Published on Office of the Information Commissioner Queensland (https://www.oic.qld.gov.au)

Home Publications  >  Policies  >  Written Decisions

Written Decisions - Policy and Procedure

1 Introduction

The procedure to be followed on external review is, subject to the Right to Information Act 2009 (Qld) (RTI Act) and Information Privacy Act 2009 (Qld) (IP Act), within the discretion of the Information Commissioner.

When an external review is not resolved informally, the RTI Act and IP Act require the Information Commissioner to make and publish a written decision1.  This requirement is met by publishing the decision on OIC’s website.  As publication is authorized by the RTI and IP Acts, an exception to the information privacy principle about disclosure of personal information applies and it is not a breach of privacy to publish personal information in a decision.

However, as reidentification from multiple information sources is an evolving issue and to be consistent with good privacy practices, the Information Commissioner should limit personal information contained in decisions as much as possible. This document provides guidance for staff of the Office of the Information Commissioner (OIC) about the information to be included in written decisions.

2 Background

Review participants—specifically, applicants and consulted third parties—are often individuals. When this is the case, a decision will usually refer to the review participant by their last name and set out information about that party where relevant in the reasons for the decision. However, in limited circumstances, the decision will refer to the review participant using a randomly generated three figure code for example 'A12' (instead of their last name), and ensure that the reasons in the decision describe relevant facts in broad terms where possible. In either instance, the manner of referring to the review participant is within the discretion of the Information Commissioner’s delegated decision-maker regarding the procedure to be followed on external review.

A randomly generated three figure code, rather than a review participant’s last name, is most often used when a decision-maker considers that the reasons for the decision include sensitive personal information about that participant. It also commonly occurs when the decision-maker considers that referring to the review participant by their last name could reasonably be expected to enable others to identify that information published elsewhere is that review participant’s personal information.

3 Purpose

This policy and procedure has been developed to provide guidance for staff of OIC about the information to be included in a written decision and particularly to provide guidance about excluding, wherever possible, personal information about an individual (either in the decision itself or in other publicly available documents) except in so far as is necessary to provide reasons for the decision.

4 Effective Date

Approved by the Information Commissioner on 14 February 2019.

5 References

  • Right to Information Act 2009
  • Information Privacy Act 2009

6 Application

This policy and procedure applies to written decisions made by the Information Commission (or delegate) after the effective date under section 110 of the Right to Information Act 2009 and section 123 of the Information Privacy Act 2009.

7 Information to be included in a decision

7.1 Usually, the following information is to be included in a written decision:

  • the review participants
  • the facts relied on
  • details of the law used
  • details of submissions made by the participants; and
  • reasons for the decision2.

The personal information about an individual included in a decision will be limited to the specific information that is necessary to provide reasons for the decision, noting that the parties to the review will have access to additional information and further information will be provided on appeal where relevant.

7.2 Generally, a decision will refer to a review participant as follows:

  • In the decision’s headnote, the individual will be referred to by their last name. As a consequence, their last name appears in the citation for that decision.
  • In the reasons for a decision, an applicant who is an individual will usually be referred to as ‘the applicant’, rather than by their last name. A consulted third party is most often referred to as ‘the third party’, but may continue to be referred to by their last name, particularly when more than one individual has been consulted, so as to distinguish between them.

8 Circumstances where information may be excluded from a decision

8.1 In so far as it is possible on the information before the delegated decision-maker at the time of issuing a decision, a written decision should not include information that could reasonably be expected to connect a review participant or other individual with sensitive personal information (either in the decision itself or in other publically available documents). Nor should a decision contain information claimed to be exempt from disclosure or contrary to the public interest3 even where the decision is that information is not of either nature. Finally, in external reviews in which a third party is objecting to release of information, the name of the objecting third party may itself be information in issue and should be excluded from a decision.

8.2 Generally, it is OIC’s experience that sensitive personal information arises when the documents in issue involve a complaint made by or about an individual in a personal capacity. More specifically, sensitive personal information often arises when the documents in issue involve:

  • medical treatment or health conditions
  • adoption
  • child protection information
  • an application made on behalf of or about a child
  • a workplace complaint or related other matter
  • a neighbourhood complaint
  • a complaint or other matter involving a school or school students
  • criminal allegations which have not resulted in conviction; or
  • criminal allegations about a child, regardless of whether or not they have resulted in a conviction
  • domestic violence or disputes involving family members
  • claims of harassment or intimidation

8.3 As part of the procedure to be followed on external review within the discretion of the Information Commissioner, where:

  • the documents in issue involve any of the circumstances identified in section 8.2 or sensitivities of a similar nature; or
  • an external review participant requests, before an external review decision is finalised, that their name not appear in the decision

the delegated decision-maker should, before finalising the decision, consider whether any information is to be excluded from the decision, so as to reduce the possibility of a review participant or other individual being connected with sensitive personal information (either in the decision itself or in other publically available documents).

8.4 The delegated decision-maker may determine that an individual’s last name comprises the only information that could reasonably be expected to connect that individual with sensitive personal information (either in the decision itself or in other publically available documents). Further, the delegated decision-maker may determine that an individual’s last name requires de-identification in order to enable the decision-maker to provide sufficiently detailed and comprehensive reasons for the determinations in the decision. In these circumstances, the decision will refer to a review participant as follows:

  • In the decision’s headnote, the individual will be referred to by a randomly generated three figure code instead of the individual’s last name. As a consequence, this code appears in the citation for that decision.
  • In the reasons for a decision, the approach of referring to an applicant who is an individual as ‘the applicant’ remains unchanged. Similarly, the approach of referring to a consulted third party as ‘the third party’ will most often continue; however when more than one individual has been consulted, the decision-maker may refer to them by their codes or by other means (for example, ‘Third Party A’, ‘Third ‘Party B’ etc), so as to distinguish between them.

8.5 Where a particular individual is a participant in more than one formal decision:

  • Generally, the individual will be assigned a different three figure code for each decision. This is done in order to avoid revealing that one particular individual is connected to the various circumstances that are recorded in the documents they have sought in different access applications.
  • There are some circumstances, however, in which it may be appropriate to re-use a three figure code for an individual that has already appeared in a formal decision – for example, if the subsequent decision considers the ‘previous application for same documents’ ground for refusing to deal with an application; or a formal decision is appealed and subsequently remitted to OIC.

8.6 The delegated decision-maker may determine that other information in a decision is unique, and therefore comprises information that could reasonably be expected to connect the review participant with sensitive personal information (either in the decision itself or in other publically available documents). In this circumstance, the decision-maker will ensure that, where possible, the reasons in the decision describe the relevant facts in broad terms, rather than providing more specific information that could possibly be combined with other information, either in the decision or elsewhere, to identify the individual concerned—for example:

  • ‘a high school’ rather than the particular high school
  • ‘a mental illness’ rather than the specific diagnosis
  • ‘a juvenile detention facility’ rather than the particular facility
  • ‘a work unit within the agency’ rather than the name of the specific unit;
  • ‘the date of the incident’ rather than the specific date of the incident; and
  • ‘Officer X’ rather than the name of a particular agency officer.

1 Sections 110(6) of the RTI Act and 123(6) of the IP Act set out this requirement (which applies unless a competent court or tribunal orders otherwise).
2 Section 110 of the RTI Act, section 123 of the IP act and section 27B of the Acts Interpretation Act 1954 (Qld)
3 Section 110(7) of the RTI Act, section 123(7) of the IP Act.