Martin and Centrelink [2003] AATA 629 (19 May 2003)

Last Updated: 3 July 2003

DECISION AND REASONS FOR DECISION [2003] AATA 629

ADMINISTRATIVE APPEALS TRIBUNAL )

) No A2002/409

GENERAL ADMINISTRATIVE DIVISION	)
	Re	ANN MARTIN

Applicant

And

CENTRELINK

Respondent

DECISION

Tribunal

Mr G A Mowbray

Date 19 May 2003

Place Canberra

Decision

For reasons given orally the Tribunal affirms the decision under review, being Centrelink's decision of 24 October 2002.

..................(sgd)......................

Member

CATCHWORDS

FREEDOM OF INFORMATION - access to documents - exemption - whether disclosure would or could reasonably be expected to have a substantial adverse effect on the proper and efficient conduct of the operations of an agency - whether countervailing public interest - whether exempt material can be deleted

PRACTICE AND PROCEDURE - confidentiality order

Freedom of Information Act 1982 s 40

Administrative Appeals Tribunal Act 1975 s 35

Re Meschino and Centrelink [2002] AATA 627

Attorney-General's Department v Cockroft (1986) 64 ALR 97

Re Bayliss and Department of Health and Family Services (AAT 12277, 10 October 1997)

Re James and Australian National University (1984) 2 AAR 327

REASONS FOR DECISION

2 July 2003

Mr G A Mowbray

HISTORY OF THE APPLICATION

1. On 12 September 2002 Mrs Ann Martin made a request to Centrelink for access to

"All documents, no matter on what media it is stored, from 1 February 1994 to date. Note: Section 17 states that computer based records are to be treated the same as paper documents. This includes are (sic) full listing of staff accesses to my records." (Emphasis original)

2. A previous request on 19 July 2002 to which Centrelink had not yet responded made clear that Mrs Martin's request included access to

"Computer based audit trails of staff accesses to my records."

3. On 16 October 2002 Mrs Martin was given full access to all requested documents, both paper and electronic, except for one folio on her files and a Customer Record Access Monitor (CRAM) system report, the latter being exempted under paragraphs 40(1)(a), (c), (d) and (e) of the Freedom of Information Act 1982 ("the Act"). There is no CRAM report held on Mrs Martin's files.

4. Mrs Martin sought review on the bases that previous requests and accesses in the 1990s had included the supply of CRAM reports and that clients had implied rights to review information held by agencies and to seek explanation from any person who had accessed, created or altered their information.

5. The original decision to refuse access to records from the CRAM system was affirmed on internal review on 24 October 2002. On 28 October 2002 Mrs Martin sought review from the Tribunal

"I am making this application on the grounds that:

1. The said Computer Records Access Monitor (CRAM) Report of staff accesses and transactions applied to my personal data held by Centrelink forms part of my record as held by Centrelink as per Section 17 of the FIO Act.

2. I am seeking details of accesses to my data only and of no other person.

3. I have been freely granted access to similar information in the past by the former Department of Social Security and latterly Centrelink in the 1990's.

4. That Centrelink's claims of withholding the said document under Section 40, is false and unlawful and the support of the precedent of Meschino and Centrelink (2002) AATA 627 does not apply in this case given item 3) above.

5. That Centrelink is interfering with my right to verify the accuracy of my data held by them, the testing of their administrative process in making decisions concerning myself based on my data, given that they had breached IPP's 1, 7 and 8 of the Privacy Act in the mid 1990's in relation to the privacy of my data as held by them."

6. The matter was heard on 19 May 2003. Mrs Martin was represented by her husband, Mr Bernard Martin and Centrelink was represented by Mr David Perdon. Oral reasons for decision were given on that day affirming the decision under review. On 4 June 2003 the Tribunal received a request for written reasons for the decision from Mr Martin on his wife's behalf pursuant to s 43(2A) of the Administrative Appeals Tribunal Act 1975. Accordingly these written reasons have been prepared based on the reasons given at the hearing with appropriate minor editing.

LEGISLATION

7. The following provisions of the Act are relevant

"4 Interpretation

(1) In this Act, unless the contrary intention appears:

...

