Information Access Guideline 4
You can read the document below or download it here Information Access Guideline 4 - Personal Information as a public interest consideration under the GIPA Act October 2023
| Who is this information for? | This document is to assist NSW public sector agency staff seeking information on personal information as a public interest consideration. |
| Why is this information important to them? | To understand what personal information means, and how to properly apply those considerations when carrying out the public interest test under the GIPA Act. |
The Information Commissioner is empowered under sections 12(3) and 14(3) of the Government Information (Public Access) Act 2009 (NSW) (the GIPA Act) to issue guidelines to assist agencies regarding the public interests in favour of, or against disclosure.
These guidelines, made pursuant to those sections of the GIPA Act, are to assist agencies to deal with requests for personal information under the GIPA Act. It deals with formal and informal requests by people for their own information and for the personal information of third parties.
This guideline supplements the provisions of the GIPA Act. Agencies must have regard to it in accordance with section 15(b) of the GIPA Act.
Elizabeth Tydd
IPC CEO, Information Commissioner
NSW Open Data Advocate
Personal information can be both a consideration in favour of disclosure, and a consideration against disclosure. This Guideline serves to assist agencies to understand what personal information means, and how to properly apply those considerations when carrying out the public interest test under the GIPA Act.
Of all categories of information held by government agencies, the type most often requested is personal information. People may request access to their own personal information, either in its own right or in combination with other government information, or they may seek access to the personal information of other people.
Dealing with requests for personal information can present agencies with a number of specific challenges. For example:
- There are two options for people to apply for access to their own personal information: under the GIPA Act and under the Privacy and Personal Information Protection Act 1998 (NSW) (PPIP Act). This can cause confusion for agencies and the public;
- personal information is defined differently in the GIPA Act and the PPIP Act; and
- under the GIPA Act, personal information can be a public interest consideration both for and against disclosure, depending on the circumstances.
Under sections 12(3) and 14(3) of the GIPA Act, the Information Commissioner can issue guidelines to assist agencies regarding the public interest considerations in favour of, or against, disclosure of information. This Guideline is made to assist agencies to deal with requests for personal information under the GIPA Act. It covers formal and informal requests by people for their own personal information and for the personal information of third parties, as well as personal information contained in information to be released by an agency proactively or as open access information.
Specifically, this Guideline covers:
- the definition of personal information under the GIPA Act and the type of information that would be covered;
- whether agencies should apply the GIPA Act or PPIP Act definition of personal information when dealing with requests under the GIPA Act;
- factors to consider when looking at personal information as a public interest consideration in favour of disclosure under the GIPA Act; and
- factors to consider when looking at personal information as a public interest consideration against disclosure under 3(a) and 3(b) of the Table at section 14 of the GIPA Act.
This Guideline does not cover how agencies should deal with requests under the PPIP Act. The PPIP Act is only considered insofar as it affects requests for personal information made under the GIPA Act. Agencies can find detailed information about the PPIP Act on the IPC website.
This Guideline is supported by other material on the IPC website.
Agencies must have regard to this guideline pursuant to section 15(b) of the GIPA Act.
Part 1: Personal information for the purposes of the GIPA Act
Definition of personal information in the GIPA Act
1.1 A person may apply under the GIPA Act for personal information about themselves, or about third parties. Personal information is defined in Schedule 4[4] of the GIPA Act as:
âinformation or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual (whether living or dead) whose identity is apparent or can reasonably be ascertained from the information or opinion. Personal information includes such things as an individualâs fingerprints, retina prints, body samples or genetic characteristics.â
1.2 Information that can be classed as personal cannot be listed exhaustively. Below are common examples of information that generally falls into the category of personal information for the purposes of the GIPA Act:
Common examples of personal information (NB this is not an exhaustive list):
- a personâs name;
- personal address and contact details, such as email and phone numbers;
- information about a personâs family life;
- financial information, including bank accounts and investments;
- employment information, including details of salaries, personnel records, and recruitment information, including job recommendation and referee reports;
- a personâs signature;
- photographs or audio or video recordings, including CCTV footage, which identifies individuals;
- information about a personâs hobbies or interests;
- information about a personâs education, including the degree they obtained and the marks they were awarded;
- membership of voluntary or professional bodies, including trade unions;
- information about a personâs religion;
- information about sexual preference;
- alpha-numeric or biometric information that can identify an individual; and
- medical and health information.
