‘DZ6’ and Department of Health (Freedom of Information) [2022] VICmr 24 (17 May 2022)

All references to legislation in this document are to the Freedom of Information Act 1982 (Vic) (FOI Act) unless otherwise stated.

Notice of Decision

I have conducted a review under section 49F of the Agency’s decision to refuse access to a document requested by the Applicant under the FOI Act.

My decision on the Applicant’s request differs from the Agency’s decision. I am not satisfied it is apparent from the nature of the documents, as described in the request, that all documents would be exempt under section 33(1).

Accordingly, I am not satisfied the requirements for the application of section 25A(5) are met.

The effect of my decision is the Agency is required to search for and identify the requested documents relevant to the terms of the Applicant’s request and assess any such documents in accordance with the FOI Act.

My reasons for decision follow.

Sven Bluemmel

Information Commissioner

17 May 2022

Reasons for Decision

Background to review

1. The Applicant made a request to the Agency for access to the following documents:

Daily statistics of the below for the period of the Covid19 pandemic to [date].

1. 1. 1. Daily General Hospitalizations itemizing Sex, Age, Vaccination status (Unvaccinated, Partially Vaccinated, Fully Vaccinated and Boostered) and variant of Covid.
      2. Daily ICU admissions itemizing Sex, Age, Vaccination status (Unvaccinated, Partially Vaccinated, Fully Vaccinated and Boostered) and variant of Covid.
      3. Daily General Hospitalization escalating to ICU admission itemizing Sex, Age, Vaccination status (Unvaccinated, Partially Vaccinated, Fully Vaccinated and Boostered) and variant of Covid.
      4. Daily Deaths due to Covid19 and at the exclusion of having other medical conditions, itemizing Sex, Age, Vaccination status (Unvaccinated, Partially Vaccinated, Fully Vaccinated and Boostered) and variant of Covid.
      5. Daily Covid infections which did not lead to any form of hospitalization (ie. General and/or ICU admission), itemizing Sex, Age, Vaccination status (Unvaccinated, Partially Vaccinated, Fully Vaccinated and Boostered) and variant of Covid.
      6. Confirmed Long-Covid cases on a daily basis since the Pandemic, itemizing Sex, Age, Vaccination status (Unvaccinated, Partially Vaccinated, Fully Vaccinated and Boostered) and variant of Covid.

 Definitions:

Unvaccinated – an individual whom is not known to have taken 1 or more doses of a Covid19 vaccine at the time of admittance for hospitalization.

Partially Vaccinated – an individual whom is known to have taken 1 dose of Covid19 vaccine at the time of admittance for hospitalization.

Fully Vaccinated – an individual whom is known to have taken 2 doses of Covid19 vaccine at the time of admittance for hospitalization.

Boostered – an individual whom is known to be Fully Vaccinated and taken an additional Covid19 Booster at the time of admittance for hospitalization.

General Hospitalization – an individual whom is generally admitted into hospital solely due to Covid19 and is known to be excluded from having other medical conditions. Individuals do not progress to ICU admission.

ICU admission – an individual whom is directly admitted into ICU solely due to Covid19 and is known to be excluded from having other medical conditions.

General Hospitalization escalating to ICU – an individual whom is generally admitted into hospital solely due to Covid19 and is known to be excluded from having other medical conditions. Individuals progress to ICU admission due to an increase in Covid19 symptoms during their general admission treatment.

Variant of Covid – Specific strain of Covid, ie. Delta, Omnicron or Other.

2. The Agency refused to grant access to documents in accordance with the Applicant’s request under section 25A(5) on grounds all documents to which the request relates, should any exist, would be exempt under section 33(1). In doing so, the Agency was not required to identify any documents relevant to the request. The Agency’s decision letter sets out the reasons for its decision.

 Review application

3. The Applicant sought review by the Information Commissioner under section 49A(1) of the Agency’s decision to refuse access.
4. The Applicant and the Agency were invited to make a written submission under section 49H(2) in relation to the review.
5. I have considered all communications and submissions received from the parties.
6. In undertaking my review, I have had regard to the object of the FOI Act, which is to create a general right of access to information in the possession of the Government or other public bodies, limited only by exceptions and exemptions necessary to protect essential public interests, privacy and business affairs.
7. I note Parliament’s intention the FOI Act must be interpreted so as to further the object of the Act and any discretions conferred by the Act must be exercised, as far as possible, so as to facilitate and promote the disclosure of information in a timely manner and at the lowest reasonable cost.

