The FOI Act and APP 12 - A tale of two information access regimes

The Freedom of Information Act 1982 (Cth) (FOI Act) provides a right of access to documents held by the Commonwealth Government. However, it is not the only means for individuals to gain access to information.

Australian Privacy Principle (APP) 12, which is found within Schedule 1 of the Privacy Act 1988 (Cth) (Privacy Act), provides that if an APP entity holds personal information about an individual, the entity must on request of the individual, give the individual access to the information.

This article explores the differences between the two frameworks and provides recommendations on when it is appropriate to use one framework as opposed to the other, and when an agency or Minister may wish to direct an applicant to consider making their request under the FOI Act, or under APP 12.

Who does it apply to?

FOI Act

Section 11 of the FOI Act provides that, subject to the FOI Act, every person has a legally enforceable right to obtain access to a document of an agency or a Minister subject to certain exemptions. An ‘agency’ under the FOI Act means a Department, a prescribed authority or a Norfolk Island authority.

Privacy Act

APP 12 applies to APP entities. An ‘APP entity’ is an agency (generally a Minister or Commonwealth body) or an organisation (generally, a business that is not a small business operator).

APP 12 therefore applies to a broader range of entities than the FOI Act

What can you access?

Under the FOI Act, a person can access documents.

‘Document’ is defined broadly and includes written records, audio, image, or text recordings that can be reproduced and any information stored electronically or mechanically.

Under APP 12, a person may access personal information that an APP entity holds about the person.

‘Personal information’ means information or an opinion about an identified individual, or an individual who is reasonably identifiable, whether the information or opinion is true or not, or recorded in a material form or not.

Importantly, APP 12 does not provide a right of access to other kinds of information other than personal information (or to documents).

How is access obtained?

Under the FOI Act, documents can be obtained by requesting access under s 15. The request must:

• be in writing
• state that the request is an application for the purposes of the FOI Act
• be sent to the agency or Minister
• provide enough information for the document to be identified, and
• provide details of how notices can be sent to the requestor.

APP 12 does not prescribe any requirements on how access may be requested. This is ultimately a matter for the APP entity.

APP 1.3  and APP 1.4(d) require an APP entity to have a clearly expressed and up-to-date privacy policy that sets out how an individual can access their personal information.

An APP entity will usually make its privacy policy available on its website. However, if a person cannot find an APP entity’s privacy policy, they can request a copy under APP 1.6.

How can access be refused?

Under the FOI Act, a person is not entitled to access an exempt document. This includes:

• documents that affect national security, defence or international relations
• documents affecting law enforcement and the protection of public safety, and
• documents containing material obtained in confidence.

Documents can also be conditionally exempt. Access to such documents can be refused if such access would, on balance, be contrary to the public interest. Examples include:

• documents that relate to certain operations of an agency
• documents that involve the unreasonable disclosure of personal information, and
• documents concerning business, commercial or financial affairs of an organisation.

Access can also be refused if the work involved in processing the request would substantially and unreasonably divert the resources of the agency from its other operations.

Under APP 12:

• An agency can refuse access to personal information if the information could be refused under the FOI Act, or any other Act that provides access to documents.
• An organisation can refuse access if an exception applies, including:
  • giving access would have an unreasonable impact on the privacy of other individuals
  • the request is frivolous or vexatious
  • giving access could prejudice negotiations with the individual, or
  • giving access would reveal information in connection with a commercially sensitive decision-making process.

How much will it cost?

Under the FOI Act, an agency or Minister can impose a charge:

• to search for, and retrieve a document
• to produce a written transcript of a document
• to supervise inspection of a document
• to examine, process and decide on access, and
• to make a copy of a document.

Under APP 12:

• An agency is not permitted to impose a charge.
• An organisation is permitted to impose a charge, but that charge must not be excessive.

How long will it take for a request to be processed?

Under the FOI Act, a decision must be made within 30 days. However, that timeframe can be extended:

• by agreement
• for the purposes of consulting relevant third parties, or
• on application to the Information Commissioner.

Under APP 12:

• An agency must respond to the request within 30 days.
• An organisation must respond within a reasonable period after the request is made.

When should an individual make their request under the FOI Act?

Generally speaking, and particularly if an individual is seeking information beyond their own personal information, agencies and Ministers should suggest that individuals make their request under the FOI Act.

The FOI Act is more facilitative for applicants because:

• it applies to any document held by an agency or Minister, not just personal information
• it imposes certain obligations on the agency or Minister to provide assistance, and
• it provides multiple avenues for review, including internal and external review.

When should an individual make a request under APP 12?

If an individual is only seeking their own personal information, a request under APP 12 may be appropriate.  We also note that a request under APP 12 is appropriate when seeking access to personal information held by an organisation that is not an agency, noting that the FOI Act does not apply directly to private organisations.

We also note that APP 12 could be directed at an APP entity where an individual does not require access to specific documents and/or is after information in a specified manner – for example, where the individual only requires a summary of the requested personal information or to receive the information in an alternative format.

It is important to note that individuals generally have a right to make a request for information under either the FOI Act or APP 12. Agencies should ensure they have processes in place to consider and process requests made under both the FOI Act and APP 12. Agencies should also ensure that, where appropriate, they are able to explain to applicants which information access mechanism may be more suitable for the applicant, depending on the type of material the applicant is seeking.

If your agency requires advice or assistance with the processing of FOI or APP 12 requests, please reach out to Chantal Tipene and our team of leading FOI specialists would be happy to assist.