Fact sheet - How to access your personal information from government agencies

You can ask for your personal information from a public sector agency using either the Privacy and Personal Information Protection Act 1998 (PPIP Act) or the Government Information (Public Access) Act 2009 (GIPA Act).

If you are making an application for your personal information to a public sector agency, you have the choice of applying under the GIPA Act or PPIP Act. Since access to your personal information under the PPIP Act is free of charge no matter how long it takes the agency to process, agencies should process your application under the PPIP Act unless you make your application under the GIPA Act.

This fact sheet explains the key differences between the GIPA Act and PPIP Act in relation to accessing your personal information to assist you with making a choice. Please see our Fact Sheet - Accessing your health information in NSW if you specifically want to access your health information.

How to make an application

PPIP Act

Contact the government agency that holds your personal information and check if an application needs to be in a particular form. The agency may also ask you for some identification to prove that you have the right to access the information either because it is your personal information or you are authorised by a third party to access their personal information. While the form of identification is not covered by either the PPIP Act or GIPA Act, most agencies require that the authorisation is in writing and clearly states the name of the person who authorises the access and the person who is authorised to have access.

GIPA Act

If you request your personal information under the GIPA Act, you can make the request informally or formally. Agencies are encouraged to process a request for access informally wherever possible unless:

• there is an overriding public interest consideration against disclosure. Relevant considerations might include if it contains the personal information of a third party or the information might prejudice law enforcement processes. The list of considerations is contained in section 14 and schedule 1 of the GIPA Act
• you want to be able to request a review of the decision if you are unhappy with the agency’s decision. Under the GIPA Act, a right of review only applies for formal applications.[1]

If you would like to make a formal application, it must be in writing, sent by post or lodged with an agency, or other method approved by the agency. It must make clear that it is an access application under the GIPA Act and include your name and a postal or email address where all correspondence relating to your application can be sent.[2] It must also provide sufficient information to allow the agency to find the personal information that is being applied for, and include a $30 application fee unless it is waived or reduced by the agency.[3]

You are also required to disclose in your access application whether you have applied, at any time, to another agency for substantially the same information and, if so, which agency you previously applied to. Your application will not be invalid if the information is not included.[4]

Information that you can request

PPIP Act

Under the PPIP Act, you can only apply for access to personal information free of charge.[5] Personal information is defined under the legislation as information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion. Personal information includes an individual’s fingerprints, retina prints, body samples and genetic characteristics.[6]

For the purposes of the PPIP Act, personal information does not include health information (including medical information).[7] There are also other exceptions to the definition of personal information under section 4 of the PPIP Act. Examples of exceptions include information about an individual that is contained in a publicly available publication, information which may have been obtained or accessed for law enforcement or public safety purposes, certain adoption information, Cabinet information, public interest disclosures, and information relating to the suitability for employment of a public servant.

GIPA Act

The GIPA Act allows you to apply for government information, which includes any personal information (including health information) that agencies might hold about you. The only exceptions to personal information under the GIPA Act are:

• information about an individual who has been dead for more than 30 years
• information about an individual that reveals nothing more than that the person is employed as a public servant (comprising the individual’s name and non-personal contact details, including the individual’s position title, public functions and the agency in which the individual works)
• other information that is listed in the GIPA Regulations. Currently, no other exceptions are listed in the Regulations.[8]

These exceptions mean that this information is not considered personal information under the GIPA Act. Therefore the ‘personal information’ considerations against disclosure of the information will not apply to any decision regarding access to information.

Can another person request your personal information on your behalf?

PPIP Act and GIPA Act

You may be able to authorise another person to access your personal information regardless of whether the application is made under the PPIP Act or GIPA Act. However, the agency can request written proof of your authorisation and proof of identity.

The law also recognises that certain persons are able to act on behalf of another person, for example:

• a person acting under an enduring power of attorney
• a guardian or person responsible within the meaning of the Guardianship Act 1987.

In each case, your authorised representative can only access personal information that is within the scope of their authorisation.

An agency may have a policy about authorised representatives in their Privacy Management Plan. You should check with the agency that holds the personal information about their policy on this issue and what information they may require before they provide your authorised representative with access.

