Timeframes and work from home and other arrangements

March 10, 2020 - 12:16pm

The current disaster events in Queensland may result in an increase in agency staff working from home, on leave, or redirected to alternative duties to provide essential services. This may impact on the ability of agencies to meet the timeframes prescribed under the Right to Information Act 2009 (Qld) (RTI Act) and the Information Privacy Act 2009 (Qld) (IP Act) for making decisions and handling privacy complaints.

The following general information has been prepared to provide guidance to those agencies who may be concerned about meeting RTI Act and IP Act timeframes.

For further or more detailed guidance, please contact the OIC Enquiries Service on telephone 1800 642 753 or by email to enquiries@oic.qld.gov.au.

Agency decision making

If an agency is due to make a decision on an access application within the coming weeks and is not able to issue the decision within the statutory timeframe due to delays caused by officers working out of the office, it can ask the applicant, under section 35 of the RTI Act (or section 55 of the IP Act) for extra time to make its decision. The applicant does not have to agree to the request; as long as they do not refuse and do not seek an external review, the agency can keep working on the application.

If a decision on an access application will not be made within the statutory timeframe due to delays, this will result in a deemed decision being made under section 46 of the RTI Act (or section 66 of the IP Act). The applicant will therefore be entitled to apply to OIC for external review of the deemed decision. Where an application is made to OIC for external review of a deemed decision, an agency may apply to OIC for further time to deal with the access application under section 93 of the RTI Act (or section 106 of the IP Act).

In deciding whether to allow an agency further time to deal with an application and deciding the appropriate amount of additional time, the Information Commissioner may take into account factors including:

  • length of time the agency was unable to operate due to the recent disaster event
  • whether agency staff numbers were affected by decisions to allow officers to work out of the office, staff leave or diversion of resources to essential services.

Current external reviews

If agencies are unable to meet a timeframe set by OIC to provide submissions or further information in relation to an external review, they should contact their review officer prior to the due date to request an extension of time:

Privacy complaints

If someone lodges a privacy complaint with an agency, the agency has 45 business days in which to respond to the complaint. If at the end of that time period, the agency has not responded to the complaint or it has provided a response but the complainant is dissatisfied with it, the complainant can bring their privacy complaint to OIC.

Under section 168(1)(e) of the IP Act, OIC may decide to not accept the complaint if it considers that the agency has not yet had an adequate opportunity to deal with the complaint.

If the agency’s ability to deal with or respond sufficiently to a privacy complaint is impacted by circumstances related to the disaster event, OIC may decide to exercise its authority under section 168(1)(e) to not accept the complaint. This would effectively remit the complaint back to the agency for a further period of time.

In deciding this course of action, the Privacy Commissioner may take into account factors including:

  • the seriousness of the privacy breach and whether the complainant is at risk of imminent or serious harm
  • any response of the agency to the complaint to date and any interim measures put in place
  • the length of time the agency has been encouraging officers to work from home and/or experienced staff shortages due to staff leave and diversion of resources
  • the number of agency staff numbers affected by the circumstances related to the event
  • the amount of further time required by the agency.

Upon receipt of a privacy complaint, OIC will make preliminary inquiries of an agency whether its ability to deal with the complaint was affected by officers working out of the office and may, as appropriate, require detailed information from the agency on the factors that will be taken into consideration.