Machinery of Government changes

This factsheet provides a high-level overview of privacy, information security and freedom of information (FOI) considerations for Victorian public sector organisations impacted by machinery of government (MoG) changes.

MoG changes occur when government decides to change the way government responsibilities are managed. MoG changes can result in the transfer of functions and responsibilities between organisations, organisational restructures, or the creation or cessation of organisations. MoG changes can occur at any time but often occur after an election.

Organisations subject to the Privacy and Data Protection Act 2014 (Vic) (PDP Act) are required to comply with privacy and information security obligations throughout the MoG process. Similarly, organisations subject to the Freedom of Information Act 1982 (Vic) (FOI Act) should ensure government-held information remains available and accessible to the public in line with obligations under the FOI Act.

Factors to consider

Privacy and information security

• The privacy and security of all information assets and systems should be managed appropriately throughout the MoG process. This includes managing privacy and information security risks for both digital (electronic) and physical information assets and systems.
• Organisations subject to Part 4 of the PDP Act are required to notify OVIC if there is a significant change to their operating environment or to the security risks relevant to their organisation.¹ MoG changes may constitute significant change for the purposes of the PDP Act. As soon as is reasonably practicable, an organisation impacted by MoG changes should complete OVIC’s Notification of significant change form and send it to the Information Security team at security@ovic.vic.gov.au.²
• Organisations should ensure information assets and systems are adequately protected ³ and remain secure throughout the MoG process. To do so, organisations should:
  • Conduct a stocktake of their information holdings and identify any information assets and systems that may be impacted by the MoG process. This includes those that may need to be securely transferred to another organisation, transferred to the Public Record Office Victoria (PROV), destroyed or decommissioned. Organisations should ensure they also identify any information assets and systems created or held by contracted service providers or other third parties that may be impacted by the MoG process.
  • Refer to their Information Asset Register (IAR) to understand the assessed security value of any relevant information and associated protective markings. Organisations may find it necessary to undertake a refreshed security value assessment to confirm the current security value of the information assets and systems. An information security value assessment helps inform the security risk assessment. ⁴
  • Assess the information security risks associated with the information assets and systems, including any new risks relating to the proposed secure transfer or disposal (including permanent archive, destruction or decommission). This security risk assessment should occur at the earliest opportunity and will inform the security measures needed to facilitate the secure transfer or disposal of the information assets and systems.
  • Ensure information assets and systems are securely transferred to the receiving organisation or securely disposed of in accordance with their security value and associated information security risk assessment.
  • Update any internal governance documentation.
• Organisations should handle any personal information they hold in line with the Information Privacy Principles (IPPs) in the PDP Act during the MoG process. Among other things, organisations should ensure:
  • they only collect the minimum amount of personal information necessary for their new functions or activities from the transferring organisation in line with IPP 1 ⁵
  • sharing of information between organisations complies with the use and disclosure principle (IPP 2)⁶
  • privacy policies and relevant notices of collection are updated to reflect any changes to how organisations collect, use and disclose personal information in line with IPP 5 and IPP 1.3.⁷