Personal information includes opinions
1.3 The definition of personal information specifically includes opinions about individuals. Opinions would be considered âpersonal informationâ under the GIPA Act where that opinion is about an individual whose identity is apparent or can âreasonably be ascertainedâ from that opinion or from other accompanying information. Examples of where an opinion could amount to personal information include:
- the report of a referee about an applicant for public sector employment;
- comments recorded by a supervisor about an employee during achievement planning;
- notes made by staff of a public hospital about a patient or an employee;
- views expressed about a member of the public during a local council meeting;
- witness statements taken during the course of a disciplinary investigation; or
- a file note made by a public servant expressing views about a colleague or a member of the public (see Bannister v Department of Finance, Services and Innovation [2018] NSWCATAD 33).
1.4 The definition refers to opinions being âaboutâ individuals. This suggests that the personal information conveyed by the opinion is that of the subject rather than the person who gives the opinion. For example, an opinion given in a referee report, the personal information is that of the person being refereed, rather than of the referee. However, in offering an opinion about someone else, personal information about the giver of the opinion may also be revealed. To take the example of a witness making a statement during a disciplinary investigation, the following personal information about the witness may be included:
- name, address, and contact details;
- employment information such as where the witness works, how long they have been employed, and any qualifications that may be relevant to the context of the statement; and
- information about the relationship between the witness and the person being investigated.
What does whose identity is apparent or can reasonably be ascertained mean?
1.5 Information will only be considered to be âpersonalâ if it is about an individual whose identity is âapparent or can reasonably be ascertainedâ. Obviously, the identity of the person will be apparent where the information includes his or her name. It may also be apparent where the person is not named. For example, a personâs identity can be apparent through a photograph or CCTV footage. However, elements of a personâs gait or body shape may not be considered sufficiently distinctive to enable identification.[i]
1.6 A personâs identity may be apparent where neither the name nor a photograph is involved, but the information about the person is such that it could not be referring to anyone else. An example would be a reference to âthe President of the United States in 2011â, or âthe current Secretary of Department Xâ.[ii] This is known as âconstructive identificationâ.
1.7 Whether the identity of a person can âreasonably be ascertainedâ will depend on the type of information and the context in which it is being used. It is not necessary that the identity of the person be widely known: it will be sufficient to satisfy the definition of personal information if the information is communicated to someone who is able to identify the person. For example, a government employee may talk to a group of colleagues about a member of the public who visits them frequently, noting the personâs gender, approximate age and physical appearance. Although the person is not named, the combination of information and the context enable the people hearing the information to identify the subject.
What is not considered to be personal information under the GIPA Act
1.8 In the GIPA Act, personal information does not include:
(a) information about an individual who has been dead for more than 30 years;
(b) information about an individual (comprising the individualâs name and non-personal contact details including the individualâs position title, public functions and the agency in which the individual works) that reveals nothing more than the fact that the person was engaged in the exercise of public functions; or
(c) information about an individual that is prescribed by the regulations as not being personal information.[iii]
1.9 Therefore, information about someone who has been dead for 30 years is not considered to be personal information for the purposes of the GIPA Act, nor is the fact that John Smith is a Senior Investigation Officer in Agency Y. This means that agencies should not apply clause 3(a) or 3(b) of the Table at section 14 of the GIPA Act to this type of information.
Definition of personal information in the PPIP Act
1.10 The core definition of personal information in section 4 of the PPIP Act is the same as that in the GIPA Act.[iv] However, the PPIP Act definition lists 12 exceptions where information is not considered to be âpersonalâ for the purposes of that Act,[v] as opposed to the three exceptions in the GIPA Act definition set out above.
1.11 Section 4A of the PPIP Act specifically excludes health information from the definition of personal information. Health information is regulated by the Health Records and Information Privacy Act 2002 (NSW).
