NSW Dept of Communities and Justice Claim Non-Existent Certification to
Support Access to Information Decisions, 13.06.2023
An Open Government, Information & Privacy Officer with Dept of Communities & Justice (Justice NSW) has responded to an enquiry in relation to a Notice of Decision issued to Telina Webb of NSW Freedom of Information.
The request for information resulting in the Notice of Decision concerned employment and authorisation documentation relating to an individual identified as Amol Mane of the global sales and marketing organisation Salesforce.
Salesforce had provided a cloud-based customer management system to the Office of the NSW Information & Privacy Commissioner (IPC) and Justice NSW, on a subscription basis at a cost of approximately $45,000.00 per year. The system was implemented in mid-2016 and promoted as the IPC GIPA Tool to encourage NSW agencies to better manage access applications and for improved mandatory reporting obligations under the Government Information (Public Access) Act 2009, GIPA.
Despite paying subscription fees allowing access to some (550) five hundred and fifty agency users, not all agencies do so and continue to comply with mandatory reporting obligations in the way they did prior.
Ms Webb’s access application also sought records of the software updates and program modifications undertaken by Amol Mane. She had initially lodged her request for information with the IPC, given the IPC GIPA Tool has been continuously promoted by the IPC, however the IPC informed Ms Webb the subject information more directly concerned Justice NSW and was therefore presumed to be held by it.
Ms Webb had lodged her access application for information about the IPC GIPA Tool subsequent to an access application with Port Stephens Council, which sought the Case Management Data records of her access applications uploaded to that Tool.
Council had responded with several documents, partially redacted, but which disclosed that the individual Amol Mane had gained access to her access application information. There was no indication that Ms Webb’s personal information including her name, address, email address and phone number had been protected from view by the individual Amol Mane, or any Salesforce employee. Council’s Privacy Statement within its Access to Information form neglected to disclose the uploading of Ms Webb’s information to this platform, which shared her personal information with a third-party external organisation to NSW government.
After having her access application transferred from the IPC to Justice NSW, Right to Information Officer Jordan Creyson determined to release part of the information requested, and that some of the information requested was not held by Justice NSW.
Mr / Ms Creyson advised Ms Webb that searches had been undertaken for the requested information and that certification of those searches had been accepted as evidence to that effect.
However, Ms Webb subsequently wrote to Mr / Ms Creyson asking for clarification of what the Department meant by “certification.”
On 13th June 2023 Mr / Ms Creyson wrote to Ms Webb stating “To assist you with your inquiry dated 8 June 2023 and clarification of what certify means in our decision letter, I advise that it means when we facilitate searches for an access application, the employee conducting the searches certifies (or confirms) that they have conducted reasonable searches for the information falling within the scope of the access application. This way we are confirming we are complying with s 53 of the GIPA Act.”
Ms Webb commented “Mr / Ms Creyson stated in the Notice of Decision:
• HR Shared Services, Shared Services and Customer Experience, Corporate Services searched the Department’s HP Records Manager, EDRMS and payroll system JSAP. The Senior Service Officer certified that reasonable searches have been undertaken and I accept this certification.
• Talent Acquisition, People, Corporate Services searched the Department’s HP Records Manager, EDRMS and SuccessFactors Recruitment system. The Senior Manager, Talent Operations certified that reasonable searches have been undertaken and I accept this certification.
• Information & Digital Services, Corporate Services searched the Department’s ITSM system and shared computer drives. The Principal Manager, Enterprise CRM and Platforms certified that reasonable searches have been undertaken and I accept this certification.
However, it is clear there never was any certification of any kind, it’s just a baseless claim something occurred without any evidence to support that. Justice NSW doesn’t have certification of any kind relating to Access Applications. How can the public have any confidence in the Department’s Open Government, Information & Privacy Unit when it is unable or unwilling to provide supporting documentation for its decisions? The claim of certification has no credibility whatsoever. And let’s not forget, these are legally binding decisions qualifying for judiciay review. In this instance we are talking about the top of the tree, Justice NSW. Agencies should be printing out the results of their searches, providing those completely unredacted with their decisions, with date of search and all the search parameters fully disclosed. This is not additional work and would be a small step towards greater transparency. In the case of this decision, without any evidence to support the claim of searches, and the realisation certification of searches doesn’t exist, any reasonable person would understand why access applicants seek administrative reviews with the NSW Civil & Administrative Tribunal (NCAT), which could easily be avoided saving the state and the public thousands of dollars per application.”
