NDIA Accountability Project

This project is in DRAFT

NDIS correspondence: Notification of Decision - FOI 24/25-0985

‹ PrevPage 1 of 5 · Source p. 1Next ›

Our reference: FOI 24/25-0985

GPO Box 700 Canberra ACT 2601 1800 800 110 ndis.gov.au

17 February 2025

Nosey By email: foi+request-12611-c8bb386e@righttoknow.org.au

Dear Nosey

Freedom of Information request — Notification of Decision

Thank you for your correspondence of 14 December 2024, in which you requested access to documents held by the National Disability Insurance Agency (NDIA), under the Freedom of Information Act 1982 (FOI Act).

Scope of your request

You have requested access to the following documents:

...I seek access to any and all documents, records, data, and supporting material held by [Name of Agency] concerning the sharing of personal information originating from the Department of Veterans’ Affairs (DVA) over the last ten years. This includes any data transfers from or to the DVA, whether they were one-off exchanges or ongoing, systematic transfers of DVA client information, including personal, medical, financial, or service-related details concerning veterans or their dependents.

I am interested in obtaining a comprehensive understanding of what DVA client information [Authority name] has received or accessed and for what purposes. Specifically, I request:

All records of data sharing arrangements between DVA and [Authority name], including but not limited to memoranda of understanding, service-level agreements, emails, letters, meeting minutes, file transfer logs, internal reports, and instructions that outline what data was shared, when it was shared, and the format or system used for the transfer.

Any policies, procedures, guidelines, or frameworks that govern how [Authority name] requests, obtains, stores, handles, or uses DVA client information. This includes documents that detail the criteria for approving access to such data, any consent or authorization processes, security controls, and retention or destruction policies.

Copies of any ethics committee approvals, privacy impact assessments, internal review board decisions, or other documents that reflect deliberations or authorizations for obtaining DVA client information. This includes records that show the agency considered the ethical, legal, or privacy implications of receiving or using DVA client data.

Documents that outline the intended uses or practical applications of the DVA client data, such as project proposals, business cases, internal strategy papers, or briefings that explain

why [Authority name] sought access to this information, how it was intended to be integrated into the agency’s operations, and any expected outcomes or benefits.

A representative sample (in a suitably de-identified or redacted form) of the data or data fields received, so long as providing this sample does not breach any exemption under the FOI Act. The purpose is to understand the nature and granularity of the information shared, without disclosing identifiable personal details.

If the only data [Authority name] received pertains solely to data linked to the Centrelink Confirmation eServices (CCeS) arrangements as described at [link provided], and there were no other forms of DVA data shared, then no CCeS-related data needs to be provided under this request…"

Consultation period

I wrote to you via email on 15 and 22 January to propose a revised scope that would allow us to continuing processing your request. You responded on 26 January 2025 stating that you did not approve a revision of scope.

I wrote to you on 29 January 2025 notifying my intention to refuse your request. This was as the work involved in processing your request would substantially and unreasonably divert the resources of the NDIA from its other operations due to its size and complexity. This is called a “practical refusal reason” under section 24AA of the FOI Act.

In that letter, you were invited to revise the scope of your request, withdraw the request or indicate you did not wish to revise the scope.

You did not respond to this letter within the 14 day timeframe, and as such, we assume that you wish to proceed with your original request.

Decision on access to documents

I am authorised to make decisions under section 23(1) of the FOI Act. My decision on your request and the reasons for my decision are set out below.

I have decided to refuse your request for access under section 24A of the FOI Act.

In reaching my decision, I took the following into account:

  • your correspondence outlining the scope of your request
  • the FOI Act
  • the FOI Guidelines published under section 93A of the FOI Act
  • consultation with relevant officers of the NDIA
  • the NDIA’s operating environment and functions.

Reasons for decision

As you have declined to reduce the scope of your request, the practical refusal reason still exists and I have decided to refuse access on this basis.

You have not confirmed if the NDIA is the agency from which you seek documents, as you have not referred to the National Disability Insurance Agency or the NDIA in the request. Your request instead refers to “Name of Agency” and “Authority name.” These terms are unclear.

We have consulted with relevant NDIA staff who could be expected to be able to identify documents within the scope of the request, including staff who are knowledgeable about how to conduct searches of the NDIA’s systems. This outcome shows that the terms of your request do not provide sufficient information to allow us to identify the specific documents that you are seeking.

In addition, the request is very broad and covers a date range of more than 10 years. You have not provided a targeted document type or category, rather you have requested “any and all”. As such, searches would have to be conducted across every business unit of the NDIA. The NDIA has over 25 different divisions. To do a comprehensive search, we would have to do consultations with all of them to locate “any and all” documents held by the NDIA.

In addition, searches would be required across multiple systems including:

  • PACE case management system
  • CRM case management system
  • LEX case management system
  • Content Manager document holding system
  • SharePoint document management system
  • The entirety of the NDIA email system, requiring specialist IT support
  • General computer files
  • Paper files

The documents assessed as being within scope of the request will then need to be reviewed for any sensitivities and possible exemption under the FOI Act and scheduled, we will need to consider any consultations and carry these out if required, a decision will need to be made on each document, and a decision letter prepared. This will significantly increase the time that it will take an FOI officer to process your request.

As a result, I am of the view that the work involved in the processing of this request would substantially and unreasonably divert the resources of the NDIA from its other operations.

Rights of review

Your rights to seek a review of my decision, or lodge a complaint, are set out at Attachment A.

Should you have any enquiries concerning this matter, please do not hesitate to contact me by email at foi@ndis.gov.au.

Yours sincerely

Cindy – CGN062 Senior Freedom of Information Officer Complaints Management & FOI Branch General Counsel Division

Your review rights

As this matter was a deemed refusal, internal review of this decision is not an option. However, if you have concern with any aspect of this decision, please contact the NDIA FOI team by email foi@ndis.gov.au or by post:

Freedom of Information Section Complaints Management & FOI Branch General Counsel Division National Disability Insurance Agency GPO Box 700 CANBERRA ACT 2601

Review by the Office of the Australian Information Commissioner

The FOI Act gives you the right to apply to the Office of the Australian Information Commissioner (OAIC) to seek a review of this decision.

If you wish to have the decision reviewed by the OAIC, you may apply for the review, in writing, or by using the online merits review form available on the OAIC’s website at www.oaic.gov.au, within 60 days of receipt of this letter.

Applications for review can be lodged with the OAIC in the following ways:

Complaints to the Office of the Australian Information Commissioner or the Commonwealth Ombudsman

You may complain to either the Commonwealth Ombudsman or the OAIC about actions taken by the NDIA in relation to your request. The Ombudsman will consult with the OAIC before investigating a complaint about the handling of an FOI request.

Your complaint to the OAIC can be directed to the contact details identified above. Your complaint to the Ombudsman can be directed to:

Your complaint should be in writing and should set out the grounds on which it is considered that the actions taken in relation to the request should be investigated.