NDIA Accountability Project

This project is in DRAFT

Freedom of Information request — Notification of Decision

‹ PrevPage 1 of 6 · Source p. 1Next ›

Our reference: FOI 21/22-0740

                                                        GPO Box 700
                                                                                 Canberra ACT 2601
                                                                            1800 800 110

21 March 2022 ndis.gov.au

Lesley

By email: foi+request-8219-ac6a2dae@righttoknow.org.au

Dear Lesley

Freedom of Information request — Notification of Decision

Thank you for your correspondence of 21 December 2021, in which you requested access to documents held by the National Disability Insurance Agency (NDIA), under the Freedom of Information Act 1982 (FOI Act).

The purpose of this letter is to provide you with a decision on your request.

Scope of your request You have requested access to documents about the National Disability Insurance Scheme (NDIS). Specifically, you requested access to:

….a copy of the Salesforce cybersecurity assurance that confirms NDIS data, privacy and information has not been compromised, affected or is at risk due to the Log4j2 Security Flaw

On 27 January 2022, the Office of the Australian Information Commissioner (OAIC) provided the NDIA with an additional 14 days to process your request for information under section 15AB of the FOI Act, making 9 February 2022, the new due date to provide you a decision on access.

On 15 February 2022, the Office of the Australian Information Commissioner (OAIC) provided the NDIA with a further 14 days to process your request for information under section 15AB of the FOI Act, making 25 February 2022, the new due date to provide you a decision on access.

On 25 February 2022, the Agency notified you of its intention to consult with a third party under sections 27 and 27A of the FOI Act, and the statutory period for providing you with a decision on access was extended until 27 March 2022.

Decision on access to documents I am authorised to make decisions under section 23(1) of the FOI Act. My decision on your request and the reasons for my decision are set out below.

I have identified one document which falls within the scope of your request.

The document was identified by conducting searches of NDIA’s systems, using all reasonable search terms that could return documents relevant to your request, and consulting with relevant NDIA staff who could be expected to be able to identify documents within the scope of the request.

                                                                                     1

I have decided to grant access to this document in part.

In reaching my decision, I took into account the following:

  • your correspondence outlining the scope of your request
  • the nature and content of the documents falling within the scope of your request
  • the FOI Act
  • the FOI Guidelines published under section 93A of the FOI Act
  • consultation with relevant NDIA staff
  • third party consultation
  • factors relevant to my assessment of whether or not disclosure would be in the public interest
  • the NDIA’s operating environment and functions.

Access to edited copies with exempt or irrelevant material deleted (section 22) I have decided that Document 1 contains material that is exempt from disclosure under the FOI Act, as well as material that is irrelevant to your request. The irrelevant material relates to the names of NDIA staff.

In accordance with section 22 of the FOI Act, I have considered whether it is possible to delete the exempt and irrelevant material from the documents and have concluded that it is reasonably practicable to do so. Accordingly, I have prepared an edited copy of the documents with the exempt and irrelevant material removed.

Reasons for decision Personal privacy (section 47F) Section 47F of the FOI Act conditionally exempts a document if its disclosure would involve the unreasonable disclosure of personal information about any person (including a deceased person).

Paragraph 6.129 of the FOI Guidelines provides that personal information is:

  • information about an identified individual or an individual who is reasonably identifiable
  • says something about a person
  • may be opinion
  • may be true or untrue
  • may be recorded in material form or not.

Document 1 contains information or opinion that, is about an identified individual, or about an individual who is reasonably identifiable, says something about a person, may be an opinion, may be true or untrue, and is recorded in material form. As such, I am satisfied that the relevant material in Document 1 meets the definition of ‘personal information’.

Section 47F(2) of the FOI Act provides that in determining whether the disclosure of documents would involve unreasonable disclosure of personal information, regard must be had to: a. the extent to which the information is well known b. whether the person to whom the information relates is known to be (or to have been) associated with the matters dealt with in the document; c. the availability of the information from publicly accessible sources d. any other matters that the agency considers relevant.

Against these criteria, I take the view that: a. it is apparent from the information that an individual is identifiable; and

b. the information referred to above is not readily available from publicly accessible sources.