Cost of making an application

PPIP Act

If you apply for your personal information under the PPIP Act, it is free of charge.[9]

GIPA Act

If you apply for your personal information under the GIPA Act there is an application fee of $30.00. However, this fee and other fees and charges may be waived by the agency. [10]

There are processing fees that apply under the GIPA Act if the request takes more than  20 hours to process. However, the first 20 hours are free. [11]

See the IPC fact sheet GIPA Act fees and charges for further information.

Time limits to process your request

PPIP Act

The government agency must provide access to your personal information without excessive delay.[12] However, specific processing times are not set by the PPIP Act.

If you decide to apply for personal information under the PPIP Act, you should ask the government agency how long it usually takes or is likely to take for your application to be processed. You should ask the agency to confirm the processing time in writing in case the application takes longer than advised.

If you believe the agency is taking too long to provide you with access to your personal information, you can make a complaint to the NSW Privacy Commissioner. Contact the Information and Privacy Commission on 1800 472 679 or at ipcinfo@ipc.nsw.gov.au for advice about what to do next.

GIPA Act

If you apply under the GIPA Act, the government agency must process your request within the following time frames. The agency:

• must notify you whether the application is a valid application within five working days of the date it receives the application;[13]
• make a decision whether to provide access to your personal information and notify you of their decision within 20 working days of the date agency receives your application.[14] If the agency does not decide your application within 20 working days (unless an extension is validly made), the application is treated as a deemed refusal and you have the right to seek a review of this deemed refusal;[15]
• the agency can extend the period for making a decision by up to 10 working days to consult another party as required by the GIPA Act, or to retrieve records from archive.[16]

Alternatively, if you agree, the agency can extend the period for making a decision.[17]  The GIPA Act does not specify the maximum amount of time the decision-making period can be extended by agreement between you and the agency. However, you cannot be required to agree to an extension.

The maximum period that an agency can extend the period for making a decision (without your agreement) is 15 working days.[18]

This means the maximum period for processing your application, if an extension is applied by the agency, is 35 working days.

How access can be provided

PPIP Act

The PPIP Act provides that you have a right to access personal information held by an agency about you.[19] If the agency refuses to give you access to your personal information you have a right to seek an internal review of this decision from the agency.[20]

If the agency decides to grant you access, the agency can provide access to the information in a form the agency considers appropriate. This might mean you can take home a copy of the information or that you can only view the information but not photocopy it.

The agency must provide access to your personal information without excessive delay or expense.[21]

GIPA Act

The agency must provide access to your personal information by:

• allowing you to inspect the record containing the information, together with any facilities to enable the information to be read, viewed or listened to as appropriate; or
• providing a copy of the information; or
• providing a written transcript of the information.[22]

The agency must provide access in the form you requested unless it would unreasonably interfere with the operations of the agency, require the agency to incur unreasonable additional costs, be detrimental to the proper preservation of the record, breach copyright, (or providing access in the form requested) or would result in an overriding public interest against disclosure if provided in the form requested.[23]

The GIPA Act requires that agencies must provide access without placing a condition on how to use the personal information, once released. However, agencies can impose conditions if it is necessary for the purposes of avoiding an overriding public interest against disclosure of the information.[24]

An agency may require you to prove your identity before you are given the personal information you requested.[25]

See the IPC Fact Sheet - What is the public interest test for further information.

Access to personal information under the GIPA Act and PPIP Act should be consistent. In LB v Hunter New England Area Health Service [2009] NSWADT 132 at [20], the NSW Civil and Administrative Tribunal (NCAT) did not re-consider an access request under s.14 of the PPIP Act for a document or documents to which that applicant had already been refused access by the Tribunal under the former Freedom of Information Act (FOI Act) application.

Further, in Ormonde v NSW National Parks & Wildlife Service (No 2) [2004] NSWADT 253 at [56] - [57], Judicial Member Montgomery made the following observations about the interaction between the PPIP Act and the former FOI Act (now GIPA Act):

• 56 Whilst the relationship between the PPIP Act and the FOI Act is potentially complex, each regime is characterised by a distinct purpose and substantive and procedural differences. Privacy and data protection laws are intended to protect and promote the fair handling of personal information by agencies, whilst FOI laws are intended to promote open government in relation to the handling of personal and non-personal information. Section 20(5) of the PPIP Act should be read in such a way that is in keeping with the spirit of the PPIP Act to protect personal information privacy.
• 57 Nevertheless, a balance needs to be found between the object of protecting personal information privacy and the objects of the FOI Act to extend, as far as possible, the rights of the public to obtain access to information held by the Government…

If you are unhappy with the agency’s decision, what rights do you have?

