Skip to main content
Skip to secondary navigation
Menu
Australian Government - Office of the Australian Information Commissioner - Home

Personal and business information — Third party review rights under the Freedom of Information Act 1982

Consultation paper

August 2012

 

Closing date for comment 17 September 2012

(PDF)

 

Contents

About this paper

When is consultation required under the FOI Act?

What is the scope of consultation required under the FOI Act?

Who should be notified of an access refusal or access grant decision?

Who can apply for review of an access grant decision?

Who cannot apply for review of an access grant decision?

What procedures apply if an FOI applicant applies for internal or IC review of an access refusal decision?

When can documents containing personal or business information be released?

Flowcharts third party review rights

 

About this paper

The Freedom of Information Act 1982 (FOI Act) requires agencies and ministers to consult third parties before deciding to release certain categories of documents in response to requests under the Act. Third parties can also apply for internal and Information Commissioner (IC) review of decisions by agencies and ministers to release information under the Act.

The FOI Act provisions are complex and frequently give rise to requests to the Office of the Australian Information Commissioner (OAIC) for advice about the rights of parties and the obligations of agencies. The area of particular concern is FOI requests for documents that contain personal or business information of someone other than the FOI applicant.

This paper provides interim guidance on the operation of the consultation requirements in ss 27 and 27A of the FOI Act that apply to the business and personal privacy exemptions (ss 47, 47F, 47G). Following consideration of any comments received on this paper, the Information Commissioner may amend the Guidelines issued by the Australian Information Commissioner under s 93A of the Freedom of Information Act 1982 (FOI guidelines).

Issues similar to those discussed in this paper arise under the consultation requirements applying to the Commonwealth-State relations and Norfolk Island intergovernmental relations exemptions (ss 26A, 26AA, 47B). The exemption for information communicated in confidence by a foreign government or organisation (s 33(b)) is different, as an agency or minister has a discretion to decide if consultation is appropriate, and the foreign entity does not have a right to apply for review of an access grant decision.

This paper deals with consultation by an agency, though the same consultation principles apply to FOI requests to ministers.

How to make comments

The Australian Information Commissioner invites your comments on the guidance given in this consultation paper. The closing date for comments is 17 September 2012.

Comments may be forwarded to consultation@oaic.gov.au, or GPO Box 2999, Canberra ACT 2601.

The OAIC may later publish a summary or analysis of comments received.

 

When is consultation required under the FOI Act?

The Freedom of Information Act 1982 requires an agency to consult a person or business before making a decision to give access to a document containing their personal or business information, if the agency considers that the person or business ‘might reasonably wish to make a contention' that the document is either exempt or conditionally exempt (and, if conditionally exempt, that access would on balance be contrary to the public interest). This is described in the Act as an ‘exemption contention' (ss 27(1),(4), 27A(1),(3)). The person or business who is invited to make a submission is called an ‘affected third party' (s 53C). A decision by an agency to give access to a document containing personal or business information is called an ‘access grant decision' (s 53B).

An agency is not required to undertake consultation in the following circumstances:

  • the agency does not intend to release the document containing personal or business information — that is, it makes an ‘access refusal decision' (s 53A)
  • the agency decides that the person or business referred to in the documents would not wish to make a submission in support of an exemption contention — for example, the information is well known or is already available from publicly accessible sources (ss 27(3), 27A(2))
  • it is not reasonably practicable for the agency to undertake consultation — for example, a person cannot easily be located (ss 27(5), 27A(4)).

What is the scope of consultation required under the FOI Act?

An affected third party who is consulted under s 27A (personal information) has an opportunity to contend only that access should be refused under s 47F (public interest conditional exemption — personal privacy). The third party has no right to contend that other exemptions should apply. Equally, the third party's opportunity to make submissions in any later internal or IC review proceedings is confined to whether s 47F applies.

