The most common complaints we investigate relate to individuals trying to access their personal information. Some of these requests are “empty-your-pocket” requests to the agency – in other words, requests for all the information held about the person concerned by the agency.

The requester is well within their rights to do this. But throughout our investigations we have seen the full spectrum of responses from agencies to these types of requests: some deal with the requests comprehensively; others leave a lot to be desired. Included below are some observations from the access complaints we have assessed.

The legal position

Principle 6

Principle 6 of Privacy Act says that individuals are entitled to have access to their personal information held by an agency. An agency can withhold personal information if one of the withholding grounds listed in the Act applies.

Principle 6 is a strong legal right. There is no limitation upon the extent of personal information which a person can request from the agency. If an individual wants to request everything the agency holds about them, they are free to do so.

What to consider when responding to these requests

Everything means everything

If a requester asks for all information about themselves, the agency needs to assess all the information it holds about the requester – obvious, right? Yet often we see agencies that initially say they have released all information to the requester but, when prompted by our Office to conduct some follow-up enquiries, are later able to locate more information. This suggests that their initial searches were not as thorough as they could have been.

Many agencies will have a designated file (or files) for the individuals that they deal with. In most cases it will not be sufficient for the agency to simply release that file in response to a ‘capture-all’ request. A request for all information held by an agency would by extension include information not necessarily on the individual’s file. The agency should ensure it checks its records for information it holds outside that individual’s file. This includes searching emails, written notes, and even employee memories.

It is important to note that when our Office notifies an agency of a complaint, it then opens up that agency to litigation risk. If we are not able to resolve the matter during an investigation, the complainant is free to take the matter up in the Human Rights Review Tribunal. Therefore, it is best practice for an agency to respond as meticulously as it can when it receives a request for all information to reduce the likelihood of the requester making a complaint to our Office in the first place. Put simply: do it once and do it well.

Ask: why do they want this information?

From a legal perspective, principle 6 is generally not concerned with why an individual wants their information. A person’s motivation for requesting information is only relevant in limited circumstances (for instance, where the requests may reach the threshold for vexatiousness, which is a ground whereby an agency can refuse an access request).

But from a practical perspective, the question of why an individual wants specific information should be at the forefront of the agency’s mind. Rather than attempting to respond to requests blindly, we encourage agencies to try and work with the requester. Can the requester clarify or specify the information they are after? Can you get more details to understand the context of the request? Asking these questions can help agencies to locate the information requested, or even narrow down the scope of the request so it is not too burdensome or time-consuming to respond to.

Transparency around the agency and its decisions

In our experience, many people who make these all-encompassing requests do so because of their lack of knowledge or lack of trust with the agency. Commonly the request is triggered by an event or decision made by the agency that takes the individual by surprise. The individual becomes suspicious of what actions the agency might take in the future, or they speculate about what information the agency holds.

These requests can be taxing for agencies to process, and often the information is not that helpful for the individual in the context of their dispute. There’s a lesson in here for agencies to be as transparent as possible when it makes decisions affecting people.

Utilise our Office

Our investigation of complaints is retrospective by nature. When we investigate, we assess how an agency has already responded to an individual. But this doesn’t mean that we cannot help agencies before this stage. If you are uncertain about how to respond to a request, feel free to contact our Office in the first instance – we are here to help.

Image credit: Request - via Blue Diamond Gallery under Creative Commons Licence

IPP6 - access