The 2018-2019 Victorian Budget: Does your project involve Information Sharing?

The Victorian Budget 2018-19 included allocation of funds to a wide range of areas where government needs to balance privacy concerns with the benefits of sharing information.  Common areas where this arise are in family violence and in the health, disability, justice and education sectors.

A key announcement in the Budget was the allocation of $13.4 million (and $30 million over the forward estimates) to support a new whole of Government initiative known as the 'Child Information Sharing Reforms'.  This initiative is underpinned by the Children Legislation Amendment (Information Sharing) Act 2018 which came into force on 10 April 2018.  The reforms seek to protect vulnerable children by simplifying and improving information sharing arrangements between specified government agencies and service providers.

Knowing when and how to lawfully disclose information in different contexts is vital.  However, an overly legalistic or unbalanced approach can lead to an unwillingness to share information, which may result in negative outcomes for Victorians, particularly for vulnerable families experiencing family violence who rely on a number of integrated support services, built on effective information sharing. 

A key objective of the Child Information Sharing Reforms is to promote child wellbeing and safety by enabling information sharing.  Budget funding will target training for workers to understand when it is appropriate to share information, to improve early risk identification and intervention and increase collaboration for the wellbeing and safety of children. 

VGSO has extensive experience in advising on information sharing in a wide range of different contexts.  Please call one of our experts in this area if you require assistance in understanding how to discharge your obligations when sharing information: 

Julie Freeman

Assistant Victorian Government Solicitor 

9947 1404

Rebecca Radford

Managing Principal Solicitor 

9947 1403

Coming soon! Cyber security audits announced by VAGO

The Victorian Auditor-General’s Office (VAGO) has this month announced plans to conduct audits on departments and agencies to assess their implementation of the Victorian Protective Data Security Framework (VPDSF) and Victorian Protective Data Security Standards (VPDSS), as well as cyber security strategy.

The audits, to run in 2018-19, will ascertain whether the VPDSF and VPDSS have been effective in improving cyber resilience in government to determine whether departments and agencies can adequately prevent, respond to and recover from cyber security attacks.

The Commissioner for Privacy and Data Protection released the VPDSF and VPDSS in mid-2016 to provide direction for Victorian public sector agencies on their data security obligations.  Department heads must prepare Protective Data Security Plans to address the VPDSS and submit the plan to the Commissioner.

Whilst VAGO will be undertaking performance audits for the purpose of ascertaining the effectiveness of the VPDSF and VPDSS in improving government's cyber resilience, the Commissioner may also conduct monitoring and assurance activities, including audits, to ascertain whether departments and agencies are complying with data security standards.

If you would like to know more, contact:

Rebecca Radford
9947 1403

Snezana Stojanoska
9947 1412

James Stephens
 9947 1422

Time for a change: Eight ways to get ready for amendments to the FOI Act

The passing of the Freedom of Information Amendment (Office of the Victorian Information Commissioner) Act 2017 has brought about notable changes to Victoria’s Freedom of Information (FOI) regime for agencies and applicants.

Victoria's amendments are designed to promote a culture of open government through access to information and strengthen oversight of the administration of the FOI Act.
The changes come into effect on 1 September 2017.

Contact us for the complete suite of updated FOI templates, available for a fixed fee.

Here are eight things FOI agencies need to do to be ready for the changes.

1. Shorter time frames for processing FOI requests

Agencies and Ministers must make decisions on FOI requests within 30 days, instead of the previous 45 day period.
With the agreement of an applicant, this time frame can be extended by up to 30 days, with the possibility of additional extensions, so long as the extension is granted before the relevant period expires.
Decision makers are permitted an extension of up to 15 calendar days for requests that require consultation with specified third parties (under sections 29, 29A, 31, 31A, 33, 34 or 35) before a decision is made.

Action: Update correspondence templates, FOI manuals and other materials.  Importantly, consider ways of streamlining your document searches, FOI processing and other processes to make them as efficient as possible.

2. New Office of the Victorian Information Commissioner

On 1 September 2017, the new Office of the Victorian Information Commissioner (OVIC) will replace the existing Offices of the Freedom of Information Commissioner and the Commissioner for Data Protection and Privacy.
OVIC is an independent regulatory body.  It will comprise an Information Commissioner who will be assisted by two Deputy Commissioners responsible for FOI and privacy and data protection respectively.

Action: Watch out for updates and free training on the new OVIC to be offered by the current Office of the Freedom of Information Commissioner.

