Section 33 – Disclosure of personal affairs information would be unreasonable in the circumstances

Section 33 of the Freedom of Information Act 1982 (Vic) (the Act) exempts documents containing personal affairs information of third parties where disclosure would be unreasonable in all the circumstances.

This Practice Note sets out the exemption, summarises the steps to take when applying it, and then discusses each element in detail. All legislative references are to the Act unless otherwise stated.

THE EXEMPTION

A document or information is exempt under section 33(1) if two conditions are satisfied:

1. the document contains information relating to the ‘personal affairs’ of a person; and
2. disclosure of that personal affairs information is unreasonable in all of the circumstances.

Section 33(2) states that – subject to certain exceptions¹ – a document containing personal affairs information relating solely to an applicant it is not exempt under section 33(1).

APPLYING THE EXEMPTION – A SUMMARY

1. Identify personal affairs information contained in the document.
2. Consult with the applicant to determine if they seek other individuals’ personal affairs information. Ask the applicant whether they agree to narrow the scope of the request to remove that information.
3. Identify and isolate the applicant’s own personal affairs information. This is not exempt unless:
   1. the request is made to an information sharing entity or authorised Hub entity,² which considers that the release of the applicant’s own information to them would increase the risk to:
      1. a primary person’s³ safety from family violence as noted in section 33(2AB); or
      2. a child or group of children’s safety as noted in section 33(2AC); or
   2. the request is for the applicant’s own health information, where the principal officer (or a health practitioner appointed by the agency) reasonably believes providing the applicant with the information would pose a serious threat to the life or health of the applicant (section 33(4)).
4. Unless one of the exceptions in section 33(2C) applies, consult with the individuals whose personal affairs information appears in the document (unless it is excluded), to seek their views on whether it should be released.
   1. Consider whether an extension of time under section 21(2)(a) is permitted due to the need for consultation under section 33(2B).
5. Determine whether release of a third party’s personal affairs information is unreasonable in all the circumstances having regard to:
   1. The nature of the information in the document.
   2. The applicant’s reasons for seeking access.
   3. The wishes or interests of the subject of the information.
   4. Public interest factors for or against disclosure.
6. If a decision is made to release personal affairs information, notify any affected third party who did not consent to the disclosure of their personal affairs information, or did not reply. Inform them of the decision and of their right to appeal to the Victorian Civil and Administrative Tribunal (VCAT), including the 60-day appeal period.
7. Wait until the conclusion of any appeal or VCAT proceedings before providing the documents to the applicant.

WHAT IS PERSONAL AFFAIRS INFORMATION?

Section 33(9) provides a non-exhaustive definition of ‘information relating to the personal affairs’ of a person. It includes:

• information that identifies any person;
• information that discloses a person’s address or location; or
• any information from which the above can reasonably be determined.

A document discloses personal affairs information if the applicant or any member of the public could directly or indirectly identify an individual from the personal affairs information.⁴

Note: ‘Personal affairs information’ under the Act, differs from ‘personal information’ in the Privacy and Data Protection Act 2014 (Vic) (PDP Act).⁵ ‘Personal affairs information’ under the Act is broader, capturing more information than ‘personal information’ in the PDP Act. For example, personal affairs information includes ‘health information’ as defined in section 3 of the Health Records Act 2001 (Vic) (Health Records Act), but ‘personal information’ under the PDP Act does not.

Examples of personal affairs information

Common examples of documents containing personal affairs information include:

• a person’s name or signature;
• a person’s clinical/medical file or record;
• a person’s contact details including a home address, telephone or mobile number, or email address;
• audio recordings or CCTV footage of a person;
• a person’s criminal history or details of a victim of crime; or
• a person’s opinion expressed about another person;⁶

THIRD PARTY CONSULTATION

When an agency determines a document contains the personal affairs information of a third party, the agency must consult (subject to limited exceptions) that person about whether their personal affairs information should be disclosed to the applicant.

