Personal and business information
Third party review rights under the
Freedom of Information Act 1982
Consultation paper
August 2012
Closing date for comment 17 September 2012
Contents
About this paper ................................................................................................. 1
How to make comments ....................................................................................................... 1
When is consultation required under the FOI Act? .............................................. 2
What is the scope of consultation required under the FOI Act? .......................... 2
Who should be notified of an access refusal or access grant decision? ................ 3
Who can apply for review of an access grant decision? ....................................... 3
Who cannot apply for review of an access grant decision? .................................. 4
What procedures apply if an FOI applicant applies for internal or IC review of an
access refusal decision? ...................................................................................... 5
When can documents containing personal or business information be released? 6
Flowcharts — third party review rights ............................................................... 8
Primary agency decision to grant access .............................................................................. 8
Primary agency decision to refuse access ............................................................................ 9
Application by third party for internal review of an access grant decision ........................ 10
Application by FOI applicant for internal review of an access refusal decision ................. 10
Application by third party for IC review of an access grant decision ................................. 11
Application by FOI applicant for IC review of an access refusal decision ........................... 11
Consultation paper: Personal and business information—third party review rights
About this paper
The Freedom of Information Act 1982 (FOI Act) requires agencies and ministers to consult
third parties before deciding to release certain categories of documents in response to
requests under the Act. Third parties can also apply for internal and Information
Commissioner (IC) review of decisions by agencies and ministers to release information
under the Act.
The FOI Act provisions are complex and frequently give rise to requests to the Office of
the Australian Information Commissioner (OAIC) for advice about the rights of parties and
the obligations of agencies. The area of particular concern is FOI requests for documents
that contain personal or business information of someone other than the FOI applicant.
This paper provides interim guidance on the operation of the consultation requirements
in ss 27 and 27A of the FOI Act that apply to the business and personal privacy
exemptions (ss 47, 47F, 47G). Following consideration of any comments received on this
paper, the Information Commissioner may amend the Guidelines issued by the Australian
Information Commissioner under s 93A of the Freedom of Information Act 1982 (FOI
guidelines).
Issues similar to those discussed in this paper arise under the consultation requirements
applying to the Commonwealth-State relations and Norfolk Island intergovernmental
relations exemptions (ss 26A, 26AA, 47B). The exemption for information communicated
in confidence by a foreign government or organisation (s 33(b)) is different, as an agency
or minister has a discretion to decide if consultation is appropriate, and the foreign entity
does not have a right to apply for review of an access grant decision.
This paper deals with consultation by an agency, though the same consultation principles
apply to FOI requests to ministers.
How to make comments
The Australian Information Commissioner invites your comments on the guidance given
in this consultation paper. The closing date for comments is 17 September 2012.
Comments may be forwarded to [email protected], or GPO Box 2999, Canberra
ACT 2601.
The OAIC may later publish a summary or analysis of comments received.
Office of the Australian Information Commissioner
1
Consultation paper: Personal and business information—third party review rights
When is consultation required under the FOI Act?
The Freedom of Information Act 1982 requires an agency to consult a person or business
before making a decision to give access to a document containing their personal or
business information, if the agency considers that the person or business ‘might
reasonably wish to make a contention’ that the document is either exempt or
conditionally exempt (and, if conditionally exempt, that access would on balance be
contrary to the public interest). This is described in the Act as an ‘exemption contention’
(ss 27(1),(4), 27A(1),(3)). The person or business who is invited to make a submission is
called an ‘affected third party’ (s 53C). A decision by an agency to give access to a
document containing personal or business information is called an ‘access grant decision’
(s 53B).
An agency is not required to undertake consultation in the following circumstances:

the agency does not intend to release the document containing personal or
business information — that is, it makes an ‘access refusal decision’ (s 53A)

the agency decides that the person or business referred to in the documents would
not wish to make a submission in support of an exemption contention — for
example, the information is well known or is already available from publicly
accessible sources (ss 27(3), 27A(2))

it is not reasonably practicable for the agency to undertake consultation – for
example, a person cannot easily be located (ss 27(5), 27A(4)).
