Our reference: FOI 21/22-1542

GPO Box 700 Canberra ACT 2601 1800 800 110 dis.gov.au

8 July 2022

Shirley By email: foi+request-8876-50d8f973@righttoknow.org.au

Dear Shirley

Freedom of Information request — Notification of Decision

Thank you for your correspondence of 8 May 2022, in which you requested access under the Freedom of Information Act 1982 (FOI Act) to documents held by the National Disability Insurance Agency (NDIA).

The purpose of this letter is to provide you with a decision on your request.

Scope of your request You have requested access to documents about the National Disability Insurance Scheme (NDIS). Specifically, you requested access to:

Please provide a copy of the NDIA Offsite Data Records Storage Policy and Procedures. That is, the specific policy and procedures that guide, manage and evaluate the NDIA’s data records stored and/or accessed from the various NDIS physical sites or locations.

Decision on access to documents I am authorised to make decisions under the FOI Act. My decision on your request and the reasons for my decision are set out below.

I have identified 5 documents which fall within the scope of your request.

The documents were identified by conducting searches of NDIA’s systems, using all reasonable search terms that could return documents relevant to your request, and consulting with relevant NDIA staff who could be expected to be able to identify documents within the scope of the request.

I have decided to grant access to 4 documents in full, and one document in part.

In reaching my decision, I took into account the following material: • your correspondence outlining the scope of your request; • the nature and content of the documents falling within the scope of your request; • the FOI Act; • the FOI Guidelines; • consultation with relevant NDIA staff; • factors relevant to my assessment of whether or not disclosure would be in the public interest; and • the NDIA’s operating environment and functions.

1

Access to edited copies with exempt or irrelevant material deleted (section 22)

I have identified that documents falling within the scope of your request contain material that is irrelevant to your request. The irrelevant material relates to names and contact details of NDIA staff.

In accordance with section 22 of the FOI Act, I have considered whether it is possible to delete the exempt and irrelevant material from the documents and have concluded that it is reasonably practicable to do so. Accordingly, I have prepared an edited copy of the documents with the exempt and irrelevant material removed.

Reasons for decision

Certain operations of agencies (section 47E(d))

Section 47E(d) of the FOI Act conditionally exempts a document if its disclosure would, or could reasonably be expected to, have a substantial adverse effect on the proper and efficient conduct of the operations of an agency.

Documents within the scope of your request contain information relating to certain operations of the NDIA, specifically internal guidance given to staff in relation to verifying the identity of applicants, internal contact points, and the processes as well as systems used to monitor and manage requests received by the NDIA.

The disclosure of this information would reveal methodologies the NDIA uses to assist in determining how sufficient proof of identity is established and how requests may be monitored and managed using particular systems. Furthermore, disclosing individual contact details may jeopardise the use of internal single points of contact.

I am satisfied that the release of this information would potentially result in the public disclosure of internal methodologies that, through improper use, would, or could, lead to individuals seeking to circumvent identity checks to fraudulently misrepresent themselves. Additionally, system vulnerabilities may be identified in how requests are monitored and managed may lead to bad faith actors seeking to exploit or circumvent particular processes. I am satisfied that this would substantially and adversely affect the integrity of the NDIA’s statutory functions in relation to the FOI Act.

I am also satisfied that there is a reasonable likelihood of aggrieved members of the public seeking to gain advantage over others by using internal points of contact in place of the appropriate points of contact and that release of this information could reasonably be expected to have an adverse effect on the proper and efficient conduct of the operations of the Agency, namely the Agency’s ability to conduct its operations in a timely and efficient way.

Public interest considerations – section 47E(d)

Under the FOI Act, access to a document covered by a conditional exemption must be provided unless disclosure would be contrary to the public interest.

After considering the public interest factors outlined in section 11B(3) of the FOI Act, I have determined that disclosure of the material identified as subject to conditional exemptions would provide access to information relating to the applicant. However, I have considered that: • disclosure of the information would not contribute to the publication of information of sufficient public interest to justify the likely harm caused by release; • disclosure of the information would not enhance Australia’s representative democracy in the ways described in section 11B(3) of the FOI Act; and • disclosure of the information would not inform any debate on a matter of public importance or promote oversight of public expenditure.

