1. The applicant applied[1] to the Department of Justice (the Department) under the Information Privacy Act 2009 (Qld) (IP Act)[2] for:

All documents in relation to any and all falsified complaints or allegations made against [applicant's name] while trying to cover up the crimes of the [name removed for privacy] family.

These false complaints will be from [names removed for privacy] ... as well as others.

Timeframe: 1 September 2022 - current.

1. The Department decided[3] the access application was noncompliant with the requirements of the IP Act, both in relation to the sufficiency of information provided which would enable the agency to identify the document/s, and with respect to the evidence of identity for the applicant.

1. The applicant applied[4] to the Office of the Information Commissioner (OIC) for external review of the Department's decision.

1. During the external review, the applicant submitted a revised scope for their access application, which the Department confirmed would meet the requirement to provide sufficient information for it to process a fresh application. Formal determination is therefore, only required in relation to the evidence of identity requirement.

1. For the reasons set out below, I set aside the Department's decision and substitute it[5] for the decision that the access application complied with the requirement to provide evidence of identity.

1. In making this decision, I have had regard to the Human Rights Act 2019 (Qld) (HR Act) particularly the right to seek, receive and impart information.[6] I consider a decision maker will be 'respecting and acting compatibly with' that right and others prescribed in the HR Act when applying the law prescribed in the IP Act.[7] I have acted in this way in making this decision, in accordance with section 58(1) of the HR Act.

1. Before making its decision, the Department wrote to the applicant[8] informing them that their application was noncompliant with relevant requirements of the IP Act. With respect to the scope of the application, the Department advised the applicant that the documents sought were not able to be determined without the decision maker, first undertaking analysis or a 'value judgement' to identify whether documents were 'falsified and therefore within scope of the application.

1. The Department outlined the steps the applicant needed to make the application valid. This included to provide a certified copy of one of the forms of identification listed in the letter and to clarify the scope of the application by providing more specific information, such as specific documents sought, the subject matter of the documents and where they may be held.

1. The Department's letter advised the applicant that 'Right to Information and Privacy accept electronic copies of documents (excluding those containing credit card details) by email...'[9]

1. The applicant responded[10] to advise in their view, they had been 'very clear' in their request.

1. The applicant attached a document containing a copy of the identification page of their passport, certified by a Justice of the Peace, as well as a copy of the front of their debit/credit card.[11]

1. The Department wrote to the applicant[12] to advise that their application remained noncompliant because they had included credit card information, and 'we were unable to consider the contents of that email'. The Department acknowledged receipt of the revised scope, however, advised that as the Department is a large organisation, the current scope would require a search of all business areas, whether or not they have had dealings with the applicant. The Department requested sufficient information to enable it to identify the documents sought.

1. The Department clarified,[13] upon request from the applicant, that it had received and deleted the email containing his identification and credit card information in line with its previous advice that the Department could not action that information. The Department reiterated its request for certified identification without credit card details, and sufficient information to identify the documents sought, by a specific date.

1. The Department advised the applicant[14] that as it had not received the requested items, the application was noncompliant with the relevant application requirements and was now closed.

1. Following receipt of the applicant's external review application, a delegate of the Information Commissioner[15] wrote to the applicant providing a preliminary view that the access application did not satisfy the application requirement concerning sufficiency,[16] advising:[17]

As the Department advised you in its letter dated 15 May 2025, your access application requires Departmental officers to make, in the Department's words, 'value judgments' as to the documents sought. Your email in reply dated 15 May 2025 in my preliminary view, insufficiently clarifies the terms of the application. The words 'I have been very clear with my request' seem to reaffirm the terms of the application in its original form, while the reference to 'false accusations of crime' would appear to continue to require value judgments or some level of subjective appraisal by Departmental officers.

1. While the applicant did not accept that view, they did provide a reframed scope which identified a timeframe, named four relevant business units within the Department, narrowed the types of documents sought and where they might be located, identified exclusions and provided keywords to enable the Department's searches. They requested OIC set aside the Department's decision and remit it to the Department with a direction to conduct searches based on the new scope.[18]

1. In an attempt to informally resolve this aspect of the external review,[19] OIC asked the Department whether the applicant's reframed scope would be sufficient for it to identify the documents sought, that is, whether it would be compliant with this application requirement.

