Other Information
FOI Solutions Training Sessions
The upcoming training sessions for June/July are as follows:
- Basic 1: Wednesday, 2 September
- Basic 2: Thursday, 3 September
- Intermediate 1: Wednesday, 23 September
- Intermediate 2: Thursday, 24 September
For more information or to register, please view our website or send an email to marketing@foisolutions.com.au requesting a copy of the brochure/registration form.
Question Time
Q: When to consult with third party individuals?
A: We often receive queries about consultation with individuals under the FOI Act and have prepared this quick overview to assist with the ins and outs of consulting under s 33(2B).
Under the FOI Act, agencies are required to consult with individuals if a requested document contains “personal affairs information” which is broadly defined in s 33(9).
If a document contains personal affairs information about someone other than the applicant, then the agency must consult with the individual to ascertain whether disclosure would be unreasonable. An agency is obliged to consult with individuals affected even if they are staff within the agency and doing so is likely to avoid the risk of potential privacy breaches through inadvertent disclosure of personal information. There are exceptions to the obligation to consult set out in s 33(2C), which include where the notification would be reasonably likely to endanger that person’s life or physical safety, or cause them undue distress, or be reasonably likely to increase the risk to that person (as a primary person) and their safety from family violence. It also may be otherwise, unreasonable in the circumstances or not reasonably practicable to do so. These more catch-all provisions could relieve consultation as being not reasonable in circumstances where you have already recently consulted with the individual, or they are a public figure and the information is already in the public arena.
The third-party individual has the right to contend that the document with their personal affairs information would be unreasonable to disclose and is therefore exempt. However, the decision maker is not bound by the response when making the decision and can form their own view on whether s 33 applies. If the agency decides to release the personal affairs information but did not obtain consent from the third party to do so, then it must notify the third-party individual and notify them of their right to seek review of that decision by the Victorian Civil and Administrative Tribunal. Once notified, the agency must wait until their review rights have expired before giving access to documents to the applicant. Finally, when an agency undertakes consultations, the statutory time frame for making the decision can be extended unilaterally by up to 15 days by giving notice to the applicant. Although an extension of up to 30 days can be sought by consent, as a first alternative. If we can assist further with your consultation obligations, please let us know.
Q: How often should my agency review its privacy policies?
A: Privacy policies should be reviewed annually to ensure they provide current and up to date information about how your agency collects, stores and uses data. Keeping reviews regular will assist your agency in staying up to date with its legal obligations and addressing incremental changes to privacy laws. Your reviews of your privacy policy should consider the use of plain language and take into account more recent concepts such as your agency’s AI usage, whether it reflects your data breach responses (and whether these can be strengthened), your use of Privacy Impact Assessments, and your data handling practices.
Alongside regular reviews of privacy policies, agencies should remain proactive in updating privacy policies when changes come into place within your organisation, including structural changes, new technologies and new security practices. Often when there are new technologies or security practices, your agency should also be implementing a new Collection Notice that complies with Information Privacy Principle (“IPP”) 1.3 and aligns with your privacy policy.
If your agency needs assistance with reviewing your privacy policy, creating Collection Notices or Privacy Impact Assessments, or advice regarding privacy, please do not hesitate to contact our firm.