Release of Documents

While there is limited public interest in the disclosure of information conditionally exempt under section 47E(d) the harm that would result from disclosure is that it could reasonably be expected to prejudice the ability of the NDIA to protect the security and integrity of information released by the NDIA, and undermine the effectiveness of processes in relation to the NDIA’s statutory functions.

In summary, I am satisfied that the factors against disclosure of the information outweigh the factors in favour of disclosure and that, on balance, it would be contrary to the public interest to release this information to you.

The documents for release, as referred to in the Schedule of Documents at Attachment A, are enclosed.

Rights of Review

Your rights to seek a review of my decision, or lodge a complaint, are set out at Attachment B.

Should you have any enquiries concerning this matter, please do not hesitate to contact me by email at foi@ndis.gov.au.

Yours sincerely

Kylie Senior Freedom of Information Officer Parliamentary, Ministerial & FOI Branch Government Division

Attachment A

Schedule of Documents for FOI 21/22-1542

Document number	Page number	Description	Access Decision	Comments
1	1-12	NDIA Records Management Policy Dated: 30 August 2013	PARTIAL ACCESS Exemption claimed: S47E(d) – Certain operations of agencies	Irrelevant material removed under section 22 of the FOI Act.
2	13-23	Information and Records Normal Administrative Practice Dated: October 2018	FULL ACCESS	Irrelevant material removed under section 22 of the FOI Act.
3	N/A	Archives Act 1983	FULL ACCESS Available: https://www.legislation.gov.au/Detail s/C2021C00218	The web address provides a link to the Archives Act 1983. Please note the link is for the current version at the date of decision.
This relates to part of your request.
If you require the document in a different format, please contact foi@ndis.gov.au
4	N/A	Digital Continuity Policy 2020	FULL ACCESS Available: https://www.naa.gov.au/information- management/information-management-policies/about-digital-continuity-2020-policy	The web address provides a link to the Digital Continuity Policy (2020). Please note the link is current at the date of decision.
This relates to part of your request.
If you require the document in a different format, please contact foi@ndis.gov.au

Attachment B

Your review rights

Internal Review

The FOI Act gives you the right to apply for an internal review of this decision. The review will be conducted by a different person to the person who made the original decision.

If you wish to seek an internal review of the decision, you must apply for the review, in writing, within 30 days of receipt of this letter.

No particular form is required for an application for internal review, but to assist the review process, you should clearly outline your grounds for review (that is, the reasons why you disagree with the decision). Applications for internal review can be lodged by email to foi@ndis.gov.au or sent by post to:

Freedom of Information Section Parliamentary, Ministerial & FOI Branch Government Division National Disability Insurance Agency GPO Box 700 CANBERRA ACT 2601

Review by the Office of the Australian Information Commissioner

The FOI Act also gives you the right to apply to the Office of the Australian Information Commissioner (OAIC) to seek a review of this decision.

If you wish to have the decision reviewed by the OAIC, you may apply for the review, in writing, or by using the online merits review form available on the OAIC’s website at www.oaic.gov.au, within 60 days of receipt of this letter.

Applications for review can be lodged with the OAIC in the following ways:

• Online: www.oaic.gov.au
• Post: GPO Box 5218, Sydney NSW 2001
• Email: enquiries@oaic.gov.au
• Phone: 1300 363 992 (local call charge)

Complaints to the Office of the Australian Information Commissioner or the Commonwealth Ombudsman

You may complain to either the Commonwealth Ombudsman or the OAIC about actions taken by the NDIA in relation to your request. The Ombudsman will consult with the OAIC before investigating a complaint about the handling of an FOI request.

Your complaint to the OAIC can be directed to the contact details identified above. Your complaint to the Ombudsman can be directed to:

• Phone: 1300 362 072 (local call charge)
• Email: ombudsman@ombudsman.gov.au

Your complaint should be in writing and should set out the grounds on which it is considered that the actions taken in relation to the request should be investigated

---

1