What is the scope of consultation required under the
FOI Act?
An affected third party who is consulted under s 27A (personal information) has an
opportunity to contend only that access should be refused under s 47F (public interest
conditional exemption — personal privacy). The third party has no right to contend that
other exemptions should apply. Equally, the third party’s opportunity to make
submissions in any later internal or IC review proceedings is confined to whether s 47F
applies.
An affected third party who is consulted under s 27 (business information) may contend
that access should be refused under either s 47 (documents disclosing trade secrets or
commercially valuable information) or s 47G (public interest conditional exemption –
business). This opportunity to make a submission relating to both provisions applies even
where the agency has invited a submission relating to only one of those provisions. The
reason is that s 27(1) applies to a document containing ‘business information … in respect
of a person, organisation or undertaking’ (s 27(1)(a)), and entitles that party to make an
exemption contention that ‘the document is exempt under section 47 [or] conditionally
exempt under s 47G’. However, both the agency and any third party making an
exemption contention should bear in mind that ss 47 and 47G contain different
exemption criteria, as affirmed in s 47G(2).
Office of the Australian Information Commissioner
2
Consultation paper: Personal and business information—third party review rights
An affected third party who is consulted under s 27 has no right to contend that
exemptions other than ss 47 or 47G should apply (see ‘E’ and National Offshore
Petroleum Safety and Environmental Management Authority [2012] AICmr 3).
Who should be notified of an access refusal or access
grant decision?
Primary access refusal decision: An agency is not required to give notice of an access
refusal decision to any person other than the FOI applicant (s 26). However, as noted
below, an agency is required to provide notice to an affected third party who made a
submission in support of an exemption contention if an access refusal decision is changed
on internal review to an access grant decision, or the FOI applicant applies for IC review
of the access refusal decision.
Primary access grant decision: An agency is required to give notice of an access grant
decision made at either the primary decision making or internal review stage to an
affected third party who made a submission in support of an exemption contention
(ss 27(6), 27A(5)). There is no obligation to provide notice of an access grant decision to a
person or business who was invited to make a submission but did not do so, or made a
submission agreeing to the release of documents (ss 27(8), 27A(7)).
Who can apply for review of an access grant decision?
Only an affected third party who made a submission in support of an exemption
contention can apply for internal or IC review of an access grant decision.
This result stems from the following two considerations. First, an agency is required to
provide notice of an access grant decision only to an affected third party who made a
submission in support of an exemption contention (ss 27(8), 27A(7)). The third party may
apply for internal or IC review within 30 days of receiving that notice (ss 54B(1)(a),
54S(2)). Based on that notice, the application for review should identify the decision to be
reviewed and submit why the decision is wrong. Secondly, upon making an access grant
decision an agency should promptly provide access to the FOI applicant, subject to the
limitation expressed in ss 27(7) and 27A(6) that access must not be given until a third
party’s opportunity to apply for review or appeal of the access grant decision has run out.
However, that limitation does not apply unless the third party made a submission in
support of an exemption contention (ss 27(8), 27A(7)).
Those considerations outweigh a competing view, based on s 54A(2), that the right to
apply for internal review is not limited to an affected third party who made a submission
in support of an exemption contention.
In summary, an affected third party who made a submission in support of an exemption
contention has the following review rights in respect of an access grant decision:
Office of the Australian Information Commissioner
3
Consultation paper: Personal and business information—third party review rights

Internal review: the third party may apply for internal review within 30 days of
being notified of the agency’s decision or within such further period as the agency
allows (ss 54A, 54B(1)(a)).

IC review following internal review: if the access grant decision is affirmed on
internal review, the third party may apply for IC review within 30 days of being
notified of the agency’s internal review decision or within such further period
approved by the Information Commissioner (ss 54M(3)(b), 54S(2)(a), 54T).
