Publishing OFFICIAL information assets: Supporting the push model through proactive disclosure
Today the Chair of the Legal Affairs and Safety Committee tabled our report in Parliament on how three Queensland government departments identify and classify their OFFICIAL information assets and how they support the push model through maximum disclosure of these information assets.
OFFICIAL information is routine information without special sensitivity or handling requirements.
Under the Right to Information Act 2009, government agencies should release information as a matter of course unless there is a good reason not to. This is referred to as the ‘push model’. This proactive disclosure approach increases accountability and transparency. It also helps build trust in government.
When considering whether to publish information, government agencies need to balance the information security risks against the disclosure benefits. De-identification, aggregation and redaction techniques can be used to support proactive information release through publication, including datasets that may be in a SENSITIVE or PROTECTED information asset.
Identifying the assets and their characteristics in a centralised register helps an agency manage the assets consistent with the rules governing access and use of the information.
We examined the practices in place at three government agencies and found that they have established information asset registers and a documented approach to approve the publication of information. However there are deficiencies in how they maintain their registers.
The gaps in the registers increase the risk of unauthorised disclosure, misuse or unavailability of the information. This also means that the departments cannot be sure that they are maximising public disclosure of the information they hold.
The three audited departments do not publish their information asset register, or a redacted version of it on their website. As a result, members of the public may seek access under a legislative process to information that the agency has already determined suitable for disclosure or administrative release.
The audit raises issues relevant to all government agencies. We made one recommendation to all agencies – publish their information asset register, or a version of it, on their websites.