3. Power to review decisions of principal officers and Ministers 

OVIC has power to review FOI decisions made by principal officers and Ministers.
The amendments also provide that OVIC can accept a complaint about a decision made by a Minister that a document does not exist or cannot be located, or a failure by a Minister to comply with new Ministerial professional standards (see below).

Action: Update decision letter templates to advise that review of a decision to refuse a document, or a complaint about a ‘no documents’ decision made by a principal officer or a Minister, can be made to OVIC within 60 days after the date of the decision.

4. Power to review decisions refusing access to Cabinet documents 

OVIC has power to conduct reviews of decisions refusing access to documents exempted under the Cabinet documents exemption (section 28(1)).
Conclusive certificates signed by the Secretary to the Department of Premier and Cabinet and produced to establish that a document is subject to the Cabinet document exemption no longer apply.  In any case, such certificates were not commonly in use.

Action: Ensure decision letters address the relevant factors required in order to claim the Cabinet exemption, namely that the purpose or a substantial purpose for creating the document was for it to be submitted to Cabinet (or a sub-committee of Cabinet) for its consideration.  Care taken to establish the basis of a Cabinet exemption from the outset (including evidence of the purpose for which a document was created) will assist in any review of a decision to apply this exemption.

5. Increased powers in relation to searches for documents

Upon review of a decision, OVIC has power to require an agency or a Minister to conduct further searches for documents.  OVIC may specify methods for undertaking a further search for documents, for example, by directing an agency to use a specified key word search of its email system.
In cases where an agency or Minister refuses a request on the basis that the work involved in processing the request would substantially and unreasonably divert resources or interfere with the performance of the agency or the Minister’s functions, OVIC can require a further search or that a ‘reasonable sample’ of documents be produced.

Compliance with a request to conduct a further search or produce a reasonable sample must be undertaken within at least 10 business days, however, this period may be extended.  Within three days after the conclusion of this time frame, the agency or Minister must notify OVIC of the outcome of the further search or retrieval of sample documents.  OVIC has power to refer a complaint back to the agency or Minister to make a fresh decision.

Action: Consider making detailed notes of searches undertaken for documents, including locations searched and key word searches undertaken. This will assist you should a review application or complaint be made to OVIC.
If you receive a notice requiring a further search or a sample of documents, ensure you comply with the deadline provided in the notice.

6. New coercive and investigative powers

OVIC has power to conduct an own-motion investigation into an agency or principal officer's performance of functions or obligations under the FOI Act. As part of an investigation, the Information Commissioner can compel the production of documents and witnesses to attend before the Commissioner to be examined on oath or affirmation.
A person served with a notice to produce or attend will have the same protection and/or immunity as a witness in a Supreme Court proceeding and will have the right to legal representation if attending to answer questions.
Non-compliance with a notice to produce or attend to answer questions without a reasonable excuse may constitute an offence.

Action: If you receive a notice requiring you to produce documents or appear before the Commissioner to answer questions, ensure you comply with the requirements set out in the notice and, if required, seek clarification from OVIC.

7. Documents that may prejudice an IBAC investigation

Agencies and Ministers should be aware that documents in their possession, which would (or would be reasonably likely to) prejudice or adversely affect IBAC's investigations or informants, are exempt.

Action: If you identify such a document, notify IBAC that you have received a request for access to the document and seek IBAC's view as to whether the document should be disclosed.
Consider preparing a policy and provide training to decision makers to ensure compliance with this requirement.

8. Reduced time limit for agencies and Ministers to apply for review

While FOI applicants continue to have 60 days to lodge a VCAT review application for an OVIC decision, the time frame for an agency or Minister to lodge a VCAT review application is 14 days.

9. Professional standards for decision makers

OVIC will implement professional standards which will operate like a code of conduct to ensure FOI decision makers meet minimum standards for dealing with applicants, conducting document searches, processing requests and engaging in timely and good decision making. The standards are binding on agencies and principal officers.  Principal officers are also responsible for ensuring that all officers and employees are informed about the standards and for ensuring compliance by junior staff.
The standards do not automatically apply to staff in Ministerial offices, but the Premier has the power to adopt the standards (with modifications, if needed) and apply them to Ministers and their staff (Ministerial Standards).

Action:  You may receive an invitation from OVIC inviting your agency to participate in a consultation process for the development of the standards.
Provide training for your FOI decision makers and staff to ensure compliance with the new standards. 

Ensure your agency’s current practices comply with not only the legal requirements but also the 'spirit’ of the FOI Act.

