Access applications and third party personal information

Under the Right to Information Act 2009¹ (Qld) (RTI Act) anyone can apply to an agency² for access to documents. However, access to information can be refused if it would be contrary to the public interest to release it. This will often, but not always, include the personal information of people other than the applicant (third party personal information).

This guideline is intended to offer assistance when considering certain broad categories of third party personal information, as applying the balancing test to information of this kind requires careful consideration. Decisions of the Information Commissioner, many of which are discussed in this guideline, demonstrate that the outcome will vary depending on the unique circumstances of each application.

Applications which name someone other than the applicant

Decisions makers should proceed carefully where an application names a person other than the applicant in the context of something that person may have done or said. For example, applications which describe the information being sought as ‘all the complaints made by Dave’ or ‘the complaints my neighbour made about my dog’ or ‘everything Bob said about my harassment complaint’ or ‘any complaints made by my family about Employee Sarah’ may require the decision maker to make a neither confirm nor deny decision.

Refer to Neither confirm nor deny the existence of documents for further guidance.

Personal information and privacy

Personal information is any information, whether true or not, about an individual whose identity can reasonably be ascertained.⁴

Can the individual be identified?

Where information includes the individual’s name, the individual’s identity will generally be apparent. Even if their identity is not readily apparent, it may be possible to identify a person using additional information. However, if only certain individuals have the information necessary to identify the individual, eg because of their relationship with the individual or their involvement in events, this will not generally be enough to make their identity reasonably ascertainable.⁵

In the context of an RTI application, it will be necessary to consider both the applicant’s knowledge and the scope of their application when determining whether third party information is personal information.

In F60XCX and Queensland Ombudsman⁶, the applicant submitted that deleting names would deidentify the documents, but the Commissioner noted that the officers’ identities could be ascertained from information already released under the application and information currently in issue. In Collins and HQCC⁷, the Commissioner agreed with submissions that a deidentified resume would still identify a clinician, because knowledge of the clinician’s previous positions and the dates they were held would allow simple internet searches to reveal their identity.

Is it about an individual?

Information will be about an individual if it reveals a fact or opinion about the individual, in that there is there is a sufficient link or connection between the information sought and the identified individual.⁸

For detailed guidance on personal information, decision makers should refer to What is personal information?.

Public interest factors

The public interest factors against disclosure that apply to third party personal information will vary from application to application, but the most common include:

• Disclosure of the information could reasonably be expected to cause a public interest harm if disclosure would disclose personal information of a person, whether living or dead.¹² (The personal information factor against disclosure.)
• Disclosure of the information could reasonably be expected to prejudice the protection of an individual’s right to privacy.¹³ (The privacy factor against disclosure.)

Who is information released to?

When making a decision about the weight to assign to the public interest factors against disclosure, decision makers should not exclude from consideration evidence about the intended or likely extent of dissemination of information by the applicant.¹⁴

In F60XCX and Queensland Ombudsman,¹⁵ the Commissioner noted that there are no restrictions on the use, dissemination, or republication of information released under the Act. She considered both the applicant’s intended use of the information and the possibility that the information could be disseminated further, as permitted by the Act, when making the decision to find it was contrary to the public interest to release.

Third party authority included with the application

Applicants sometimes include a consent or authority (authority) from the third party with their application which gives the applicant permission to access the third party’s personal information. These authorities do not override the decision maker’s obligation to:

• consider whether release of the third party personal information would be contrary to the public interest; or
• their obligation to seek the third party’s views if they decide to release and think it would reasonably be of concern to the third party.

Each decision maker must decide how much weight they give to an authority, taking into account any relevant factors, including:

• Are there any doubts about the genuineness or voluntariness of the authority?
• What is the extent of the third party’s knowledge? How likely are they to be aware of the personal information they’ve agreed to allow the applicant to access?
• How sensitive is the information? The greater the sensitivity, the less weight a decision maker might give to an authority.
• How much does the applicant already know? If it’s mutual personal information, or the applicant is already aware of it, a decision maker might give greater weight to the authority.