I have also had regard to the key factors for determining whether disclosure is unreasonable, in line with Paragraph 6.142 of the FOI Guidelines and I am of the view that: a. Document 1 contains third party personal information b. release of the relevant information in Document 1 would cause stress on the third party c. no public purpose would be achieved through release.

With reference to the assessments above, I have decided that it would be unreasonable to publicly disclose the personal information in Document 1, and is, therefore, conditionally exempt under section 47F(1) of the FOI Act. My considerations of the public interest test are set out below.

Public interest considerations – section 47F

Section 11A(5) of the FOI Act provides that access to a document covered by a conditional exemption must be provided unless disclosure would be contrary to the public interest.

I have not considered any of the irrelevant factors as set out under section 11B(4) of the FOI Act in making this decision.

After considering the public interest factors outlined in section 11B(3) of the FOI Act, I have determined that disclosure of the material identified as subject to conditional exemptions would promote the objects of the FOI Act by providing access to government-held information. However, I consider that:  disclosure of the information would not contribute to the publication of information of sufficient public interest to justify the likely harm caused by release  disclosure of the information would not enhance Australia’s representative democracy in the ways described in section 11B(3) of the FOI Act  disclosure of the information would not inform any debate on a matter of public importance or promote oversight of public expenditure.

While there is limited public interest in the disclosure of information conditionally exempt under section 47F of the FOI Act, the harm that would result from disclosure is that it could reasonably be expected to affect an individual’s right to privacy by having their personal information in the public domain.

In summary, I am satisfied that the factors against disclosure of the information outweigh the factors in favour of disclosure and that, on balance, it would be contrary to the public interest to release this information to you. Accordingly, I have decided that the relevant information in Document 1 is exempt under section 47F of the FOI Act.

Release of documents The documents for release, as referred to in the Schedule of Documents at Attachment A, are enclosed.

Rights of review Your rights to seek a review of my decision, or lodge a complaint, are set out at Attachment B.

Should you have any enquiries concerning this matter, please do not hesitate to contact me by email at foi@ndis.gov.au.

Yours sincerely

[signature]

Carolyn Assistant Director FOI Parliamentary, Ministerial & FOI Branch Government Division

                                                                     4

Attachment A

Schedule of Documents for FOI 21/22-0740

Document number Page number Description Access Decision Comments
1 1-2 Email Subject: Log4j2 vulnerability Date: 13 December 2021 PARTIAL ACCESS Exemption claimed: s47F – personal privacy Irrelevant material removed under section 22 of the FOI Act

Attachment B

Your review rights

Internal Review

The FOI Act gives you the right to apply for an internal review of this decision. The review will be conducted by a different person to the person who made the original decision.

If you wish to seek an internal review of the decision, you must apply for the review, in writing, within 30 days of receipt of this letter.

No particular form is required for an application for internal review, but to assist the review process, you should clearly outline your grounds for review (that is, the reasons why you disagree with the decision). Applications for internal review can be lodged by email to foi@ndis.gov.au or sent by post to:

Freedom of Information Section Parliamentary, Ministerial & FOI Branch Government Division National Disability Insurance Agency GPO Box 700 CANBERRA ACT 2601

Review by the Office of the Australian Information Commissioner

The FOI Act also gives you the right to apply to the Office of the Australian Information Commissioner (OAIC) to seek a review of this decision.

If you wish to have the decision reviewed by the OAIC, you may apply for the review, in writing, or by using the online merits review form available on the OAIC’s website at www.oaic.gov.au, within 60 days of receipt of this letter.

Applications for review can be lodged with the OAIC in the following ways:

Complaints to the Office of the Australian Information Commissioner or the Commonwealth Ombudsman

You may complain to either the Commonwealth Ombudsman or the OAIC about actions taken by the NDIA in relation to your request. The Ombudsman will consult with the OAIC before investigating a complaint about the handling of an FOI request.

Your complaint to the OAIC can be directed to the contact details identified above. Your complaint to the Ombudsman can be directed to:

Your complaint should be in writing and should set out the grounds on which it is considered that the actions taken in relation to the request should be investigated