Speech by Karen Curtis, Privacy Commissioner. Delivered to the Institute of Public Administration Australia, 15 June 2006.

Good morning. Delighted to be here.

I note the date - the 15th of June. Today is the 791st anniversary of the signing of the Magna Carta. On this day in 1215, King John of England put his seal to this famous document which has since become an international symbol of liberty and democracy. Australia recognises its influence on our own constitution. On display at Parliament House, there is a 1297 copy of the Magna Carta, and in 2003, a monument to the Magna Carta was erected in Canberra's Parliamentary Triangle.

It seems apt that today - on the anniversary of the signing of the Magna Carta - we should be discussing one of the key features of democracy: open government.

Open government is essential to administrative transparency and accountability, integrity in public life, civil participation, and, of course, democracy. But how is this ideal of open government made tangible and put into practice on a daily basis? Do we have open government in Australia or are they just words? Is it reality or rhetoric?

Along with the Freedom of Information Act 1982 (the FOI Act), the Privacy Act 1988 (the Privacy Act) enshrines the principles of open government in law. Perhaps counter to preconceptions, the Privacy Act, amongst other things, creates transparency rather than prevents it.

In speaking to you today, I will explore the practical applications of both acts and the way in which they work together to make 'open government' rhetoric a reality.

Let us begin by dispelling three myths:

 

1. "The Privacy Act is about secrecy."
2. "The Privacy Act and the FOI Act are diametrically opposed."
3. "Agencies can use the Privacy Act to avoid giving out information under the FOI Act."

Wrong, wrong and wrong! Let me 'bust' each of these myths in order.

Firstly, the Privacy Act is not about secrecy. It's about making sure that the personal information of Australians is respected and handled appropriately. It protects individual privacy, not organisational, body corporate or business privacy. It gives people control, to the extent possible, over their personal information. It allows people to find out what information an organisation holds about them and to amend that information if it is incorrect.

Secondly, the Privacy Act and the FOI Acts are not mutually exclusive or diametrically opposed - but in fact complement each other. They have in common the aim of strengthening transparency of government and work in tandem to give people access and amendment rights to information held by public sector agencies.

Regarding the final myth, an agency that claims that it cannot fulfil an FOI request because of the Privacy Act is very risk averse, lazy or being economical with the truth! There may be good reasons why an agency decides not to release requested documents, such as the exemptions contained within the FOI Act, but in general the two acts have been designed to avoid inconsistency and promote smooth legislative interaction.

Privacy and Freedom of Information: How do they work together?

So, what is the Privacy Act and how does it interact with the FOI Act? The Privacy Act was implemented in 1989 in part as a response to a 1983 Australian Law Reform Commission (ALRC) report recommending privacy legislation and in reaction to the Hawke Government's proposal for an 'Australia Card'. It put in place a number of information handling principles to regulate the way public sector agencies collect, use, store, and disclose individuals' personal information. Since December 2001, the Privacy Act has also covered much of the private sector.

The Privacy Act, like the FOI Act, came out of a period of reform to the administrative law framework. This reform was underscored by the aim of establishing in Australia a more transparent governing system and thus both acts provide for access to certain types of official documents.

Under the Privacy Act, the public sector is governed by 11 'Information Privacy Principles' or IPPs and it is IPP 6, 7 and 11 which are of most relevance to the open government debate. In a nutshell:

• IPP 6 grants individuals access to personal information about them held by agencies;
• IPP 7 provides individuals with the right to correct information held by an agency that is outdated or wrong; and
• IPP 11 puts limits on the disclosure of personal information.

It is in these 3 IPPs that the Privacy Act meets and intertwines with the FOI Act. Like the Privacy Act, the FOI Act provides for the access, alteration and disclosure of certain types of records held by public sector agencies. Let's take a closer look at how these laws interact.1

IPP 6

IPP 6 provides that an agency must allow individuals to access personal information concerning them held by the agency. However, this IPP is subject to the provisions of other applicable laws, of which the FOI Act is one. Therefore, where the information would not be available under the FOI Act, there is no obligation on the part of the agency to allow access under IPP 6. Thus, IPP 6 gives the same right of access to information as is available under the FOI Act.

IPP 7

Sometimes an agency will believe that the personal information it holds is accurate, relevant, up-to-date, complete and not misleading, but the subject of the information will disagree and ask the agency to change, delete or add information.

