Ooi v NSW Ministry of Health

Issues

1. The issue in this review is whether government information, as requested by the applicant, is held by the respondent.

Legislation

1. The objects of the GIPA Act as set out in s 3 are to facilitate open government and to give "members of the public an enforceable right to access government information": GIPA Act, s 3(1)(a).
2. Section 4 of GIPA Act defines an access application as "an application for access to government information under Part 4 that is a valid access application under that Part".
3. Government information means "information contained in a record held by an agency", and record is defined in Sch 4(10) as: any document or other source of information compiled, recorded or stored in written form or by electronic process, or in any other manner or by any other means.
4. Where the GIPA Act refers to "government information" that is "held" by an agency, this "includes a reference to information contained in a record held by the agency": GIPA Act Sch 4, cl 12(1)(a).
5. Section 9 GIPA Act provides a proviso to the right for access to information in that it is legally enforceable "unless there is an overriding public interest against disclosure of the information".
6. Section 53 of the GIPA Act imposes an obligation on an agency to undertake "such reasonable searches as may be necessary to find" the requested information: s 53(2). The obligation extends to searches using "any resources reasonably available to the agency including resources that facilitate the retrieval of information stored electronically": s 53(3). The obligation to search does not extend to searches that would require a "substantial and unreasonable diversion of the agency's resources".
7. As was stated by the Appeal Panel in Wojciechowska v Commissioner of Police [2020] NSWCATAP 173 ("Wojciechowska") at [43] whether an agency has complied with the obligation imposed by s 53 of the GIPA Act is plainly a relevant factor in determining whether a decision that "information is not held" is the "correct and preferable decision".
8. How an agency may decide an application for access to government information is governed by GIPA Act, s 58 which provides: 58 How applications are decided (1) An agency decides an access application for government information by - (a) deciding to provide access to the information, or (b) deciding that the information is not held by the agency, or (c) deciding that the information is already available to the applicant (see section 59), or (d) deciding to refuse to provide access to the information because there is an overriding public interest against disclosure of the information, or (e) deciding to refuse to deal with the application (see section 60), or (f) deciding to refuse to confirm or deny that information is held by the agency because there is an overriding public interest against disclosure of information confirming or denying that fact. Note - These decisions are reviewable under Part 5. (2) More than one decision can be made in respect of a particular access application, so as to deal with the various items of information applied for. (3) If an agency finds that information or additional information is held by the agency after deciding an access application, the agency can make a further decision that replaces or supplements the original decision, but cannot be required to make a further decision in such a case. The further decision can be made even if the period within which the application is required to be decided has expired.
9. There is a discretion under GIPA Act, s 75 to provide access to information by creating a new record: 75 Providing access by creating new record (1) An agency is not prevented from providing access in response to an access application to government information held by the agency by making and providing access to a new record of that information. (2) An agency's obligation to provide access to government information in response to an access application does not require the agency to do any of the following - (a) make a new record of information held by the agency, (b) update or verify information held by the agency, (c) create new information, or produce a new record of information, by deduction, inference or calculation from information held by the agency or by any other use or application of information held by the agency.

Jurisdiction

1. The decision under review (being one that information is not held by the agency) is a reviewable decision by the Tribunal in accordance with GIPA Act, s 80(e) and enlivened by s 100 of the GIPA Act (see also s 30(1) and (3) of the Civil and Administrative Tribunal Act 2013 (NSW) and ss 7, 9, 65 of the Administrative Decisions Review Act 1997 (NSW) ("ADR Act").
2. The Tribunal's function on a review under s 63 of the ADR Act is to make the correct and preferable decision having regard to the material before it, and any written or unwritten law as though it were the administrator: Commissioner of Police v Danis [2017] NSWCATAP 7 at [31].
3. The respondent in these proceedings has the onus of establishing that the decision under review is justified: GIPA Act, s 105(1).
4. In Wojciechowska at [44] the Appeal Panel summarised the Tribunal's task in reviewing a decision of an agency that it does not hold the information sought as follows: 1. identify on the basis of the agency's reasons and the applicant's submissions, any relevant factual issues including those derived from s 53; 2. determine whether the agency has proved any relevant factual issues on the balance of probabilities; 3. consider any evidence which may have emerged since the agency made its decision, which might tend to prove that the requested information is held by the agency; 4. applying those findings, decide what the correct or preferable decision is; 5. affirm, set aside or vary the agency's decision: s 63(3) of the ADR Act.

