Basic guide to confidentiality

The concept of confidentiality often arises when processing access applications under the Right to Information Act 2009¹ (Qld) (RTI Act). This guideline is an introduction to the concept of confidentiality and the requirements necessary to establish that information is confidential under the RTI Act.

Confidentiality – what kind of confidential?

There are two types of confidentiality relevant to access applications under the RTI Act:

• Equitable confidentiality, which must meet a specific set of criteria; and
• Contractual confidentiality.

Under schedule 3, section 8 of the RTI Act information will be exempt from release if it would found an action for breach of equitable or contractual confidence. For detailed information, decision makers should refer to the Breach of Confidence Guideline.

Equitable confidentiality

As set out above, information that is subject to equitable confidentiality is exempt from release in response to an RTI access application. For detailed information, decision makers should refer to the Breach of Confidence guideline.

In order to qualify as equitable confidentiality and be exempt from release, the information must fulfil four criteria. Every criterion must be met; if it misses out on even one, the information will not be subject to equitable confidentiality.

The criteria are:

1. The information must be specifically identified.

2. The information must have the 'quality of confidence'—this can be complex, but at its most basic, the information must not be trivial or useless, it must not be in the public domain, common knowledge, or something which the applicant already knows, and it cannot be evidence of a crime.

3. When the person the information belonged to gave it to the agency, they must have meant for it to be kept confidential and when the agency received it, they must also have intended for it to be kept confidential.

4. Giving the information to the applicant would be an unauthorised use of the information—if the other three criteria would be satisfied, and the applicant was not a party to the confidentiality, then this test will be met.

5.Where the person the information belonged to was a government body, it will generally be necessary for disclosing it to cause them a detriment. This will not apply for non-government entities.

Contractual confidentiality

Agency contracts for goods or services often contain an obligation of confidentiality in relation to certain information. If release of the information would be a breach of these clauses, it may be exempt from release under schedule 3, section 8 of the RTI Act.

Legislative confidentiality

Many Acts contain confidentiality clauses which may provide different levels of protection for information. For example, they may protect specific kinds of information, such as patient information or student information, prohibit the release of any information an officer becomes aware of due to their job, or prevent the release of information except in certain circumstances or to specified parties.

These confidentiality provisions are overridden by the RTI Act.³ Once someone makes an access application under the RTI Act, those provisions no longer apply.  However, the information protected by those confidentiality provisions may, in some circumstances, be exempt⁴ or contrary to the public interest to release.⁵

What confidentiality is not

In some circumstances, confidentiality is confused with other concepts such as privacy or commercial affairs. When considering documents under the RTI Act, or discussing matters with applicants or third parties, it is important to be clear about which concept is relevant.

Documents stamped 'confidential' or 'commercial in confidence'

Documents located in searches may be marked 'confidential' or 'commercial in confidence'. They may have been marked by business units of the agency or by people outside the agency who originally provided the documents. These kinds of notations cannot determine whether the information contained in the documents is confidential.

It is necessary to carefully consider the contents of all documents within the scope of an application to decide if their contents:

• satisfy the criteria for equitable confidentiality and as such are exempt under schedule 3 of the RTI Act; or
• attract relevant public interest factors against release, such as those involving the commercial and business affairs, to determine if they are contrary to the public interest.

Email disclaimers

Many email systems automatically add a disclaimer to outgoing emails. These disclaimers generally include statements like: 'the contents of this email are confidential' and 'confidentiality is not waived if you receive it in error'.

Much like stamping a document 'confidential' or 'commercial in confidence', these disclaimers do not automatically make the email confidential. Its contents must still satisfy the relevant tests. If they do not, the type of information in the email must be categorised—is it personal information, or legally privileged, or does it relate to an investigation?—and any relevant public interest factors for and against disclosure identified.

Confidentiality and privacy

There are public interest factors against release which relate to personal information⁶ and privacy⁷. These can weigh heavily against refusal of access, particularly where the information is highly personal, such as information that relates to someone’s private life, details about their participation in an investigation, or medical information.

In some circumstances personal information will also satisfy the tests for equitable confidentiality, but privacy and confidentiality are not the same; when making decisions under the RTI Act it is important to understand the difference.

Legislative confidentiality and privacy

Agencies are subject to the privacy principles contained in the IP Act, including the principles⁸ which set out when personal information can be disclosed. Many legislative confidentiality provisions allow information to be disclosed where the disclosure is authorised by law. Generally, law refers to another Act, but it is important to remember that, while they are contained in an Act, the disclosure privacy principles⁹ cannot be relied on to override a confidentiality provision¹⁰ because they are not an authority to disclose. Rather, they are an exception to the general rule¹¹ that an agency is not permitted to disclose personal information.