"document" includes:

(a) any of, or any part of any of, the following things:

(i) any paper or other material on which there is writing;

(ii) a map, plan, drawing or photograph;

(iii) any paper or other material on which there are marks, figures, symbols or perforations having a meaning for persons qualified to interpret them;

(iv) any article or material from which sounds, images or writings are capable of being reproduced with or without the aid of any other article or device;

(v) any article on which information has been stored or recorded, either mechanically or electronically;

(vi) any other record of information; or

(b) any copy, reproduction or duplicate of such a thing; or

(c) any part of such a copy, reproduction or duplicate;

but does not include:

(d) library material maintained for reference purposes; or

(e) Cabinet notebooks."

"11 Right of access

(1) Subject to this Act, every person has a legally enforceable right to obtain access in accordance with this Act to:

(a) a document of an agency, other than an exempt document; or

(b) an official document of a Minister, other than an exempt document.

(2) Subject to this Act, a person's right of access is not affected by:

(a) any reasons the person gives for seeking access; or

(b) the agency's or Minister's belief as to what are his or her reasons for seeking access."

"17 Requests involving use of computers etc.

(1) Where:

(a) a request (including a request of the kind described in subsection 24(1)) is made in accordance with the requirements of subsection 15(2) to an agency;

(b) it appears from the request that the desire of the applicant is for information that is not available in discrete form in written documents of the agency; and

(ba) it does not appear from the request that the applicant wishes to be provided with a computer tape or computer disk on which the information is recorded; and

(c) the agency could produce a written document containing the information in discrete form by:

(i) the use of a computer or other equipment that is ordinarily available to the agency for retrieving or collating stored information; or

(ii) the making of a transcript from a sound recording held in the agency;

the agency shall deal with the request as if it were a request for access to a written document so produced and containing that information and, for that purpose, this Act applies as if the agency had such a document in its possession.

(2) An agency is not required to comply with subsection (1) if compliance would substantially and unreasonably divert the resources of the agency from its other operations."

"22 Deletion of exempt matter or irrelevant material

(1) Where:

(a) an agency or Minister decides:

(i) not to grant a request for access to a document on the ground that it is an exempt document; or

(ii) that to grant a request for access to a document would disclose information that would reasonably be regarded as irrelevant to that request; and

(b) it is possible for the agency or Minister to make a copy of the document with such deletions that the copy:

(i) would not be an exempt document; and

(ii) would not disclose such information; and

(c) it is reasonably practicable for the agency or Minister, having regard to the nature and extent of the work involved in deciding on and making those deletions and the resources available for that work, to make such a copy;

the agency or Minister shall, unless it is apparent from the request or as a result of consultation by the agency or Minister with the applicant, that the applicant would not wish to have access to such a copy, make, and grant access to, such a copy.

..."

"40 Documents concerning certain operations of agencies

(1) Subject to subsection (2), a document is an exempt document if its disclosure under this Act would, or could reasonably be expected to:

(a) prejudice the effectiveness of procedures or methods for the conduct of tests, examinations or audits by an agency;

(b) prejudice the attainment of the objects of particular tests, examinations or audits conducted or to be conducted by an agency;

(c) have a substantial adverse effect on the management or assessment of personnel by the Commonwealth or by an agency;

(d) have a substantial adverse effect on the proper and efficient conduct of the operations of an agency; or

(e) have a substantial adverse effect on the conduct by or on behalf of the Commonwealth or an agency of industrial relations.

(2) This section does not apply to a document in respect of matter in the document the disclosure of which under this Act would, on balance, be in the public interest."

"55 Applications to Administrative Appeals Tribunal

(1) Subject to this section, an application may be made to the Administrative Appeals Tribunal for review of:

(a) a decision refusing to grant access to a document in accordance with a request; or

(aa) a decision granting access to a document but not granting, in accordance with a request, access to all documents to which the request relates; or

...

..."

"58 Powers of Tribunal

(1) Subject to this section, in proceedings under this Part, the Tribunal has power, in addition to any other power, to review any decision that has been made by an agency or Minister in respect of the request and to decide any matter in relation to the request that, under this Act, could have been or could be decided by an agency or Minister, and any decision of the Tribunal under this section has the same effect as a decision of the agency or Minister.