1. The Department advised OIC that it considered the applicant's revised scope had been sufficiently narrowed as to allow searches to be conducted within the Department's relevant business units. The Department confirmed that should the applicant lodge a new application with the revised scope and with 'appropriate evidence of identity', the Department would commence processing this.[20]

1. However, the applicant did not accept that a new application to the Department was 'appropriate or legally required'. [21] They instead requested the matter proceed to a formal decision under the IP Act.

1. In addition to a revised access scope, the applicant provided OIC with a copy of their certified identification, without the credit card information.[22] However, as noted above, they were unwilling to make a new access application to the Department. Given the original access application was made prior to 1 July 2025, I was unable to consider remitting it to the Department to continue processing.[23]

1. The reviewable decision is the Department's decision of 10 June 2025.

1. Evidence, submissions, legislation and other material considered in reaching this decision are referred to in these reasons (including footnotes).

1. The residual issue for determination is whether the Department was entitled to refuse to deal with the access application on the basis that it did not comply with the requirement to provide evidence of identity.

1. Section 43 of the IP Act states that an individual may apply to an agency for access to a document of the agency, to the extent it contains the individual's personal information and specifies the requirements for a valid access application. These requirements include that 'the applicant must provide with the application or within 10 business days after making the application ... evidence of identity for the applicant'. [24]

1. Evidence of identity means the evidence of identity prescribed under the regulation,[25] which is 'a document verifying the person's identity, including, for example - (a) a passport[26]... and 'if a document under this section... is a photocopy of an original document, the document must be certified by a qualified witness as being a correct copy of the original document'.[27]

1. The applicant provided their certified identification electronically to the Department. Section 16 of the Electronic Transactions (Queensland) Act 2001 (Qld) (the ET Act) provides that if, under a State law, a person is required to produce a document that is in the form of paper, an article or other material, the requirement is taken to have been met if the person produces, by electronic communication, an electronic form of the document in the following circumstances:

• having regard to all the relevant circumstances when the communication was sent, the method of generating the electronic form of the document provided a reliable way of maintaining the integrity of the information contained in the document
• when the communication was sent, it was reasonable to expect the information contained in the electronic form of the document would be readily accessible so as to be useable for subsequent reference; and
• the person to whom the document is required to be produced consents to the production, by an electronic communication, of an electronic form of the document.

1. In reaching its decision that the application did not meet the application requirement concerning evidence of identity, the Department advised OIC[28] it relied on:

• OIC Guidelines concerning Evidence of Identity and Authority (the OIC Guideline)[29]
• The Department's Financial Policy and Procedure concerning the security of customer credit card data
• The Department's Internal Procedure, Protection of Credit Card Holder Information; and
• The Department's Financial Management Practice Manual (FMPM) at Section 12, which outlines that in general, to protect credit card holder information, no electronic credit card numbers should be transmitted or stored in any departmental system.

1. The Department made further submissions[30] which principally relied on:

• its advice to the applicant about how to make their application compliant with the requirements of the legislation (both for identity and scope)
• the OIC Guideline, which references the ET Act; and
• the Department's FMPM.

OIC Guideline and the Electronic Transactions (Queensland) Act

1. The Department noted that the OIC Guideline, in referencing the ET Act, states that:

Apart from PDFs created using the approved app, the RTI Act does not specify how copies of evidence of identity documents are to be given to an agency. If the agency allows, they can be provided electronically, such as by email or fax...

It is up to each agency to decide whether it is appropriate to accept identity documents electronically, taking into account any general restrictions about receipt of sensitive personal information documents. However, allowing these documents to be provided electronically can help simplify the application process.

1. The Department added that in this case the applicant was advised that an electronic copy of his identification would not be accepted while it was accompanied by a copy of his bank card with card details included. Further, the applicant was advised that the Department would accept his identification electronically, if it was supplied without bank card details.