Preliminary view provided to Agency

8. On [date], the Agency was provided with OVIC’s preliminary view on its decision that the requirements of section 25A(5) had not been made out. The Agency was invited to provide a further submission or consider making a fresh decision under section 49M.
9. On [date], the Agency disagreed with the preliminary view and provided a further submission in support of its decision that the requirements of section 25A(5) are met.

Review of application of section 25A(5) to refuse to grant access to documents

10. Section 25A(5) provides an agency may refuse to grant access to a request for documents, without having identified any or all of the documents, if it is apparent from the nature of the request that all documents would be exempt in full under the FOI Act, and either there is no obligation for the agency to provide the applicant with an edited copy of the documents or the applicant does not agree to receive an edited copy of the documents.
11. The power to refuse a request under section 25A(5) is ‘carefully circumscribed’.[1] In Knight v Corrections Victoria,[2] the Supreme Court of Victoria held section 25A(5) will apply to an FOI request only where the following three requirements are met:

1. 1. First, the exempt nature of the documents sought must be objectively apparent from terms of
      the applicant’s request. The ‘nature’ of a document refers to their inherent or essential quality
      or character.
   2. Second, it must be apparent from the terms of the applicant’s request that all documents relevant to the request would be exempt.
   3. Third, it must be apparent from:

1. 1. 1. the nature of the documents, as described in an applicant’s request, that no obligation would arise under section 25 for an agency to grant access to an edited copy of a document with exempt or irrelevant information deleted; or
      2. an applicant’s request, or through consultation with the applicant, they do not seek access to an edited copy of a document.

What is the essential character of the document requested?

12. I am satisfied the nature or character of the requested documents, as described in the Applicant’s FOI request, is apparent from the terms of their request, being data or tables containing data which concern COVID-19 infections and infection outcomes held by the Agency.
13. Accordingly, I am satisfied the first requirement of section 25A(5) is met.

Would the requested documents, as described in the FOI request, be exempt?

14.  As stated above, in refusing access to the requested documents under section 25A(5), the Agency submits the documents, should any exist, would be exempt in full under section 33(1).

 Application of section 33(1) – Documents affecting personal privacy of third parties

15. A document is exempt under section 33(1) if two conditions are satisfied:
    1. disclosure of the document under the FOI Act would ‘involve’ the disclosure of information relating to the ‘personal affairs’ of a person other than the Applicant (a third party);^[3] and
    2. such disclosure would be ‘unreasonable’.

Would the requested document contain personal affairs information?

16. Personal affairs information includes any information that identifies any person or discloses their address or location. It also includes any information from which this may be reasonably determined.[4]
17. I also note, the Victorian Civil and Administrative Tribunal (VCAT) has interpreted the scope of ‘personal affairs information’ broadly to include matters relating to health, private behaviour, home life or personal or family relationships of individuals.[5]
18. Based on the terms of the Applicant’s request, I am satisfied there would be personal affairs information of third parties in the requested documents, specifically, their sex, age, and health information, including date of death.
19. I note there are various data sets available on publicly accessible websites concerning COVID-19 infections in Victoria. However, I consider the specific combination of data requested by the Applicant does not appear to be publicly available.
20. The Agency submits:

The department notes OVIC’s view in relation to item 4 of the request, that the exact date of death, in addition to other publicly available information, may re-identify deceased individuals. However, the department contends that this same principle also applies to all of the documents requested.

The information in the requested documents is likely to contain unit-record level data points with very small values. This is because the applicant’s request is for specific and granular unit-record data (such as the specific dates, ages and genders). The department submits that the small value data points of age and gender, when linked with exact dates, is reasonably likely to be able to re-identify individuals.

…

It is also important to note that the scope of the applicant’s request is from the start of the pandemic till the date of the request. During the course of the pandemic, there were many dates where there were very limited numbers of hospitalisations and ICU admissions, even for older ages. Providing the exact age and gender of this small group, linked to the exact date of their admission, would also reasonably allow for these individuals to be re-identified. Similarly, there are various days during the pandemic in Victoria where less than 10 COVID infections were reported.

In support of this position, we note that OVIC’s report, ‘The Limitations of De-Identification – Protecting Unit-Record Level Personal Information’, explores the risk of re-identification for unit-record level personal information, such as the requested documents. The report notes that as a general principle, agencies should “avoid the use of individual-level data sets, whether de-identified or not”.