(2) Where, in proceedings under this Act, it is established that a document is an exempt document, the Tribunal does not have power to decide that access to the document, so far as it contains exempt matter, is to be granted.

..."

"61 Onus

(1) Subject to subsection (2), in proceedings under this Part, the agency or Minister to which or to whom the request was made has the onus of establishing that a decision given in respect of the request was justified or that the Tribunal should give a decision adverse to the applicant.

..."

EVIDENCE

8. The evidence before the Tribunal consisted of "T-documents" filed under section 37 of the Administrative Appeals Tribunal Act 1975 labelled T1 to T8, documents T1 and T2 from matter A2002/343 which was a previous application by Mrs Martin since withdrawn, the Applicant's document A1 and the Respondent's documents R1 to R4. Oral evidence was given by Mr Martin in the course of presenting his wife's case and by Ms Joan Savic, Assistant Manager, Privacy and Information Access Team at Centrelink.

ISSUES

9. As mentioned above, Centrelink refused Mrs Martin access to a CRAM report held electronically covering the period from February 1994 to the present. Centrelink relied on the provisions of section 40 to exempt this record from release under the Act. The issues, as I see them are

* would release of the CRAM report fall within any of the exemptions in section 40(1)

* if so, is there a countervailing public interest in disclosure of the matter in the CRAM report (section 40(2))

* if not, can deletions be made to the report such that it would no longer be an exempt document (section 22).

CONSIDERATION OF ISSUES AND FINDINGS

Onus of Proof

10. Section 61 of the Act makes it clear that the onus of establishing whether a decision on a document was justified or that the Tribunal should give a decision adverse to an applicant rests on the agency, in this case Centrelink.

Section 40

11. Section 40(1)(d) provides

" Subject to subsection (2), a document is an exempt document if its disclosure under this Act would, or could reasonably be expected to:

(d) have a substantial adverse effect on the proper and efficient conduct of the operations of an agency;"

12. This provision was carefully considered in July last year by Deputy President Forgie in Re Meschino and Centrelink [2002] AATA 627. I adopt her views on section 40(1)(d). Her consideration of the words "would or could reasonably be expected to" at paragraph 16 of her decision incorporated a passage from Attorney-General's Department v Cockroft (1986) 64 ALR 97 at 106 on the same phrase in another provision of the Act

"In our opinion, in the present context the words `could reasonably be expected to prejudice the supply of information' were intended to receive their ordinary meaning. That is to say, they require a judgment to be made by the decision-maker as to whether it is reasonable, as distinct from something that is irrational, absurd or ridiculous, to expect that those who would otherwise supply information of the prescribed kind to the Commonwealth or any agency would decline to do so if the document in question were disclosed under the Act."

Although these words refer to another provision in the Act they have been accepted as applying the test for the introductory words in section 40(1).

13. In considering the words "have a substantial adverse effect" Deputy President Forgie (at paragraph 17) reviewed a number of authorities and adopted the words in a previous decision of the Tribunal in Re Bayliss and Department of Health and Family Services (AAT 12277, 10 October 1997)

"What is required by the exemption in paragraph 40(1)(d)... is an adverse effect that is real or of substance and not that which is insubstantial or nominal."

14. Deputy President Forgie also considered (at paragraph 18) the words "proper and efficient conduct of the operations of the agency". She said that these words should be given their ordinary meaning. The ordinary meaning of "operation" is

"...4a An act of a practical or technical nature, esp. one forming a step in a process. ... b ...Also, a business concern or enterprise..." (New Shorter Oxford English Dictionary, 3^rd edition, 1993)

She also referred to the Tribunal's decision in Re James and Australian National University (1984) 2 AAR 327 where it said that the operations of an agency extend to the way in which an agency discharges or performs any of its functions.

Would release of the CRAM report fall within section 40(1)(d)?

