When a customer asks to see their record

The requestHowever it arrives, it counts

APP 12 sets no formal requirements for a request. It need not be in writing, and the person need not say it is an APP 12 request. A business may offer a form, but it cannot require one, insist on a procedure or ask why the person wants the information.

Six questionsThe OAIC’s order of work

The OAIC’s step-by-step guide for businesses asks six questions, in this order.

1. Is it really them?

   The business must be satisfied the request comes from the person, or from someone authorised to ask for them, such as a legal guardian or authorised agent. It can ask for the evidence it reasonably needs, while leaving room for people who do not have a particular form of identification. The OAIC says it is preferable to sight identity documents rather than copy and keep them, and that personal information should not be disclosed if the business is not sure who it is dealing with.

2. What does the business hold?

   An entity “holds” personal information if it has possession or control of a record that contains it, and that extends to a record it has the right or power to deal with. The OAIC’s guide names the places to search: hard copy records and electronic databases, including emails and calendars. The search also reaches information whose storage has been outsourced to a third party, where the business still keeps the right to deal with it. A CRM is one of those places, not necessarily the only one.

   The right is to personal information, not to documents more broadly, and a document that also holds other information need not be handed over in full.

3. Is there a ground to refuse?

   APP 12.3 lists ten grounds. To the extent one applies, an organisation does not have to give access. The quoted words are the Act’s:

   • Safety. A reasonable belief: “giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety”.
   • Other people’s privacy. “Giving access would have an unreasonable impact on the privacy of other individuals”.
   • Frivolous requests. “The request for access is frivolous or vexatious”.
   • Legal proceedings. “The information relates to existing or anticipated legal proceedings between the entity and the individual, and would not be accessible by the process of discovery in those proceedings”.
   • Negotiations. “Giving access would reveal the intentions of the entity in relation to negotiations with the individual in such a way as to prejudice those negotiations”.
   • Unlawfulness. “Giving access would be unlawful”.
   • Law or court order. “Denying access is required or authorised by or under an Australian law or a court/tribunal order”.
   • Suspected wrongdoing. Reason to suspect unlawful activity or serious misconduct relating to the entity’s functions or activities, where “giving access would be likely to prejudice the taking of appropriate action in relation to the matter”.
   • Enforcement. “Giving access would be likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body”.
   • Commercial decisions. “Giving access would reveal evaluative information generated within the entity in connection with a commercially sensitive decision-making process”.

   The OAIC sets a high bar for the third ground: a request should not be refused as frivolous or vexatious without a clear and convincing basis, and causing inconvenience or irritation is not enough. An organisation can also choose not to rely on any ground and give access anyway, unless disclosure is prohibited.

4. Can access be given another way?

   Where access is refused on a ground, or refused in the form asked for, APP 12.5 requires reasonable steps (if any) “to give access in a way that meets the needs of the entity and the individual”, and access may be given “through the use of a mutually agreed intermediary”. The OAIC’s alternatives include a redacted version, a summary, and letting the person inspect hard copy records and take notes.

5. Can it be given the way they asked?

   Access must be given in the manner the person asks for, if that is reasonable and practicable. The OAIC’s examples are the phone, email, hard copy or an electronic record; a large amount of information read out over the phone may be impracticable.

6. Will there be a charge?

   An organisation may charge for giving access, but it does not have to. If it does, APP 12.8 says “the charge must not be excessive and must not apply to the making of the request”. Staff time, postage, materials and an intermediary’s cost can be charged for. Whether a charge is excessive depends on the organisation and the information. Among the charges the OAIC says may be considered excessive is “a charge that reflects shortcomings in your information management systems”.

RefusalWhen the answer is no

A refusal, on a ground or in the form asked for, needs a written notice. Under APP 12.9 it gives “the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so”; it must also describe “the mechanisms available to complain about the refusal”, plus any other matter the regulations prescribe. The OAIC adds that the complaint options described should cover internal and external routes and the steps to follow, and that the notice could suggest how a person might narrow or re-frame the request so it need not be refused.

If the person takes it further, the Information Commissioner will not generally investigate until they have first raised it with the business, unless that first step was not appropriate.