‘AC1’ and Victoria Police (Freedom of Information) [2019] VICmr 19 (29 March 2019)

All references to legislation in this document are to the Freedom of Information Act 1982 (Vic) (FOI Act) unless otherwise stated.

Notice of Decision

I have conducted a review under section 49F of the Agency’s decision to refuse access to documents requested by the Applicant under the FOI Act.

My decision on the Applicant’s request is the same as the Agency’s decision in that I have decided to refuse access to the document.

My reasons for decision follow.

Joanne Kummrow

Acting Public Access Deputy Commissioner

29 March 2019

Reasons for Decision

Background to review

1. The Applicant made a request to the Agency, which the Agency interpreted the request to be for:

The IP address to contact the Operations Manager of an Internet Service Provider (ISP). Should access be denied for the full IP address be denied, then the Service Provider name will be sufficient.

2. The Agency identified one document comprising two pages that falls within the terms of the Applicant’s request, namely an online dating profile provided by a dating agency.
3. The Agency decided to deny access to the document under section 33(1).

Review

4. The Applicant sought review by the Information Commissioner under section 49A(1) of the Agency’s decision to refuse access.
5. In making [their] review application, the Applicant states [they were] a victim of an online dating financial scam. [They] reported the matter to Victoria Police and was advised by a police officer ‘that the Internet Service Provider was hacked and the IP address used for fraud and no individual could be identified’. The Applicant seeks access to the information so [they] can ‘contact the Operations Manager of the Internet Service Provider’. The Applicant also advised [they] seek ‘the full IP address contained in the document’ or ‘part of the IP address that would provide the Service Provider name and Operations Manager or the block of IP addresses in which the particular IP address is contained’.
6. I have examined a copy of the document subject to review. I confirm it contains an IP address, but does not expressly state the ISP to which the IP is assigned.
7. The Applicant and the Agency were invited to make a written submission under section 49H(2) in relation to the review.
8. I have considered all communications and submissions received from the parties, including:

(a)  the Agency’s decision on the FOI request; and

(b)  the Applicant’s submission dated 18 February 2019 and information provided with [their] review application.

9. I have also considered a previous decision of the Acting Assistant FOI Commissioner made on 24 May 2017 (Reference […]), which concerned the same document in relation to which access was denied under section 33(1).
10. In undertaking my review, I have had regard to the object of the FOI Act, which is to create a general right of access to information in the possession of the Government or other public bodies, limited only by exceptions and exemptions necessary to protect essential public interests, privacy and business affairs.

Review of exemptions

11. The Agency relied on section 33(1) to refuse access to the document. The Agency’s decision letter sets out the reasons for its decision.

Section 33(1)

12. A document is exempt under section 33(1) if two conditions are satisfied:

(a)  disclosure of the document under the FOI Act would ‘involve’ the disclosure of information relating to the ‘personal affairs’ of a person other than the Applicant;^[1] and

(b)  such disclosure would be ‘unreasonable’.

13. Information relating to a person’s ‘personal affairs’ includes information that identifies any person, or discloses their address or location. It also includes any information from which this may be reasonably determined.^[2]
14. The document comprises two pages and consists of the dating profile of an individual. The Applicant, in [their] review application and subsequent submission, indicated [their] review request concerns the IP address in the document.
15. The Queensland Office of the Information Commissioner (OIC) has published guidelines on whether an IP address constitutes ‘personal information’, as defined in the Information Privacy Act 2009 (Qld).[3] That definition is in relevantly similar terms to section 33(9) of the Victorian FOI Act.
16. The OIC guidelines provide a description of an IP address:

An IP address (internet protocol address) is a string of numbers separated by decimal points … which identifies a specific piece of equipment, usually a computer, on the internet. IP addresses are generally assigned by an Internet Service Provider (ISP), either temporarily (a dynamic IP address) or permanently (a static IP address).

There are a number of IP address locator websites which will provide the name and geographical location of the entity to whom an IP address is registered. Because most internet users access the internet through an ISP … the locator will reveal information about the ISP and not the individual internet user.

