GIPA Guideline 4 - Personal information as public interest consideration under the GIPA Act

GIPA Guideline 4: Personal information as a public interest consideration under the GIPA Act (PDF, 443kb)

The Information Commissioner is empowered under sections 12(3) and 14(3) of the Government Information (Public Access) Act 2009 (NSW) (the GIPA Act) to issue guidelines to assist agencies regarding the public interests in favour of, or against disclosure.

These guidelines, made pursuant to those sections of the GIPA Act, are to assist agencies to deal with requests for personal information under the GIPA Act. It deals with formal and informal requests by people for their own information, and for the personal information of third parties.  

This guideline supplements the provisions of the GIPA Act. Agencies must have regard to it in accordance with section 15(b) of the GIPA Act.

As this issue involves a privacy-related public interest, the Information Commissioner has also consulted with the Acting Privacy Commissioner in developing these guidelines, as required by section 14(4) of the GIPA Act.

The operation and effectiveness of the Guidelines will be reviewed after twelve months.

Deidre O’Donnell

Information Commissioner

December 2011

Introduction

Personal information can be both a consideration in favour of disclosure, and a consideration against disclosure. This Guideline is to assist agencies to understand what personal information means, and how to properly apply those considerations when carrying out the public interest test under the Government Information (Public Access) Act 2009 (NSW).

Overview

Of all categories of information held by government agencies, the type most often requested is personal information. People may request access to their own personal information, either in its own right or in combination with other government information, or they may seek access to the personal information of other people.

Dealing with requests for personal information can present agencies with a number of specific challenges. For example:

  • there are two options for people to apply for access to their own personal information: under the Government Information (Public Access) Act 2009 (NSW) (GIPA Act) and under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act). This can cause confusion for agencies and the public;
  • personal information is defined differently in the GIPA Act and the PPIP Act; and
  • under the GIPA Act, personal information can be a public interest consideration both for and against disclosure, depending on the circumstances.

Under sections 12(3) and 14(3) of the GIPA Act, the Information Commissioner may make guidelines to assist agencies regarding the public interest considerations in favour of, or against, disclosure of information. This Guideline is made to assist agencies to deal with requests for personal information under the GIPA Act. It covers formal and informal requests by people for their own personal information, and for the personal information of third parties.

Specifically, this Guideline covers:

  • the definition of personal information under the GIPA Act and the type of information that would be covered;
  • whether agencies should apply the GIPA Act or PPIP Act definition of personal information when dealing with requests under the GIPA Act;
  • factors to consider when looking at personal information as a public interest consideration in favour of disclosure under the GIPA Act; and
  • factors to consider when looking at personal information as a public interest consideration against disclosure under 3(a) and 3(b) of the Table at section 14 of the GIPA Act.

This Guideline does not cover how agencies should deal with requests under the PPIP Act. The PPIP Act is only considered insofar as it affects requests for personal information made under the GIPA Act. Agencies can find detailed information about the PPIP Act on the Office of the Privacy Commissioner’s website.

This Guideline is supported by other material on the OIC website. (Note: the OIC is now the IPC)

The Privacy Commissioner has been consulted in accordance with section 14(4) of the GIPA Act.

Agencies are required to have regard to this guideline in accordance with section 15(b) of the GIPA Act. 

Part 1: Personal information for the purposes of the GIPA Act

Definition of personal information in the GIPA Act

1.1   People may apply under the GIPA Act for personal information about themselves, or about third parties. Personal information is defined in Schedule 4[4] to the GIPA Act as:

“information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual (whether living or dead) whose identity is apparent or can reasonably be ascertained from the information or opinion. Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics.”

1.2   Information that can be classed as personal cannot be listed exhaustively. Below are common examples of  information that generally falls into the category of personal information for the purposes of the GIPA Act:

Common examples of personal information: (NB this is not an exhaustive list)

  • a person’s name;
  • personal address and contact details, such as email and phone numbers;
  • information about a person’s family life;
  • financial information, including bank accounts and investments;
  • employment information, including details of salaries, personnel records, and recruitment information, including job recommendation and referee reports;
  • photographs or audio or video recordings, including CCTV footage, which identifies individuals;
  • information about a person’s hobbies or interests;
  • information about a person’s education, including the degree they obtained and the marks they were awarded;
  • membership of voluntary or professional bodies, including trade unions;
  • information about a person’s religion;
  • information about sexual preference;
  • alpha-numeric or biometric information that can identify an individual; and
  • medical and health information.