If there are no concerns, a third party authority can remove/greatly reduce the weight of the privacy and personal information factors against disclosure. Common examples are:

• an insurance company makes an RTI application and includes an authority from the claimant, giving permission for the company to access their medical records; or
• Spouse A make an IP application for complaints about the dog they jointly own with Spouse B and includes an authority from Spouse B, giving permission for Spouse A to access their personal information.

It may not be appropriate to reduce the weight of the privacy and personal information factors where:

• agency files show that the applicant has a history of coercing the third party or there is other information that indicate the authority may not be genuine; or
• the third party could not reasonably be aware of their personal information which is in scope of the application, which means they could not have known what they were agreeing to.

Disclosure to family members

When considering the privacy and personal information factors against disclosure, family members have no greater right to the personal information of their adult living relatives than any other person¹⁹.

In 0ZH6SQ and Department of Health²⁰ the Commissioner noted that the applicant’s contact with his family did not impact the balancing of the public interest in relation to their personal information. The privacy interests of those family members were still relevant when considering disclosure under the Act.

For information on parents applying for children, refer to Applications by and for children.

Third party personal information known to the applicant

When applying the privacy and personal information factors against disclosure, it will be relevant that the third party personal information was provided by the applicant or is known to the applicant. It does not automatically mean that it will be released to the applicant, but it may impact on the application and/or weighting of those factors against disclosure.

Does the personal information factor against disclosure apply?

The personal information factor against disclosure in schedule 4, part 4, section 6 provides that it causes a public interest harm to disclose personal information.

The Commissioner in Australian Broadcasting Corporation and Department of Child Safety, Youth and Women²¹ stated:

...where releasing personal information would not involve conveying to any person or entity information not already known to them, it cannot be said such release would disclose personal information within the meaning of the personal information harm factor, and that factor will therefore not apply.

If the third party personal information is known to an applicant, particularly where it was provided by them, or had previously been given to them, the personal information factor against disclosure will not apply. However, the decision maker will need to be satisfied that the information is, as a matter of fact, actually known to the applicant.

Documents provided by the applicant

The Commissioner in G46 and Queensland Police Service²² noted that providing unredacted copies of correspondence already sent or received by the applicant would not disclose third party personal information to the applicant, as the applicant already knew it.

Care needs to be taken, however, when making this decision, and the documents provided by and/or given to the applicant need to be assessed. If they are old, for example, or were provided jointly by parties who are no longer together (eg after a divorce or dissolution of a business partnership), it may raise questions as to whether the applicant still has a copy.

Care also needs to be taken when considering how the document appears in agency records. In James and Queensland Police Service²³ the Commissioner found that third party personal information provided by the applicant could reasonably be expected to prejudice the protection of the third party’s right to privacy if disclosed because it appeared in an official QPS record.

In 0ZH6SQ and Department of Health²⁴, third party personal information provided by the applicant had become part of a psychiatric report, which was a significant contributor to it being contrary to the public interest to disclose.

In both these cases, the way in which the information now appeared in agency records altered the way in which it impacted third parties.

Depending on the way the document appears in agency records, the third party personal information it contains may have acquired additional meaning—for example, a letter may have become part of a mental health assessment or investigation report or have been significantly notated by agency officers. If so, giving the applicant a copy would mean disclosing that additional information to the applicant and schedule 4, part 4, section 6 would apply.

Information that is known to the applicant

In some circumstances, the applicant may simply be aware of the information. This may be because they told the agency the information, or acquired it through other means, or were involved in a relevant incident with the third party.

When this occurs, the privacy interests that attach to the third party personal information may be lessened but they will not be negated.²⁵ In most cases, the applicant’s knowledge will not be sufficient to outweigh the privacy and personal information factors against disclosure.