Practical effect of the exemptions
1.12 The effect of the PPIP Act and GIPA Act exemptions in practice will mean that some information will be considered to be personal for the purposes of the GIPA Act, but not for the PPIP Act. An example is information or an opinion about an individualâs suitability for appointment or employment as a public sector official, which is excluded from the definition of âpersonal informationâ by subsection 4(3)(j) of the PPIP Act, but is considered to be personal information under the GIPA Act.
1.13 As a result, information, such as recruitment records, referee reports and performance appraisals, is covered by the GIPA Act, but not by the PPIP Act. This means that a person does not have a right to his or her own public sector recruitment documents under the PPIP Act, but there is a public interest in favour of disclosing that information to the person to whom it relates under the GIPA Act.
1.14 Furthermore, if a request is made under the GIPA Act by someone wanting access to a recruitment panelâs comments about another applicant, this would amount to revealing the personal information of a third party, which would enliven the consideration against disclosure in 3(a) in the Table at section 14 of the GIPA Act:
There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:
(a) reveal an individualâs personal information
1.15 However, the public interest consideration against disclosure in 3(b) of the Table would not apply:
There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:
(b) contravene an information protection principle under the PPIP Act or a Health Privacy Principle under the Health Records and Information Privacy Act 2002 (HRIP Act).
This is because the information privacy principles (IPPs) in the PPIP Act only apply to personal information as defined in that Act. Since recruitment panel reports about public officials are not âpersonal informationâ under the PPIP Act, the IPPs do not apply to that information.
1.16 The public interest considerations against disclosure in 3(a) and (b) are discussed further in Part 3.
Which definition to use when dealing with GIPA requests?
1.17 The following points can assist when dealing with requests:
- where agencies are considering requests for personal information under the PPIP Act, the PPIP Act definition of personal information applies;
- where agencies are considering requests for personal information under the GIPA Act, the GIPA Act definition of personal information applies;
- the only situation where the PPIP Act definition of personal information will be relevant to requests being dealt with under the GIPA Act is where agencies need to know if releasing the information to a third party would breach an IPP under the PPIP Act. In that situation, agencies need to look at whether the information is personal information for the purposes of the PPIP Act, since the IPPs only apply to that information
Part 2: Personal information as a public interest consideration in favour of disclosure
2.1 Section 12 of the GIPA Act reiterates the general presumption in favour of disclosure of government information, and lists examples of public interest considerations that favour disclosure. Those considerations include situations where the information is personal information of the person to whom it is to be disclosed.
2.2 Wherever possible, government agencies should provide people with access to their own personal information quickly and free of charge, or at the lowest reasonable cost. This supports the objects of the GIPA Act as stated in section 3, and reinforces the right people have under section 14 of the PPIP Act to obtain access to their personal information âwithout excessive delay or expenseâ. Section 67 of the GIPA Act states that agencies cannot impose any processing charge for the first 20 hours of processing time for an application for personal information.
2.3 When an applicant applies for a combination of personal and non-personal information the information must be assessed by the agency to identify if the information is characterised as personal information. The fact that the request may seek business and commercial information does not preclude it from being treated as personal information when the dealings may be relevant to a personal matter. Importantly, whether the access application form contains answers to pro-forma questions such as âare you seeking personal information Yes / Noâ, is also of limited relevance in making this determination. The inclusion of pro-forma questions does not create a legal consequence for either an applicant or an agency. It is only when the agency assesses the information collated as a result of its searches that the legal consequence crystallises.[vi] In relation to an application that is characterised as personal information in whole or in part the GIPA Act imposes specific requirements including the permissible charges.
2.4 In assessing the characteristics of the information sought, agencies should consider their information management practices in holding personal information. It is arguable that all personal information held by agencies constitutes mixed information (personal and non-personal). For example, information that a person owns a property in a local government area is both personal information and non personal information. It is âmixedâ information. Additionally, depending on the context that the information is being viewed, or the purpose (if any) to which the information is applied, it may take on further characteristics. It would include land titling information, local council information, potentially water utility information, land valuation information and clearly personal information.[vii]
2.5 When dealing with requests by a person for access to their own personal information under the GIPA Act, agencies also need to consider any relevant considerations against disclosure of that information. However, those considerations would have to be very significant to override the general presumption of disclosure in the GIPA Act, and the specific consideration in favour of disclosure of giving people access to their own information.