Personal information includes opinions

1.3   The definition of personal information specifically includes opinions about individuals. Opinions would be considered “personal information” under the GIPA Act where that opinion is about an individual whose identity is apparent or can “reasonably be ascertained” from that opinion or from other accompanying information. Examples of where an opinion could amount to personal information include:

  • the report of a referee about an applicant for public sector employment;
  • comments recorded by a supervisor about an employee during achievement planning;
  • notes made by staff of a public hospital about a patient or an employee;
  • views expressed about a member of the public during a local council meeting;
  • witness statements taken during the course of a disciplinary investigation; or
  • a file note made by a public servant expressing views about a colleague or a member of the public.

1.4   The definition refers to opinions being “about” individuals. This suggests that the personal information conveyed by the opinion is that of the subject rather than the person who gives the opinion. For example, in an opinion given in a referee report, the personal information is that of the person being refereed, rather than of the referee. However, in offering an opinion about someone else, personal information about the giver of the opinion may also be revealed. To take the example of a witness making a statement during a disciplinary investigation, the following personal information about the witness may be included:

  • name, address, and contact details;
  • employment information such as where the witness works, how long they have been employed, and any qualifications that may be relevant to the context of the statement; and
  • information about the relationship between the witness and the person being investigated.

What does whose identity is apparent or can reasonably be ascertained mean?

1.5   Information will only be considered to be “personal” if it is about an individual whose identity is “apparent or can reasonably be ascertained”. Obviously, the identity of the person will be apparent where the information includes his or her name. It may also be apparent where the person is not named. For example, a person’s identity can be apparent through a photograph.

1.6   A person’s identity may be apparent where neither the name nor a photograph is involved, but the information about the person is such that it could not be referring to anyone else. An example would be a reference to “the President of the United States in 2011”, or “the current Director General of Department X”. This is known as “constructive identification”.

1.7   Whether the identity of a person can “reasonably be ascertained” will depend on the type of information and the context in which it is being used. It is not necessary that the identity of the person be widely known: it will be sufficient to satisfy the definition of personal information if the information is communicated to someone who is able to identify the person. For example, a government employee may talk to a group of colleagues about a member of the public who visits them frequently, noting the person’s gender, approximate age and physical appearance. Although the person is not named, the combination of information and the context enable the people hearing the information to identify the subject.

What is not considered to be personal information under the GIPA Act

1.8   In the GIPA Act, personal information does not include:

(a)  information about an individual who has been dead for more than 30 years;

(b)  information about an individual (comprising the individual’s name and non-personal contact details) that reveals nothing more than the fact that the person was engaged in the exercise of public functions; or

(c)  information about an individual that is prescribed by the regulations as not being personal information.[1]

1.9   Therefore, information about someone who has been dead for 50 years is not considered to be personal information for the purposes of the GIPA Act, nor is the fact that John Smith is a Senior Investigation Officer in Agency Y.

Definition of personal information in the PPIP Act

1.10   The core definition of personal information in section 4 of the PPIP Act is the same as that in the GIPA Act. However, the PPIP Act definition lists 12 exceptions where information is not considered to be “personal” for the purposes of that Act,[2] as opposed to the three exceptions in the GIPA Act definition set out above.

1.11   Also, section 4A of the PPIP Act specifically excludes health information from the definition of personal information. Health information is regulated by the Health Records and Information Privacy Act 2002 (NSW).

Practical effect of the different definitions

1.12   The effect of the different definitions in practice is that some information will be considered to be personal for the purposes of the GIPA Act, but not for the PPIP Act. An example is information or an opinion about an individual’s suitability for appointment or employment as a public sector official, which is excluded from the definition of “personal information” by subsection 4(3)(j) of the PPIP Act, but is considered to be personal information under the GIPA Act.

