Access applications and third party personal information

Under the Right to Information Act 20091 (Qld) (RTI Act) anyone can apply to an agency2 for access to documents. However, access to information can be refused if it would be contrary to the public interest to release it. This will often, but not always, include the personal information of people other than the applicant (third party personal information).

This guideline is intended to offer assistance when considering certain broad categories of third party personal information, as applying the balancing test to information of this kind requires careful consideration. Decisions of the Information Commissioner, many of which are discussed in this guideline, demonstrate that the outcome will vary depending on the unique circumstances of each application.

Limitations

This guideline only deals with the public interest factors against disclosure that generally apply to third party personal information. It does not cover other public interest factors or the exempt information provisions in schedule 3 of the RTI Act.3

Applications which name someone other than the applicant

Decisions makers should proceed carefully where an application names a person other than the applicant in the context of something that person may have done or said. For example, applications which describe the information being sought as ‘all the complaints made by Dave’ or ‘the complaints my neighbour made about my dog’ or ‘everything Bob said about my harassment complaint’ or ‘any complaints made by my family about Employee Sarah’ may require the decision maker to make a neither confirm nor deny decision.

Refer to Neither confirm nor deny the existence of documents for further guidance.

Personal information and privacy

Personal information is any information, whether true or not, about an individual whose identity can reasonably be ascertained.4

Can the individual be identified?

Where information includes the individual’s name, the individual’s identity will generally be apparent. Even if their identity is not readily apparent, it may be possible to identify a person using additional information. However, if only certain individuals have the information necessary to identify the individual, eg because of their relationship with the individual or their involvement in events, this will not generally be enough to make their identity reasonably ascertainable.5

In the context of an RTI application, it will be necessary to consider both the applicant’s knowledge and the scope of their application when determining whether third party information is personal information.

In F60XCX and Queensland Ombudsman6, the applicant submitted that deleting names would deidentify the documents, but the Commissioner noted that the officers’ identities could be ascertained from information already released under the application and information currently in issue. In Collins and HQCC7, the Commissioner agreed with submissions that a deidentified resume would still identify a clinician, because knowledge of the clinician’s previous positions and the dates they were held would allow simple internet searches to reveal their identity.

Is it about an individual?

Information will be about an individual if it reveals a fact or opinion about the individual, in that there is there is a sufficient link or connection between the information sought and the identified individual.8

For detailed guidance on personal information, decision makers should refer to What is personal information?.

Information of the deceased

While only living individuals can have personal information, the RTI Act explicitly recognises the privacy rights of the deceased in both the public interest factors9 and in the obligation to consult.10

When considering applications for information about a deceased person, decision makers should refer to Applications for records of a deceased person .11

Public interest factors

The public interest factors against disclosure that apply to third party personal information will vary from application to application, but the most common include:

  • Disclosure of the information could reasonably be expected to cause a public interest harm if disclosure would disclose personal information of a person, whether living or dead.12 (The personal information factor against disclosure.)
  • Disclosure of the information could reasonably be expected to prejudice the protection of an individual’s right to privacy.13 (The privacy factor against disclosure.)

Who is information released to?

When making a decision about the weight to assign to the public interest factors against disclosure, decision makers should not exclude from consideration evidence about the intended or likely extent of dissemination of information by the applicant.14

In F60XCX and Queensland Ombudsman,15 the Commissioner noted that there are no restrictions on the use, dissemination, or republication of information released under the Act. She considered both the applicant’s intended use of the information and the possibility that the information could be disseminated further, as permitted by the Act, when making the decision to find it was contrary to the public interest to release.

The fact that there is no limit on dissemination of information released under the Act has been a contributing factor in according a strong weight to the non-disclosure factors in a number of Commissioner decisions.16 However, in Bowmaker Realty and Department of Justice and Attorney-General; Andrews17 the Commissioner considered third party submissions that the applicant would publish any released documents on social media and decided they were an irrelevant consideration18 which must be disregarded.