The requirement to consult and related considerations

Section 33(2B) requires that in deciding whether to exempt a document, an agency must:

• notify a third party who is the subject of the information (or if deceased, their next of kin) that a request has been received; and
• seek that individual’s view as to whether they consent or object to disclosure of the document or information; and
• advise the individual that if they consent to disclosure, they are not entitled to apply to VCAT for a review of a decision to grant access to the document.

The third party’s view is not determinative. It is only one factor to be considered in deciding whether it is unreasonable to release the personal affairs information in the circumstances.

When consulting, the 30-day period for deciding a request may be extended by up to 15 days under section 21(2)(a). See Procedural Practice Note 8 – Timeframes and extensions of time for further guidance.

Where appropriate, an agency should ask the applicant if they actually require third party information. If not, the scope of the request can be reduced and the need to consult with some or all third parties is avoided. This approach also assists the applicant by reducing appeal times while giving access to the substance of a document.

If the applicant does seek personal affairs information, the applicant could be encouraged to refine their request to limit the types or nature of the third party information they seek, and therefore limit the consultation required.

When consulting, Professional Standard 7.3 requires a record of the consultation to be kept. This includes who was consulted, whether they consented or objected, and any reasons provided.

Consultation with a child

A ‘child’ is defined as a person under the age of 18 years.⁷ Section 33A states that where the third party to be consulted is a child, an agency may notify either or both of the child and their parent/guardian.

When considering who to notify, an agency should consider the exceptions in section 33(2C) about the risks to life and safety, the risk of undue distress, unreasonable in the circumstances, and practicability.

Further, section 33A(2) states that if an agency is an information sharing entity,⁸ the parent or guardian of the child must not be notified if:

• the child is a primary person;⁹ and
• the parent or guardian is a person of concern¹⁰ or is alleged to pose a risk of family violence to that child.

Consultation with a next of kin

Where the third party is a deceased person, the person’s next of kin should be consulted.

The term ‘next of kin’ is not defined in the Act. An agency can adopt an appropriate approach based on their particular operating context or business or the nature of the document.

The Human Tissues Act 1982, Coroners Act 2008, Guardian and Administration Act 2019, and Administration and Probate Act 1958 all offer guidance as to who may be the appropriate next of kin in certain circumstances.

The next of kin may include:

• a parent;
• a spouse or domestic partner;
• a brother or sister who is 18 years or older;
• a son or daughter who is 18 years or older; or
• a person who was a guardian immediately before a child’s death.

When consultation is not required

There are important circumstances when notification is not required. These are set out in section 33(2C):

• where the notification would be reasonably likely to:
  • endanger the life or physical safety of that person;
  • cause that person undue distress;
  • is otherwise unreasonable in the circumstances; or
• where the person to be notified is a ‘primary person’,¹¹ and the notification would be reasonably likely to increase the risk to that person’s safety from family violence; or
• where it is not practicable to do so.

Considerations as to what is ‘practicable’, and further information about third party consultation are discussed in Procedural Practice Note 12 – Practicability and third party consultation and notification.

WOULD DISCLOSURE BE UNREASONABLE?

Personal affairs information is not automatically exempt.¹² A document is only exempt under section 33(1) if its disclosure is ‘unreasonable’.

Deciding whether disclosure is ‘unreasonable’ involves balancing the public interest in open government against the personal interest in an individual’s privacy.

An agency must carefully weigh matters that ‘relevantly, logically, and probatively’ bear upon whether disclosure of their personal affairs information is unreasonable in the circumstances.¹³ Common considerations are:

The Information in the document

• The nature of the information in the document.¹⁴
  1. the more sensitive the information, the more likely disclosure would be unreasonable;
  2. the more innocuous the information, the less likely disclosure would be unreasonable; and
  3. information with no current relevance, the less likely that disclosure would be unreasonable.
• The circumstances in which the information was obtained. If the information was obtained in confidence, disclosure of that information is more likely to be unreasonable.¹⁵ However, confidentiality does not create a presumption in favour of unreasonableness.¹⁶
• The extent to which the information is available to the public. If the information is largely in the public domain, disclosure is less likely to be unreasonable.