1.13   As a result, information such as recruitment records, referee reports and performance appraisals is covered by the GIPA Act, but not by the PPIP Act. This means that a person does not have a right to his or her own public sector recruitment documents under the PPIP Act, but there is a public interest in favour of disclosing that information to the person to whom it relates under the GIPA Act.

1.14   Furthermore, if a request is made under the GIPA Act by someone wanting access to a recruitment panel’s comments about another applicant, this would amount to revealing the personal information of a third party, which would enliven the consideration against disclosure in 3(a) in the Table at section 14 of the GIPA Act.

There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:

(a)  reveal an individual’s personal information

1.15   However, the public interest consideration against disclosure in 3(b) of the Table would not apply:

There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:

b)  contravene an information protection principle under the Privacy and Personal Information Protection Act 1998 or a Health Privacy Principle under the Health Records and Information Privacy Act 2002

This is because the information privacy principles (IPPs) in the PPIP Act only apply to personal information as defined in that Act. Since recruitment panel reports about public officials are not “personal information” under the PPIP Act, the IPPs do not apply to that information.

1.16   The public interest considerations against disclosure in 3(a) and (b) are discussed further in Part 3.

Which definition to use when dealing with GIPA requests?

1.17   The multiple definitions of personal information, and the differences between them, can be a source of confusion. These points can assist when dealing with requests:

  • where agencies are considering requests for personal information under the PPIP Act, the PPIP Act definition of personal information applies;
  • generally, where agencies are considering requests for personal information under the GIPA Act, the GIPA Act definition of personal information applies;
  • the only situation where the PPIP Act definition of personal information will be relevant to requests being dealt with under the GIPA Act is where agencies need to know if releasing the information to a third party would breach an IPP under the PPIP Act. In that situation, agencies need to look at whether the information is personal information for the purposes of the PPIP Act, since the IPPs only apply to that information.

1.18   Where a member of the public requests their own personal information but does not identify whether they are asking under the GIPA Act or the PPIP Act, as a matter of good practice and to further the objects of the GIPA Act, the agency receiving the request ought to assist the applicant identify the most effective mechanism for accessing that information, and process the request accordingly.

Part 2: Personal information as a public interest consideration in favour of disclosure

2.1   Section 12 of the GIPA Act reiterates the general presumption in favour of disclosure of government information, and lists examples of public interest considerations that favour disclosure. Those considerations include situations where the information is personal information of the person to whom it is to be disclosed.

2.2   Wherever possible, government agencies should provide people with access to their own personal information quickly and free of charge, or at the lowest reasonable cost. This supports the objects of the GIPA Act as stated in section 3, and reinforces the right people have under section 14 of the PPIP Act to obtain access to their personal information “without excessive delay or expense”.

2.3   When dealing with requests by a person for access to their own personal information under the GIPA Act, agencies also need to consider any relevant considerations against disclosure of that information. However, those considerations would have to be very significant to override the general presumption of disclosure in the GIPA Act, and the specific consideration in favour of disclosure of giving people access to their own information.

2.4   If there are strong considerations against disclosing personal information to the person to whom that information relates, agencies should look for ways to mitigate the strength of those considerations.[3] For example, if disclosing the information would also involve revealing the personal information of another person, the agency should consult with that person to obtain his or her views. It may be that the third party does not object to the information being disclosed, which makes that consideration against disclosure far less significant. Even where the third party objects, the consultation may indicate to the agency that there is a greater public interest in the information being disclosed to the person requesting it than there are considerations against disclosure. The issue of consulting with third parties about releasing information that affects them is discussed in a separate Guideline.[4]

2.5   Other ways agencies may proceed when there are significant public interest considerations against disclosure are to provide the person with access to their own information, but redact any other information for which there is an overriding public interest against disclosure, or to create a new document.

2.6   However, the public interest in providing people with access to their own information is extremely strong and should only be displaced where the considerations against disclosure are overriding.