The Department's Financial Management Practice Manual

1. The Department submitted that by destroying the applicant's emails containing their credit card information (and taking no action in relation to the emails' contents) it was acting in accordance with the Department's FMPM,[31] which states (in part):

In circumstances where customers have emailed their cardholder details (deemed to be incidental contact), business units are required to send a response email or message advising the customer that card transactions are not accepted through these channels (making sure they do not send back the card data), and direct the customer to an accepted payment channel. Business areas are to permanently delete the original email or other EUMT message (my emphasis).

1. It is not in dispute that the applicant emailed a certified copy of the identity page of their passport to the Department, during the processing period for their access application.

1. Further, it is not in dispute that prior to its decision, the Department contacted the applicant to inform them how it considered the application did not comply with relevant application requirements and provided the applicant with a reasonable opportunity to make an application which complied with those requirements.[32]

1. The issue for determination is whether the Department was entitled to refuse to deal with the access application on the basis that it did not comply with the application requirement to provide evidence of identity.[33]

1. The Department's submission implies that in the circumstances, that is, where the applicant's evidence of identity document also contained their bank card details, it did not provide consent for the applicant to provide their evidence of identity electronically.

1. However, while section 16 of the ET Act refers to 'the person' to whom the document is to be provided, reference to a person within an Act, generally includes a reference to a corporation.[34]

1. Given an access application is made to the agency (or Minister) under the IP Act,[35] it is the agency, as opposed to delegated decision makers within the agency, who provide consent to the production of an electronic form of the document under the ET Act.[36]

1. In the present case, the Department has decided it is appropriate to accept identity documents electronically, as published in its online policy, 'How to make an RTI application'.[37] This policy states that certified identity documents can be emailed, posted or delivered/sighted in person. No exceptions or conditions to electronic transmission are cited.

1. I note the OIC Guideline, relied on by the Department, is consistent with this as it states that, 'if the agency allows...' identification documents can be provided electronically, and 'it is up to each agency to decide whether it is appropriate to accept identity documents electronically...' (my emphasis).

1. While there are previous decisions of the Information Commissioner which refer to decision makers having the discretion to accept (or not accept) evidence of identity electronically, I have considered these decisions and am satisfied they are not determinative of this issue. In Y63 and Department of Health,[38] the applicant failed to submit evidence of their identity, in any form with the access application. In Mathews and Attorney-General and Minister for Justice,[39] the issue was largely theoretical as the Department agreed to accept electronic submission of the applicant's certified identity to informally resolve the application.

1. I have also had regard to the recent matter, Department of Education v Poyton[40] (Poyton), where the Queensland Civil and Administrative Tribunal considered section 16 of the ET Act, and found that due to the Department of Education's lack of consent to receiving evidence of identity electronically, the electronic document submitted by the applicant rendered their application noncompliant.[41] In that case, the Department of Education had published a policy that it would only accept original copies of certified identity by post and in the circumstances, was following that policy.

1. In the OIC's external review of Poyton, the Right to Information Commissioner found that it was appropriate and reasonable for the Department of Education to have enacted a policy requiring production of the actual certified copy of evidence of identity and to have applied that policy in the circumstances of this case. She said, 'for the sake of clarity, I do not imply that all agencies must adopt this policy. I merely observe that it is reasonable for the Department to have done so'.[42]

1. The clear contrast between Poyton and the current matter is that the Department has published a policy confirming its consent to accept evidence of identity documents electronically.

1. I anticipate the Department requires delegated decision makers to follow its policy concerning the receipt of certified identity documents and subsequently decide whether the evidence of identity received meets the requirements under the IP Act.

1. Departmental officers are of course, also required to follow their FMPM. However, the fact that the document supplied by the applicant by email also contained a copy of their bank card information, which the Department is required to delete to comply with its FMPM, is irrelevant to the determination of whether the applicant met the relevant application requirement. It is a secondary, administrative issue for the Department to manage.

1. The inclusion of the bank card information does not render the application noncompliant with the IP Act, nor provide the delegated decision maker a basis on which to withdraw the Department's consent to receive the document electronically.

1. The applicant provided evidence of their certified identity which met the requirement of the IP Act. Therefore, I find the applicant complied with the application requirement under the IP Act to provide evidence of identity.