The applicant’s reasons

• Why the applicant seeks the information, including:
  1. the applicant’s interest in the information;¹⁷
  2. the applicant’s purpose for seeking access;¹⁸
  3. the applicant’s motives for seeking access;¹⁹
  4. whether the applicant is likely to disclose the information.²⁰
• Whether the applicant’s purpose for seeking access to the information is likely to be achieved by granting him or her access to that information.²¹ Where there would be no benefit to the applicant if the information were released, disclosure is more likely to be unreasonable.

Public interest

• Whether any public or important interest would be promoted by release of the information.²² Noting there is a distinction between a matter which is in the public interest and a matter which is merely a curiosity to the public.²³
• Whether disclosure of the information would be contrary to a public interest other than the public interest in protecting the privacy of the individuals referred to in the document. For example, disclosure is more likely to be unreasonable if the respondent’s ability to obtain similar information in the future would be impaired by such disclosure.²⁴

Subject of the information

• Whether the person to whom the information relates objects to the information being disclosed.²⁵ The fact that the person does not want the information disclosed is a relevant consideration to be taken into account, but is not determinative.²⁶ Conversely, the fact that a person does not object to disclosure does not necessarily mean section 33 does not apply.²⁷ The capacity of a person who does not object to disclosure to understand the implications of release is a relevant factor.²⁸
• Whether the release of the information could lead to the person to whom it relates suffering stress and anxiety.²⁹ Even though the applicant may know the persons involved, the decision-maker must consider the applicant’s likely reaction on seeing the personal information in the documents, and what the applicant might do with those documents.³⁰ It may be found that disclosure is likely to cause stress and anxiety, even if that is not the applicant’s intention.³¹
• Whether disclosure of the information would or would be reasonably likely to endanger the life or physical safety of any person. Note that disclosure may still be unreasonable even if it would not be reasonably likely to endanger the life or physical safety of any person.³²

WOULD DISCLOSURE ENDANGER LIFE OR PHYSICAL SAFETY?

Under section 33(2A), when deciding if disclosure is unreasonable, an agency must consider if disclosure could endanger the life or physical safety of any person. An agency must take into account that:

• there must be a real chance of danger occurring, rather than a fanciful or remote chance;³³
• the danger to persons must arise from the disclosure of the specific document, rather than from other circumstances;³⁴
• the risk need not be from the applicant themselves; it may be from anyone, should the information become generally or publicly known;³⁵
• physical harm need not be a certainty, the test is that the danger to physical safety is ‘reasonably likely’;³⁶
• physical safety is not only about actual safety; it is also about the relevant person’s perception as to whether he or she is safe;³⁷ and
• it is the impact on the relevant person or persons that is relevant, not the motives of the applicant.³⁸

AGENCY OFFICERS AND EMPLOYEES

Personal affairs information of agency officers or employees is not automatically exempt. Often, agency staff (regardless of their seniority) are identified while carrying out their role as a public sector employee. Consequently, their personal information is not usually sensitive with the occasional exception of direct contact information such as a mobile phone number.

Whether it is unreasonable to release information always depends on the circumstances of the particular request. An agency must consider if disclosure of an employee’s personal information to a particular applicant would be unreasonable in the circumstances taking into account the factors above as well as:

• the seniority of an employee – the more senior their role, the greater their level of accountability for decisions, and the more likely their details are in the public domain – in those circumstances, disclosure is not unreasonable unless special circumstances apply;
• the relevance of the employee to the issue that is the subject of an applicant’s request – if the person was directly involved in the matter then disclosure of their involvement is unlikely to be unreasonable. If an employee had an administrative role, then disclosure may be unreasonable;
• whether the identity or personal information of the employee is known to the applicant or the public – for example, despite their seniority, if the employee has a public facing role, for example in service delivery or in public meetings, then the disclosure of their name is less likely to be unreasonable;
• other matters relevant to the employee – like personal safety concerns either in relation to the applicant or another person or the sensitivity of the employee’s role in the agency (for example, undercover police officer).