Part 3: Personal information as a public interest consideration against disclosure

3.1   An exhaustive list of public interest considerations against disclosure is contained in the Table at section 14 of the GIPA Act. The following two considerations are relevant to this Guideline:

3.  Individual rights, judicial processes and natural justice

There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:

(a)  reveal an individual’s personal information; or

(b)  contravene an information protection principle under the Privacy and Personal Information Protection Act 1998 or a health privacy principle under the Health Records and Information Privacy Act 2002.

Revealing personal information as a consideration against disclosure

3.2   This consideration against disclosure will apply once information has been identified as “personal” under the GIPA Act definition of personal information, and the information would be “revealed” by disclosing it under the GIPA Act.

3.3   Although not expressly stated in 3(a), this consideration against disclosure of personal information should be interpreted as referring to third party information: that is, personal information about someone other than the person requesting the information. Any other interpretation would be inconsistent with the public interest consideration in favour of providing people with access to their own personal information under section 12.

3.4   Clause 3(a) therefore should not be used as a reason for denying people access to their own personal information. Rather, it is intended as a balance between the public interest in having access to government information, and the public interest in protecting and controlling the disclosure of personal information to people other than the person to whom the information relates.

3.5   In Schedule 4[1] to the GIPA Act, to “reveal” information is defined as “to disclose information that has not already been publicly disclosed (otherwise than by unlawful disclosure)”. Accordingly, if the personal information has already been publicly disclosed in a lawful manner, this consideration against disclosure cannot be relied on.[5]

3.6   While the fact that disclosing information to someone would reveal personal information about someone else is a public interest consideration against disclosure, it is not an absolute barrier to the information being disclosed. It is only a relevant factor that needs to weighed against other factors for and against disclosure.

Consultation with third parties

3.7   Where a request for access to the personal information of a third party is a formal access application, consultation to obtain the views of the third party may be required. Section 54 of the GIPA Act provides that agencies must take such steps (if any) as are reasonably practicable to consult with a person before providing access to information relating to the person in response to an access application if it appears that:

(a)  the information is of a kind that requires consultation under this section, and

(b)  the person may reasonably be expected to have concerns about the disclosure of the information, and

(c)  those concerns may reasonably be expected to be relevant to the question of whether there is a public interest consideration against disclosure of the information.

3.8   Section 54(4) states that the purpose of consultation is to find out whether the third party objects to the release of the information, and, if so, the reasons for any objection. The views of third parties about the disclosure of their personal information to an access applicant will be relevant to agencies in determining the weight to give to the consideration against disclosure in 3(a).

3.9   Third party views are only considerations to be taken into account when determining whether or not the information is released to the applicant. This decision must be made by the agency based on the public interest test.

Contravening an IPP in the PPIP Act as a consideration against disclosure

3.10   There will be a public interest against disclosure of information if the disclosure would reasonably be expected to contravene an IPP in the PPIP Act. The IPPs in the PPIP Act govern the way that public sector agencies must deal with the personal information they hold. The IPPs cover the collection, storage, use and disclosure of personal information by government agencies.

3.11   The IPPs apply only to personal information as it is defined in the PPIP Act.

3.12   In the context of 3(b) of Table 14, the IPP dealing with disclosure of personal information would be the most likely one to be breached by disclosure of personal information under the GIPA Act. That IPP is contained in section 18 of the PPIP Act and provides that agencies must not disclose personal information unless:

(a)  the disclosure is directly related to the purpose for which the information was collected, and there is no reason to believe that the person would object to the disclosure, or

(b)  the individual concerned is aware, or reasonably likely to be aware, that information of that kind is usually disclosed, or

(c)  the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.

3.13   In determining whether disclosure of personal information would reasonably be expected to contravene the PPIP Act, agencies should ask the following questions:

(a)  Is the information personal information as defined in section 4 of the PPIP Act?

(b)  Is the information being disclosed for the same purpose for which it was collected, or a purpose directly related?

(c)  Has the person who is the subject of the information consented to the disclosure?

(d)  Would the subject of the information be likely to be aware that information of that type is usually disclosed?

(e)  Would disclosure of the information be likely to prevent or lessen a serious or imminent threat to someone’s life or health?

If the answer to any of these questions is “yes”, it is unlikely that disclosure would be a breach of the PPIP Act.