1. For the reasons set out above, I set aside the reviewable decision and substitute it[43] for the decision that the applicant's access application was compliant with the access application requirement set out in section 43(3)(a) of the IP Act.

1. I have made this decision under section 123 of the IP Act as a delegate of the Information Commissioner, under section 139 of the IP Act_._

1. My decision considers only the issue of the validity of the applicant's evidence of identity. The second issue upon which the Department refused the application was the sufficiency of information provided by the applicant. As stated above, during efforts to resolve this matter informally, OIC obtained the agreement of the applicant to narrow the scope of their request. However, the Department required a fresh access application to continue processing it and the applicant did not agree to this. Therefore, the effect of my decision only concerns the evidence of identity issue and does not constitute a decision that the Department should process the proposed amended application. Accordingly, should the applicant wish to progress their application, they are encouraged to engage with the Department via a new application.

[2] On 1 July 2025 key parts of the Information Privacy and Other Legislation Act 2023 (Qld) (IPOLA Act) came into force, effecting changes to the IP Act and Right to Information Act 2009 (Qld) (RTI Act). As the applicant's application was made before this change, the IP Act and RTI Act as in force prior to 1 July 2025 remain applicable to it. This is in accordance with transitional provisions in chapter 8, part 3 of the IP Act and chapter 7, part 9 of the RTI Act, which require that applications on foot before 1 July 2025 are to be dealt with as if the IPOLA Act had not been enacted. Accordingly, references to the IP Act and RTI Act in this decision are to those Acts as in force prior to 1 July 2025. These may be accessed at https://www.legislation.qld.gov.au/view/html/inforce/2024-12-31/act-2009-014 and https://www.legislation.qld.gov.au/view/html/inforce/2024-12-31/act-2009-013 respectively.

[5] Under section 123(1)(c) of the IP Act.

[7] XYZ v Victoria Police (General) [2010] VCAT 255 (16 March 2010) at [573]; Horrocks v Department of Justice (General) [2012] VCAT 241 (2 March 2012) at [111].

[8] Letter dated 15 May 2025, in accordance with the requirement under section 53(2) of the IP Act.**

[11] While this document was not retained by the Department, a copy was received by the OIC as an attachment to the external review application dated 11 June 2025.

[14] Letter dated 10 June 2025, in accordance with section 53(6) of the IP Act.

[16] Under section 43(2)(b) of the IP Act.

[19] Email dated 14 November 2025, as required under section 103(1) of the IP Act.

[23] The power to direct an agency to decide whether access to be given under section 110A of the RTI Act commenced on 1 July 2025 in relation to applications made after this date.

[24] Under section 43(3)(a) of the IP Act.

[25] Under section 43(4) of the IP Act.**

[26] Under section 3(1) of the Information Privacy Regulation 2009 (Qld).

**[27] Under section 3(2) of the Information Privacy Regulation 2009 (Qld).

[29] Office of the Information Commissioner. (n.d.) Evidence of identity and authority. Guidelines for Government - Access and amendment. Retrieved 21 July 2025 from Evidence of identity and authority | Office of the Information Commissioner Queensland

[31] Established under section 12 of the Financial and Performance Standard 2019 and section 57 of the Financial Accountability Act 2009 (Qld).

[32] In compliance with section 53 of the IP Act.

[33] Under section 43(3)(a) of the IP Act.

[34] Under section 32D of the Acts Interpretation Act 1954 (Qld).

[36] Under section 16(2)(c) of the ET Act.

[37] Department of Justice (n.d.) How to make an RTI Application. Right to Information and privacy. Retrieved 5 December 2025 from How to make an RTI application | Department of Justice.

[38] Y63 and Department of Health [2022] QICmr 3 (21 January 2022) at [26].

[39] Mathews and Attorney General and Minister for Justice (Unreported, Queensland Information Commissioner, 20 May 2013) at [20].

[40] Department of Education v Poyton [2024] QCATA 78.

[42] Poyton and Department of Education [2023] QICmr 13 (16 March 2023) at [47].**

[43] Under section 123(1)(c) of the IP Act.