Materials relied on

1. The material that was before the Tribunal and upon which this decision is based is that provided by the parties.
2. The applicant relied on: 1. Written submissions dated 25 November 2022; 2. Oral submissions during the hearing.
3. The respondent relied on the following: 1. Submissions dated 25 October 2022; and 2. Statement of Dr Christine Selvey dated 21 October 2022.
4. The Information Commissioner also filed written submissions dated 8 December 2022 and made oral submissions at the hearing: GIPA Act, s 104(1).

Dr Selvey's evidence

1. Dr Selvey was the only witness in the proceeding. She was cross-examined by the applicant. I accepted her evidence.
2. Dr Selvey is the Director of the COVID Influenza Branch which falls within the Health Protection Branch of the respondent. Dr Selvey's role includes being responsible for the acquisition of data related to COVID-19 and influenza and the analysis and reporting of the data. She also provides advice on the public health management of infections in the community.
3. Health Protection is responsible for the surveillance and public health responses in NSW including monitoring the incidence of notifiable infectious diseases and taking appropriate action to control the spread of diseases. The COVID Influenza Branch is particularly concerned with addressing threats to health arising from COVID-19 and influenza.
4. The COVID Influenza Branch was created as part of a restructure of the Ministry of Health in March 2022. Prior to this, the Public Health Response Branch ("PHRB") had responsibility for the public health response to the COVID-19 pandemic.
5. During the period for which information has been requested (January 2022 to February 2022) PHRB was responsible for the public health response to COVID-19 including surveillance, case and outbreak management and contact tracing functions as well as the development of evidence-based policy to protect the community. Dr Selvey was the Senior Medical Advisor throughout the period.
6. The PHRB started producing the COVID-19 Weekly Surveillance in NSW reports in May 2020 publishing a public report on a weekly basis since that time ("Weekly Reports"). Vaccinations commenced on 22 February 2021 and from April 2021 the Weekly Reports included data regarding vaccinations. Initially the Weekly Reports contained data as to the number of overseas and locally acquired cases, and self-reported vaccination doses received. As vaccinations increased in the community, the reporting shifted to vaccination rates and coverage within New South Wales and the vaccination status of hospitalised COVID-19 patients.
7. The information in Table 5 of the report contains information as to the number of hospitalisations, ICU admissions and deaths among cases diagnosed with COVID-19 by vaccination status in the period. It represents statistics as a percentage of the total cases for the period and by reference to the number of vaccine doses received (including where that information is unknown).
8. The information in Table 6 of the report contains the proportion of cases with a severe outcome (ICU and/or death) amongst all cases by age and vaccination doses (excluding those with unknown vaccination status).
9. As set out by the respondent in submissions, Dr Selvey's evidence indicated that the information in Tables 5 and 6 was produced on a weekly basis by extracting and linking data from three separate sources: 1. Notifiable Condition Information Management System ("NCIMS") - a database that is used for disease surveillance across New South Wales and which holds notifications for COVID-19. The PHRB extracted information regarding all positive COVID tests notified in each period. 2. Australian Immunisation Register ("AIR"), a Commonwealth database that contains information regarding vaccination status. The respondent was granted access to the data for a strictly prescribed purpose. 3. The Patient Flow Portal - a database maintained by the System Performance Support Branch of the respondent, which contains information about all patients being treated in hospitals within the NSW health system. It is a live source of information which is updated throughout each day. The PHRB received a "daily snapshot" from the portal related only to patients with a confirmed COVID-19 test result. This provides a static record of patient-level data from the portal as at that particular time on that day. Data from the patient portal is then collated into the Enterprise Data Warehouse for Analysis and Report ("EDWARD"). The data in EDWARD is linked with that from the NCIMS and AIR for the purposes of creating the Weekly Report.