An affected third party who is consulted under s 27 (business information) may contend that access should be refused under either s 47 (documents disclosing trade secrets or commercially valuable information) or s 47G (public interest conditional exemption — business). This opportunity to make a submission relating to both provisions applies even where the agency has invited a submission relating to only one of those provisions. The reason is that s 27(1) applies to a document containing ‘business information ... in respect of a person, organisation or undertaking' (s 27(1)(a)), and entitles that party to make an exemption contention that ‘the document is exempt under section 47 [or] conditionally exempt under s 47G'. However, both the agency and any third party making an exemption contention should bear in mind that ss 47 and 47G contain different exemption criteria, as affirmed in s 47G(2).

An affected third party who is consulted under s 27 has no right to contend that exemptions other than ss 47 or 47G should apply (see ‘E' and National Offshore Petroleum Safety and Environmental Management Authority[2012] AICmr 3).

Who should be notified of an access refusal or access grant decision?

Primary access refusal decision: An agency is not required to give notice of an access refusal decision to any person other than the FOI applicant (s 26). However, as noted below, an agency is required to provide notice to an affected third party who made a submission in support of an exemption contention if an access refusal decision is changed on internal review to an access grant decision, or the FOI applicant applies for IC review of the access refusal decision.

Primary access grant decision: An agency is required to give notice of an access grant decision made at either the primary decision making or internal review stage to an affected third party who made a submission in support of an exemption contention (ss 27(6), 27A(5)). There is no obligation to provide notice of an access grant decision to a person or business who was invited to make a submission but did not do so, or made a submission agreeing to the release of documents (ss 27(8), 27A(7)).

Who can apply for review of an access grant decision?

Only an affected third party who made a submission in support of an exemption contention can apply for internal or IC review of an access grant decision.

This result stems from the following two considerations. First, an agency is required to provide notice of an access grant decision only to an affected third party who made a submission in support of an exemption contention (ss 27(8), 27A(7)). The third party may apply for internal or IC review within 30 days of receiving that notice (ss 54B(1)(a), 54S(2)). Based on that notice, the application for review should identify the decision to be reviewed and submit why the decision is wrong. Secondly, upon making an access grant decision an agency should promptly provide access to the FOI applicant, subject to the limitation expressed in ss 27(7) and 27A(6) that access must not be given until a third party's opportunity to apply for review or appeal of the access grant decision has run out. However, that limitation does not apply unless the third party made a submission in support of an exemption contention (ss 27(8), 27A(7)).

Those considerations outweigh a competing view, based on s 54A(2), that the right to apply for internal review is not limited to an affected third party who made a submission in support of an exemption contention.

In summary, an affected third party who made a submission in support of an exemption contention has the following review rights in respect of an access grant decision:

  • Internal review: the third party may apply for internal review within 30 days of being notified of the agency's decision or within such further period as the agency allows (ss 54A, 54B(1)(a)).
  • IC review following internal review: if the access grant decision is affirmed on internal review, the third party may apply for IC review within 30 days of being notified of the agency's internal review decision or within such further period approved by the Information Commissioner (ss 54M(3)(b), 54S(2)(a), 54T). (Section54C(4) implies that the notice of the agency's access grant decision must be given under s 26. Section 26 speaks only of access refusal decisions. It is nevertheless clear that an affected third party must be notified of the agency's internal review decision, and this should be done in conformance with s 26 as far as possible.)

An agency is deemed to have affirmed the access grant decision if it does not make a decision within 30 days of receiving the affected third party's application for internal review (s 54D(2)(a)). Notice of that deemed decision is taken to have been given to the internal review applicant under s 26 (s 54D(2)(b)).

  • IC review of the primary agency decision:the third party may apply directly for IC review of the agency's access grant decision within 30 days of being notified of the decision or within such further period approved by the Information Commissioner (ss 54M(3)(a), 54S(2)(b)), 54T). The application for IC review must include a copy of the notice given under s 26 (s 54N(1)(b)). (In fact, an affected third party does not receive a notice under s 26, but under ss 27(6) or 27A(5). This requirement should be read in that way.)