IPP 7 requires agencies to make corrections to personal information to ensure that records are accurate, relevant to the purpose for which the information was collected, up-to-date, complete and not misleading. But, again, this principle is subject to any applicable limitation encompassed in other laws including the FOI Act. So, where amendment would not be available under the FOI Act, the agency is under no obligation to make the amendment under IPP 7.

Some of those limitations that the FOI Act may place on requests for personal information include:

 

• The person must apply in writing;
• The person must pay a lodgement fee
• As far as practicable the agency must amend the document in a way that does not obliterate the original text;
• The document must have been used, be being used or be available for use for an "administrative purpose".

There are some additional amendment rights under the Privacy Act, where the right to have records amended is slightly broader than the corresponding right under the FOI Act. Those additional amendment rights under the Privacy Act include:

• Amendment on the grounds that the information is irrelevant
• Amendment in the form of deletion of personal information; and
• Amendment of personal information in a record to which he or she has not been provided with lawful access (under either Act)

The FOI Act does not cover amendments under these circumstances. Therefore, there would be instances where a request for amendment falls outside the FOI Act but is within IPP 7 of the Privacy Act.

IPP 11

Finally, IPP 11 places limits on the disclosure of personal information. The emphasis here is on maintaining the privacy of personal information held by public sector agencies. At the same time, however, it encompasses a number of exemptions to allow for disclosures of personal information that are necessary in the community interest.

A disclosure made under the FOI Act is also consistent with IPP 11 because, like IPPs 6 and 7, IPP 11 permits disclosures which are 'required or authorised by or under law'.

Under the FOI Act disclosure provisions, personal privacy is also protected. A document is exempt from release in the case of an FOI request if its disclosure would result in the unreasonable disclosure of personal information about any individual person, including a deceased person. This exemption of course does not apply to people seeking their own personal information.

At points of commonality, which act should be applied?

When the FOI Act and Privacy Act cover similar ground, the question remains as to which act an agency should apply. In general, if an agency receives a request for access under IPP 6 for personal information from the subject of the information, it should deal with it under its normal access processes which will include, but may not be restricted to, FOI. While complaints must be considered on a case by case basis, I will generally decline to investigate complaints where FOI processes have not been exhausted.

However, where a request for access or amendment falls outside the jurisdiction of the FOI Act, the Privacy Act may apply and individuals with a complaint may ask my Office to investigate. An example of falling outside the FOI Act but under the Privacy Act would be the additional amendment rights (deletion, irrelevance etc) available under the Privacy Act.

Are there any major points of divergence between the acts?

There is one point of divergence between the two acts which is worth noting. Under the FOI Act the personal information of deceased persons has the same protections as for living persons, whereas the Privacy Act only protects the personal information of living persons. This is an inconsistency that I raised in my 2005 review of the private sector provisions of the Privacy Act. In that review I recommended that the Government consider whether the jurisdiction of the Privacy Act should be extended to cover the personal information of deceased persons. This would not only remove inconsistencies between the Privacy and FOI Acts, but also between the Privacy Act and some state privacy legislation which also contain protections for deceased persons. This is an issue that the Australian Law Reform Commission will be examining in its current review of privacy laws.

So there you have nuts and bolts of the legislation about personal information that facilitates open government in Australia on a day-to-day basis.

But why go to all this trouble? What's the point?!

At this point it is perhaps timely to think about why these acts were enacted in the first place. It is easy to wax lyrical about open government, but what about the ongoing effort of processing FOI requests, and the time, energy and public resources that are used in the process. What's it all for?

It is beyond my persuasive skills to convince you that processing FOI requests is one of the most exhilarating activities those in the public service can undertake, but I am going to try to convince you that it is necessary and that the advantages of FOI far outweigh the costs.

FOI: Respecting Australians' democratic rights

When the FOI Act was introduced in 1982, it was shaped by a number of ideals. These ideals or principles were well summarised in the first annual report on the operation of the FOI Act in 1983 and are as follows:

• when government is more open to public scrutiny it becomes more accountable;
• if people are adequately informed and have access to information, there is likely to be more public participation in the policy making process and in government itself;
• groups and individuals who are affected by government decisions should know the criteria applied in making those decisions; and
• every individual has a right:
  • to know what information is held in government records about him or her […]
  • to inspect files held about, or relating to him or her
  • to have inaccurate material on file corrected 2

More than 20 years on, some challenges have emerged for the FOI Act. A common concern is that frank and fearless advice to ministers would be damaged by the looming threat of increased numbers of possible FOI requests; that, in order to protect their ministers from embarrassment public servants will become increasingly partisan and their advice politicised.

