A guide to applying s 38(2) of the FOI Act - allowing disclosure of an applicant's own personal information where secrecy provisions would otherwise apply

When considering the disclosure of information protected by a secrecy provision under s 38 of the FOI Act, an FOI decision-maker may have to release information which would otherwise be exempt, where it is the personal information of the FOI applicant themselves. However, this only applies to information which is solely about applicant or to mixed information in which the applicant’s personal information can be practically separated. Documents containing “mixed information”, in which the applicant’s personal information is so intermingled with other parties that disclosure would include the information of third parties, will remain exempt from disclosure under s 38.  

The s 38 exemption

Relevantly, s38 of the FOI Act operates to protect the operation of secrecy provisions present in other legislative instruments, ensuring that the FOI process cannot be used as a back door to access certain protected information. Under s 38, information which would otherwise be released will be exempt if its disclosure is prohibited under a provision of an Act specified in Schedule 3, or where s 38 of the FOI Act is expressly applied to the document by a provision of any other enactment.

In the recent case of Endacott and Chief Executive Officer, Services Australia (Freedom of Information) [2025] ARTA 2519 (Endacott) at paragraph [55], the Tribunal stepped out the application of s 38 of the FOI Act, the relevant considerations being:

1. whether the redacted parts of the documents in issue contain 'protected information'?
2. if they contain protected information, is the information 'concerning another person', such that a secrecy provision applies?
3. whether an exception applies (either that the enactment permits disclosure to the applicant, or the information is the personal information of the applicant)?

For a more comprehensive discussion of this case, please click here to read our previous article blog post on Endacott.

Section 38(2) carve out for personal information of the applicant

Importantly, the s 38 exemption does not apply, and information may be released in so far as it contains personal information about the applicant. Endacott confirmed that the FOI Act adopts the definition of personal information taken from the Privacy Act 1988 (Cth) (Privacy Act) when applying s 38(2), being

’Information or an opinion about an identified individual, or an individual who is reasonably identifiable:

a.     whether the information or opinion is true or not; and

b.     whether the information or opinion is recorded in a material form or not.’

Mixed information

However, the FOI guidelines at paragraph 5.137 provide that the s 38(2) exception applies only to personal information which is solely about the FOI applicant and not to ‘mixed personal information’. Mixed information being personal information about the FOI applicant which, if disclosed, would also reveal personal information about another individual.

For example, the Tribunal in Endacott found that certain information contained in the relevant documents related to both Child Support parties and therefore could not be considered the applicant’s personal information for the purpose of s 38(2).

In assessing mixed information, a decision maker must ‘undertake a detailed consideration of the extent of the intermingling of the two types of information’ and disclose the applicant’s personal information where possible ('AIF' and Services Australia (Freedom of information) [2024] AICmr 51 at [36]).

Where separation is possible

Where it is possible to separate the mixed information so that certain documents or sections relate solely to the applicant, the decision maker should apply s 38(2) and disclose the information to the applicant, despite the potential application of a secrecy provision. In Endacott, the Tribunal found that redactions had been appropriately applied to notes of telephone conversations and letters between the applicant and other parties which contained ‘mixed personal information’, allowing certain documents to be released under s 38(2).

Where separation is not possible

Conversely, the Tribunal in Endacott confirmed that where the applicant’s personal information is mixed or intermingled with other information and cannot be disclosed without revealing the personal information of another individual, the exception in s 38(2) does not apply. Subsequently, where information is so intermingled that it cannot be practically separated, for example through the application of redactions, it will remain exempt and be excluded from disclosure, even though it may relate to the applicant’s personal affairs.

Narrow application of s 38(2)

It is important to note that the s 38(2) carve out applies narrowly to personal information and has not historically taken into consideration other contextual factors, including whether or not the applicant may already have access to the information (Endacott) or whether the information could reasonably be assumed to be known to the FOI applicant (AFV and Services Australia (Freedom of information) [2023] AICmr 125 at [48]). Notably the Tribunal emphasised that ‘the test is not whether information already is, or may be, known to an applicant, but how the relevant legislation applies to it.’

In Endacott, the s 38 exemption was not overcome by the fact that the applicant had previously been granted access to the documents or had access to information that may have been contained in the ‘mixed personal information’ to which the s38 exemption applied. Similarly, the Tribunal found certain information to remain protected despite being included in a previous FOI disclosure, because there was no exception in the secrecy provision for protected information which is already in the public domain.

Equally, in ‘ADN’ and the Australian Taxation Office (Freedom of information) [2023] AICmr 44 the Acting FOI Commissioner found that the information remained protected despite the third-party consenting to disclosure to the applicant, because consent is not a defence to the offence of disclosure under the Taxation Administration Act 1953 (Cth).

Overriding s 38(2)

It is important to remember that the s 38 exemption will continue to apply, even to the personal information of the applicant, where certain secrecy provisions are relevant under s 38(3) and s 38(3A) the FOI Act. Specifically, the applicant’s personal information cannot be disclosed under s 38(2) where disclosure is prohibited under s 503A of the Migration Act 1958, as affected by s 503D of that Act or under subsection 29A(7) of the Research Involving Human Embryos Act 2002.

Key takeaways

1. Section 38 of the FOI Act exempts information affected by certain secrecy provisions and operates to preserve the application of Australian secrecy provisions, the effective operation of non-FOI legislation and confidential information collected under other legislative instruments.
2. Unless any other exemptions apply, personal information of the applicant should be disclosed despite the application of any secrecy provisions under s 38(2). This exception is extended to ‘mixed information’ so far as the applicant’s personal information can be practically separated and disclosure would not include information relating to other individuals.
3. All is applied narrowly and contextual considerations which may be considered elsewhere in the FOI Act have been found largely irrelevant to the application of s 38(2), including whether:
   1. the applicant was in fact already aware of any protected information,
   2. the information was included in previous FOI disclosures, and
   3. the information exists in the public domain.

If your agency requires advice or assistance with the processing of FOI requests, please reach out to Chantal Tipene and our team of FOI specialists would be happy to assist.