Who cannot apply for review of an access grant decision?

Person or business who was not consulted: A person or business who was not invited by an agency to make a submission in support of an exemption contention cannot apply for internal or IC review of an agency decision to give access to a document containing their business or personal information. This is so even if the person contends that the agency acted incorrectly or unreasonably in not providing a consultation opportunity. The person may complain to the OAIC under s 70 about the agency's access grant decision, though the OAIC has no direct power to restrain an agency from releasing a document under the Act. In addition, the person may commence proceedings under the Administrative Decisions (Judicial Review Act) 1977 to restrain release of a document, but would have to establish that the agency's access grant decision was unlawfully made.

Person or business who was consulted but did not make a submission in support of an exemption contention: An affected third party who was invited to make a submission but did not do so cannot apply for internal or IC review of an access grant decision. As noted above, the right to seek review of an access grant decision follows receipt of a notice of that decision; an agency is not required to provide notice of an access grant decision to a person or business who was invited to make a submission but did not do so.

If, as an administrative gesture, an agency informs a person or business of an access grant decision even though no submission was received in support of an exemption contention, the person or business does not have a right to seek internal or IC review.

What procedures apply if an FOI applicant applies for internal or IC review of an access refusal decision?

Internal review — prior consultation with an affected third party: Where an FOI applicant applies for internal review of an access refusal decision that was made following consultation with an affected third party, the FOI Act does not require consultation with the third party during internal review. Specifically, the Act does not require an agency to notify the affected third party of the access refusal decision or the internal review application, or invite or allow the third party to participate in the internal review. It is nevertheless open to an agency to take any of those steps, provided the internal review is completed within the 30 day statutory time limit (s 54C(3)). There is no power in the FOI Act to extend that time period to facilitate further consultation with the affected third party.

If the agency changes the access refusal decision to an access grant decision, it cannot give access to a document until an affected third party's opportunity for review and appeal have run out (ss 27(7), 27A(6)). Consequently, the agency should provide a notice that complies with s 27(6) or s 27A(5) to an affected third party who earlier made a submission in support of an exemption contention. The third party may then apply for IC review of the agency's access grant decision.

Internal review — no prior consultation: If the document being considered in internal review contains personal or business information about a person or business who was not earlier consulted, the agency must turn its mind to whether the person ‘might reasonably wish to make [an] exemption contention' (ss 27(1)(b) and 27A(1)(b)). If this obligation was not met at the primary decision-making stage it must be considered at the internal review stage. For instance, the reason why consultation was not earlier undertaken may be that the agency based its decision on another exemption ground, which if set aside at internal review may expose personal or business information to release without proper consultation under ss 27 or 27A. Once again, there is no power in the FOI Act to extend the 30 day time limit to facilitate consultation.

If the third party is invited to make a submission and does so, and the agency changes the access refusal decision to an access grant decision, the agency should give the third party notice of the decision (ss 27(6), 27A(5)). The agency cannot give access until the third party's opportunity to apply for review or appeal has run out (ss 27(7), 27A(6)).

IC review — prior consultation with an affected third party: An agency must ‘take all reasonable steps' to notify an affected third party of an application by an FOI applicant for IC review of an access refusal decision (s 54P(2)). This obligation applies to an affected third party who made a submission in support of an exemption contention, as well as an affected third party who was invited to make a submission but did not do so. An agency can apply to the Information Commissioner under s 54Q for an order that it is not required to provide notice to the affected third party for a reason stated in that section (for example, law enforcement or security). An affected third party who receives a notice under s 54P has a right to be a party in the IC review (s 55A(1)(c)).

IC review — no prior consultation: Any person ‘whose interests are affected by an IC reviewable decision' may apply to the Information Commissioner to be made a party to an IC review (s 55A(2)). In theory, this means that a person or business who was not consulted by an agency under ss 27 or 27A could apply to be a party to an IC review proceeding that concerns a document containing their personal or business information. However, as a practical matter this opportunity could only be taken up if the person or business is aware of the proceeding.