Third party authority included with the application

Applicants sometimes include a consent or authority (authority) from the third party with their application which gives the applicant permission to access the third party’s personal information. These authorities do not override the decision maker’s obligation to:

  • consider whether release of the third party personal information would be contrary to the public interest; or
  • their obligation to seek the third party’s views if they decide to release and think it would reasonably be of concern to the third party.

Each decision maker must decide how much weight they give to an authority, taking into account any relevant factors, including:

  • Are there any doubts about the genuineness or voluntariness of the authority?
  • What is the extent of the third party’s knowledge? How likely are they to be aware of the personal information they’ve agreed to allow the applicant to access?
  • How sensitive is the information? The greater the sensitivity, the less weight a decision maker might give to an authority.
  • How much does the applicant already know? If it’s mutual personal information, or the applicant is already aware of it, a decision maker might give greater weight to the authority.

If there are no concerns, a third party authority can remove/greatly reduce the weight of the privacy and personal information factors against disclosure. Common examples are:

  • an insurance company makes an RTI application and includes an authority from the claimant, giving permission for the company to access their medical records; or
  • Spouse A make an IP application for complaints about the dog they jointly own with Spouse B and includes an authority from Spouse B, giving permission for Spouse A to access their personal information.

It may not be appropriate to reduce the weight of the privacy and personal information factors where:

  • agency files show that the applicant has a history of coercing the third party or there is other information that indicate the authority may not be genuine; or
  • the third party could not reasonably be aware of their personal information which is in scope of the application, which means they could not have known what they were agreeing to.

Disclosure to family members

When considering the privacy and personal information factors against disclosure, family members have no greater right to the personal information of their adult living relatives than any other person19.

In 0ZH6SQ and Department of Health20 the Commissioner noted that the applicant’s contact with his family did not impact the balancing of the public interest in relation to their personal information. The privacy interests of those family members were still relevant when considering disclosure under the Act.

For information on parents applying for children, refer to Applications by and for children.

Third party personal information known to the applicant

When applying the privacy and personal information factors against disclosure, it will be relevant that the third party personal information was provided by the applicant or is known to the applicant. It does not automatically mean that it will be released to the applicant, but it may impact on the application and/or weighting of those factors against disclosure.

Does the personal information factor against disclosure apply?

The personal information factor against disclosure in schedule 4, part 4, section 6 provides that it causes a public interest harm to disclose personal information.

The Commissioner in Australian Broadcasting Corporation and Department of Child Safety, Youth and Women21 stated:

...where releasing personal information would not involve conveying to any person or entity information not already known to them, it cannot be said such release would disclose personal information within the meaning of the personal information harm factor, and that factor will therefore not apply.

If the third party personal information is known to an applicant, particularly where it was provided by them, or had previously been given to them, the personal information factor against disclosure will not apply. However, the decision maker will need to be satisfied that the information is, as a matter of fact, actually known to the applicant.

Documents provided by the applicant

The Commissioner in G46 and Queensland Police Service22 noted that providing unredacted copies of correspondence already sent or received by the applicant would not disclose third party personal information to the applicant, as the applicant already knew it.

Care needs to be taken, however, when making this decision, and the documents provided by and/or given to the applicant need to be assessed. If they are old, for example, or were provided jointly by parties who are no longer together (eg after a divorce or dissolution of a business partnership), it may raise questions as to whether the applicant still has a copy.

Care also needs to be taken when considering how the document appears in agency records. In James and Queensland Police Service23 the Commissioner found that third party personal information provided by the applicant could reasonably be expected to prejudice the protection of the third party’s right to privacy if disclosed because it appeared in an official QPS record.

In 0ZH6SQ and Department of Health24, third party personal information provided by the applicant had become part of a psychiatric report, which was a significant contributor to it being contrary to the public interest to disclose.

In both these cases, the way in which the information now appeared in agency records altered the way in which it impacted third parties.