(Section 54C(4) implies that the notice of the agency’s access grant decision must
be given under s 26. Section 26 speaks only of access refusal decisions. It is
nevertheless clear that an affected third party must be notified of the agency’s
internal review decision, and this should be done in conformance with s 26 as far as
possible.)
An agency is deemed to have affirmed the access grant decision if it does not make a
decision within 30 days of receiving the affected third party’s application for internal
review (s 54D(2)(a)). Notice of that deemed decision is taken to have been given to the
internal review applicant under s 26 (s 54D(2)(b)).

IC review of the primary agency decision: the third party may apply directly for
IC review of the agency’s access grant decision within 30 days of being notified of
the decision or within such further period approved by the Information
Commissioner (ss 54M(3)(a), 54S(2)(b)), 54T). The application for IC review must
include a copy of the notice given under s 26 (s 54N(1)(b)). (In fact, an affected third
party does not receive a notice under s 26, but under ss 27(6) or 27A(5). This
requirement should be read in that way.)
Who cannot apply for review of an access grant decision?
Person or business who was not consulted: A person or business who was not invited by
an agency to make a submission in support of an exemption contention cannot apply for
internal or IC review of an agency decision to give access to a document containing their
business or personal information. This is so even if the person contends that the agency
acted incorrectly or unreasonably in not providing a consultation opportunity. The person
may complain to the OAIC under s 70 about the agency’s access grant decision, though
the OAIC has no direct power to restrain an agency from releasing a document under the
Act. In addition, the person may commence proceedings under the Administrative
Decisions (Judicial Review Act) 1977 to restrain release of a document, but would have to
establish that the agency’s access grant decision was unlawfully made.
Person or business who was consulted but did not make a submission in support of an
exemption contention: An affected third party who was invited to make a submission but
did not do so cannot apply for internal or IC review of an access grant decision. As noted
above, the right to seek review of an access grant decision follows receipt of a notice of
that decision; an agency is not required to provide notice of an access grant decision to a
person or business who was invited to make a submission but did not do so.
Office of the Australian Information Commissioner
4
Consultation paper: Personal and business information—third party review rights
If, as an administrative gesture, an agency informs a person or business of an access grant
decision even though no submission was received in support of an exemption contention,
the person or business does not have a right to seek internal or IC review.
What procedures apply if an FOI applicant applies for
internal or IC review of an access refusal decision?
Internal review — prior consultation with an affected third party: Where an FOI
applicant applies for internal review of an access refusal decision that was made
following consultation with an affected third party, the FOI Act does not require
consultation with the third party during internal review. Specifically, the Act does not
require an agency to notify the affected third party of the access refusal decision or the
internal review application, or invite or allow the third party to participate in the internal
review. It is nevertheless open to an agency to take any of those steps, provided the
internal review is completed within the 30 day statutory time limit (s 54C(3)). There is no
power in the FOI Act to extend that time period to facilitate further consultation with the
affected third party.
If the agency changes the access refusal decision to an access grant decision, it cannot
give access to a document until an affected third party’s opportunity for review and
appeal have run out (ss 27(7), 27A(6)). Consequently, the agency should provide a notice
that complies with s 27(6) or s 27A(5) to an affected third party who earlier made a
submission in support of an exemption contention. The third party may then apply for
IC review of the agency’s access grant decision.
Internal review — no prior consultation: If the document being considered in internal
review contains personal or business information about a person or business who was
not earlier consulted, the agency must turn its mind to whether the person ‘might
reasonably wish to make [an] exemption contention’ (ss 27(1)(b) and 27A(1)(b)). If this
obligation was not met at the primary decision-making stage it must be considered at the
internal review stage. For instance, the reason why consultation was not earlier
undertaken may be that the agency based its decision on another exemption ground,
which if set aside at internal review may expose personal or business information to
release without proper consultation under ss 27 or 27A. Once again, there is no power in
the FOI Act to extend the 30 day time limit to facilitate consultation.