On the other hand, the OAIC must turn its mind to whether the person or business referred to in the documents ‘might reasonably wish to make [an] exemption contention', and be invited to do so under ss 27 or 27A. As noted above, if this obligation to allow proper consultation was not met at the primary decision-making stage it must be considered at later review stages. (This is noted in the FOI Act in a note following s 55G(1).)

When can documents containing personal or business information be released?

Following an access grant decision, an agency must provide access as soon as reasonably practicable after:

  • the FOI applicant was notified of the decision and paid any access charges, and
  • an affected third party's ‘opportunities ... for review or appeal in relation to the decision to give access to the document have run out' (ss 27(7), 27A(6)). As noted earlier, this opportunity to seek review is limited to an affected third party who made a submission in support of an exemption contention (ss 27(8), 27A(6)).

The following table explains how those principles apply to different categories of decision.

Categories of decision

Agency decision

When access can be given to the FOI applicant

Agency makes an access grant decision without consulting a person or business

Access should be given as soon as reasonably practicable following the agency decision

Agency makes an access grant decision after inviting an affected third party to make a submission, but not receiving a submission opposing release

Access should be given as soon as reasonably practicable following the agency decision

Agency makes an access grant decision after receiving a submission opposing release from an affected third party

Access cannot be given until 30 days after the agency notifies its decision to the affected third party. Access can then be given if the third party has not applied for internal or IC review.

Note: it is advisable to check with the OAIC as to whether the affected third party has been given an extension of time to apply for IC review.

Agency makes an access grant decision following internal review initiated by an affected third party

Access cannot be given until 30 days after the agency notifies its internal review decision to the affected third party. Access can then be given if the third party has not applied for IC review, and has not been given an extension of time by the OAIC to do so.

Agency makes an access grant decision following internal review initiated by an FOI applicant

If an affected third party made a submission opposing release, either at the primary or the internal review stage, access cannot be given until 30 days after the agency notifies the internal review decision to the affected third party. Access can then be given if the third party has not applied for IC review, and has not been given an extension of time by the OAIC to do so.

Flowcharts — third party review rights[1]

Flowchart 1: Primary agency decision to grant access

Decision tree for when the agency's primary decision is to grant access

Link to text description of flowchart 1 on separate page.

Flowchart 2: Primary agency decision to refuse access

Decision tree showing process when agency's primary decision is to refuse access

Link to text description of flowchart 2 on separate page.

Flowchart 3: Application by third party for internal review of an access grant decision

The agency is not required to notify the FOI applicant of the internal review application, but it is good practice to do so as the FOI applicant will have earlier received notice of the access grant decision. The time for making the internal review decision cannot be extended to facilitate consultation with the FOI applicant.

If the access grant decision is affirmed, the agency must notify the third party, who can apply for IC review of the agency's decision. The FOI applicant cannot be given access until the third party's opportunity to apply for IC review has run out.

If the access grant decision is changed to an access refusal decision, the agency must notify both the FOI applicant and the third party. The FOI applicant can apply for IC review of the agency's decision.

Flowchart 4: Application by FOI applicant for internal review of an access refusal decision

Decision tree showing process when applicant requests internal review of access refusal

Link to text description of flowchart 4 on separate page.

Flowchart 5: Application by third party for IC review of an access grant decision

The OAIC is required to notify the FOI applicant of the IC review application (s 54Z). The FOI applicant can apply to the OAIC to be made a party to the IC review as a person whose interests are affected by the IC review.

Flowchart 6: Application by FOI applicant for IC review of an access refusal decision

Decision tree showing process when applicant requests IC review of access refusal

Link to text description of flowchart 6 on separate page.


[1] The flow charts refer to a ‘third party' as meaning a person or business who can or should be consulted under ss 27 or 27A before an agency decides to give access to a document containing their personal or business information.