2.6 If there are strong considerations against disclosing personal information to the person to whom that information relates, agencies should look for ways to mitigate the strength of those considerations.[viii] For example, if disclosing the information would also involve revealing the personal information of another person, the agency should consult with that person to obtain his or her views. It may be that the third party does not object to the information being disclosed, which makes that consideration against disclosure far less significant. Even where the third party objects, the consultation may indicate to the agency that there is a greater public interest in the information being disclosed to the person requesting it than there are considerations against disclosure. The issue of consulting with third parties about releasing information that affects them is discussed in a separate Guideline.[ix]
2.7 Other ways agencies may proceed when there are significant public interest considerations against disclosure are to provide the person with access to their own information but redact any other information for which there is an overriding public interest against disclosure, or to create a new document. In particular, the GIPA Act provides that agencies must facilitate public access to government information contained in a record.[x] That can be achieved by creating a new record or deleting information from a record that would otherwise result in there being an overriding public interest against disclosure of the record.[xi]
2.8 However, the public interest in providing people with access to their own information is extremely strong and should only be displaced where the considerations against disclosure are overriding.[xii]
Part 3: Personal information as a public interest consideration against disclosure
3.1 An exhaustive list of public interest considerations against disclosure is contained in the Table at section 14 of the GIPA Act. The following two considerations are relevant to this Guideline:
3.2 Individual rights, judicial processes and natural justice
There is a public interest consideration against disclosure of information if disclosure of the information could reasonably be expected to have one or more of the following effects:
(a) reveal an individualâs personal information;[xiii] or
(b) contravene an information protection principle under the Privacy and Personal Information Protection Act 1998 or a health privacy principle under the Health Records and Information Privacy Act 2002.[xiv]
Revealing personal information as a consideration against disclosure
3.3 This consideration against disclosure will apply once information has been identified as âpersonalâ under the GIPA Act definition of personal information, and the information would be ârevealedâ by disclosing it under the GIPA Act.
3.4 Although not expressly stated in 3(a), this consideration against disclosure of personal information may be interpreted as referring to third party information: that is, personal information about someone other than the person requesting the information. Any other interpretation would be inconsistent with the public interest consideration in favour of providing people with access to their own personal information under section 12.
3.5 Clause 3(a) therefore should not be used as a reason for denying people access to their own personal information. Rather, it is intended as a balance between the public interest in having access to government information, and the public interest in protecting and controlling the disclosure of personal information to people other than the person to whom the information relates.
3.6 In Schedule 4[1] to the GIPA Act, to ârevealâ information is defined as âto disclose information that has not already been publicly disclosed (otherwise than by unlawful disclosure)â. Accordingly, if the personal information has already been publicly disclosed, this consideration against disclosure cannot be relied on.[xv]
3.7 While the fact that disclosing information to someone would reveal personal information about someone else is a public interest consideration against disclosure, it is not an absolute barrier to the information being disclosed. It is only a relevant factor that needs to be weighed against other factors for and against disclosure.
Consultation with third parties
3.8 Where a request for access to the personal information of a third party is a formal access application, consultation to obtain the views of the third party may be required. Section 54 of the GIPA Act provides that agencies must take such steps (if any) as are reasonably practicable to consult with a person before providing access to information relating to the person in response to an access application if it appears that:
(a) the information is of a kind that requires consultation under this section, and
(b) the person may reasonably be expected to have concerns about the disclosure of the information, and
(c) those concerns may reasonably be expected to be relevant to the question of whether there is a public interest consideration against disclosure of the information.
3.9 Section 54(4) states that the purpose of consultation is to find out whether the third party objects to the release of the information, and, if so, the reasons for any objection. The views of third parties about the disclosure of their personal information to an access applicant will be relevant to agencies in determining the weight to give to the consideration against disclosure in 3(a).