Certainly this is an issue that requires discussion. However, I think it is worth going back to those original principles for open government (which I just outlined) to remind ourselves of just how important the FOI Act is to the democratic rights we take for granted. I would emphasise that freedom of information, like privacy, is about balance. Let us not allow possible downsides or criticisms to undermine the, on balance, good outcomes that the FOI Act achieves.

Lessons can also be learnt from the experiences other democratic nations which have implemented freedom of information laws. A good example is New Zealand, which has one of the freest freedom-of-information regimes in the world. New Zealand's Official Information Act was also introduced in 1982 and has minimal exemptions. Famously, New Zealand has no FOI exemption for cabinet papers (as we do in Australia).

The New Zealand Privacy Commissioner Marie Shroff has offered insight into the operation of the Official Information Act in New Zealand. She has noted that:

Open government is now deeply ingrained. Normal policy development processes continue but most, and certainly the best, policy advisers now start thinking at an early stage how to consult interest groups and the public. […] Departments and state agencies almost universally cultivate strong stakeholder relationships […] Very few major policies now come as a surprise to the public as they will have been signalled well in advance through these various means3

Shroff also points out that New Zealand's FOI laws encourage accuracy and careful research on the part of policy advisers. With the knowledge that your work may be given public airing comes a greater effort to check facts and footnotes. On the one hand it could be argued that FOI laws encourage public servants to become more politically engaged to avoid producing potentially embarrassing documents. However, on the other hand Shroff notes that enhanced public oversight can also promote more objective, carefully researched and accurate work from policy advisers who anticipate the potential publication of their advices.

FOI and Privacy: Giving people control over their personal info

A final point I wish to emphasise relates to one of the most common uses of the FOI and Privacy Acts: access - not to government policy advices - but to personal information. In the last financial year 39,265 requests for information were received by public sector agencies under the FOI Act. Of those requests, 91% were requests for personal information.4 Media coverage of cases such as the McKinnon FOI request has served to associate freedom of information singularly with high profile governmental disclosures and miss this other fundamental and very important application of the FOI Act.

People exercise this right of access over the way organisations collect and use their personal information. Access laws, such as the FOI Act and the Privacy Act help curtail the possibility of covert collection of information or the development of secret databanks by ensuring people can find out exactly what information an agency holds information about them. In this age of technological sophistication and data-matching, laws like these protect people from unwarranted surveillance and intrusion upon their private lives. The emphases in the FOI and Privacy Acts are upon giving people control over their personal information and making government practices more transparent and accountable.

To conclude…

Today I have outlined the legislative framework in Australia that facilitates open government. I have also tried to dispel myths that identify the Privacy Act as a block to administrative transparency. To the contrary, the Privacy Act, like the FOI Act, enhances our democracy by strengthening open government mechanisms. It is my belief that in Australia, open government is reality and not rhetoric.

At the time of the passage of FOI legislation in Australia, the Senate Legal and Constitutional Committee undertook an investigation into the proposed FOI Act and I think their conclusions are worth repeating. They said:

Very often people have alleged that [our system of government] is under attack by freedom of information legislation when what is actually under attack is their own traditional and convenient way of doing things, immune from public gaze and scrutiny. We are indeed seeking to put an end to that. What matters is not the convenience of ministers or public servants, but what contributes to better government.5

Hear, hear! FOI requests may not always be easy or convenient to process, but when we consider what is enhanced - fair and transparent government - I believe that it is worth the trouble.

1 For more in depth information on how to comply with the IPPs of the Privacy Act see the Information Privacy Principle Guidelines available on our website at http://www.privacy.gov.au/materials#G

2 Annual Report of the Operation of the Freedom of Information Act 1982,December 1982-30 June 1983, Canberra, AGPS 1983, available at http://www.ag.gov.au/agd/FOI/FreedomofInformationAct1982History.htm

3 Marie Shroff, ''The Official Information Act and Privacy: New Zealand''s Story'', Speech presented at the FOI Live 2005 Conference, London

4 Operation of the Freedom of Information Act 1982, 2004-05, available at http://www.ag.gov.au/agd/WWW/agdHome.nsf/AllDocs/D43D82C47B4E21D5CA2570C800100BA2?OpenDocument#c1

5 Senate Legal and Constitutional Committee quoted in Annual Report into the Operation of the Freedom of Information Act 1982, December 1982-June 1983, available at http://www.ag.gov.au/agd/FOI/FreedomofInformationAct1982History.htm