(emphasis in original)

21. I consider individuals may be able to be re-identified by linking the requested information with publicly available information about COVID-19 infections. The ability to re-identify an individual by using information in a dataset combined with other information in the public domain was the subject of an investigation report issued by my office in 2019.[6] While that investigation report concerns ‘personal information’ in the context of the Privacy and Data Protection Act 2014 (Vic), I consider the same principles apply in the context of re-identification of a person’s ‘personal affairs information’ for the purpose of section 33(1) of the FOI Act.
22. However, on the face of the request, I am not satisfied the entire content of the documents would constitute personal affairs information of third parties. For example, the requested documents may contain some information related to individuals that does not allow their identity to be reasonably determined. For example, release of the age, gender and date of infection of an individual is unlikely to allow for the re-identification a person, depending on the number of infections reported in the community at that time. However, deceased individuals may be able to be re-identified by linking the exact date of death with other publicly available information regarding the death of those persons.
23. While I accept the Agency’s submission that the requested documents are likely to contain unit-level data points that may enable re-identification of individuals, I am not satisfied that this meets the definition of personal affairs information for the purposes of establishing section 25A(5) across the entire document set.

Would release of the personal affairs information of third parties be unreasonable in the circumstances?

24. Even if I were satisfied that the content of all requested documents constituted personal affairs information of third parties, the documents would only be exempt if the disclosure of the personal affairs information would be unreasonable.
25. Determining whether disclosure of a document would be unreasonable in the circumstances involves balancing the public interest in the disclosure of official information held by a government agency with the interest in protecting an individual’s personal privacy in the circumstances.[7]
26. The Victorian Court of Appeal has held there is ‘no absolute bar to providing access to documents which relate to the personal affairs of others’, and the exemption under section 33(1) ‘arises only in cases of unreasonable disclosure’ and ‘[w]hat amounts to an unreasonable disclosure of someone’s personal affairs will necessarily vary from case to case’.^[8] Further, ‘[t]he protection of privacy, which lies at the heart of section 33(1), is an important right that the FOI Act properly protects. However, an individual’s privacy can be invaded to a lesser or greater degree’.^[9]
27. In determining whether disclosure of the personal affairs information would be unreasonable in the circumstances, I have considered the following factors:
    1. the nature of the personal affairs information;
    2. the circumstances in which the information was obtained;
    3. the Applicant’s interest in the information and whether their purpose for seeking the information is likely to be achieved;
    4. whether any public interest would be promoted by release of the personal affairs information;
    5. the likelihood of disclosure of information, if released;
    6. whether the individuals to whom the information relates object, or would be likely to object, to the release of the information; and
    7. whether disclosure of the information would or would be reasonably likely to endanger the life or physical safety of any person^[10]

28. The Agency submits it would be unreasonable to disclose personal affairs information for the following reasons:

• • • The requested documents would disclose the sensitive health (ie. dates of admission to hospital, ICU, COVID infection and death) and personal affairs information (ie. age and gender) of individuals;
    • These relevant third parties would be reasonably likely to object to the release of their sensitive health and personal affairs information to the applicant;
    • Members of public would expect the department to maintain the confidentiality of this sensitive health and personal affairs information, which has been provided for the purpose of assisting the department’s response to the pandemic. Disclosure of this personal affairs information, where individuals may be re-identified, is likely to undermine the public’s trust in the department.
    • The information was collected in difficult circumstances, including the individual being admitted to hospital or the death of next of kin. The disclosure of the requested documents, given the circumstances under which it was collected, would be reasonably likely to cause third parties stress and anxiety;
    • There is no benefit to the applicant if the information is released, given there is already suitably de-identified information on similar information available (such as the department’s daily COVID updates and other websites, such as https://covidlive.com.au/).
    • The public interest would not be promoted by disclosure of further sensitive health and personal affairs information of third parties.

OVIC has also maintained in a previous decision that personal affairs information, relating to deceased individuals from COVID-19 (such as the date of death), is unreasonable to disclose [please see DJ3 and Department of Health (Freedom of Information) [2021] VICmr 211 (2 July 2021)].