3.10 Third party views are only considerations to be taken into account when deciding whether or not the information is released to the applicant. Third party views are considered when deciding applications, however, do not determine the decision whether or not information is released to the applicant. This decision must be made by the agency based on the public interest test. More information can be found in Information Access Guideline 5 â Consultation on public interest considerations under section 54.
Contravening an IPP in the PPIP Act as a consideration against disclosure
3.11 There will be a public interest against disclosure of information if the disclosure would reasonably be expected to contravene an IPP in the PPIP Act. The IPPs in the PPIP Act govern the way that public sector agencies must deal with the personal information they hold. The IPPs cover the collection, storage, use and disclosure of personal information by government agencies.
3.12 The IPPs apply only to personal information as it is defined in the PPIP Act.
3.13 In the context of 3(b) of Table 14, the IPP dealing with disclosure of personal information would be the most likely one to be breached by disclosure of personal information under the GIPA Act. That IPP is contained in section 18 of the PPIP Act and provides that agencies must not disclose personal information unless:
(a) the disclosure is directly related to the purpose for which the information was collected, and there is no reason to believe that the person would object to the disclosure, or
(b) the individual concerned is aware, or reasonably likely to be aware, that information of that kind is usually disclosed, or
(c) the agency believes on reasonable grounds that the disclosure is necessary to prevent or lessen a serious and imminent threat to the life or health of the individual concerned or another person.
3.14 In determining whether disclosure of personal information would reasonably be expected to contravene the PPIP Act, agencies should initially determine if the information is personal information as defined in section 4 of the PPIP Act and then ask the following questions:
(a) Is the information being disclosed for the same purpose for which it was collected, or a purpose directly related?
(b) Has the person who is the subject of the information consented to the disclosure?
(c) Would the subject of the information be likely to be aware that information of that type is usually disclosed?
(d) Would disclosure of the information be likely to prevent or lessen a serious or imminent threat to someoneâs life or health?
If the answer to any of these questions is âyesâ, it is unlikely that disclosure would be a breach of the PPIP Act.
3.15 If the request for the information is in the form of a formal GIPA Act access application, an agency may need to consult with the third party to see if he or she consents to the disclosure. If the third party consents, there will be no contravention of the IPP.
3.16 In establishing whether or not the public interest consideration in 3(b) is relevant, agencies should identify the particular IPP it considers disclosure could reasonably be expected to contravene. Disclosure of the information need only âreasonably be expectedâ to breach an IPP. Agencies do not need to determine conclusively whether an IPP would in fact be contravened by disclosure of the information.
3.17 If an agency establishes that disclosure of the information could reasonably be expected to contravene an IPP, the question of whether that consideration against disclosure will be an overriding one will depend on the weight given to that consideration. The weight will depend on the type of personal information being requested, the context of the request, and the extent of the breach.
The effect of section 5 of the PPIP Act
3.18 If an agency finds that either 3(a) or 3(b), or both, are public interest considerations against disclosure and that releasing the information would contravene the PPIP Act, it may still release the information after applying the public interest test under the GIPA Act. This is made clear by section 5 of the PPIP Act, which provides that nothing in that Act serves to lessen the obligations agencies must exercise under the GIPA Act. Therefore, if the public interest considerations in favour of disclosure outweigh those against, then the personal information can be released to the applicant. In the context of considering an information access request and applying the âpublic interest testâ the GIPA Act must be applied and accordingly section 5 of the PPIP Act must be considered together with section 20(5) of the PPIP Act.
Appendix A: GIPA Act and definition of personal information
4 Personal information
(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual (whether living or dead) whose identity is apparent or can reasonably be ascertained from the information or opinion.
(2) Personal information includes such things as an individualâs fingerprints, retina prints, body samples or genetic characteristics.
(3) Personal information does not include any of the following:
(a) information about an individual who has been dead for more than 30 years;
(b) information about an individual (comprising the individualâs name and non-personal contact details including the individualâs position title, public functions and the agency in which the individual works) that reveals nothing more than the fact that the person was engaged in the exercise of public functions; or
(c) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subclause.
