You can ask for your personal information from a public sector agency using either the Privacy and Personal Information Protection Act 1998 (PPIP Act) or the Government Information (Public Access) Act 2009 (GIPA Act).
If you are making an application for your personal information to a public sector agency, you have the choice of applying under the GIPA Act or PPIP Act. Since access to your personal information under the PPIP Act is free of charge no matter how long it takes the agency to process, agencies should process your application under the PPIP Act unless you make your application under the GIPA Act.
This fact sheet explains the key differences between the GIPA Act and PPIP Act in relation to accessing your personal information to assist you with making a choice. Please see our Fact sheet on how to access your health information if you specifically want to access your health information.
How to make an application
Contact the government agency that holds your personal information and check if an application needs to be in a particular form. The agency may also ask you for some identification to prove that you have the right to access the information either because it is your personal information or you are authorised by a third party to access their personal information. While the form of identification is not covered by either the PPIP Act or GIPA Act, most agencies require that the authorisation is in writing and clearly states the name of the person who authorises the access and the person who is authorised to have access.
If you request your personal information under the GIPA Act, you can make the request informally or formally. Agencies are encouraged to process a request for access informally wherever possible unless:
- there is an overriding public interest consideration against disclosure. Relevant considerations might include if it contains the personal information of a third party or the information might prejudice law enforcement processes. The list of considerations are contained in section 14 and schedule 1 of the GIPA Act
- you want to be able to request a review of the decision if you are unhappy with the agency’s decision. Under the GIPA Act, a right of review only applies for formal applications.
If you would like to make a formal application, it must be in writing, state that it is an access application under the GIPA Act and include a postal address where all correspondence relating to your application can be sent. It must also provide sufficient information to allow the agency to find the personal information that is being applied for, and include a $30 application fee, unless it is waived or reduced by the agency.
Information that you can request
Under the PPIP Act, you can only apply for access to personal information. Personal information is defined under the legislation as information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. Personal information includes an individual’s fingerprints, retina prints, body samples and genetic characteristics.
For the purposes of the PPIP Act, personal information does not include health information (including medical information). There are also other exceptions to the definition of personal information under section 4 of the PPIP Act. Examples of exceptions include information about an individual that is contained in a publicly available publication, information which may have been obtained or accessed for law enforcement or public safety purposes, certain adoption information, Cabinet information, public interest disclosures, and information relating to the suitability for employment of a public servant.
The GIPA Act allows you to apply for government information, which includes any personal information (including health information) that agencies might hold about you. The only exceptions to personal information under the GIPA Act are:
- information about an individual who has been dead for more than 30 years
- information about an individual that reveals nothing more than that the person is employed as a public servant (including the individual’s name and non-personal contact details)
- other information that is listed in the GIPA Regulations. Currently no other exceptions are listed in the Regulations.
Can another person request your personal information on your behalf?
PPIP Act and GIPA Act
You may be able to authorise another person to access your personal information regardless of whether the application is made under the PPIP Act or GIPA Act. However, the agency can request written proof of your authorisation and a proof of identity.
The law also recognises certain persons to be able to act on behalf of another person. These persons include:
- a person acting under an enduring power of attorney
- a guardian or person responsible within the meaning of the Guardianship Act 1987. This may include an individual’s legally appointed guardian, spouse or partner if the spouse or partner is close and the relationship is continuing, or in some circumstances, a close friend or relative of the individual
- a person empowered under law to act as an individual’s agent. For example, a financial manager appointed by a court or tribunal might be able to request access to the individual’s financial information.
In each case, your authorised representative can only access personal information that is within the scope of their authorisation.
An agency may have a policy about authorised representatives in their Privacy Management Plan. You should check with the agency that holds the personal information about their policy on this issue and what information they may require before they provide your authorised representative with access.
Cost of making an application
If you apply for your personal information under the PPIP Act, it is free of charge.
If you apply for your personal information under the GIPA Act the first 20 hours of processing time is free of charge. If it takes the agency more than 20 hours to process your application, the agency may charge at a maximum rate of $30 per hour for each hour they take to process your application over the first 20 hours. For example, if it takes 25 hours for an agency to decide your application and provide you access to your personal information, the agency may charge for a total of 5 hours at a maximum charge of $30 per hour.
Processing time is defined in section 64(2) of the GIPA Act as the total amount of time that is necessary to be spent by any officer of the agency in:
a) dealing efficiently with your application (including considering the application, searching for records, consultation, decision-making and any other function necessary in deciding your application); or
b) providing access in response to your application (based on the lowest reasonable estimate of the time that will need to be spent in providing that access).
Time limits to process your request
The government agency must provide access to your personal information without excessive delay. However, specific processing times are not set by the PPIP Act.
If you decide to apply for personal information under the PPIP Act, you should ask the government agency how long it usually takes, or is likely to take for your application to be processed. You should ask the agency to confirm the processing time in writing in case the application takes longer than advised.
If you believe the agency is taking too long to provide you with access to your personal information, you can make a complaint to the NSW Privacy Commissioner.
Contact the Information and Privacy Commission on 1800 472 679 or at firstname.lastname@example.org for advice about what to do next.
If you apply under the GIPA Act, the government agency must process your request within the following time frames. The agency:
- must notify you whether the application is a valid application within five working days of the date it receives the application;
- make a decision whether to provide access to your personal information and notify you of their decision within 20 working days of the date agency receives your application. If the agency does not decide your application within 20 working days (unless an extension is validly made), the application is treated as a deemed refusal and you have the right to seek a review of this deemed refusal;
- the agency can extend the period for making a decision by up to 10 working days to consult another party as required by the GIPA Act, or to retrieve records from archive.