FAMILY VIOLENCE AND CHILD SAFETY PROVISIONS – APPLICANT’S OWN PERSONAL AFFAIRS INFORMATION

Under section 33(2AB), if an applicant requests a document of an agency:

• where that agency is an information sharing entity³⁹ or an authorised Hub entity; and
• the document contains information relating to the applicant’s personal affairs; and
• the applicant is a person of concern, or a person who is alleged to pose a risk of committing family violence;

then in making the assessment of whether disclosure would be unreasonable, the agency must also consider whether the disclosure of the document would increase the risk to a primary person’s safety from family violence.

The Family Violence Protection Act 2008 (Vic) defines a primary person⁴⁰ as an individual that an information sharing entity reasonably believes is at risk of being subjected to family violence, and may include an affected family member, a child, or a protected person.⁴¹

Additionally, under section 33(2AC), if an applicant makes a request for a document of an agency:

• where that agency is an information sharing entity,⁴² authorised Hub entity or restricted information sharing entity; and
• the document contains information relating to the applicant’s personal affairs;

then in making the assessment of whether disclosure would be unreasonable, the agency must also consider whether the disclosure of the document would increase the risk to the safety of a child or group of children.

If disclosure would be unreasonable in either of these cases, the exemption in section 33(1) applies, even though the relevant information may relate only to the personal affairs of the applicant.

Sections 27(2)(ab) and (ac) allow an agency, in notifying the applicant of its decision in these circumstances, to neither confirm nor deny the existence of a document.

REQUESTS FOR HEALTH INFORMATION

‘Health information’ is defined in section 3 of the Health Records Act. Broadly, it relates to information or opinions about medical services provided to an individual.

Section 33(4) sets out additional processes when a request is made for health information. If a request is made for access to documents that contain an applicant’s health information and the agency believes on reasonable grounds that provision of the health information to the applicant would pose a serious threat to their life or health, the agency must:

• not give access to a document in so far as it contains that information; and
• follow the procedure set out in Division 3 of Part 5 of the Health Records Act.

Under section 33(5), this decision must be made by a principal officer who is a registered health practitioner under the Health Practitioner Regulation National Law. Where the agency’s principal officer is not a registered health, the agency must appoint one for to make this decision.

The procedure set out in the Health Records Act provides an avenue for access to be provided through an appropriate health service provider nominated by the applicant and approved by the agency, where appropriate.

As a matter of practice, an agency may establish policies and procedures for assessing and determining whether reasonable grounds exist to indicate that the release of the document would pose a serious threat. In making this decision, an agency may consider:

• if is there a history indicating the person has, or has previously had, serious mental health issues (for example, suicidal tendencies, severe anxiety or depression, or psychiatric treatment); or
• whether there is a reasonable belief, based on credible and reliable evidence that the release of the health information would pose a serious threat to the applicant.

These considerations are not simple and may require an agency to obtain the view of a registered medical health practitioner. If the applicant consents, this could include the applicant’s regular treating doctor.

An agency is encouraged, where possible, to make individuals’ own health information available to them without the requirement for an access request under the Act.

Where necessary, access may be subject to the deletion of information the disclosure of which is prohibited by law. Providing information that is routinely requested through informal or administrative processes is generally more efficient for the agency and more cost-effective for applicants.

CONFIRMING NEITHER THE EXISTENCE OR NON-EXISTENCE OF A DOCUMENT – SECTION 33(6)

Sometimes, disclosing information as to the existence or non-existence of a document may itself be an unreasonable disclosure of an individual’s personal affairs information under section 33(1).

Section 33(6) allows an agency, in responding to an access request, to neither confirm nor deny the existence or non-existence of a document.

Before applying section 33(6), the agency must be satisfied that in either instance, if they were to notify the applicant of the result of their search, the inclusion of that information would involve the unreasonable disclosure of personal affairs information.