Depending on the way the document appears in agency records, the third party personal information it contains may have acquired additional meaning—for example, a letter may have become part of a mental health assessment or investigation report or have been significantly notated by agency officers. If so, giving the applicant a copy would mean disclosing that additional information to the applicant and schedule 4, part 4, section 6 would apply.

Information that is known to the applicant

In some circumstances, the applicant may simply be aware of the information. This may be because they told the agency the information, or acquired it through other means, or were involved in a relevant incident with the third party.

When this occurs, the privacy interests that attach to the third party personal information may be lessened but they will not be negated.25 In most cases, the applicant’s knowledge will not be sufficient to outweigh the privacy and personal information factors against disclosure.

  • In Beale and Department of Community Safety26, the Commissioner considered video footage of an incident involving the applicant which took place in a prison. The applicant was able to provide details of a prisoner in the video with them and had been held in the same facility as other prisoners captured in the footage. On that basis, the Commissioner considered it likely that the applicant knew some, if not all, of the other prisoners. However, the Commissioner found that both the privacy and personal information factors against disclosure applied and gave them significant weight, deciding it was contrary to the public interest to release.
  • In 3ZA9CH and Cairns and Hinterland Hospital and Health Service27, the information was highly sensitive information provided by other people as part of the applicant’s healthcare. The applicant submitted that he might know it, given it related to his healthcare (although there was no evidence to support that position). However, the Commissioner found that, because of the highly sensitive nature of the information,28 any purported knowledge of the applicant would not reduce the privacy interests of the third parties. The Commissioner found it was contrary to the public interest to release.
  • In Setschnjak and Department of Justice and Attorney-General29 some aspects of the information, which related to a complaint against the applicant, may have been known to the applicant because current court proceedings made similar allegations. However, the Commissioner was not satisfied that, even if some aspects of the complaint were known to the applicant, the privacy interests attaching to the information had been significantly reduced. She found that disclosing the information would prejudice the complainant’s privacy and decided it was contrary to the public interest to release.
  • In 0ZH6SQ and Department of Health30, the information had been provided by the applicant to the agency. However, it was sensitive information about the applicant’s family and victims which now formed part of a psychiatric report in which its source was not clear. The Commissioner found that disclosing it to the applicant would significantly impact the privacy of the individuals involved and found it was contrary to the public interest to release.
  • In James and Queensland Police Service31, the applicant provided a third party’s name to the Queensland Police Service (QPS). While the applicant’s direct involvement diminished the weight of the privacy and personal information nondisclosure factors, the Commissioner was satisfied that disclosure of the individual’s details, given they appeared in an official QPS record, could prejudice the protection of their right to privacy.32 The Commissioner decided it was contrary to the public interest to release.

Decision makers need to consider the sensitivity of the third party personal information, the circumstances in which it appears, and to what extent the applicant actually knows it when deciding how much the weight given to the privacy and personal information factors against nondisclosure is reduced.

Third party personal information that could potentially be known to an applicant

Information appearing on the internet

In some circumstances the third party personal information may be available on the internet. This will need to be confirmed before it can be taken into consideration. If it can be confirmed, decision makers will need to consider the sensitivity of the information and the extent to which it is identical to information in the documents they are considering, noting James and Queensland Police Service (discussed above) regarding the privacy implications of third party personal information appearing in government records.

In J2P8MT and Department of Health33, the Commissioner found that the privacy factors against disclosure were significantly reduced in relation to the third party personal information, which related to a property transaction. Internet searches conducted using information already known to the applicant provided the details necessary to do a land title and a land valuation search, which would reveal the personal information in question.

Information that may have been presented in court

When making their applications, applicants will sometimes claim that third party personal information has been presented in court. Where the applicant does not include evidence of this, eg a transcript, decision makers are not obligated to ascertain if this is correct.

If the document the decision maker is considering is a court transcript, it is open to them to refuse access34, as transcripts are available from Auscript35. If the document is not a transcript, the third party personal information should be considered in the context in which it appears in the agency document.

