In these extraordinary times, individuals, organisations and government are facing unprecedented challenges to stop the spread of COVID-19. As we navigate these issues, the use of personal information is essential to address this public health crisis. And it’s also important that our personal information is protected and respected, and handled in a way that is reasonably necessary to prevent and manage COVID-19.

In recent days I joined with other members of the Global Privacy Assembly Executive Committee to show our support for public bodies and health practitioners communicating directly with people, and scientific and government bodies coordinating nationally and globally, to tackle the pandemic. The Privacy Act does not stand in the way of exchanging critical information in these circumstances.

However, health information is sensitive information, and any new or changed ways of handling personal information must be reasonable, necessary and proportionate. Personal information must also be kept secure as millions of Australians transition to working from home.

We’ve released advice for employers on how to take reasonable steps to address these challenges. We’re also providing advice to government agencies and organisations on information handling practices to support economic and public health initiatives in the public interest.

Ongoing changes to working arrangements have the potential to affect agencies’ ability to meet statutory timeframes under the Freedom of Information Act. We’re encouraging agencies to use self-service or administrative access schemes where possible to provide access to information. They should also consider any potential delays early in the process and seek agreement from applicants to extend the timeframe where required, or where necessary apply to the OAIC for an extension, clearly setting out the factors contributing to delay.

The OAIC is continuing to provide services to the community and regulated entities with adjustments to keep our staff and others safe. Our enquiries line is now operating as a call back service and we are encouraging people to use our online forms wherever possible.

We are committed to providing the community with the advice it needs to protect personal information in these difficult circumstances.  We are also preparing for the challenges and solutions that may lie ahead, and their implications for our privacy and information access rights, so we can be ready to assist the nation and ensure these rights are protected as we respond to the pandemic.

Angelene Falk
Australian Information Commissioner and Privacy Commissioner

The OAIC has developed privacy guidance for Australian Government agencies and organisations covered by the Privacy Act 1988 to help keep workplaces safe and handle personal information appropriately as part of the COVID-19 response. 

This includes:

• Using and disclosing individuals’ personal information, including sensitive health information, on a ‘need-to-know’ basis
• Only collecting, using or disclosing the minimum amount of personal information reasonably necessary to prevent or manage COVID-19
• Advising staff about how their personal information will be handled in responding to any potential or confirmed COVID-19 cases in the workplace
• Taking reasonable steps to keep personal information secure, including where employees are working remotely.

We also acknowledge that the impact of the coronavirus may affect the ability of agencies to meet statutory timeframes for processing freedom of information requests. We recommend agencies consider a range of measures to help meet these obligations, including using self-service or administrative access schemes, updating information for FOI applicants,  and seeking agreement to extend the processing timeframe where necessary. If you have any questions about these issues please email us at [email protected].

The Australian Information Commissioner has lodged proceedings against Facebook in the Federal Court, alleging the social media platform has committed serious and/or repeated interferences with privacy in contravention of Australian privacy law. She considers these were systemic failures to comply with Australian privacy laws by one of the world’s largest technology companies.

“All entities operating in Australia must be transparent and accountable in the way they handle personal information, in accordance with their obligations under Australian privacy law,” Commissioner Falk said.

We have updated three of our FOI SmartForms, which now have new URLs. Please use these new links to update your bookmarks and references to OAIC SmartForms on your website or other materials. 

We encourage everyone to use these forms to apply for extensions of time or an IC review or to submit an FOI complaint.

The previous URLs will be retired on 3 April 2020.

IC Request Form - Agency extension of time for processing an FOI request

• New URL: https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICRF_1
• Old URL: https://forms.business.gov.au/aba/oaic/foi-agency-extension-of-time-/

• New URL: https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICCA_1
• Old URL: https://forms.business.gov.au/aba/landing.htm?formCode=ICCA_1

• New URL: https://forms.business.gov.au/smartforms/servlet/SmartForm.html?formCode=ICR_10
• Old URL: https://forms.business.gov.au/aba/oaic/foi-review-/

You can catch up with our submissions on a range of legislative and other issues through our website, including comments to the Department of Home Affairs regarding the Draft Code of Practice – Securing the Internet of Things.

Information Commissioner review decisions and privacy determinations are listed on our website and published in full on AustLII. Recent Information Commissioner decisions include:

• Services Australia and ‘RS’ (Freedom of information) [2020] AICmr 6
  Vexatious applicant declaration — Whether person should be declared a vexatious applicant — Whether person repeatedly engaged in access actions that involve an abuse of process — Whether access actions harass or intimidate an individual or an employee of an agency — Whether requests designed to intimidate agency staff and force them to capitulate on another issue — Whether the access actions unreasonably interfere with agency operations — Vexatious applicant declaration made for 2 years
• Asylum Seeker Resource Centre and Department of Home Affairs (Freedom of information) [2020] AICmr 7
  Request for access to Serco policy and procedure manual — Whether disclosure would disclose commercially valuable information — Whether disclosure would have substantial adverse effect on proper and efficient conduct of agency operations — Whether contrary to public interest to release conditionally exempt documents — Decision under review set aside
• ‘RT’ and Australian Taxation Office (Freedom of information) [2020] AICmr 8
  Request for access to Microsoft Outlook calendar invitations sent by two named ATO officers — Whether reasonable steps taken to find documents — Searches of backup tapes — Decision under review affirmed
• Microflite Helicopter Services and Civil Aviation Safety Authority (Freedom of information) [2020] AICmr 9
  Access grant — Request for access to documents relating to investigation into possible low flying helicopters filming 2018 Adelaide 500 Supercars event — Whether documents contain commercially valuable information — Whether disclosure would unreasonably affect an organisation in respect of its lawful business affairs — Whether contrary to the public interest to release conditionally exempt documents — Decision under review affirmed
• 'RU' and Services Australia (Freedom of information) [2020] AICmr 10
  Request for access to information about an investigation — Whether reasonable steps taken to locate documents — Decision under review affirmed