Alternatively, if you agree, the agency can extend the period for making a decision. However, you cannot be required to agree to an extension.
The maximum period that an agency can extend the period for making a decision is by 15 working days. This means the maximum period for processing your application, if an extension is applied, is 35 working days.
How access can be provided
There is a presumption in favour of access and failure to provide access is considered a deemed refusal that gives you a right to seek an internal review from the agency.
If the agency decides to grant you access, the agency can provide access to the information in a form the agency considers appropriate. This might mean you can take home a copy of the information or that you can only view the information but not photocopy it.
The agency must provide access to your personal information without excessive delay or expense.
The agency must provide access to your personal information by:
- allowing you to inspect the record containing the information, together with any facilities to enable the information to be read, viewed or listened to as appropriate; or
- providing a copy of the information; or
- providing a written transcript of the information (section 71(1).
The agency must provide access in the form you requested unless it would unreasonably interfere with the operations of the agency, require the agency to incur unreasonable additional costs, be detrimental to the proper preservation of the record, breach copyright, (or providing access in the form requested) or would result in an overriding public interest against disclosure if provided in the form requested (section 72(2) GIPA Act).
The GIPA Act requires that agencies must provide access without placing a condition on how to use the personal information, once released. However, agencies can impose conditions if it is necessary for the purposes of avoiding an overriding public interest against disclosure of the information (s 73 GIPA Act).
For more information on how the public interest test might apply to your request, please contact the Information and Privacy Commission NSW (IPC). See contact details listed at the end of this fact sheet.
If you are unhappy with the agency's decision, what rights do you have?
If you have made an application under the PPIP Act and are unhappy with the government agency’s decision, you can request an internal review of an agency’s decision or conduct within six months from being notified of the decision. In some circumstances, an agency may extend this time. If you have missed this six month period, you should ask the agency if they can still accept your request for an internal review and provide your reasons.
An internal review is free of charge.
The agency must complete the internal review as soon as reasonably practicable and, at the latest, within 60 days from the day the application for internal review is received by the agency.
NSW Civil and Administrative Tribunal
If you are unhappy with the result of the review (or it is not completed in 60 days) you have 28 days to apply to the NSW Civil and Administrative Tribunal (NCAT) for a review.
NCAT can review the conduct of the agency in processing and making a decision on the original application for access.
There is a filing fee charged by NCAT for lodging an application with them. For more information, see www.ncat.nsw.gov.au.
Complaint to the NSW Privacy Commissioner
You can also make a complaint to the NSW Privacy Commissioner about a breach of, or interference, with your privacy rights. This includes if you experienced difficulty attempting to access your personal information.
The Privacy Commissioner does not usually deal with a complaint that is more appropriately dealt with by an application for internal review.
The Privacy Commissioner accepts complaints from:
- the individual whom the personal information is about; or
- a third party with:
- evidence of the consent of the person who the personal information relates to; or
- if consent has not be obtained from the person who the personal information is about, evidence of the legal incapacity and contact details of the person to whom the personal information relates.
You have six months from the date of the agency’s decision or after finding out about the agency’s conduct to make a complaint to the Privacy Commissioner. However, the Privacy Commissioner has the discretion to extend the time for making a complaint beyond
Please see the Privacy Commissioner’s Protocol for Handling Complaints for more information on your rights and the procedures for making a complaint or contact the Information and Privacy Commission on 1800 472 679 or at email@example.com.
If you are unhappy with the agency’s decision about your request to access your personal information, you can:
- request an internal review within 20 working days after the notice of a decision has been posted to you; or
- request a review by the Information Commissioner within 40 working days of being notified of the decision; or
- request a review by NCAT within 40 working days of being notified of the decision.
There is a $40 fee for an internal review application unless the decision is a ‘deemed refusal’ because the agency did not process your application in time or it is an internal review as recommended by the Information Commissioner under section 93(6).
The agency must acknowledge your application within five working days of receiving it.
The agency must decide the internal review within 15 working days (this can be extended by 10 working days if the agency has to consult with a third party, or by agreement with you).
The agency can make any decision or take any action in regard to the internal review as they believe appropriate.
Review by the Information Commissioner and NCAT
If you are the applicant, you do not need to request an internal review first before requesting a review from the Information Commissioner or NCAT. You have 40 working days in which to request a review after being notified of the agency’s decision.
However, if you are not the access applicant (i.e. you are a third party), you must request an internal review by the agency first before you can apply for a review by the Information Commissioner, unless the option is not available to you. This would be relevant in situations, for example, where a third party has objected to the release of their personal information and the Principal Officer of the agency had made the decision in response to an access application.
If you are unhappy with the Information Commissioner’s review decision, you can apply to NCAT within 20 working days from being notified of the Information Commission’s review outcome. However, if you have requested NCAT to review the agency’s decision, you cannot later ask the Information Commissioner to review a decision.
You may request an review of the agency’s decision by the Information Commissioner free of charge. For more information about reviews by the Information Commissioner, please see our fact sheet on External Review by the Information Commissioner.
If you request a review by NCAT, there is a filing fee charged by the Tribunal for lodging an application. For more information on NCAT, visit http://www.ncat.nsw.gov.au/
For more detailed information about your review rights under the GIPA Act, please see our Fact sheet on your review rights under the GIPA Act.
For more information
Contact the Information and Privacy Commission NSW (IPC):