An example – section 33(6)

An agency received a request from a member of the public for ‘the complaint lodged by Mr X about my driving’. The applicant knows, due to surrounding factual information, that only two individuals could have made the complaint, being either Mr X or Mr Y.

If the agency were to disclose that it has a document matching the description in the application, the applicant would know Mr X made the complaint about them. That fact is, in itself, information relating to Mr X’s personal affairs. Disclosing the existence of the complaint may amount to an unreasonable disclosure of Mr X’s personal actions.

However, if the agency were to disclose that it did not have a complaint matching the description in the application, it would effectively confirm that the complaint was in fact made by Mr Y. That fact would reveal information relating to Mr Y’s personal affairs, the disclosure of which may also be unreasonable. In these circumstances, the agency may respond to the applicant’s request by making a decision that neither confirms nor denies the existence of any documents, to avoid the unreasonable disclosure of information relating to the personal affairs of either Mr X or Mr Y.

In this scenario, before applying section 33(6), the decision maker must be satisfied that disclosing the identity of the complainant to the applicant would be unreasonable, in either case.

NOTIFYING A THIRD PARTY OF THE DECISION

When a decision is made to release a third party’s personal affairs information, if practicable, section 33(3) requires the third party (or if deceased, their next of kin) to be notified of the:

• decision to grant access to the document; and
• their right to apply to VCAT for review of the decision.

However, section 33(3A) states that where a third party consents to the release of their personal affairs information when initially being consulted, they are not required to be notified about the decision.

Where a third party did object to the disclosure and they are notified, disclosure of the documents to the applicant must be delayed for 60 days to give effect to a third party’s right under section 50 to apply to VCAT for review of the decision. If a third party who objected to disclosure exercises their right to seek review by VCAT, an agency must not disclose the documents until the VCAT proceedings are finalised and directions made.

Disclaimer: The information on this page is general in nature and does not constitute legal advice.