3.14   If the request for the information is in the form of a formal GIPA Act access application, an agency may need to consult with the third party to see if he or she consents to the disclosure. If the third party consents, there will be no contravention of the IPP.

3.15   In establishing whether or not the public interest consideration in 3(b) is relevant, disclosure of the information need only “reasonably be expected” to breach an IPP. Agencies do not need to determine conclusively whether an IPP would in fact be contravened by disclosure of the information.

3.16   If an agency establishes that disclosure of the information could reasonably be expected to contravene an IPP, the question of whether that consideration against disclosure will be an overriding one will depend on the weight given to that consideration. The weight will depend on the type of personal information being requested, the context of the request, and the extent of the breach.

The effect of section 5 of the PPIP Act

3.17   If an agency finds that either 3(a) or 3(b), or both, are public interest considerations against disclosure and that releasing the information would contravene the PPIP Act, it may still release the information after applying the public interest test under the GIPA Act. This is made clear by section 5 of the PPIP Act, which provides that nothing in that Act serves to lessen the obligations agencies must exercise under the GIPA Act. Therefore, if the public interest considerations in favour of disclosure outweigh those against, then the personal information can be released to the applicant.

Appendix A: GIPA Act and definition of personal information

4 Personal information

(1)  In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual (whether living or dead) whose identity is apparent or can reasonably be ascertained from the information or opinion.

(2)  Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics.

(3)  Personal information does not include any of the following:

(a)  information about an individual who has been dead for more than 30 years;

(b)  information about an individual (comprising the individual’s name and non-personal contact details) that reveals nothing more than the fact that the person was engaged in the exercise of public functions; or

(c)  information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subclause.

Appendix B: Privacy and Personal Information Protection Act 1998 (NSW)

4 Definition of personal information

(1)  In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.

(2)  Personal information includes such things as an individual’s fingerprints, retina prints, body samples or genetic characteristics.

(3)  Personal information does not include any of the following:

(a)  information about an individual who has been dead for more than 30 years;

(b)  information about an individual that is contained in a publicly available publication;

(c)  information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act;

(d)  information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth;

(e)  information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 1994, or that has been collected in the course of an investigation arising out of a public interest disclosure;

(f)  information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997;

(g)  information about an individual arising out of a Royal Commission or Special Commission of Inquiry;

(h)  information about an individual arising out of a complaint made under Part 8A of the Police Act 1990;

(i)  information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009;

(j)  information or an opinion about an individual’s suitability for appointment or employment as a public sector official;

(ja)  information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000;

(k)  information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection.

Privacy and Personal Information Protection Regulation 2005

4 Meaning of personal information

For the purposes of section 4(3)(k) of the Act, the following information is not personal information:

(a)  information about an individual that is contained in a document kept in a library, art gallery or museum for the purposes of reference, study or exhibition,

(b)  information about an individual that is contained in a state record under the control of the State Records Authority that is available for public inspection in accordance with the State Records Act 1998,

(c)  information about an individual that is contained in archives within the meaning of the Copyright Act 1968 of the Commonwealth.

Footnotes

[1].  The GIPA Regulation does not prescribe any category of information as not being personal information.

[2].  See Appendix B of this Guideline for the PPIP Act definition of personal information.

[3].  See the GIPA Act sections 54; 72-75.

[4].  See Guideline 5: consultation on public interest considerations under section 54 of the GIPA Act.

[5].  For a ruling of the Administrative Decisions Tribunal on this point, see Richard v Commissioner, Department of Corrective Services [2011] NSWADT 98. (The ADT is now the NSW Civil and Administrative Tribunal)

 

Audience: 
Rating: 
5 out of 5 star rating
Average: 5 (1 vote)
Resource Type: 
Keywords: 
GIPA Guideline 4 - Personal information as public interest consideration under the GIPA Act
Archive: 
0
Teaser: 
This Guideline, made pursuant to those sections of the GIPA Act, is to assist agencies to deal with requests for personal information under the GIPA Act. It deals with formal and informal requests by people for their own personal information, and for the personal information of third parties.

POPUP MINIPANEL