15. Centrelink's Statement of Facts and Contentions (Exhibit R1) stated the following regarding it's computer system and the nature of the CRAM report. I did not understand this to be disputed

"The respondent's computer system is a mainframe-based application. A person's records are kept, amended or altered by staff completing details onto a screen or screens within that person's record and then "entering" that information. There are approximately 2,500 screens available in respect of each person's record and about 1,500 screens are frequently used. For example, there are personal detail screens such as address, marital status etc, qualification screens such as residency etc, income and assets screens, payment screens and many others. A staff member can only update a person's record if the delegation of their current position allows such. For instance, the writer can access a person's screens for appeal processes, but cannot alter/update that person's records. Each transaction is known as an "activity".. Current and archived activity lists are held within a person's record and the applicant has been given access to those histories (T4p8). Staff may also input online documents to a record, noting such things as decisions, contacts etc. The applicant has been given access to these(T4p8). ;

The respondent also has an audit mechanism known as a CRAM report. These do not exist on a person's individual record but can be interrogated from the system by a limited number of delegated officers. They show the date, time, name and logon ID of any officer accessing a person's record and the screens perused during a time period specified in the interrogation request. CRAM reports are mainly used for such purposes as audit and in the investigation of internal and external fraud."

16. Ms Savic gave written and oral evidence on the CRAM system and its functions that I found particularly helpful. In all critical respects her evidence was the same as that set out in paragraphs 8 to 14 of Re Meschino.. She adopted that summary of her evidence. In addition she made it clear that

* a CRAM report was not a mechanism for, nor would it assist in, verifying the accuracy of other documents released under freedom of information requests

* it would not assist in verifying documents in general

* the CRAM report was a record of access. It was simply an audit trail detailing access to customer records, including names, systems and screens and dates.

17. In her witness statement (Exhibit R2) Ms Savic said that

"4. Despite past instances involving the release of Customer Record Access Monitor (CRAM) reports, Centrelink policy is that those documents are exempt under the Freedom of Information Act 1982 and should not be released to customers. This is in part due to the audit function associated with the CRAM report and in part due to concerns over safety.

5. In relation to the audit function, since 17 February 1994 access to Centrelink computer records has been logged. The purpose of this log is to provide an audit base detailing access to customer records. The CRAM system provides a tool for interrogating the audit log. The CRAM report was created specifically for audit purposes, in order for the agency to fulfil its obligation in relation to privacy and confidentiality legislation. In particular, Information Privacy Principle 4 as contained in the Privacy Act 1988 requires the agency to ensure that personal information is kept secure and protected against unauthorised access, modification, use and/or disclosure. The identification of unauthorised access is necessary to detect and prevent fraudulent activity, either initiated by staff or undertaken with their complicity. Release of a CRAM report, which can identify extraordinary access of records by fraud or compliance investigators, might lead to a change in the behaviour of either the customer or the staff member to the extent that the investigation and the outcome is compromised."

18. Mrs Martin's concerns as expressed by her husband appear to relate to the accuracy of responses by Centrelink to FOI requests and in at least one case the accuracy of a previous Centrelink debt recovery determination involving her. In the Martins' view the CRAM report is the "most accurate resource to match up people's stories and recollections"

* it assists as a verification tool

* the activity statement is not always able to help in this respect

* CRAM reports would allow for verification of information supplied by Centrelink to clients in matters of dispute. It is therefore a cross-checking mechanism.

Mr Martin noted that up until 1998 CRAM reports had been provided under the Act.

19. However I note Ms Savic's evidence, which I accept, that access to the CRAM report would not assist persons in verification of information and documents provided to clients under the Act or otherwise. A CRAM report is simply a record of access providing an audit trail. In Re Meschino Deputy President Forgie said

"22. In order to ensure that employees are fulfilling their functions and that they are not, and Centrelink is not, in breach of any legislative or other duty, it is to be expected that Centrelink will have developed a system of checks and balances to monitor the use of the information it records. Such a system is essential for the proper and efficient conduct of its operations as it enables Centrelink to ensure that its information is protected from misuse and its pensions, benefits and allowances are not paid through fraud or misuse of its systems. On the basis of the evidence of Ms Savic, I am satisfied that one such system that that this has developed is the CRAM Report. It has been developed to monitor the use made of the information maintained on Centrelink's computers. Release of a CRAM report would show the footsteps in the computer file of the investigators as well as those of any other employ[ee] gaining access to that file.

