NSW Dept of Education Lacks Fundamental Comprehension of Access to Information Legislation, 13.06.2023
A recent request for external review of a Dept of Education access to information application has revealed the department’s fundamental lack of understanding of the Government Information (Public Access) Act 2009, GIPA.
The request for information originated from Telina Webb of NSW Freedom of Information who sought an unredacted copy of the department’s IPC GIPA Tool Case Management Files pertaining to the access applications previously lodged by her. Those access applications were dated August 2021 and October 2022.
The Dept of Education’s Right to Information Officer Shelley Napper responded to Ms Webb’s request for information by deciding to release the information in full, however having wrongfully determined the information as personal in nature, Ms Napper insisted Ms Webb provide copies of her ID to ensure she was who she claimed to be.
Ms Webb stated “I advised the agency I had not requested any personal information, particularly that the request was not made under the Privacy & Personal Information Protection Act 1998, (PPIP). However Ms Napper referred me to Section 55(5) of the GIPA Act 2009, which states ‘an agency may ……… require the applicant to take reasonable steps to provide proof of his or her identity.’
The key term here is MAY. The Interpretations Act 1987 Section 9 actually addresses the meaning of may and shall, stating ‘may means…….the power may be exercised or not, at discretion’. This means it is not mandatory for an agency to demand proof of ID of any access applicant, it is a discretionary power. Yet Dept of Education viewed Section 55(5) of the GIPA Act 2009 as giving it full authority to access a copy of my ID. This is very concerning, as it is now clear agencies are not rightfully disclosing they may be uploading copies of the public’s ID to a third party website, one which is owned by a sales and marketing organisation who’s staff have ready access to all kinds of personal information.”
Information on the IPC website states agencies have custodianship and control over the data entered by them, and that requests for access to that data should be made directly with the particular agency as the IPC does not have access to it https://www.ipc.nsw.gov.au/information-access/agencies/ipc-gipa-tool.
The IPC GIPA Tool is owned by the third-party sales and marketing organisation identified as Salesforce, but made available to all NSW government agencies.
Salesforce has provided the software program, a customer management record system, to the IPC on a subscription basis, currently documented to be paying administrative access for (550) five hundred and fifty agency users, at an average annual cost of approximately $45,000.00 per annum.
The IPC GIPA Tool was implemented by the Office of the NSW Information & Privacy Commissioner (IPC) in mid-2015, as a way for agencies to better manage their applications, provide their annual reports to the IPC and directly upload data.
However, using the Tool is not mandatory, with numerous agencies providing the required data as they did prior to the provision of the GIPA Tool.
The Tool User Manual makes clear there are a number of fields agencies can input data, most of which has no relevance to the data required by the IPC.
For example, there are fields for an Access Applicant’s full name, address, phone number(s), and email addresses.
Mechanisms also allow for the uploading of Access Applicant’s personal documents of ID, such as passport, driver’s licence, birth certificate, etc.
Another field provides ample space for agencies to record running commentary on Access Applications, record communications between the agency and the Applicant’s, and the full details of an access application, etc.
None of those fields aforementioned is a data requirement for mandatory reporting to the IPC. Similarly, the Tool fails to provide accurate data as intended, exemplified by the 2016 GIPA Tool Records of Ms Webb which recorded (1) one only prevention of access to open access records due to an unnamed public interest against disclosure, when in fact the agency had referred to the GIPA Act 2009 Section 14 Table 3(f) a staggering total of (235) two hundred and thirty-five times in its collective decisions.
Thus far there is no evidence any NSW agency or the IPC has disclosed the full capabilities of the Tool, nor has any NSW agency or the IPC disclosed that agencies are uploading the public’s personal information, including documents of identification, into the Tool.
Further responses to requests for information from Ms Webb document Salesforce personnel regularly access this personal information, with Salesforce personnel ID logged as having access. Ms Webb has confirmed some of that access has been remote, as far away as the sub-continent. The total cost for the application was $200.00.
This particular request for information with the Dept of Education ended up in front of the Tribunal’s Mr Montgomery, where the Department’s Manager – Right to Access / Legal Services Officer Jenni Pendergast pleaded necessity to validate an Applicant’s identity for fear of breaching privacy, was given the personal reassurance of Mr Montgomery who stated “I can vouch for Ms Webb, I know her very well.”
“What is very clear from this singular agency response to a valid access application, is there are still senior right to information / legal officers making legal decisions, who do not properly comprehend the terminology of the GIPA Act 2009. Thankfully I resisted providing my ID documents, as now I know such documents would likely have been uploaded to the IPC GIPA Tool without my knowledge or consent.
This raises serious concerns about any agency’s ability to properly interpret the PPIP Act 1998, when an access application gives reassurances personal information will be protected, and yet the truth is the public’s personal information is on the internet and totally available to a sales and marketing organisation, which sees both the NSW Information and Privacy Commissioners negligent in their duties to protect the public, particularly in an age of unquantifiable instances of identity theft and fraud.
“This is so much more concerning with the revelation from the Crown Solicitor’s Andrew Bell who frankly informed the NCAT on 22nd March 2023 “Those privacy statements (on agency access application forms) don’t mean anything,” stated Ms Webb. "I cannot see $200.00 worth of value for this simple request for information, which took (4) four months to resolve."