Freedom of information

• Organisations should consider how existing and future FOI requests will be handled, to ensure individuals are able to exercise their right to request access to government-held information. Organisations will need to preserve documents to ensure they can be accessed and may need to transfer documents to another organisation if an FOI request is going to be managed by that other organisation. Where existing FOI requests, or undecided review matters before OVIC or the Victorian Civil and Administrative Tribunal (VCAT) are transferred, the transferring organisation should inform the applicant and the relevant review body of the MoG change and provide the receiving organisation’s name and contact details. The applicant should be informed as soon as practicable that the receiving organisation is now responsible for processing and deciding the FOI request or the respondent in any undecided review proceeding.
• An FOI request can be made to any organisation that holds a copy of the requested document(s).⁸ An organisation may transfer an FOI request to another organisation where it does not have possession of the document ⁹ or where the subject-matter of the document is more closely connected with the functions of that other organisation.¹⁰ See OVIC’s FOI Guidelines resource for more detailed guidance on the transfer of FOI requests.¹¹
• Where a MoG change results in a Minister’s portfolio changing or a change in government, any unprocessed FOI requests made to the outgoing Minister before they ceased office will remain active. Whether a requested document is an ‘official document of a Minister’ for the purposes of the FOI Act is determined at the time the request is made to the Minister. After a MoG change, the Minister responsible for the portfolio will be required to make a decision on any unprocessed FOI requests and will be the respondent in any subsequent review of the decision by OVIC or VCAT. The responsible Minister may also become the respondent in any undecided review matters before OVIC or VCAT at the time the outgoing Minister’s office ceased. There is no obligation on an outgoing Minister to preserve and maintain documents or transfer documents to the responsible Minister. However, the outgoing Minister should not take any steps to prevent an applicant’s FOI request from being heard, including on review.¹² Where there are unprocessed FOI requests or undecided review matters, the outgoing Minister or new responsible Minister should inform the applicant, OVIC or VCAT as soon as practicable of the MoG change and provide the new responsible Minister’s name and contact details.
• Sections 7, 8 and 11 of Part II of the FOI Act require organisations to publish certain information about their functions, operations and documents they hold, among other things. Organisations impacted by MoG changes should review this information and, if necessary, update it to ensure it satisfies the requirements of the FOI Act. Detailed guidance on Part II of the FOI Act is available in OVIC’s FOI Guidelines resource.
• If there are personnel changes, organisations should ensure there is an agency officer responsible for responding to requests for information from OVIC. Organisations should provide the name and contact details of the officer to OVIC.
• If there are changes to the FOI process, organisations should be transparent with applicants if their FOI request is affected.

Records management

• Organisations should ensure information is handled in accordance with recordkeeping obligations established under the Public Records Act 1973 (Vic) (Public Records Act). This includes determining whether information should be securely transferred to the receiving organisation, transferred as permanent value records to PROV or securely disposed of in accordance with a current retention and disposal authority issued by the Keeper of Public Records. Recordkeeping obligations established under the Public Records Act will prevail over the PDP Act and IPPs to the extent of any inconsistency.¹³ Detailed guidance on recordkeeping and MoG changes is available on PROV’s website.

Additional resource

• Machinery of Government changes – Victorian Public Sector Operating manual – This resource provides comprehensive guidance on planning and implementing MoG changes (please note that this resource includes some references to outdated privacy legislation and frameworks and is in the process of being updated).

1. PDP Act, section 6.
2. Detailed information on the significant change notification process is available on the OVIC website here: https://ovic.vic.gov.au/information-security/significant-change-and-protective-data-security-obligations/.
3. Organisations should implement measures to maintain the confidentiality, integrity and/or availability of information and information systems across the 5 security domains: personnel security, information security, ICT security, physical security and governance.
4. Detailed guidance on assessing the security value of information is available on the OVIC website here: https://ovic.vic.gov.au/information-security/practitioner-guide-assessing-the-security-value-of-public-sector-information-v2-0/.
5. Detailed guidance on IPP 1 is available in OVIC’s IPP Guidelines resource here: https://ovic.vic.gov.au/book/ipp-1-collection/
6. Detailed guidance on IPP 2 is available in OVIC’s IPP Guidelines resource here: https://ovic.vic.gov.au/book/ipp-2-use-and-disclosure/
7. Detailed guidance on privacy policies is available in the IPP 5 – Openness chapter of OVIC’s IPP Guidelines resource here: https://ovic.vic.gov.au/book/ipp-5-openness/#IPP_5.1:_Written_policy_on_management_of_personal_information_
8. FOI Act, section 18(1).
9. FOI Act, section 18(2)(b)(i). See also paragraphs 1.19 – 1.21 of OVIC’s FOI Guidelines resource for guidance on when a document is considered ‘in the possession of’ an agency for the purposes of an FOI request: https://ovic.vic.gov.au/freedom-of-information/foi-guidelines/section-5/#document-of-an-agency.
10. FOI Act, section 18(2)(b)(ii).
11. See section 18 of OVIC’s FOI Guidelines resource available here: https://ovic.vic.gov.au/freedom-of-information/foi-guidelines/section-18/
12. The information in this paragraph is the position taken in Attorney-General (Cth) v Patrick [2024] FCAFC 126 and will likely apply in the Victorian context.
13. PDP Act, section 6.