they wish to preserve their personal privacy in the documents and protect themselves from future actions
[45.3] the disclosure of their information may compromise the potential for persons like them to raise concerns about the breach of privacy provisions with the OAIC
[45.4] the disclosure of their personal information would not serve the public interest and/or
[45.5] their personal information is not public.
[46] One of the individuals notified has not provided a response. Four of the individuals notified of this review did not object to the disclosure of their personal information to the applicant.
[47] The organisation objected to the release of correspondence between the RACP in relation to the privacy complaint and subsequent conciliation, and documents submitted by the parties to the OAIC in relation to the privacy complaint and subsequent conciliations on the basis that:
[47.1] the RACP is a member-based organisation for which member engagement is central to the RACP’s functions
[47.2] the information has been restricted within the RACP and remains confidential information of the RACP
[47.3] the RACP is concerned to limit the disclosure of the sensitive information contained in the correspondence, noting that the RACP is a professional organisation for which its good standing in the medical community is central to its capacity to operate effectively and disclosure could unreasonably affect its standing
[47.4] information was provided to the OAIC on the understanding that it would be kept confidential, the clear purpose of which was to encourage frank participation by the parties.
I have found above that third parties disclosed their personal information to the Respondent with an expectation that it would be disclosed to the parties to the complaint but would otherwise be kept confidential. Four of those third parties have objected to the release of their personal information. In those circumstances, it would be unreasonable for their personal information to be disclosed. It is noted that some of the personal information of third parties is intertwined with the personal information of the Applicant such that it cannot be meaningfully separated. The third-party personal information contained in the privacy complaint investigation file is not information that is publicly available, but rather is contained in a file over which confidentiality is maintained. That information is not well known. Those third parties who have objected to the release of their information are persons who want the information to remain confidential and one can infer that its release would cause stress and detriment to the third party. No public purpose would be achieved through its release, but rather, as I have found, there would be a significant adverse impact on the operations of the Respondent. I note that, where possible, information about individuals who did not object to the disclosure of their personal information has been released to the Applicant.
I find pursuant to s 47F that it would be unreasonable in the above circumstances to disclose the information in issue.
The public interest
I must first turn my mind to whether the documents in issue are conditionally exempt under s 47E(d). If so, then I must turn my mind to the public interest. The Guidelines say at [6.7] that the decision-maker is not required to consider the public interest test until they have first determined that the document is conditionally exempt.
I have found that the documents in issue are conditionally exempt. Section 11A(5) says that if a document is conditionally exempt it must be disclosed unless access to the document would, on balance, be contrary to the public interest.
There are factors that weigh in favour of disclosure, namely:
(a)the promotion of the objects of the FOI Act, including by:
(i)increasing public participation in Government processes, with a view to promoting better-informed decision-making;
(ii)increasing scrutiny, discussion, comment and review of the Government’s activities;[30]
(b)informing debate on a matter of public importance; and
(c)allowing the Applicant to access his own personal information.
[30] Freedom of Information Act 1982 (Cth) s 3(2).
When considering where the balance lies, I accept the Applicant’s contention that I must do so based on the particular facts of the matter at the time the decision is made. The Applicant contends that significant weight should be given to the particular status of the Applicant as the person the subject of the complaint, and whose personal information is contained on the investigation file. The Applicant says that he has rights as an ‘interested party’ and separate rights of access under APP 12. In addition to these particular facts, I note, as I have already found, that the investigation has been finalised. Further, the organisation the subject of the complaint was the RACP and not the Applicant. Any personal rights that may have existed when the investigation was being conducted have little, if any, relevance to the task I must carry out in accordance with ss 11A(5) and 11B.
I accept that allowing the Applicant to access his own personal information on the investigation file is a factor that weighs in favour of disclosure, but some of that personal information is entwined with that of other parties who have made clear their objections to disclosure of their personal information.
There are substantial matters in the public interest that weigh against disclosure, namely:
(a)disclosure would, as I have found above, impede the flow of privacy complaints to the Respondent and prejudice its ability to obtain information provided on a confidential basis with respect to potential interferences with privacy in the future;
(b)disclosure would involve the unreasonable disclosure of third-party personal information in circumstances where those parties participated in a complaints process based upon the expectation of confidentiality and have objected to the disclosure of their personal information;
(c)disclosure would prejudice the effective and efficient management of the respondent’s privacy complaint investigation function; and
(d)disclosure of this particular privacy complaint investigation file would shed little light or scrutiny and do little to enhance transparency of government decision-making generally because the investigation did not proceed to a final determination but rather was finalised under s 41 of the Privacy Act, by which it was decided not to investigate further the complaint.
I find that the public interest against disclosure significantly outweighs the public interest factors in favour of disclosure. Access to the investigation file held by the Respondent would have very real and seriously negative consequences for the future operations of the Respondent. It is important that confidentiality over the file is maintained. The particular interests of third parties are involved as well as the interests of potential complainants and participants in future investigations. I note that the Applicant already has an understanding of the complaints insofar as they relate to him because he received the letter dated 20 August 2018,[31] which outlined the complaint at that time, and he received a copy of the Respondent’s letter, dated 25 October 2019, which outlined the formal privacy complaint that had been made to the Respondent with respect to the RACP. Further, the Applicant should take comfort from the fact that the complaint did not proceed to a final determination but was instead finalised under s 41 of the Privacy Act. Little would be gained by giving the Applicant access to an investigation file.
[31] Wilson affidavit annexure JWW-1.
I conclude that access to the documents in question would be contrary to the public interest.
DECISION
The decision of the Tribunal is to affirm the decision under review.

1. I certify that the preceding sixty-nine (69) paragraphs are a true copy of the reasons for the decision herein of Deputy President Britten-Jones.

..................[sgd]...........................
Associate

Date of Decision: 21 March 2023

Dates of Hearing

Counsel for the Applicant

Solicitor for the Applicant

16 May 2022 and 16 June 2022

Mr Michael Rivette

Hunt & Hunt Lawyers

Counsel for the Respondent
Mr Sam Walpole

Solicitor for the Respondent Australian Government Solicitor

[2023] AATA 458

21 March 2023

Key Legal Topics

Areas of Law

Administrative Law

Statutory Interpretation

Legal Concepts

Judicial Review

Procedural Fairness

Standing

Statutory Construction

Appeal

Remedies

Date of Decision:	21 March 2023
Dates of Hearing Counsel for the Applicant Solicitor for the Applicant	16 May 2022 and 16 June 2022 Mr Michael Rivette Hunt & Hunt Lawyers
Counsel for the Respondent	Mr Sam Walpole
Solicitor for the Respondent	Australian Government Solicitor