Contact:
Andrew Bell, (02) 9474 9022
Jenni Pendergast, (02) 7814 1107 Shelley Napper, (02) 7814 0651
IPC, 1800 472 679
The request for information originated from Telina Webb of NSW Freedom of Information who sought an unredacted copy of the department’s IPC GIPA Tool Case Management Files pertaining to the access applications previously lodged by her. Those access applications were dated August 2021 and October 2022.
The Dept of Education’s Right to Information Officer Shelley Napper responded to Ms Webb’s request for information by deciding to release the information in full, however having wrongfully determined the information as personal in nature, Ms Napper insisted Ms Webb provide copies of her ID to ensure she was who she claimed to be.
Ms Webb stated “I advised the agency I had not requested any personal information, particularly that the request was not made under the Privacy & Personal Information Protection Act 1998, (PPIP). However Ms Napper referred me to Section 55(5) of the GIPA Act 2009, which states ‘an agency may ……… require the applicant to take reasonable steps to provide proof of his or her identity.’
The key term here is MAY. The Interpretations Act 1987 Section 9 actually addresses the meaning of may and shall, stating ‘may means…….the power may be exercised or not, at discretion’. This means it is not mandatory for an agency to demand proof of ID of any access applicant, it is a discretionary power. Yet Dept of Education viewed Section 55(5) of the GIPA Act 2009 as giving it full authority to access a copy of my ID. This is very concerning, as it is now clear agencies are not rightfully disclosing they may be uploading copies of the public’s ID to a third party website, one which is owned by a sales and marketing organisation who’s staff have ready access to all kinds of personal information.”
Information on the IPC website states agencies have custodianship and control over the data entered by them, and that requests for access to that data should be made directly with the particular agency as the IPC does not have access to it https://www.ipc.nsw.gov.au/information-access/agencies/ipc-gipa-tool.
The IPC GIPA Tool is owned by the third-party sales and marketing organisation identified as Salesforce, but made available to all NSW government agencies.
Salesforce has provided the software program, a customer management record system, to the IPC on a subscription basis, currently documented to be paying administrative access for (550) five hundred and fifty agency users, at an average annual cost of approximately $45,000.00 per annum.
The IPC GIPA Tool was implemented by the Office of the NSW Information & Privacy Commissioner (IPC) in mid-2015, as a way for agencies to better manage their applications, provide their annual reports to the IPC and directly upload data.
However, using the Tool is not mandatory, with numerous agencies providing the required data as they did prior to the provision of the GIPA Tool.
The Tool User Manual makes clear there are a number of fields agencies can input data, most of which has no relevance to the data required by the IPC.
For example, there are fields for an Access Applicant’s full name, address, phone number(s), and email addresses.
Mechanisms also allow for the uploading of Access Applicant’s personal documents of ID, such as passport, driver’s licence, birth certificate, etc.
Another field provides ample space for agencies to record running commentary on Access Applications, record communications between the agency and the Applicant’s, and the full details of an access application, etc.
None of those fields aforementioned is a data requirement for mandatory reporting to the IPC. Similarly, the Tool fails to provide accurate data as intended, exemplified by the 2016 GIPA Tool Records of Ms Webb which recorded (1) one only prevention of access to open access records due to an unnamed public interest against disclosure, when in fact the agency had referred to the GIPA Act 2009 Section 14 Table 3(f) a staggering total of (235) two hundred and thirty-five times in its collective decisions.
Thus far there is no evidence any NSW agency or the IPC has disclosed the full capabilities of the Tool, nor has any NSW agency or the IPC disclosed that agencies are uploading the public’s personal information, including documents of identification, into the Tool.
Further responses to requests for information from Ms Webb document Salesforce personnel regularly access this personal information, with Salesforce personnel ID logged as having access. Ms Webb has confirmed some of that access has been remote, as far away as the sub-continent. The total cost for the application was $200.00.
This particular request for information with the Dept of Education ended up in front of the Tribunal’s Mr Montgomery, where the Department’s Manager – Right to Access / Legal Services Officer Jenni Pendergast pleaded necessity to validate an Applicant’s identity for fear of breaching privacy, was given the personal reassurance of Mr Montgomery who stated “I can vouch for Ms Webb, I know her very well.”
“What is very clear from this singular agency response to a valid access application, is there are still senior right to information / legal officers making legal decisions, who do not properly comprehend the terminology of the GIPA Act 2009. Thankfully I resisted providing my ID documents, as now I know such documents would likely have been uploaded to the IPC GIPA Tool without my knowledge or consent.
This raises serious concerns about any agency’s ability to properly interpret the PPIP Act 1998, when an access application gives reassurances personal information will be protected, and yet the truth is the public’s personal information is on the internet and totally available to a sales and marketing organisation, which sees both the NSW Information and Privacy Commissioners negligent in their duties to protect the public, particularly in an age of unquantifiable instances of identity theft and fraud.
“This is so much more concerning with the revelation from the Crown Solicitor’s Andrew Bell who frankly informed the NCAT on 22nd March 2023 “Those privacy statements (on agency access application forms) don’t mean anything,” stated Ms Webb. "I cannot see $200.00 worth of value for this simple request for information, which took (4) four months to resolve."
Contact:
Andrew Bell, (02) 9474 9022
Jenni Pendergast, (02) 7814 1107 Shelley Napper, (02) 7814 0651
IPC, 1800 472 679