If the third party is invited to make a submission and does so, and the agency changes the
access refusal decision to an access grant decision, the agency should give the third party
notice of the decision (ss 27(6), 27A(5)). The agency cannot give access until the third
party’s opportunity to apply for review or appeal has run out (ss 27(7), 27A(6)).
IC review — prior consultation with an affected third party: An agency must ‘take all
reasonable steps’ to notify an affected third party of an application by an FOI applicant
for IC review of an access refusal decision (s 54P(2)). This obligation applies to an affected
third party who made a submission in support of an exemption contention, as well as an
affected third party who was invited to make a submission but did not do so. An agency
can apply to the Information Commissioner under s 54Q for an order that it is not
Office of the Australian Information Commissioner
5
Consultation paper: Personal and business information—third party review rights
required to provide notice to the affected third party for a reason stated in that section
(for example, law enforcement or security). An affected third party who receives a notice
under s 54P has a right to be a party in the IC review (s 55A(1)(c)).
IC review — no prior consultation: Any person ‘whose interests are affected by an IC
reviewable decision’ may apply to the Information Commissioner to be made a party to
an IC review (s 55A(2)). In theory, this means that a person or business who was not
consulted by an agency under ss 27 or 27A could apply to be a party to an IC review
proceeding that concerns a document containing their personal or business information.
However, as a practical matter this opportunity could only be taken up if the person or
business is aware of the proceeding.
On the other hand, the OAIC must turn its mind to whether the person or business
referred to in the documents ‘might reasonably wish to make [an] exemption
contention’, and be invited to do so under ss 27 or 27A. As noted above, if this obligation
to allow proper consultation was not met at the primary decision-making stage it must be
considered at later review stages. (This is noted in the FOI Act in a note following
s 55G(1).)
When can documents containing personal or business
information be released?
Following an access grant decision, an agency must provide access as soon as reasonably
practicable after:

the FOI applicant was notified of the decision and paid any access charges, and

an affected third party’s ‘opportunities … for review or appeal in relation to the
decision to give access to the document have run out’ (ss 27(7), 27A(6)). As noted
earlier, this opportunity to seek review is limited to an affected third party who
made a submission in support of an exemption contention (ss 27(8), 27A(6)).
The following table explains how those principles apply to different categories of
decision.
Agency decision
When access can be given to the FOI
applicant
Agency makes an access grant decision
without consulting a person or business
Access should be given as soon as
reasonably practicable following the agency
decision
Agency makes an access grant decision
after inviting an affected third party to
make a submission, but not receiving a
submission opposing release
Access should be given as soon as
reasonably practicable following the agency
decision
Office of the Australian Information Commissioner
6
Consultation paper: Personal and business information—third party review rights
Agency makes an access grant decision
after receiving a submission opposing
release from an affected third party
Access cannot be given until 30 days after
the agency notifies its decision to the
affected third party. Access can then be
given if the third party has not applied for
internal or IC review.
Note: it is advisable to check with the OAIC
as to whether the affected third party has
been given an extension of time to apply
for IC review.
Agency makes an access grant decision
following internal review initiated by an
affected third party
Access cannot be given until 30 days after
the agency notifies its internal review
decision to the affected third party. Access
can then be given if the third party has not
applied for IC review, and has not been
given an extension of time by the OAIC to
do so.
Agency makes an access grant decision
following internal review initiated by an
FOI applicant
If an affected third party made a
submission opposing release, either at the
primary or the internal review stage, access
cannot be given until 30 days after the
agency notifies the internal review decision
to the affected third party. Access can then
be given if the third party has not applied
for IC review, and has not been given an
extension of time by the OAIC to do so.
Office of the Australian Information Commissioner
7
Consultation paper: Personal and business information—third party review rights
Flowcharts — third party review rights1
Primary agency decision to grant access
Was the third party invited to make
a submission under ss 27 or 27A
prior to the agency’s access grant
decision?
NO
YES
NO
Did the third party make a
submission opposing release?