10. As Dr Selvey explained, the process of extracting data from each of the sources and linking the data sets was an extremely complex process and took several hours. Once the data was extracted, an analyst ran the code to create the tables with the outputs which were then reviewed by the epidemiologist. This process took a further several hours.
11. In order to undertake the analysis required to produce the tables, the respondent uses "R" which is a statistical programming language. A temporary database (data-frame) is created which is held within the machine RAM and only exists for the duration of the R session. No intermediary tables are created and only the required outputs are produced, following which the session ends and the data-frame is erased.
12. Given the time taken to produce the tables, if there were any issues with the information in the tables, the epidemiologist would make changes direct to the tables rather than undertake a re-extraction exercise.
13. Dr Selvey accepted that while she understands the data sets, where they come from, their validity and what needs to be done to link those data sets to produce the final tables that were produced, the respondent has data analysts who write the programs to perform that function. She did however have input into the design of the tables and the surrounding information as well as general oversight and involvement in the generation of the Weekly Reports. In preparing her statement, Dr Selvey consulted with the senior analyst and epidemiologist about the processes involving in linking the data sets and the way the programming is done. She confirmed that the only record resulting from the analysis in R was the final versions of Tables 5 and 6 that are published in the Weekly Reports.
14. It was also explained by Dr Selvey that the respondent did not maintain intermediate records generated in the process of producing Tables 5 and 6 for the following reasons: 1. The purpose of the analysis was to produce a snapshot at a particular point in time reflected in the published tables. It was unnecessary to retain copies. Further, if additional analysis was required later, more up-to-date information from NCIMS, EDWARDS and the AIR could be extracted at that point; 2. Access to data from AIR is only permitted for very limited purposes and is not to be retained other than for the prescribed purpose; 3. Linked patient information is extremely sensitive and the retention of those records would give rise to privacy concerns.
15. Dr Selvey explained that there was a very strict regulatory framework regulating the handling of and provision of access to patient level data collected and held by the respondent. It can only be provided in accordance with the Health Records and Information Privacy Act 2002 (NSW), the Health Administration Act 1982 (NSW), and the NSW Health Policy Directive PD2012_012 "Data Collections - Disclosure of unit record data held for research or management of health issues" (a copy of which was provided to the Tribunal).
16. According to Dr Selvey, following receipt of the applicant's GIPA application, searches were undertaken by the Response Team within PHRB in consultation with the epidemiology team. No responsive records were identified. She also stated that it was not part of PHRB's standard reporting function to generate or produce records in the nature of what was sought by the applicant.
17. The applicant's cross-examination of Dr Selvey was directed to demonstrating that there is no evidence before the Tribunal from anyone who directly worked on the data and created the relevant tables and that Dr Selvey was not directly involved. She contended that the respondent's arguments as to why intermediate records made in the process of generating the tables were not kept are unconvincing and that the process of multiple people working on the data over a period of time makes it more likely that intermediate records would have been saved during this time.
18. It is noted that the applicant further contends that the respondent's privacy concerns are unwarranted as a record de-identifying the data could easily be made with a minimum of data analyst skill and experience as well as time. She explained that she has experience herself and on this basis was of the view that it could be done. The applicant had no evidence from any expert on this subject and, in my view, it was speculative in nature. It is noted that in oral submissions the applicant clarified that she is not in fact asking for a new record but just the existing record be de-identified.