Contact:
Jordan Creyson, (02) 9716 2664
The request for information resulting in the Notice of Decision concerned employment and authorisation documentation relating to an individual identified as Amol Mane of the global sales and marketing organisation Salesforce.
Salesforce had provided a cloud-based customer management system to the Office of the NSW Information & Privacy Commissioner (IPC) and Justice NSW, on a subscription basis at a cost of approximately $45,000.00 per year. The system was implemented in mid-2016 and promoted as the IPC GIPA Tool to encourage NSW agencies to better manage access applications and for improved mandatory reporting obligations under the Government Information (Public Access) Act 2009, GIPA.
Despite paying subscription fees allowing access to some (550) five hundred and fifty agency users, not all agencies do so and continue to comply with mandatory reporting obligations in the way they did prior.
Ms Webb’s access application also sought records of the software updates and program modifications undertaken by Amol Mane. She had initially lodged her request for information with the IPC, given the IPC GIPA Tool has been continuously promoted by the IPC, however the IPC informed Ms Webb the subject information more directly concerned Justice NSW and was therefore presumed to be held by it.
Ms Webb had lodged her access application for information about the IPC GIPA Tool subsequent to an access application with Port Stephens Council, which sought the Case Management Data records of her access applications uploaded to that Tool.
Council had responded with several documents, partially redacted, but which disclosed that the individual Amol Mane had gained access to her access application information. There was no indication that Ms Webb’s personal information including her name, address, email address and phone number had been protected from view by the individual Amol Mane, or any Salesforce employee. Council’s Privacy Statement within its Access to Information form neglected to disclose the uploading of Ms Webb’s information to this platform, which shared her personal information with a third-party external organisation to NSW government.
After having her access application transferred from the IPC to Justice NSW, Right to Information Officer Jordan Creyson determined to release part of the information requested, and that some of the information requested was not held by Justice NSW.
Mr / Ms Creyson advised Ms Webb that searches had been undertaken for the requested information and that certification of those searches had been accepted as evidence to that effect.
However, Ms Webb subsequently wrote to Mr / Ms Creyson asking for clarification of what the Department meant by “certification.”
On 13th June 2023 Mr / Ms Creyson wrote to Ms Webb stating “To assist you with your inquiry dated 8 June 2023 and clarification of what certify means in our decision letter, I advise that it means when we facilitate searches for an access application, the employee conducting the searches certifies (or confirms) that they have conducted reasonable searches for the information falling within the scope of the access application. This way we are confirming we are complying with s 53 of the GIPA Act.”
Ms Webb commented “Mr / Ms Creyson stated in the Notice of Decision:
• HR Shared Services, Shared Services and Customer Experience, Corporate Services searched the Department’s HP Records Manager, EDRMS and payroll system JSAP. The Senior Service Officer certified that reasonable searches have been undertaken and I accept this certification.
• Talent Acquisition, People, Corporate Services searched the Department’s HP Records Manager, EDRMS and SuccessFactors Recruitment system. The Senior Manager, Talent Operations certified that reasonable searches have been undertaken and I accept this certification.
• Information & Digital Services, Corporate Services searched the Department’s ITSM system and shared computer drives. The Principal Manager, Enterprise CRM and Platforms certified that reasonable searches have been undertaken and I accept this certification.
However, it is clear there never was any certification of any kind, it’s just a baseless claim something occurred without any evidence to support that. Justice NSW doesn’t have certification of any kind relating to Access Applications. How can the public have any confidence in the Department’s Open Government, Information & Privacy Unit when it is unable or unwilling to provide supporting documentation for its decisions? The claim of certification has no credibility whatsoever. And let’s not forget, these are legally binding decisions qualifying for judiciay review. In this instance we are talking about the top of the tree, Justice NSW. Agencies should be printing out the results of their searches, providing those completely unredacted with their decisions, with date of search and all the search parameters fully disclosed. This is not additional work and would be a small step towards greater transparency. In the case of this decision, without any evidence to support the claim of searches, and the realisation certification of searches doesn’t exist, any reasonable person would understand why access applicants seek administrative reviews with the NSW Civil & Administrative Tribunal (NCAT), which could easily be avoided saving the state and the public thousands of dollars per application.”
Contact:
Jordan Creyson, (02) 9716 2664