In 3ZA9CH and Cairns and Hinterland Hospital and Health Service (discussed above), the applicant proposed that he might know the information, and the Commissioner considered the applicant’s purported knowledge when making her decision. Where the applicant contends that third party personal information might have been presented in open court, a decision maker can account for the possibility in their decision. However, they need to apply the privacy and public interest factors against disclosure to the information as it appears in agency records, based on its sensitivity and the fact that they have no evidence that the applicant knows it.

Third party personal information

Below are some personal information types in relation to which issues often arise.

Employment information

Public sector employees

Personal information of individuals employed by entities subject to the RTI Act falls into two categories: personal information that relates to the routine carrying out of their day to day work functions (routine personal work information) and personal information that doesn’t.

The discussion in this guideline applies to everything that isn’t routine personal work information. For information on dealing with routine information, refer to  Routine personal work information of public sector employees.

Mobile phone numbers

It has consistently been found36 that it is contrary to the public interest to release mobile phone numbers (both agency issued and personal phones) of public sector employees, because it could reasonably be expected to prejudice their right to privacy.

For information about third party personal information in public sector recruitment documents, please refer to Accessing information following a government recruitment process.

Private sector employees

Private sector employees do not have routine personal work information. When considering their personal information, the following considerations will be relevant:

  • What kind of information is it? For example, is it names and position titles or is it highly personal/private information?
  • What is the status of the employee? For example, are they the head of the company or the company’s public face?
  • Is the information already public? For example, does it appear on the company website?

In The Barlow Group Pty Ltd and Department of Housing and Public Works; JM Kelly (Project Builders) Pty Ltd (Third Party)37(Barlow) the Commissioner found that, while the privacy and personal information factors against disclosure applied to the names and position titles of private sector employees, they attracted a low weight. The Commissioner considered that disclosing the names and position titles of employees who were the public face of the company would reveal only that the individuals were employees and, due to their role in the company, that they had signed statutory declarations the substance of which had already been provided to the applicant.

In McCrystal and Queensland Building and Construction Commission38, however, when considering private sector employees’ personal information, the Commissioner afforded a high weight to the privacy and personal information factors against disclosure. Unlike Barlow, this information was provided to or obtained by the agency as part of an investigation into alleged regulatory breaches. It included names, contact details, personal opinions and other personal information, including audio recordings.

Audio recordings: non-lexical information

When an individual’s voice is recorded, the recording captures more information than just their words.39 This includes voice inflections and other non-lexical information40 such as tone, cadence, emphasis, inflection and pauses,41 reactions,42 tone of interactions with other people,43 and their emotional state or intellectual capacity at the time of the recording44.

Non-lexical information is sensitive and highly personal in nature.45 When considering audio recordings, the privacy interests of the third party should generally be accorded greater weight than might otherwise be the case for purely text-based documents.46

As was observed in NY Times v NASA:

...disclosure of the [tape] would reveal the sound and inflection of the crew's voices during the last seconds of their lives. Therefore, the tape contains personal information the release of which is subject to the balancing of the public gain against the private harm at which it is purchased.47

The Commissioner has stated48 that the “public interest harm that could ordinarily be expected to flow from disclosure of personal information of this kind is relatively significant having regard to the prejudicial effect on the protection of an individual’s right to privacy.”

For information on video recordings, decision makers should refer to Managing access to Digital Video Recordings.

Handwriting

Where documents have been handwritten by a third party, the handwriting itself is their personal information.49 Decision makers will need to assess the circumstances and the information to determine what weight to attribute to the privacy and personal information factors.

For example, in:

  • O’Hagan and Building Services Authority50 the documents were handwritten responses to questions.51
  • Plfugrath and Gympie Regional Council52 the handwriting would have been likely to identify the person who made a complaint to the Council and, as such, the Commissioner found it was not in the public interest to release the document.
  • McEniery and Medical Board of Queensland53 where release of the handwritten document would have allowed the identity of the writer to be ascertained.54

Investigations and complaints information

For information on dealing with third party personal information appearing in investigation and complaint documents, including the name of complainants, refer to Applications for investigation and complaint documents.