23. Access to a document under the FOI Act must be considered not on the basis of the identity and qualities of the person who seeks that access but on the basis that it may be seen by anybody. As it is usually expressed, access under the FOI Act is access to the world at large. In that world, it is reasonable to expect, that there are those who would seek to subvert Centrelink in its proper functions. It is reasonable to expect that they may wish to gain, either for themselves or others, a pension, benefit or allowance to which they are not entitled under social security law or that they may wish to gain information that is held about a person on Centrelink's files for reasons unconnected with any function they may have under the social security law. It is also reasonable to expect that such people may be employed by Centrelink from time to time.

24. Whether employed by Centrelink or not, I am satisfied that it is reasonable to expect that, were they able to gain access to a CRAM report that showed the access made to a particular file, they would be able to glean whether the file had been the subject of scrutiny by investigators within Centrelink. On the basis of the evidence of Ms Savic, I am satisfied that this would enable them either to desist or to modify their behaviour either in relation to that file or generally. That would follow either from the knowledge that the file had been checked or from being able to identify the particular aspects checked by the investigation team and so enable them to modify their behaviour generically, as it were. The value of the CRAM Reports would be substantially compromised as a result of disclosure. That in turn would lead to a substantial adverse effect on Centrelink's proper and efficient monitoring of the manner in which functions are carried out and so on the proper and efficient conduct of its operations within the meaning of s. 40(1)(d) of the FOI Act."

20. The matter before me is on all fours with this recent decision of Deputy President Forgie. I agree with and adopt her reasons and conclude that release of a CRAM report would or could reasonably be expected to lead to a substantial adverse affect on the proper and efficient conduct of the operations of Centrelink within the meaning of section 40(1)(d) of the Act.

Is there a countervailing public interest?

21. The countervailing public interests to which Mr Martin pointed were

* enabling clients to check the accuracy of Centrelink's determinations

* enabling clients to verify documents and information provided under the Act or otherwise, and ensuring that such documents were complete

* assisting advocates in these verification procedures.

22. Again relying on and adapting the words of Deputy President Forgie in Re Meschino

"25. ...Even if he were able to gain that benefit [and I interpose that I doubt this would be the case on the evidence before me], I have reached the view that it would be outweighed by the public interest in ensuring that social security pensions, benefits and allowances are properly paid and that the personal information held about a vast number of Australians on Centrelink's computer bases are not misused. As I have said, access to the CRAM Report is not to be considered in the context of the use that Mr Meschino would like to make of it but in the context of what use could be made of it by the world at large. The world at large comprises the honourable and the dishonourable and, in the case of the CRAM report, I consider that its disclosure would not on balance be in the public interest. The detriment that its release could cause in frustrating a monitoring tool used by Centrelink to protect person's personal privacy as well as the public purse far outweighs any benefit the public may obtain [from the benefits that Mr Martin has alluded to].. There are other means of finding out these things. They arise through the internal mechanisms offered by Centrelink or through the Ombudsman [or through this Tribunal in other cases]."

Can deletions be made to render the CRAM report no longer exempt?

23. I will not quote again from section 22 but it relevantly covers this matter. Mr Martin suggested deletion of the names of Centrelink officers and replacement with a unique identifier would remove any industrial relations concern over the release of the names of Centrelink staff.

24. In its Statement of Facts and Contentions (Exhibit R1) Centrelink said

"In the alternative, it is contended that a CRAM report should be exempted under S40 of the Act, even if the name and logon IDs of the individual officers were removed... Access to a CRAM report is not to be considered in the context of the use the applicant would like to make of it, but in the context of what use could be made of it by the world at large. In respect of, for instance, an internal fraud investigation, persons could be alerted by the accessing of a screen or a pattern of usage to a review investigation. Also, in cases of external fraud, if that person had a contact within the respondent and either the person or the officer gets hold of a CRAM report, that could alert them."

