New changes to Victoria’s Freedom of Information and Privacy Laws
The Justice Legislation Amendment (Integrity, Defamation and Other Matters) Act 2024 (the Act) recently commenced. The Act makes changes to both the Freedom of information Act 1982 (Vic) (FOI Act) and the Privacy and Data Protection Act 2014 (Vic) (PDP Act). These changes take effect on 11 September 2024.
A summary of the main changes to the FOI Act and PDP Act can be found below.
OVIC is currently updating its FOI and privacy guidance, to reflect the changes.
Changes to the FOI Act
Agency obligations
- Section 14(1)(a) now extends to documents made publicly available free of charge, as well as for a fee or other charge. This means that a person cannot request access under the FOI Act, to documents made freely available, for example, on an agency’s website.
- In deciding whether an exemption applies, an agency is only required to consult with third parties where it is “reasonably practicable”. This change affects all exemption provisions that require third party consultation; sections 29(2), 29A(1D), 31(5) and (6), 31A(2), 33(2C)(b) and (3), 34(3) and 35(1B)(b).
- Section 7(1)((a)(viii) is repealed. This means that agencies are no longer required to publish information about reading rooms and libraries in their Part II Statements.
Reviews and complaints
- The Information Commissioner now has more power to resolve a review informally.
- The Information Commissioner may conduct preliminary inquiries and consult with the parties to a review, to determine whether the matter can be resolved informally.
- If the Information Commissioner determines it is reasonably possible to resolve the matter informally, the Information Commissioner must take reasonable steps to do so.
- If the matter is resolved informally:
- the Information Commissioner must record the outcome in writing; and
- the outcome is not a decision on the review for the purposes of the Act. This means the parties cannot seek review of an informally resolved matter at VCAT.
- OVIC employees now have a duty to assist an individual to make a complaint in writing, if the individual is otherwise unable to do so.
- New provisions at the end of section 61GB clarify the process for informal resolution of complaints. Under these new provisions, if a complaint is resolved informally:
- the Information Commissioner must record the outcome in writing; and
- a complainant may take no further action under the FOI Act in relation to the subject matter of the complaint.
- There are small changes to the special requirements in section 63D, relating to producing documents to OVIC claimed to be exempt under sections 28 (cabinet documents), 29A (documents affecting national security, defence or international relations), 31 (law enforcement documents) or 31A (documents relating to IBAC). Under the changes, where it is not reasonably practicable for OVIC to destroy a document after inspection, the Information Commissioner must ensure that the document is retained in a secure form, and advise the agency or Minister in writing that the inspection of the document is complete and that the document will be retained in a secure form.
Investigations
- The Information Commissioner must notify the Victorian Inspectorate where a notice to produce or attend is varied or revoked. This amendment clarifies that the Victorian Inspectorate has oversight responsibility of the Information Commissioner’s exercise of powers to both vary or revoke a notice to produce or attend.
- Section 61TJ(1)(b) gives the Information Commissioner a new discretionary power to issue a confidentiality notice when investigating public interest complaints (PICs). The Information Commissioner can now issue a confidentiality notice to a person (other than an IBAC officer or a Victorian Inspectorate officer), where the Information Commissioner considers on reasonable grounds that disclosure of one or more restricted matters specified in the notice, would be likely to prejudice the investigation of the PIC. These changes align the Information Commissioner’s powers, with the existing confidentiality notice powers of the Victorian Ombudsman.
- Under section 61TM(2)(f)(i)(B), the definition of “trade union” is now the same as its definition in the Competition and Consumer Act 2010 (Cth).
Changes to the PDP Act
Sensitive information
- In the definition of “sensitive information” in Schedule 1 of the PDP Act, the phrase “sexual preferences” is replaced by “sexual orientation”. This means that information or an opinion about an individual’s sexual orientation must now be treated as “sensitive information” under the PDP Act.
Privacy complaints
- The Information Commissioner has more power to resolve a privacy complaint informally. Under these changes:
- The Information Commissioner may conduct preliminary inquiries and consult with the parties to a complaint, to determine whether a complaint can be resolved informally.
- If the Information Commissioner determines it is reasonably possible to resolve a complaint informally, the Information Commissioner must take reasonable steps to do so.
- If a complaint is resolved informally:
- the Information Commissioner must record the outcome in writing; and
- a complainant may take no further action under the PDP Act in relation to the subject matter of the complaint.
- The Information Commissioner may now decline to entertain a privacy complaint where the complainant has failed to cooperate with the Information Commissioner without reasonable excuse.
Investigations
- The Information Commissioner must notify the Victorian Inspectorate where a notice to produce or attend is varied. This amendment clarifies that the Victorian Inspectorate has oversight responsibility of the Information Commissioner’s exercise of powers to both vary or revoke a notice to produce or attend.
Information Security
- The coverage of the Victorian protective data security standards (the Standards) is now changed from “security, confidentiality and integrity” to “confidentiality, integrity and availability”. This change accurately reflects the three pillars of information security that are covered by the Standards.
- A security risk profile assessment undertaken by agencies for the purposes of section 89 of the PDP Act cannot be accessed under the FOI Act. This is in addition to protective data security plans which are already excluded from the FOI Act.
Law enforcement agency
- The Victorian Legal Services Board and the Victorian Legal Services Commissioner are now included in the definition of a ‘law enforcement agency’ under the PDP Act. This change alters the application of the Information Privacy Principles to those bodies.