Third party personal information that can’t be separated from the applicant’s

In some circumstances, third party personal information will also be the applicant’s personal information, eg where it is the thoughts and/or opinions of other people about the applicant or vice versa, and/or be so mixed together it can’t be separated. This kind of personal information is called mutual or shared personal information.

In 5GNOF4 and Queensland Health55, information was recorded on Admission Cards in such a way that the applicant’s could not be separated from other people’s and, according high weight to the privacy and personal information factors against disclosure, the Commissioner refused access to the mutual personal information.

In 8RS6ZB and Metro North Hospital and Health Service56, the applicant’s information was also the thoughts and opinions of the individuals who provided it. The Commissioner held that the privacy and personal information factors against disclosure applied to the information and, given the information was “sensitive in nature, comprising opinions, thoughts and feelings”, gave them significant weight and found it would be contrary to the public interest to disclose.

Consultation

If a decision maker decides to release third party personal information, they must take reasonable steps to consult with the third party if disclosure would reasonably be of concern to the third party. If a decision maker is concerned about the impact viewing or reading the documents could have on the third party, it may be possible to consult in a way that does not require them to be given a copy. If the information is about a deceased person, the decision maker must consult with their representative.

Refer to Consulting with a relevant third party for more information.

  • 1 And the Information Privacy Act 2009 (IP Act)
  • 2 In this guideline, agency includes a Minister.
  • 3 Where information qualifies for exemption under schedule 3 of the RTI Act the public interest factors are irrelevant.
  • 4 Section 12 of the IP Act.
  • 5 Refer to the discussion in Seven Network (Operations) Limited and Logan City Council [2018] QICmr 21 (11 May 2018) beginning at paragraph 32
  • 6 [2014] QICmr 28 (13 June 2014)
  • 7 (Information Commissioner Qld, Decision No 301696, 310877, 6 Nov 2012), footnote 6.
  • 8 Mahoney and Ipswich City Council (Unreported, Queensland Information Commissioner, 17 June 2011)
  • 9 Schedule 4, part 4, section 6 and schedule 4, part 3, item 5
  • 10 Section 37 of the RTI Act
  • 11 There is also an information sheet: Applying for a deceased person's information.
  • 12 Schedule 4, part 4, section 6
  • 13 Schedule 4, part 3, item 3
  • 14 F60XCX and Queensland Ombudsman [2014] QICmr 28 (13 June 2014) (F60XCX)
  • 15  [2014] QICmr 28 (13 June 2014)
  • 16 l6XD0H and Department of Community Safety (Information Commissioner Qld, Decision No 310820, 26 Jun 2012); James and Queensland Police Service [2018] QICmr 8 (22 February 2018); The Courier-Mail and Queensland Police Service (Information Commissioner Qld, Decision No 311142, 15 Feb2013); F60XCX; Malfliet and Department of Education, Training and Employment [2014] QICmr 31 (17 July 2014); and WL1T8P and Queensland Police Service [2014] QICmr 40 (16 October 2014).
  • 17 [2015] QICmr 19 (17 August 2015)
  • 18 Schedule 4, part 1, item 3: disclosure could reasonably be expected to result in mischievous conduct by the applicant.
  • 19 However, when the information relates to a deceased relative, eligible family members are recognised in both the factors favouring disclosure and the factors against disclosure. Refer to Q20RYB and Department of Justice and Attorney-General [2014] QICmr 2 (16 January 2014) and Applications for records of a deceased person for more information.
  • 20 (Information Commissioner Qld, Decision No 310805, 21 May 2012)