This blog was prepared by Joanne Kummrow and Samudhya Jayasekara with the assistance of Milli Allan.

For further information on FOI matters contact:

Joanne Kummrow 
8684 0462

Andrew Field 
8684 0889

Michele Rowland
8684 0413

Kay Chan
8684 4020

To retain or not to retain, that is the question: PROV's new record keeping policy

 Interest in records management tends to be events driven.  Last year the release of the Privacy and Data Protection Act 2014 (PDP Act) heightened awareness of data security issues for government entities.  Then in the lead up to the 2014 State election, minds were turned to which documents should be retained, or not retained, as the case may be.  

But best-practice records management presents constant challenges in respect of both form and content of records.  Records now come in diverse forms - not only traditional paper documents and record-keeping or business systems, but also email and social media accounts and network drives, for example.  But their significance is premised on their nature and content, which in some cases can be difficult to assess. 

Additional guidance is now to hand.

New policy released

In February this year, Public Record Office Victoria (PROV) released an over-arching policy on record-keeping for the Victorian Government, pursuant to its responsibility for collecting and preserving records from all Victorian government and local governing bodies whose records are public records under the Public Records Act 1973 (PR Act).    

PROV's new 'Record Keeping Policy: Appraisal Statement for Public Records required as State Archives' (Appraisal Statement) sets out the key appraisal considerations for specifying and identifying those Victorian records that are of permanent value to the Government and people of Victoria.  

What is 'appraisal'?

Appraisal is the process by which those records that are required for preservation as State Archives are identified by Government agencies.  In PROV's words:

appraisal is a planned and documented process based on research and analysis to provide transparent, reasoned and consistent reasons for the retention or non-retention of records. It is a reasonably complex, judicious and somewhat subjective process that involves the evaluation of the continuing value of records for the government and community against the cost of retaining and keeping the records accessible in perpetuity.

PROV has divided the characteristics of records of enduring value into the following six categories:

1. The authority, establishment and structure of government;
2.  Primary functions and programs of government;
3. Enduring rights and entitlements (of individuals and groups);
4. Significant impact on individuals;
5. Environmental management and change; and
6. Significant contribution to community memory.

Some of these activities and associated records are relatively self-evident.  For example, in respect of the second category, PROV lists the State budget papers as an example of 'Records that illustrate the government's role in the management of the Victorian economy'. 

However other categories, notably the fourth, are potentially more problematic.  Here PROV's guidance is particularly useful in circumstances where appraisal decisions may affect the 'most vulnerable members of Victorian society'.  Records listed as potentially falling into category four include:

• Collections and analyses of data compiled for planning and decision making;
• Representations and appeals against the decisions/actions of government or legislature; and
• Petitions documenting significant community opposition to government actions or policies.

Records not of permanent value

But what about those records appraised as not being of permanent value? All public records must continue to be retained for as long as they're needed to meet Government's administrative needs and legislative requirements, and to support accountability and community expectations. Section 19 of the PR Act has the effect that it is unlawful to dispose of or destroy a public record other than in accordance with a Standard made under s 12.  Minimum periods are set out in the Standards, or Retention and Disposal Authorities, issued by PROV for use by Government agencies.

Retention periods and personal information

Since opinions may differ as to how an individual record should be categorised in light of the Standards, these minimum periods are not without controversy, particularly in light of the requirements of Information Privacy Principle (IPP) 4.2 of the PDP Act (and its predecessor in the Information Privacy Act 2000).  IPP 4.2 requires destruction or permanent de-identification of personal information 'if it is no longer needed for any purpose'. 

The PR Act prevails over IPP 4.2 as a result of s 6 of the PDP Act (and previously s 6 of the IP Act).  Decisions of the Victorian Civil and Administrative Tribunal have accepted that personal information retained pursuant to a requirement of the PR Act is still relevantly 'needed' for a purpose (Caripis v Victoria Police(Health and Privacy) [2012] VCAT 1472; Zeqajv Victoria Police (Human Rights) [2013] VCAT 2105). 

Agencies should therefore be aware that retention of personal information beyond the retention period specified in a relevant Standard increases their risk if a complaint is made under IPP 4.2.  Moreover, when protective data security standards are released this year under the PDP Act, agencies may need to reevaluate the cost of managing any records that they are not required to retain.

If you are in the Victorian Government and would like assistance in respect of your agency's records management or privacy obligations, contact:

Carolyn Doyle

Managing Principal Solicitor

9947 1403

Deidre Missingham

Senior Solicitor

8684 0483

---