Can someone request access logs?

The identity of members of staff who have accessed an individual’s information is personal information about that individual. This means this is something that individuals are entitled to request under the Privacy Act.

However, in many cases, details about who has accessed a file and when will be trivial, so there may be a good reason to withhold this information. Alternatively, sometimes there might be safety concerns. Occasionally you may have particularly strong privacy concerns for staff who have accessed the relevant information.

If you receive a request for information of this type, it may be a good idea to contact the individual to see if there is a specific reason they are seeking this information.

While individuals don’t have to explain why they’ve asked for their personal information, in our experience, people generally request this type of information when they have concerns that staff may have accessed their information inappropriately.

If that is the case, there may be other things you can do to resolve their concerns, for instance investigating the reasons why staff members accessed the individual’s information, rather than handing over a list of staff names to the individual.