Recent Cases: Victoria
Kirkham v Office of the Victorian Information Commissioner [2025] VCAT 1031(24 November 2025)
Facts
Dr Reuben Kirkham (“applicant”) made an FOI request to the Office of the Victorian Information Commissioner (“Commissioner”) for copies of any reports of redaction errors made to the Commissioner in 2022 including the name of the public authority and any actions taken in response.
The Commissioner identified 12 notifications of data breaches made by organisations relating to redaction issues, and refused access to the applicant as they contain information about an individual or organization obtained by the Commissioner in the course of performing its functions under the PDP Act. The functions were performed under the Victorian Protective Data Security Standards (“Standards”), which ask organisations to notify the Commissioner of incidents having an adverse impact on the confidentiality of public sector information. Section 120 of the PDP Act prohibits the Commissioner’s staff from disclosing such information except for specific circumstances, making the documents exempt from release under s 38 of the FOI Act. The applicant sought review by the Victorian Civil and Administrative Tribunal (“Tribunal”).
Held
The Tribunal affirmed the Commissioner’s decision to refuse access.
Reasoning
Documents subject to secrecy provisions: s 38
The Tribunal considered the Commissioner’s functions in relation to the Standards and whether redaction notifications are incident notifications under the notification scheme of Standard 9, it then considered whether s 120 of the PDP Act met the requirements of s 38 of the FOI Act. Section 120 of the PDP Act was held to apply specifically to the information in the redaction notifications as it included information able individuals and organisations which was received by officers of the Commissioner in the court of performing its functions under the PDP Act. Therefore, s 120 was a prohibition on the Commissioner from disclosing the information meaning s 38 of the FOI Act applied. The Tribunal confirmed that even if the Commissioner were able to disclose the information, the secrecy provision could still apply. The Commissioner would not required be to seek written consent from the relevant organisations, as neither the PDP Act nor the FOI Act require this action.
Does public interest require the disclosure of the documents: s 50(4)
The Tribunal viewed the public interest as not requiring access to the redaction notifications. Parliament intended information about an individual or organisation, obtained by the Commissioner in the course of performing its functions under the PDP Act, to be prohibited from disclosure except for in limited circumstances. Further, there was no widespread public debate that the redaction notifications could assist with, the documents did not evidence misconduct or impropriety but merely indicated that the relevant organisations took their information security obligations seriously.
Producing an edited copy of the documents: s 25
It was not practicable to grant access to the redaction notifications with deletions or editing because doing so would render the documents to be without meaning in the context of the FOI request. Explanation of the documents were provided confirming they were an Information Security and Privacy Incident Notification Form, with the inserted text being almost entirely about the organisation; or agency spreadsheets, with the majority of the document being information about the organisation; and lastly, emails from an organisation, where the document was primarily information about the incident at the organisation.
Davis v Department of Energy, Environment and Climate Action [2026] VCAT 41
Facts
In May 2024, the Department of Energy, Environment and Climate Action (“Department”) published a Regulatory Impact Statement (“Statement”) assessing the impacts of amending the Residential Tenancies Regulations 2001 (Vic) and Residential Tenancies (Rooming House Standards) Regulations 2023 (Vic) to introduce minimum energy efficiency and safety standards. The Honourable David Davis MP (“applicant”) requested access to the modelling of the Statement under the FOI Act. The Department issued a decision regarding the request. After having identified the cost-benefit analysis spreadsheets as the relevant documents, it claimed them as exempt in full under s 34(1) of the FOI Act. The applicant applied to the Office of the Victorian Information Commissioner (“Commissioner”) for review of the Department’s decision, and with no decision made within the statutory period subsequently applied to the Victorian Civil and Administrative Tribunal (“Tribunal”) for review of the Commissioner’s decision taken to have been made refusing access.
Held
The Tribunal affirmed the Department’s decision, finding the documents to be exempt, the public interest did not require disclosure, and the documents were not practicable to provide in an edited form.
Reasoning
Trade secrets: s 34(1)(a)
The Department had engaged a third party to assist it prepare the statement, which was done with spreadsheets created to model the effect of reform options. The Tribunal first considered whether disclosure of the spreadsheets would disclose that third party’s trade secrets. The Tribunal considered how the documents had been prepared and whether they were related to a process that was not in common use or public knowledge.
The Tribunal agreed that the spreadsheets would disclose information related to trade secrets. The information included methodology and formulae as well as the use of secondary source input. The methodology had been developed over several years and was not known to the third party’s competitors, and if it were disclosed, it would be of value to competitors and impact upon the third party’s competitive position for other future advisory work.
Information relating to other matters of a business, commercial or financial nature: ss 34(1)(b) and 34(2).
The Tribunal considered whether the disclosure of information relating to other matters of a business, commercial or financial nature would expose the third party unreasonably to disadvantage. The Tribunal considered whether disclosure would expose the third party unreasonably to disadvantage and ultimately found that this would be the case. In making this finding, the Tribunal considered that disclosure of the information would likely cause substantial harm to the third party’s competitive position, that the information was generally not available to competitors and the information included modelling and assumptions adopted as well as spreadsheets.
Does public interest require disclosure: s 50(4)
While there was a community benefit in allowing scrutiny of the Statement and its underlying analysis, the document itself already provides significant information. Disclosure of the spreadsheets might add to transparency and accountability, however that was not a sufficient public interest ground to require the disclosure of the spreadsheets. Substantial steps had been taken to keep the information confidential and disclosure would be likely to expose the third party unreasonably to disadvantage. Following this analysis, the Tribunal found that factors against disclosure weighed more heavily than factors favouring disclosure, therefore the public interest did not require the Department to disclose the spreadsheets.
Is it practical to grant access to a copy of the documents with deletions: s 25
The Tribunal considered that it was not practicable to grant access to the spreadsheets in an edited form so as to remove trade secrets. It considered the nature of the documents, finding it was impractical to remove parts of the documents. With fields having formulae drawing on data from within documents, it was impracticable to slice out parts of the electronic file documents with the secret information. In any event, with exempt information removed, the edited form of the documents would not provide meaningful documents because information such as methodology, formulae and data sources would need to be deleted. An edited form of the documents would not advance the purpose of further analysing the options in the Statement or further understanding the cost benefit approach.