…

While any website may collect and hold IP addresses, generally only an ISP can link it to the name of an individual account holder. Because of this lack of ability to link an IP address to an identifiable individual, a number of authorities are of the view that an IP address in isolation is not personal information. [footnotes omitted, emphasis in original]

… if an IP address is linked to other information which would allow an individual to be reasonably identified then it will become personal information…

17. Section 33(1) extends to the disclosure of information that would ‘involve’ the disclosure of personal affairs information. Namely, information that does not specifically relate to personal affairs of a person, but enables a person to be identified will involve the disclosure of the personal affairs of a person.
18. While I accept the IP address in isolation does not identify an individual, an online search of the IP address with other linking information has the potential to identify an individual or their location. In circumstances where the relevant IP address can be directly associated with a physical street address, I consider this information to be sensitive in that it may be used to identify an individual or individuals currently associated with a specific property.
19. I am of the view that, should the Applicant be given access to the full IP address information, the location, address or identity of an individual could reasonably be determined. Moreover, the address may not correctly identify the individual whose information the Applicant seeks. This weighs against disclosure.
20. The concept of ‘unreasonable disclosure’ involves balancing the public interest in the disclosure of official information with the personal interest in privacy in the particular circumstances of a matter.
21. While the FOI Act creates a general right of access to information held by agencies in Victoria it is limited to the extent necessary to protect public interests and the private affairs of individuals whose information is collected and held by agencies.
22. I am of the view releasing the IP address in full would be unreasonable. In making my decision, I have weighed the public interest in disclosure with the personal interest in privacy, with consideration given to:

(a)  the nature of the personal affairs information;

(b)  the circumstances in which the information was obtained by the Agency;

(c)  the Applicant’s interest in the information (including their purpose for seeking access to the document);

(d)  whether the individuals to whom the information relates object or would be likely to object to the release of the information; and

(e)  the likelihood of further disclosure of the information, if released.

23. I acknowledge the Applicant’s personal reasons for seeking access to the IP address in full. The Applicant’s private interest in obtaining the information is only one of the factors I must consider. It does not of itself determine whether disclosure would be reasonable or unreasonable in the circumstances.
24. While the Applicant clearly has a private interest in the information, I do not consider the public interest would be promoted by the release of such information. The personal affairs information in the document was obtained by the Agency to be used for the limited purpose of its investigation following a complaint by the Applicant. The company that provided this information to the Agency would reasonably have expected the information would only be used for law enforcement purposes by the Agency or any prosecution arising from its investigation.
25. I am of the view the greater public interest in this matter lies in the Agency preserving the confidentiality of the information provided during an investigation. This ensures the Agency’s ability to obtain similar information and cooperation from the public in order to effectively carry out its investigative functions. Therefore, I consider there is a greater public interest in the third parties’ information not being released to the Applicant.
26. I have considered the likelihood and potential effect of wider dissemination of information that could be obtained from the document, if released, given the FOI Act does not place any conditions or restrictions on an applicant’s use of documents obtained under the FOI Act. [Redacted]. If the IP address is released to the Applicant there is a risk it may be used to identify an address or individual with which it is associated. As stated above, the address currently associated with the IP address may not correctly identify the individual whose information the Applicant seeks. This weighs against disclosure. Particularly, where Victoria Police has informed the Applicant ‘the ISP was hacked and the IP address used for fraud and no individual could be identified’.
27. On 1 September 2017, changes to the FOI Act introduced section 33(2B), which requires an Agency to consult with individuals whose personal details are captured within a document in order to seek that person’s view regarding disclosure. The results of this consultation process should be considered by the agency prior to determining a document is exempt under section 33(1).
28. The Agency in its decision advised consultation was not undertaken with third parties as it was considered impracticable in the circumstances. Given the circumstances, I consider any individual residing at the address identified by the IP address, particularly if they are not involved in the allegations made by the Applicant, would object to the release of their personal affairs information in the circumstances. This goes against disclosure. Particularly, where there is no evidence to suggest any individual, whose address is currently associated with the IP address, is the same person whose information is sought by the Applicant in relation to the online dating financial scam.
29. While I acknowledge the Applicant may be frustrated that [their] efforts in obtaining the information [they] seek, having considered the relevant exemption and the information in the document sought, I have determined it is exempt under section 33(1).