The agency is not required to
notify the third party of its
access grant decision. The third
party cannot apply for internal
or IC review of the agency’s
decision. The FOI applicant
should be given access as soon
as reasonably practicable
following the agency’s decision.
YES
The agency must notify its access
grant decision to the third party,
who can then apply for internal or
IC review. The FOI applicant
cannot be given access until the
third party’s opportunity to apply
for internal and IC review has run
out.
1
The flow charts refer to a ‘third party’ as meaning a person or business who can or should be consulted
under ss 27 or 27A before an agency decides to give access to a document containing their personal or
business information.
Office of the Australian Information Commissioner
8
Consultation paper: Personal and business information—third party review rights
Primary agency decision to refuse access
Was the third party invited to make
a submission under ss 27 or 27A
prior to the agency’s access refusal
decision?
NO
The agency is not required to
notify the third party of its access
refusal decision. The third party
cannot apply for internal or
IC review of the agency’s
decision.
YES
Did the third party make a
submission opposing release?
NO
YES
The agency is not required to
notify its access refusal decision
to the third party, but it is good
practice to do so as the third party
must later be notified if the access
refusal decision is either changed
on internal review to an access
grant decision or is the subject of
an application for IC review.
Office of the Australian Information Commissioner
9
Consultation paper: Personal and business information—third party review rights
Application by third party for internal review of an access grant decision
The agency is not required to notify the FOI applicant of the internal review
application, but it is good practice to do so as the FOI applicant will have earlier
received notice of the access grant decision. The time for making the internal
review decision cannot be extended to facilitate consultation with the FOI applicant.
If the access grant decision is affirmed, the agency must notify the third party, who
can apply for IC review of the agency’s decision. The FOI applicant cannot be given
access until the third party’s opportunity to apply for IC review has run out.
If the access grant decision is changed to an access refusal decision, the agency
must notify both the FOI applicant and the third party. The FOI applicant can apply
for IC review of the agency’s decision.
Application by FOI applicant for internal review of an access refusal
decision
Was the third party invited to make
a submission under ss 27 or 27A
prior to the agency’s primary
decision to refuse access?
NO
YES
The agency is not required to
notify the third party of the
internal review application, or
provide an opportunity to make
a further submission.
If the access refusal decision is
affirmed, the agency is not
required to notify its decision to
the third party.
If the access refusal decision is
changed to an access grant
decision, the third party must be
notified and can apply for
IC review of the agency’s
decision. The FOI applicant
cannot be given access until the
third party’s opportunity to
apply for IC review has run out.
Office of the Australian Information Commissioner
The agency must consider
whether to consult the third
party under ss 27 or 27A. The
time for making the internal
review decision cannot be
extended to facilitate
consultation.
If the access refusal decision is
affirmed, the agency is not
required to notify its decision to
the third party.
If the access refusal decision is
changed to an access grant
decision, a third party who was
invited to make a submission
and did so must be notified of
the decision and their right to
seek IC review. The FOI
applicant cannot be given access
until the third party’s
opportunity to apply for
IC review has run out.
10
Consultation paper: Personal and business information—third party review rights
Application by third party for IC review of an access grant decision
The OAIC is required to notify the FOI applicant of the IC review application (s 54Z). The
FOI applicant can apply to the OAIC to be made a party to the IC review as a person
whose interests are affected by the IC review.
Application by FOI applicant for IC review of an access refusal decision
Was the third party invited to make
a submission under ss 27 or 27A, at
either the primary or internal
review stage?
NO
YES
The agency must take all
reasonable steps to notify the
third party of the IC review
application, whether or not they
made a submission opposing
release. Upon receiving a notice
the third party can apply to the
OAIC to be made a party to the
IC review.
Office of the Australian Information Commissioner
The OAIC must consider
whether to consult the third
party under ss 27 or 27A.
Neither the agency nor the OAIC
is required to notify the third
party of the IC review
application. However, the third
party can apply to be made a
party to the IC review as a
person whose interests are
affected by the IC review.
11