25. I note first that Mr Martin's suggestion of removing the officers' names would not resolve the concern that Centrelink has about the adverse effects on the operations of the agency generally. On the evidence of Ms Savic I accept that the utility of the CRAM report would be compromised even with staff identifiers removed. Indeed, on the evidence before me release of any of the material in the CRAM report, whether it be the date, the user IDs, user names, systems or screens accessed, could prejudice its effectiveness and therefore could be expected to result in a substantial adverse effect on the proper and efficient conduct of the operations of Centrelink.

Conclusions

26. I am satisfied that

* release of the CRAM report under the Act would or could reasonably be expected to have a substantial adverse effect on the proper and efficient conduct of the operations of Centrelink for the purposes of section 40(1)(d) of the Act

* no head of public interest has been identified which would outweigh the public interest in protecting the CRAM report

* it is not possible to make such deletions as would render the CRAM report not an exempt document.

27. Having reached these conclusions in relation to the exemption under section 40(1)(d) it is unnecessary for me to consider whether any of the other heads of exemption under section 40(1) apply.

Centrelink's request for a confidentiality order

28. In the course of the hearing Mr Perdon indicated that if I were to find the CRAM report to be exempt Centrelink would seek a confidentiality order under section 35(2)(b) of the Administrative Appeals Tribunal Act 1975 regarding Exhibit A1, a single page from a CRAM report generated on 19 April 1996 that was provided to Mrs Martin in response to a freedom of information request around that date. He submitted that, applying the decision in Re Meschino and a like decision in the present matter, Exhibit A1 had been incorrectly released and that to allow its further distribution would thwart or subvert the Tribunal's decisions in both matters.

29. Section 35 relevantly provides

"35 Hearings to be in public except in special circumstances

...

(2) Where the Tribunal is satisfied that it is desirable to do so by reason of the confidential nature of any evidence or matter or for any other reason, the Tribunal may, by order:

...

(b) give directions prohibiting or restricting the publication of evidence given before the Tribunal, whether in public or in private, or of matters contained in documents lodged with the Tribunal or received in evidence by the Tribunal; and

...

(3) In considering:

...

(b) whether publication, or disclosure to some or all of the parties, of evidence given before the Tribunal, or of a matter contained in a document lodged with the Tribunal or received in evidence by the Tribunal, should be prohibited or restricted;

the Tribunal shall take as the basis of its consideration the principle that it is desirable that hearings of proceedings before the Tribunal should be held in public and that evidence given before the Tribunal and the contents of documents lodged with the Tribunal or received in evidence by the Tribunal should be made available to the public and to all the parties, but shall pay due regard to any reasons given to the Tribunal why the hearing should be held in private or why publication or disclosure of the evidence or the matter contained in the document should be prohibited or restricted."

30. Exhibit A1 is in a sense a different document from the CRAM report that would have been produced had I found in Mrs Martin's favour in the present matter. Some of the information on Exhibit A1 would not be reproduced, such as the date and time and the person who requested generation of the report.

31. Section 35 only allows the Tribunal to give directions prohibiting or restricting publication of evidence before the Tribunal or documents that are lodged with the Tribunal and received into evidence. Any section 35 order that I were to make would have no effect in relation to the rest of the CRAM report from which Exhibit A1 comes, nor would it affect any other CRAM reports already in Mrs Martin's possession.

32. The evidence before me is that Exhibit A1 was created over seven years ago. The document having been provided to Mrs Martin at that time under the Act, it has been freely available to anyone she may have chosen to give it to. In these circumstances I cannot see that I could be satisfied that Exhibit A1 should remain confidential under section 35. I therefore refuse Centrelink's request for a confidentiality order.

DECISION

33. The decision of the Tribunal is that Centrelink's internal review decision of 24 October 2002 is affirmed.

I certify that the 33 preceding paragraphs are a true copy of the reasons for the decision herein of Mr G A Mowbray

Signed:

..........(Trevor Mobbs)..............................................

Associate

Date of Hearing 19 May 2003

Date of Decision 19 May 2003

Date of Written Reasons 2 July 2003

Counsel for the Applicant Mr Bernard Martin

Counsel for the Respondent Mr David Perdon

Solicitor for the Respondent Service Recovery Team, Centrelink