Appendix B: Privacy and Personal Information Protection Act 1998 (NSW)
4 Definition of personal information
(1) In this Act, personal information means information or an opinion (including information or an opinion forming part of a database and whether or not recorded in a material form) about an individual whose identity is apparent or can reasonably be ascertained from the information or opinion.
(2) Personal information includes such things as an individualâs fingerprints, retina prints, body samples or genetic characteristics.
(3) Personal information does not include any of the following:
(a) information about an individual who has been dead for more than 30 years;
(b) information about an individual that is contained in a publicly available publication;
(c) information about a witness who is included in a witness protection program under the Witness Protection Act 1995 or who is subject to other witness protection arrangements made under an Act;
(d) information about an individual arising out of a warrant issued under the Telecommunications (Interception) Act 1979 of the Commonwealth;
(e) information about an individual that is contained in a public interest disclosure within the meaning of the Public Interest Disclosures Act 2022, or that has been collected in the course of an investigation arising out of a public interest disclosure;
(f) information about an individual arising out of, or in connection with, an authorised operation within the meaning of the Law Enforcement (Controlled Operations) Act 1997;
(g) information about an individual arising out of a Royal Commission or Special Commission of Inquiry;
(h) information about an individual arising out of a complaint made under Part 8A of the Police Act 1990;
(i) information about an individual that is contained in Cabinet information or Executive Council information under the Government Information (Public Access) Act 2009;
(j) information or an opinion about an individualâs suitability for appointment or employment as a public sector official;
(j) information about an individual that is obtained about an individual under Chapter 8 (Adoption information) of the Adoption Act 2000;
(k) information about an individual that is of a class, or is contained in a document of a class, prescribed by the regulations for the purposes of this subsection.
Privacy and Personal Information Protection Regulation 2014
5 Meaning of personal information
For the purposes of section 4(3)(k) of the Act, the following information is not personal information:
(a) information about an individual that is contained in a document kept in a library, art gallery or museum for the purposes of reference, study or exhibition
(b) information about an individual that is contained in a state record under the control of the State Records Authority that is available for public inspection in accordance with the State Records Act 1998
(c) information about an individual that is contained in archives within the meaning of the Copyright Act 1968 of the Commonwealth.
Footnotes
[i] Seven Network Limited v Southern Eastern Sydney Local Health District [2017] NSWCATAD 210.
[ii] Zonnevylle v NSW Department of Finance and Services [2015] NSWCATAD 175.
[iii] The GIPA Regulation does not prescribe any category of information as not being personal information.
[iv] Schedule 4 clauses 4(1) and 4(2).
[v] See Appendix B of this Guideline for the PPIP Act definition of personal information.
[vi] Walton v Eurobodalla Shire Council [2022] NSWCATAD 46.
[vii] Ibid at [109].
[viii] See the GIPA Act sections 54; 72-75.
[ix] See Guideline 5: consultation on public interest considerations under section 54 of the GIPA Act.
[x] See the GIPA Act section 3(2)(b)
[xi] See the GIPA Act sections 6-8.
[xii] Bryant v Secretary, Department of Communities and Justice [2021] NSWCATAD 73 at [30]; Cameron v Commissioner of Police, New South Wales Police Force [2014] NSWCATAD 13 at [77].
[xiii] Davis v Secretary, Department of Education [2022] NSWCATAD 55; Newton v Newcastle City Council [2022] NSWCATAD 18; Norkin v University of New England (No. 2) [2021] NSWCATAD 371; Dennis v Department of Planning, Industry and Environment [2021] NSWCATAD 377.
[xiv] Morgan v Commissioner of Police [2021] NSWCATAD 173; Seven Network Limited v South Eastern Sydney Local Health District [2017] NSWCATAD 210; Burke v Health Education and Training Institute [2016] NSWCATAD 194; Khoo v South Western Sydney Local Health District [2015] NSWCATAD 183; Field v Commissioner of Police (NSW) [2015] NSWCATAD 153.
[xv] For a ruling of the Administrative Decisions Tribunal on this point, see Richard v Commissioner, Department of Corrective Services [2011] NSWADT 98. (the ADT is now the NSW Civil and Administrative Tribunal).