Information Commissioner's submissions

1. The Information Commissioner made comprehensive submissions addressing issues concerning the interpretation of s 75 GIPA Act and indicated that a significant issue in the case was whether the respondent generated or produced records in its actions in extracting data including from AIR. The Commissioner relied on Nicholson v Sydney Children's Hospital Network [2021] NSWCATAD 87 to ultimately submit: "[128] In conclusion, the Commissioner highlights that complex, multidimensional or dynamic data sets are a modern feature of government information and digital record-keeping. [129] The statutory term for identifying 'government information' in s. 4 is not construed narrowly but is to be 'given a wide meaning'. [130] The Information Commissioner is concerned that a narrower construction of 'government information' may make it difficult for citizens to seek information that is meaningful, particularly as technology advances and government information is increasingly digitised and stored as data."

Consideration

1. The starting point for this application for review is the actual terms of the applicant's GIPA access request (as set out at [2] above) for patient-level data underlying Tables 5 and 6. As explained by Dr Selvey, this is data was extracted and compiled from three databases (including AIR which is a Commonwealth agency) to produce Tables 5 and 6, but which has not been retained.
2. In Redfern Legal Centre v Commissioner of Police [2021] NSWCATAD 288 ("Redfem") and in Evans v Chief Commissioner of State Revenue [2022] NSWCATAD 307 ("Evans"), the Tribunal found that "government information" is limited to information contained in records that exist at the time that an application is made.
3. The application for information in Redfern was for statistical information that could be generated but did not exist as its own record. The Tribunal set out its reasoning at [40]-[50] having regard to principles of statutory construction. The Tribunal stated at [51] that "government information" is limited to what was available at the time and that: "[53] The evidence establishes that at the time of the access application, the NSWPF did not have a record which contained the information sought by the applicant, although it was possible to bring such a record into existence, by the creation and application of a bespoke computer program. [54] It follows that the information sought by item 3 is not 'government information'."
4. Evans concerned a GIPA application for access to a particular format of a spreadsheet populated with information from an unclaimed money database maintained by Revenue NSW. It was found that Revenue NSW did not hold the information in the format sought nor did it generate reports in the format requested. The Tribunal said at [68]: "While on the evidence it is possible to create a new record, the decision to do so is a discretionary decision and there is no requirement for the Chief Commissioner to create a new record. I am also satisfied on the evidence that to create a new record would require a substantial and unreasonable diversion of resources."
5. Those cases are slightly different to the present where data (being personal and sensitive health information at a particular point-in-time) was extracted from several sources (including a restricted Commonwealth immunisation database), compiled and analysed to produce statistical tables, but the point-in-time compilation of data has not been retained or stored.
6. Contrary to the applicant's submissions, I had no reason to disbelieve Dr Selvey's evidence and I found her to be a truthful witness. On the basis of Dr Selvey's evidence, I find that the patient-level data (including highly personal and sensitive health information) extracted from three separate sources was compiled and a temporary data-frame was created which was held within the machine RAM of the respondent, but it only existed for the duration of the R session. Critically, the patient-level data was not retained or stored (in any form) once Table 5 and 6 were produced.
7. Consequently, I am satisfied on the balance of probabilities that the respondent did not retain the patient-level data underlying Tables 5 and 6 and so does not hold the information sought by the applicant. I also find that intermediary records of the data were not kept (in any form) and consequently are also not held by the respondent.
8. In reaching this conclusion, I am satisfied on the evidence before me, and I find, that reasonable searches were undertaken by the respondent in response to the applicant's GIPA application.
9. I note the Information Commissioner's concerns such as: 1. whether a narrow construction of the expression "government information" in the GIPA Act is appropriate in the modern context of data, data sets, algorithms, or test suites; and 2. that the increasingly complex way information is stored in digital forms should not limit an expansive view of the expression "government information".
10. However, in this case, given the findings made in [51]-[52] above (particularly that the patient-level data was not retained or stored in any form), those questions do not seem to arise. In any event, I see no reason to interpret "government information" in more broadly than was applied in Redfern. The principles of statutory construction which were applied in Redfern (at [41]-[51]) apply here.

Section 75 discretion

1. For completeness, I note that the respondent submitted that it is not required to create a new record to meet the applicant's request for information although it might theoretically be able to create a new record that contains the information requested. To do so would require an exercise of re-extraction of the data (including data held by AIR who is not the respondent), a complex compilation and analysis of the data, interpretation and the creation of a new record. Further, there is uncertainty about whether precisely the same information could be extracted again when the linked data that was used to produce Tables 5 and 6 was point-in-time.
2. While I accept the respondent's submission that it is not required under s 75 GIPA Act to create new information or produce a new record in order to respond to a request for government information, in my view, issues about the discretion in s 75 GIPA Act to create a new record do not arise in this case. This is for the reason that I have already found that the respondent does not hold the information sought by the applicant. This finding is central to the disposition of this case.
3. As submitted by the Information Commissioner, while s 75 may have application in a review where the Tribunal's function under s 63 of the ADR Act is to make the "correct and preferable decision", it does not operate to give assistance to the addressing the question of whether government information is held. It is only in circumstances where access is to be given to information held that the discretionary consideration in s 75 arise. The Appeal Panel in Commissioner of Police v DYD [2022] NSWCATAP 224 stated: "The question of how access to government information is to be provided under Part 4 Division 6 of the GIPA Act does not arise until the agency has made a decision under s58(1)(a) to give access to that information. Before making such a decision the information must meet the definition of 'government information' in s 4, that is, information 'contained in a record' as defined in cl 10 of Sch 4. Section 75(2) does not provide a 'general administrative reason' for refusing to provide access to information."
4. For the reasons set out above, in my view the correct and preferable decision is to affirm the decision of the respondent.

Order

1. The order of the Tribunal is: 1. The decision under review is affirmed.

I hereby certify that this is a true and accurate record of the reasons for decision of the Civil and Administrative Tribunal of New South Wales. Registrar

Amendments 09 May 2023 - Par 24 - format revised Par 50 - incomplete - text added DISCLAIMER - Every effort has been made to comply with suppression orders or statutory provisions prohibiting publication that may apply to this judgment or decision. The onus remains on any person using material in the judgment or decision to ensure that the intended use of that material does not breach any such order or provision. Further enquiries may be directed to the Registry of the Court or Tribunal in which it was generated. Decision last updated: 09 May 2023