Version: June 2020 – D19/8812

1. Set out in section 33(2AB), (2AC), and (4).
2. Defined in section 33(9) of the Act.
3. Defined in section 33(9) of the Act.
4. O’Sullivan v Department of Health & Community Services (No 2) (1995) 9 VAR 1 at 14; Beauchamp v Department of Education [2006] VCAT 1653 at [42].
5. See section 3 of the Privacy and Data Protection Act 2014 (Vic).
6. Mond v Building Commission of Victoria [2012] VCAT 796 at [21]-[23].
7. See section 5 of the Act.
8. Defined in section 144D Family Violence Protection Act 2008 (Vic).
9. Section 144E Family Violence Protection Act 2008 (Vic).
10. Defined in section 144B Family Violence Protection Act 2008 (Vic).
11. Section 33(9) provides that a ‘primary person’ has the meaning given in section 144E of the Family Violence Protection Act 2008 (Vic).
12. Note that section 6(2) of the Privacy and Data Protection Act 2014 (Vic) states that nothing in that Act affects the operation of the FOI Act or any right, privilege, obligation or liability conferred or imposed under that Act or any exemption arising under that Act.
13. Victoria Police v Marke [2008] VSCA 218 at [98].
14. Page v Metropolitan Transit Authority (1988) 2 VAR 243 at 246.
15. Levy v Department of Sustainability & Environment [2011] VCAT 417 at [18]; AB v Department of Education & Early Childhood Development [2011] VCAT 1263 at [57].
16. Bowes v Victoria Police [2002] VCAT 739 at [17]; Kyriazis v Victoria Police [2011] VCAT 365 at [17].
17. Penhalluriack v Department of Labour and Industry (unreported, County Court, Vic, Lazarus J, 19 December 1983); Knight v Public Correctional Enterprise [2002] VCAT 1769 at [13]; McNamara v Department of Human Services [2004] VCAT 1085 at [10]; Vaughan v Department of Sustainability and Environment (2004) 21 VAR 307; [2004] VCAT 1562 at [25]; Howden v Mornington Peninsula Shire Council [2004] VCAT 1829 at [15]; Leed v Casey City Council [2004] VCAT 2180 at [13].
18. Targridge Pty Ltd v Road Traffic Authority (1988) 2 VAR 604; Amusement Machine Operators Assn Ltd v Department of Sport & Recreation (1988) 2 VAR 584; Ing v Legal Aid Commission of Victoria (unreported, AAT of Vic, Rizkalla DP, 25 September 1992); Vaughan v Department of Sustainability and Environment (2004) 21 VAR 307; [2004] VCAT 1562 at [25]; Leed v Casey City Council [2004] VCAT 2180 at [13]; Zacek v Medical Practitioners Board (Vic) [2005] VCAT 114 at [61]; Levy v Department of Sustainability & Environment [2011] VCAT 417 at [17].
19. Gunawan v Department of Education (unreported, VCAT, Davis SM, 15 December 1998); Pinder v Medical Practitioners Board (1996) 10 VAR 75; Knight v Public Correctional Enterprise [2002] VCAT 1769 at [19]; Akers v Victoria Police (No 2) [2003] VCAT 398 at [57]; Vaughan v Department of Sustainability and Environment (2004) 21 VAR 307; [2004] VCAT 1562 at [58]; Conyers v Monash University [2005] VCAT 2509 at [18]; Williams v Police (Vic) [2005] VCAT 2516 at [32].
20. Victoria Police v Marke (2008) 23 VR 223; 30 VAR 212; [2008] VSCA 218.
22. Vaughan v Department of Sustainability and Environment (2004) 21 VAR 307; [2004] VCAT 1562 at [66]; Morgan v Port Phillip City Council [2008] VCAT 978 at [45]; AB v Department of Education & Early Childhood Development [2011] VCAT 1263 at [56].
23. Director of Public Prosecutions v Smith [1991] 1 VR 63 at [75].
24. Richards v Transport Accident Commission [2005] VCAT 1444.
25. Page v Metropolitan Transit Authority (1988) 2 VAR 243 at 245–246.
26. Marke v Victoria Police (2007) 28 VAR 84; [2007] VSC 522 at [45], Marke v Victoria Police [2007] VCAT 747 at [22].
27. McNamara v Deakin University [2011] VCAT 1089 at [49]
28. McNamara v Department of Human Services [2010] VCAT 1237 at [41].
29. Reilly v Kilmore & District Hospital (1993) 6 VAR 16; Mamo v Crimes Compensation Tribunal (1996) 10 VAR 264; Koch v Swinburne University [2004] VCAT 1513 at [34]; Vaughan v Department of Sustainability and Environment (2004) 21 VAR 307; [2004] VCAT 1562; Hanson v Department of Education & Training [2007] VCAT 123 at [16].
30. AB v Department of Education & Early Childhood Development [2011] VCAT 1263 at [58].
31. Edwards v Museum Victoria [2011] VCAT 1421 at [40(b)].
32. Teong v Monash University (2003) 20 VAR 153 at [21]. In Brygel v Victoria Police [2014] VCAT 1199 at [56] VCAT found it unnecessary to consider section 33(2A) where it had already found that section 33(1) was satisfied.
33. Vaughan v Department of Sustainability and Environment [2004] VCAT 1562 at [51] and Department of Agriculture and Rural Affairs v Binnie [1989] VR 836 at [842].
34. Re Lawless and Secretary to Law Department (1985) 1 VAR 42 at [50–51].
35. Department of Agriculture and Rural Affairs v Binnie [1989] VR 836 at [844].
36. Department of Agriculture and Rural Affairs v Binnie [1989] VR 836 at [844].
37. O’Sullivan v Police (Vic) (2005) 22 VAR 426.
38. O’Sullivan v Police (Vic) (2005) 22 VAR 426.
39. Defined in section 144D of the Family Violence Protection Act 2008 (Vic).
40. Section 144E Family Violence Protection Act 2008 (Vic).
41. ‘Protected person’ is defined in section 4 Family Violence Protection Act 2008 (Vic).
42. Defined in section 41R of the Child Wellbeing and Safety Act 2005 (Vic).