  • 21 [2018] QICmr 47 (21 November 2018) and Seven Network (Operations) Limited and Department of Justice and Attorney-General; Department of Child Safety, Youth and Women [2018] QICmr 48 (29 November 2018)
  • 22  [2020] QICmr 11 (24 February 2020)
  • 23 [2018] QICmr 8 (22 February 2018)
  • 24 (Information Commissioner Qld, Decision No 310805, 21 May 2012)
  • 25 0ZH6SQ and Department of Health (Information Commissioner Qld, Decision No 310805, 21 May 2012)
  • 26 (Information Commissioner Qld, Decision No 310872, 11 May 2012)
  • 27  [2016] QICmr 39 (6 October 2016) (3ZA9CH and Cairns and Hinterland Hospital and Health Service)
  • 28 and the fact that health care workers responsible for patient care were entitled to expect sensitive personal information would not be disclosed to others
  • 29 (Information Commissioner Qld, Decision No 310604, 25 May 2012)
  • 30 (Information Commissioner Qld, Decision No 310805, 21 May 2012)
  • 31 [2018] QICmr 8 (22 February 2018) (James and Queensland Police Service)
  • 32 The Commissioner noted that “once the information is disclosed, there is no control over how information may be further disseminated. Therefore, I consider that disclosing the Third Party Information in the particular context of the Notebook, an official record created by a QPS officer, would cause a moderate level of harm to that individual’s personal sphere and moderately infringe upon their privacy."
  • 33 (Information Commissioner Qld, Decision No 310418, 11 May 2012)
  • 34 Refusal of access on the grounds that other access is available under section 53 of the RTI Act.
  • 35 https://www.auscript.com/en-AU/court-transcripts/queensland-courts/
  • 36 See for example L78 and Queensland Health [2020] QICmr 5 (10 February 2020) at paragraph 28.
  • 37 [2014] QICmr 12 (8 April 2014) (Barlow)
  • 38 [2017] QICmr 32 (10 August 2017)
  • 39 New York Times Co. v. National Aeronautics & Space Administration, 920 F.2d 1002, 1006 (D.C. Cir. 1990) (NY Times v NASA), cited with approval in Robert & Perlita Williamson and Queensland Police Service; "A" Third Party (Information Commissioner Qld, Decision No. 04/2005, 20 April 2005), decided under the now repealed Freedom of Information Act 1992.
  • 40 NY Times v NASA
  • 41 McKean and Department of Justice and Attorney-General; Carmody (Third Party) [2016] QICmr 25 (27 June 2016)
  • 42 82PNLR and Queensland Police Service [2019] QICmr 21 (13 June 2019)
  • 43 Nine Entertainment Co Holdings Ltd and Queensland Police Service [2018] QICmr 54 (20 December 2018)
  • 44 Palmer and Queensland Police Service [2018] QICmr 38 (13 September 2018)
  • 45 McKean and Department of Justice and Attorney-General; Carmody (Third Party) [2016] QICmr 25 (27 June 2016)
  • 46 82PNLR and Queensland Police Service [2019] QICmr 21 (13 June 2019)
  • 47 NY Times v NASA
  • 48 McKean and Department of Justice and Attorney-General; Carmody (Third Party) [2016] QICmr 25 (27 June 2016)
  • 49 O’Hagan and Building Services Authority (Information Commissioner Qld, Decision No 311112, 4 December 2012) and 06KLXE and Hinchinbrook Shire Council [2019] QICmr 22 (20 June 2019
  • 50 (Information Commissioner Qld, Decision No 311112, 4 December 2012)
  • 51 The responses were also personal information, separate from the handwriting, as they concerned the education of the third party.
  • 52 (Information Commissioner Qld, Decision No 210499, 16 March 2009), decided under the now repealed Freedom of Information Act 1992
  • 53 (Information Commissioner Qld, Decision No 94002, 28 February 1994), decided under the now repealed Freedom of Information Act 1992
  • 54 In this decision, the Commissioner was considering whether disclosure would allow a confidential source of information to be identified, but the principle of handwriting allowing the identification of an individual applies when considering the privacy and personal information factors against disclosure.
  • 55 [2018] QICmr 1 (11 January 2018)
  • 56 [2015] QICmr 3 (13 February 2015)

Current as at: April 17, 2023