29. As noted above, I consider the specific combinations of data requested by the Applicant do not appear to be publicly available.
30. Certain information requested by the Applicant is personal and sensitive in nature, as it concerns their personal health records.
31. While the Applicant may not necessarily seek to reidentify individuals from the data, or publicly disclose the information, it is relevant to consider the potential consequences of further dissemination of the documents, given the documents would contain sensitive information concerning the health of third parties.
32. I consider it is reasonably likely that some of the third parties, or their next of kin, would object to disclosure of their personal affairs information, particularly where the information concerns their health, particularly where there is a possibility that they could be re-identified through the release of a specific dataset.
33. On balance, while there is a public interest is transparency concerning COVID-19 infections, I am satisfied it would be unreasonable to disclose certain personal affairs information of third parties that would be contained in the documents requested by the Applicant.
34. However, I am not satisfied it would necessarily be unreasonable to release other parts of the requested documents, which may contain general information for members of the public regarding the number and outcomes of COVID-19 infections, as it is unlikely third parties could be re-identified if such information were disclosed. My view on this issue is based solely on the terms of the request.
35. For the above reasons, I am not satisfied all personal affairs information in the requested documents, should any exist, would be exempt under section 33(1).
36. Accordingly, I am not satisfied the second requirement of section 25A(5) is met.

Is there scope to provide an edited copy of the documents requested?

37. Section 25 requires an agency to grant access to an edited copy of a document when it is practicable to delete exempt or irrelevant information and the applicant agrees to receiving such a copy.
38. Determining what is ‘practicable’ requires consideration of the effort and editing involved in making the deletions ‘from a resources point of view’^[11] and the effectiveness of the deletions. Where deletions would render a document meaningless, they are not ‘practicable’, and release of the document is not required under section 25.^[12]
39. Having considered the particular circumstances of this matter, I am not satisfied that no obligation would arise under section 25 to provide the Applicant with an edited copy the requested documents, should any exist.
40. Accordingly, I am not satisfied the third requirement of section 25A(5) is met.

Conclusion

41. As stated above, the power for an agency to refuse a request under section 25A(5) is carefully circumscribed and will apply to a limited category of cases only.
42. Having carefully considered the application of section 25A(5) to the requested documents and for the reasons set out above, I am not satisfied it is apparent from the terms of the Applicant’s request that all documents relevant to the request, if any exist, would be exempt in full under section 33(1).
43. I am also not satisfied that no obligation would arise for the Agency to provide an edited copy of the requested documents, if any exist, to the Applicant with exempt information deleted in accordance with section 25.
44. Accordingly, I am not satisfied each of the requirements of section 25A(5) are met such that the Applicant’s request for access to the requested document can be categorically refused.
45. The effect of my decision is the Agency is required to search for, identify and assess any document or documents relevant to the terms of the Applicant’s request in accordance the FOI Act.

Review rights

46. If the Agency is not satisfied with my decision, it is entitled to apply to VCAT for it to be reviewed.[13]
47. The Agency may apply to VCAT for a review up to 14 days from the date it is given this Notice of Decision.[14]
48. Information about how to apply to VCAT is available online at www.vcat.vic.gov.au. Alternatively, VCAT may be contacted by email at admin@vcat.vic.gov.au or by telephone on 1300 018 228.
49. The Agency is required to notify the Information Commissioner in writing as soon as practicable if an application to VCAT for a review of my decision is made.[15]

When this decision takes effect

50. My decision does not take effect until the Agency’s 14 day review period expires, after which I consider the Agency has 28 days to process the Applicant’s request in accordance with the FOI Act.

Endnotes

[1] Knight v Corrections Victoria [2010] VSC 338 at [37].

[2] Ibid.

[3] Sections 33(1) and (2).

[4] Section 33(9).

[5] Re F and Health Department (1988) 2 VAR 458 as quoted in RFJ v Victoria Police FOI Division [2013] VCAT 1267 at [103].

[6] Office of the Victorian Information Commissioner, Disclosure of myki travel information Investigation under section 8C(2)(e) of the Privacy and Data Protection Act 2014 (Vic)’ published on 15 August 2019 at https://ovic.vic.gov.au/wp-content/uploads/2019/08/Report-of-investigation_disclosure-of-myki-travel-information.pdf. In particular, see [71]-[79] and [96].

[7] Re Page v Metropolitan Transit Authority (1988) 2 VAR 243 at 245-6.

[8] Victoria Police v Marke [2008] VSCA 218 at [76].

[9] Victoria Police v Marke [2008] VSCA 218 at [79].

[10] Section 33(2A).

[11] Mickelburough v Victoria Police (General) [2009] VCAT 2786 at [31]; The Herald and Weekly Times Pty Limited v The Office of the Premier (General) [2012] VCAT 967 at [82].

[12] Honeywood v Department of Human Services [2006] VCAT 2048 at [26]; RFJ v Victoria Police FOI Division (Review and Regulation) [2013] VCAT 1267 at [140] and [155].

[13] [Section 50(3D)].

[14] Section52(9).

[15] Sections 50(3F) and (3FA).