PPIP Act

If you have made an application under the PPIP Act and are unhappy with the government agency’s decision, you can request an internal review of an agency’s decision or conduct within six months from being notified of the decision. In some circumstances, an agency may extend this time. If you have missed this six month period, you should ask the agency if they can still accept your request for an internal review and provide your reasons.[26]

An internal review is free of charge.

The agency must complete the internal review as soon as reasonably practicable and, at the latest, within 60 days from the day, the application for internal review is received by the agency.[27]

NSW Civil and Administrative Tribunal

Once you have sought an internal review and if the review is not completed within 60 days as required by legislation, or you are not happy with the decision made or actions taken in the internal review, you can go to the NCAT.[28]

You must lodge your application with NCAT within 28 days of receiving the agency’s decision.[29]

See IPC Fact Sheet - Privacy complaints: Your review rights for further information.

NCAT can review the conduct of the agency in processing and making a decision on the original application for access.

There is a filing fee charged by NCAT for lodging an application with them. For more information, see www.ncat.nsw.gov.au.

Complaint to the NSW Privacy Commissioner

You can also make a complaint to the NSW Privacy Commissioner about a breach of, or interference, with your privacy rights. This includes if you experienced difficulty attempting to access your personal information.[30]

The Privacy Commissioner does not usually deal with a complaint that is more appropriately dealt with by an application for internal review.

The Privacy Commissioner accepts complaints from:

• the individual whom the personal information is about; or
• a third party with:
  • evidence of the consent of the person who the personal information relates to; or
  • if consent has not been obtained from the person who the personal information is about, evidence of the legal incapacity and contact details of the person to whom the personal information relates.

You have six months from the date of the agency’s decision or after finding out about the agency’s conduct to make a complaint to the Privacy Commissioner. However, the Privacy Commissioner has the discretion to extend the time for making a complaint beyond six months.[31]

Please see the Privacy Commissioner’s Protocol for Handling Complaints for more information on your rights and the procedures for making a complaint or contact the Information and Privacy Commission on 1800 472 679 or at ipcinfo@ipc.nsw.gov.au.

GIPA Act

If you are unhappy with the agency’s decision about your request to access your personal information, you can:

1. request an internal review within 20 working days after the notice of a decision has been posted to you;[32] or
2. request a review by the Information Commissioner within 40 working days of being notified of the decision;[33] or
3. request a review by NCAT within 40 working days of being notified of the decision.[34]

Internal review

There is a $40 fee for an internal review application unless the decision is a ‘deemed refusal’ because the agency did not process your application in time or it is an internal review as recommended by the Information Commissioner under section 93(6).[35]

The agency must acknowledge your application within 5 working days of receiving it.[36]

The agency must decide the internal review within 15 working days (this can be extended by 10 working days if the agency has to consult with a third party, or by agreement with you).[37]

The agency can make any decision or take any action in regard to the internal review as they believe appropriate.

Review by the Information Commissioner and NCAT

If you are the applicant, you do not need to request an internal review first before requesting a review from the Information Commissioner or NCAT. You have 40 working days in which to request a review after being notified of the agency’s decision.[38]

However, if you are not the access applicant (i.e. you are a third party), you must request an internal review by the agency first before you can apply for a review by the Information Commissioner or NCAT, unless the option is not available to you. This would be relevant in situations, for example, where a third party has objected to the release of their personal information and the Principal Officer of the agency had made the decision in response to an access application.[39]

If you are unhappy with the Information Commissioner’s review decision, you can apply to NCAT within 20 working days from being notified of the Information Commission’s review outcome.[40] However, if you have requested NCAT to review the agency’s decision, you cannot later ask the Information Commissioner to review a decision.[41]

You may request a review of the agency’s decision by the Information Commissioner free of charge. For more information about reviews by the Information Commissioner, please see our Fact Sheet - External Review by the Information Commissioner.

If you request a review by NCAT, there is a filing fee charged by the Tribunal for lodging an application. For more information on NCAT, visit www.ncat.nsw.gov.au

For more detailed information about your review rights under the GIPA Act, please see our Fact sheet on your review rights under the GIPA Act.

For more information

Contact the Information and Privacy Commission
NSW (IPC):

Freecall:           1800 472 679
Email:               ipcinfo@ipc.nsw.gov.au
Website:           www.ipc.nsw.gov.au