The Information Privacy Act 2009 (Qld) (IP Act) and the Right to Information Act 2009 (Qld) (RTI Act), contain rules about information that is personal information. It is important to understand the way these Acts apply to personal information that is solely the routine personal work information of public sector employees.
Routine personal work information is only relevant in relation to potential disclosure under:
It does not apply to any other privacy principle or disclosure.
This guideline only addresses the disclosure of routine personal work information to the public or to a member of the public where the disclosure is for legitimate agency or department business.
The concept of ‘routine personal work information’ applies to employees of agencies1 which are subject to the RTI Act or IP Act.2 It is not limited to those employed under the Public Service Act 2008 (Qld) and may be relevant for employees of any agency subject to the legislation (such as local government, public authorities and ministerial staff).
For simplicity this guideline will refer to all agency employees as ‘public sector employees’.
The concept of routine personal work information does not apply to private sector employees.3
Personal information is defined in both the IP Act and the RTI Act as:
information or an opinion, including information or an opinion forming part of a database, whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
This definition is extremely broad, and captures a substantial amount of information, beyond what most individuals would generally regard as 'private' or 'personal'.
Routine personal work information is personal information.
The information being considered in this guideline is limited to routine personal work information—personal information that is solely and wholly related to the routine day to day work duties and responsibilities of a public sector employee.
This includes information such as:
This kind of personal information will be referred to as routine personal work information throughout this guideline.
Information that is not related wholly to the routine day to day work activities of a public sector employee is not routine personal work information. The discussions in sections 5 and 6 below do not apply to information that is not routine personal work information, even if that non-routine information arose in or out of a work context, for example:
The RTI Act and IP Act allow people to apply to access documents of an agency or Minister. Access can be refused to exempt information or information the release of which would be contrary to the public interest.
Personal information is not a category of exempt information. Access to it can only be refused if would be contrary to the public interest to release (or if it is exempt for other reasons, eg it is confidential or would prejudice an investigation if released).
Information will be contrary to the public interest to release if the factors favouring disclosure outweigh the factors favouring non-disclosure (refer to the Public Interest Balancing Test for more information).
Schedule 4, part 3, provision 3 provides that it is a factor favouring non-disclosure that disclosure of the information could reasonably be expected to prejudice the protection of an individual's right to privacy (the privacy factor).
Schedule 4, part 4, provision 6 provides that disclosure of the information could reasonably be expected to cause a public interest harm if disclosure would disclose personal information (the personal information factor).
Additional public interest factors can apply to routine personal work information of a public sector employee. Those factors must be applied and balanced accordingly.
For example, in B31 and Queensland Ombudsman7 the Commissioner considered an application for the direct contact details of the Ombudsman and Deputy-Ombudsman. While their personal information was wholly employment related, the Commissioner found that it would be contrary to the public interest to release the information because of the:
The routine personal work information of public sector employee is personal information within the meaning of the RTI Act and the IP Act. This means the privacy and personal information public interest factors will be relevant.
However, the potential harm that could be caused by disclosure of routine personal work information will, in most circumstances, be minimal or none. Additionally, the infringement of a public sector employee’s right to privacy will, generally, be minimal or non-existent.
The assigning of minimal or no harm under these factors to the routine personal work information of a public sector employee may not be appropriate in all circumstances.
For example, for officers who conduct risk assessments of dangerous prisoners: disclosing their routine personal work information, ie their identity as risk assessors and/or the advice they provide, may cause harm if disclosed and if so, refusing access may be necessary to protect their safety.
A number of factors contribute to this, including:
This applies only to routine personal work information as discussed above and not to any other personal information of public sector employees arising out of or in connection with the workplace. It does not apply to the personal information of private sector employees.
Some Commissioner decisions that consider the application of routine personal work information are:
Other public interest factors may apply to routine personal work information of a public sector employee. Those factors must be applied and balanced accordingly.
A decision maker must take reasonable steps to seek the views of someone who would reasonably be expected to be concerned about the release of information. Generally, when dealing with routine personal work information, there would be no reasonable expectation of concern and consultation would not be necessary. However, if based on the circumstances the decision maker believes the employee would reasonably be concerned, they will need to consult.
As discussed above, routine personal work information is personal information within the meaning of both the RTI and the IP Act. The IP Act contains privacy principles which regulate the disclosure of personal information.
Whether personal information can be disclosed in compliance with the privacy principles does not have the same ‘public interest’ considerations as a formal access application. The agency or Minister must consider the privacy principles to determine whether personal information (including routine personal work information) can be disclosed.
Generally, disclosure of a public sector employees' routine personal work information is unlikely to be a breach of the IP Act.
Disclosure is defined in the IP Act as a situation in which an agency or Minister:
If an agency or Minister makes a public sector employee’s routine personal work information available to a member of the public, eg by providing their name and work phone number to a person, or to the public generally, eg by including it on a webpage, they have disclosed it. The general rule under the IP Act is that personal information cannot be disclosed unless one of a number of factors apply.
The rules about disclosure of personal information are contained in the privacy principles – the Information Privacy Principles (IPPs) and the National Privacy Principles (NPPs). The IPPs apply to all agencies (except health agencies); the NPPs apply to health agencies.
Disclosure of routine personal work information to the public or to a member of the public for legitimate agency purpose will, in most circumstances, be a permitted disclosure under IPP 11(1)(a) or NPP 2(1)(a).
Under IPP 11(1)(a) it may be disclosed because a reasonable public sector employee would, because of the nature of a public sector employee’s position and the need to both interact with the public and provide it with information, be reasonably likely to be aware that routine personal work information would be disclosed to the public or members of the public where it was necessary for legitimate agency purposes.
The reason for collecting routine personal work information would, in most instances, be done to facilitate the workings of the health agency or to carry out its legitimate business. Where the secondary purpose for disclosing routine personal work information to the public or members of the public is to conduct legitimate business of the health agency, this is directly related to the primary purpose.
Under NPP 2(1)(a) it may be disclosed because a reasonable public sector employee would reasonably expect that routine personal work information would be disclosed to the public or members of the public where it was necessary for legitimate business of the health agency.
The routine personal work information ‘exception’ only applies when disclosing personal information under IPP 11 or NPP 2. It does not change an agency’s obligation to collect, store, use and ensure the accuracy of routine personal work information in compliance with the privacy principles.
Current as at: May 14, 2021