• In Beale and Department of Community Safety²⁶, the Commissioner considered video footage of an incident involving the applicant which took place in a prison. The applicant was able to provide details of a prisoner in the video with them and had been held in the same facility as other prisoners captured in the footage. On that basis, the Commissioner considered it likely that the applicant knew some, if not all, of the other prisoners. However, the Commissioner found that both the privacy and personal information factors against disclosure applied and gave them significant weight, deciding it was contrary to the public interest to release.
• In 3ZA9CH and Cairns and Hinterland Hospital and Health Service²⁷, the information was highly sensitive information provided by other people as part of the applicant’s healthcare. The applicant submitted that he might know it, given it related to his healthcare (although there was no evidence to support that position). However, the Commissioner found that, because of the highly sensitive nature of the information,²⁸ any purported knowledge of the applicant would not reduce the privacy interests of the third parties. The Commissioner found it was contrary to the public interest to release.
• In Setschnjak and Department of Justice and Attorney-General²⁹ some aspects of the information, which related to a complaint against the applicant, may have been known to the applicant because current court proceedings made similar allegations. However, the Commissioner was not satisfied that, even if some aspects of the complaint were known to the applicant, the privacy interests attaching to the information had been significantly reduced. She found that disclosing the information would prejudice the complainant’s privacy and decided it was contrary to the public interest to release.
• In 0ZH6SQ and Department of Health³⁰, the information had been provided by the applicant to the agency. However, it was sensitive information about the applicant’s family and victims which now formed part of a psychiatric report in which its source was not clear. The Commissioner found that disclosing it to the applicant would significantly impact the privacy of the individuals involved and found it was contrary to the public interest to release.
• In James and Queensland Police Service³¹, the applicant provided a third party’s name to the Queensland Police Service (QPS). While the applicant’s direct involvement diminished the weight of the privacy and personal information nondisclosure factors, the Commissioner was satisfied that disclosure of the individual’s details, given they appeared in an official QPS record, could prejudice the protection of their right to privacy.³² The Commissioner decided it was contrary to the public interest to release.

Decision makers need to consider the sensitivity of the third party personal information, the circumstances in which it appears, and to what extent the applicant actually knows it when deciding how much the weight given to the privacy and personal information factors against nondisclosure is reduced.

Third party personal information that could potentially be known to an applicant

Information appearing on the internet

In some circumstances the third party personal information may be available on the internet. This will need to be confirmed before it can be taken into consideration. If it can be confirmed, decision makers will need to consider the sensitivity of the information and the extent to which it is identical to information in the documents they are considering, noting James and Queensland Police Service (discussed above) regarding the privacy implications of third party personal information appearing in government records.

In J2P8MT and Department of Health³³, the Commissioner found that the privacy factors against disclosure were significantly reduced in relation to the third party personal information, which related to a property transaction. Internet searches conducted using information already known to the applicant provided the details necessary to do a land title and a land valuation search, which would reveal the personal information in question.

Information that may have been presented in court

When making their applications, applicants will sometimes claim that third party personal information has been presented in court. Where the applicant does not include evidence of this, eg a transcript, decision makers are not obligated to ascertain if this is correct.

If the document the decision maker is considering is a court transcript, it is open to them to refuse access³⁴, as transcripts are available from Auscript³⁵. If the document is not a transcript, the third party personal information should be considered in the context in which it appears in the agency document.

In 3ZA9CH and Cairns and Hinterland Hospital and Health Service (discussed above), the applicant proposed that he might know the information, and the Commissioner considered the applicant’s purported knowledge when making her decision. Where the applicant contends that third party personal information might have been presented in open court, a decision maker can account for the possibility in their decision. However, they need to apply the privacy and public interest factors against disclosure to the information as it appears in agency records, based on its sensitivity and the fact that they have no evidence that the applicant knows it.

Third party personal information

Below are some personal information types in relation to which issues often arise.

Employment information

Public sector employees

Personal information of individuals employed by entities subject to the RTI Act falls into two categories: personal information that relates to the routine carrying out of their day to day work functions (routine personal work information) and personal information that doesn’t.

The discussion in this guideline applies to everything that isn’t routine personal work information. For information on dealing with routine information, refer to  Routine personal work information of public sector employees.

For information about third party personal information in public sector recruitment documents, please refer to Accessing information following a government recruitment process.

Private sector employees

Private sector employees do not have routine personal work information. When considering their personal information, the following considerations will be relevant:

• What kind of information is it? For example, is it names and position titles or is it highly personal/private information?
• What is the status of the employee? For example, are they the head of the company or the company’s public face?
• Is the information already public? For example, does it appear on the company website?