Deletion of exempt or irrelevant information

30. Section 25 requires an agency to grant access to an edited copy of a document when it is practicable for the agency or Minister to delete exempt or irrelevant information and the applicant agrees to receiving such a copy.
31. Determining what is ‘practicable’ requires consideration of the effort and editing involved in making the deletions ‘from a resources point of view’^[4] and the effectiveness of the deletions. Where deletions would render the document meaningless they are not ‘practicable’ and release of the document is not required under section 25.^[5]
32. I have considered the effect of deleting the exempt and irrelevant information in the document. Based on the Applicant’s request, everything other than an IP address is irrelevant information. Therefore, in my view, it is not practicable for the Agency to provide an edited copy of the document with the irrelevant and exempt information, because doing so would render all information in the document deleted, leaving a blank document.
33. Having reviewed the terms of the Applicant’s current request, I note [they are] agreeable to obtaining ‘part of the IP address that would provide the Service Provider name’ (i.e. the ISP provider’s name). Accordingly, it is necessary for me to consider whether it is practicable to provide the Applicant with access to the IP address in part to assist [them] in identifying the ISP.
34. Firstly, I consider I would be permitted to provide the Applicant with an edited copy of the exempt information (ie. part of the IP address) if the partial information to be released would retain meaning. I consider ‘meaning’ is to be determined from the perspective of the Applicant, rather than any person. I accept ‘meaning’ in this instance would be satisfied if, for example, part of the IP address was released to the Applicant allowing [them] to identify the ISP.
35. Secondly, I do not consider information that would identify an ISP is personal affairs information of an individual for the purposes of sections 33(1) or 33(9). Rather it would, in this case, relate to a telecommunications company.
36. However, in order for an IP address to retain meaning, in this case, the ability to identify the ISP, the entire IP address would need to be released. Therefore, I have determined that partial release of the IP address in the document would not be practicable, as I am satisfied it would not identify the ISP and would be devoid of meaning.
37. Therefore, I am satisfied there is no obligation to disclose part of the IP address in accordance with section 25 as it would not be practicable to release any non-exemption information as the entire IP address is exempt information.
38. For completeness, I confirm for the benefit of the Applicant, the document does not disclose the name of the telecommunications company.

Conclusion

39. On the information available, I am satisfied the exemption in section 33(1) applies to the personal affairs information in document, which is the entire IP address on account it could be used to identify the location, address or identity of an individual, who may not necessarily correctly identify the individual whose information the Applicant seeks.
40. As I have determined it would not be practicable to provide an edited copy of the document in accordance with section 25, I have decided to refuse access to the document in full.

Review rights

41. If either party to this review is not satisfied with my decision, they are entitled to apply to the Victorian Civil and Administrative Tribunal (VCAT) for it to be reviewed.^[6]
42. The Applicant may apply to VCAT for a review up to 60 days from the date they are given this Notice of Decision.^[7]
43. The Agency may apply to VCAT for a review up to 14 days from the date it is given this Notice of Decision.^[8]
44. Information about how to apply to VCAT is available online at www.vcat.vic.gov.au. Alternatively, VCAT may be contacted by email at admin@vcat.vic.gov.au or by telephone on 1300 018 228.
45. The Agency is required to notify the Information Commissioner in writing as soon as practicable if either party applies to VCAT for a review of my decision.^[9]

When this decision takes effect

46. My decision does not take effect until the relevant review period (stated above) expires, or if either party applies to VCAT for a review, until the VCAT proceeding is concluded.

Endnotes

[1] Sections 33(1) and (2).

[2] Section 33(9).

[3] IP Addresses, Google Analytics and the Privacy Principles, Office of the Information Commissioner Queensland, updated
11 January 2012.

[4] Mickelburough v Victoria Police (General) [2009] VCAT 2786 [31]; The Herald and Weekly Times Pty Limited v The Office of the Premier (General) [2012] VCAT 967 [82].

[5] Honeywood v Department of Human Services [2006] VCAT 2048 [26]; RFJ v Victoria Police FOI Division (Review and Regulation) [2013] VCAT 1267 [140], [155].

[6] The Applicant in section 50(1)(b) and the Agency in section 50(3D).

[7] Section 52(5).

[8] Section 52(9).

[9] Sections 50(3F) and (3FA).