In The Barlow Group Pty Ltd and Department of Housing and Public Works; JM Kelly (Project Builders) Pty Ltd (Third Party)³⁷(Barlow) the Commissioner found that, while the privacy and personal information factors against disclosure applied to the names and position titles of private sector employees, they attracted a low weight. The Commissioner considered that disclosing the names and position titles of employees who were the public face of the company would reveal only that the individuals were employees and, due to their role in the company, that they had signed statutory declarations the substance of which had already been provided to the applicant.

In McCrystal and Queensland Building and Construction Commission³⁸, however, when considering private sector employees’ personal information, the Commissioner afforded a high weight to the privacy and personal information factors against disclosure. Unlike Barlow, this information was provided to or obtained by the agency as part of an investigation into alleged regulatory breaches. It included names, contact details, personal opinions and other personal information, including audio recordings.

Audio recordings: non-lexical information

When an individual’s voice is recorded, the recording captures more information than just their words.³⁹ This includes voice inflections and other non-lexical information⁴⁰ such as tone, cadence, emphasis, inflection and pauses,⁴¹ reactions,⁴² tone of interactions with other people,⁴³ and their emotional state or intellectual capacity at the time of the recording⁴⁴.

Non-lexical information is sensitive and highly personal in nature.⁴⁵ When considering audio recordings, the privacy interests of the third party should generally be accorded greater weight than might otherwise be the case for purely text-based documents.⁴⁶

As was observed in NY Times v NASA:

...disclosure of the [tape] would reveal the sound and inflection of the crew's voices during the last seconds of their lives. Therefore, the tape contains personal information the release of which is subject to the balancing of the public gain against the private harm at which it is purchased.⁴⁷

The Commissioner has stated⁴⁸ that the “public interest harm that could ordinarily be expected to flow from disclosure of personal information of this kind is relatively significant having regard to the prejudicial effect on the protection of an individual’s right to privacy.”

For information on video recordings, decision makers should refer to Managing access to Digital Video Recordings.

Handwriting

Where documents have been handwritten by a third party, the handwriting itself is their personal information.⁴⁹ Decision makers will need to assess the circumstances and the information to determine what weight to attribute to the privacy and personal information factors.

For example, in:

• O’Hagan and Building Services Authority⁵⁰ the documents were handwritten responses to questions.⁵¹
• Plfugrath and Gympie Regional Council⁵² the handwriting would have been likely to identify the person who made a complaint to the Council and, as such, the Commissioner found it was not in the public interest to release the document.
• McEniery and Medical Board of Queensland⁵³ where release of the handwritten document would have allowed the identity of the writer to be ascertained.⁵⁴

Investigations and complaints information

For information on dealing with third party personal information appearing in investigation and complaint documents, including the name of complainants, refer to Applications for investigation and complaint documents.

Third party personal information that can’t be separated from the applicant’s

In some circumstances, third party personal information will also be the applicant’s personal information, eg where it is the thoughts and/or opinions of other people about the applicant or vice versa, and/or be so mixed together it can’t be separated. This kind of personal information is called mutual or shared personal information.

In 5GNOF4 and Queensland Health⁵⁵, information was recorded on Admission Cards in such a way that the applicant’s could not be separated from other people’s and, according high weight to the privacy and personal information factors against disclosure, the Commissioner refused access to the mutual personal information.

In 8RS6ZB and Metro North Hospital and Health Service⁵⁶, the applicant’s information was also the thoughts and opinions of the individuals who provided it. The Commissioner held that the privacy and personal information factors against disclosure applied to the information and, given the information was “sensitive in nature, comprising opinions, thoughts and feelings”, gave them significant weight and found it would be contrary to the public interest to disclose.

Consultation

If a decision maker decides to release third party personal information, they must take reasonable steps to consult with the third party if disclosure would reasonably be of concern to the third party. If a decision maker is concerned about the impact viewing or reading the documents could have on the third party, it may be possible to consult in a way that does not require them to be given a copy. If the information is about a deceased person, the decision maker must consult with their representative.

Refer to Consulting with a relevant third party for more information.