Australian Information Commissioner Act 2010

The AIC Act directly affects four main groups.

1. Commonwealth agencies and Ministers. Every agency (defined by reference to the FOI Act s 4) must comply with the information publication scheme (FOI Act Part II), respond to FOI requests, and supply statistics for the Information Commissioner’s annual report (AIC Act s 31). Agencies are subject to monitoring, investigation and compliance reporting by the Commissioners (ss 8(g), 8(i)). They must also observe Privacy Act Australian Privacy Principles and, where relevant, CDR data standards and accreditation rules.

2. Individuals and organisations seeking access or complaining. Any person may apply for FOI review by the Information Commissioner (FOI Act Part VII) or lodge a privacy complaint under Privacy Act s 36. CDR consumers can direct data holders to share information with accredited data recipients; the Office oversees accreditation decisions and handles related complaints.

3. The three information officers and their staff. The Act sets out appointment, remuneration, termination, outside-employment restrictions, conflict-of-interest disclosure, and delegation rules that govern their daily work. Staff are engaged under the Public Service Act 1999 (s 23) and form part of a statutory agency headed by the Information Commissioner (s 5(3)). Consultants may be engaged but may exercise only delegable powers (s 24).

4. The Information Advisory Committee and its members. Senior agency officers nominated by the Minister and external experts appointed by the Minister sit on the Committee (s 27(2)). They are subject to travel-allowance-only remuneration (s 27(4)) and stringent conflict-of-interest rules (s 27A), including mandatory recusal unless the Committee determines otherwise.

The Act also indirectly affects courts and tribunals. Section 29(3)–(4) limits the circumstances in which Commissioners or staff can be compelled to give evidence or produce documents containing protected information. The immunity provision (s 35) protects the Commissioners and anyone acting under their authority from civil suit for good-faith acts.

Duties of the Information Commissioner (s 10):

• Perform all information commissioner functions (strategic reporting to the Minister on government information policy – s 7(a)).
• Perform FOI functions and privacy functions.
• Exercise all incidental powers (s 10(2)).

Duties of the FOI Commissioner (s 11):

• Perform FOI functions.
• May perform privacy functions.
• Must obtain Information Commissioner approval before issuing, varying or revoking s 93A guidelines or making legislative or administrative recommendations to the Minister (s 11(4)).
• When exercising a power expressed to be conferred on the “Information Commissioner”, does so on his or her own belief or state of mind; the act is taken to be that of the Information Commissioner (s 11(5)).

Duties of the Privacy Commissioner (s 12):

• Perform privacy functions.
• May perform FOI functions.
• Must obtain Information Commissioner approval before exercising Part IIIB Privacy Act powers, issuing or varying APP guidelines, making certain rules, or advising on spent-conviction exclusions (s 12(4)).
• Parallel “own belief or state of mind” rule (s 12(5)).

Rights and protections:

• All information officers enjoy Remuneration Tribunal-determined pay and recreation leave (ss 17, 18).
• Personal immunity for good-faith acts (s 35).
• Crown privileges and immunities attach to the Office (s 34).
• Strict confidentiality offence with statutory exceptions (s 29).
• Staff and delegates may exercise delegated powers; SES restriction applies to the most significant decisions (s 25(2)).

Duties on agencies and Ministers:

• Supply FOI, privacy and CDR statistics for the annual report (s 30).
• Comply with guidelines issued under FOI Act s 93A or Privacy Act s 28.
• Implement IC review decisions (FOI Act s 58).

The principal sanction is the criminal offence in s 29(1): unauthorised recording, disclosure or use of protected information carries up to two years’ imprisonment. Chapter 2 of the Criminal Code applies. The defendant bears an evidential burden for the exceptions in s 29(2). Subsection 29(3) creates a statutory privilege against compulsory court disclosure except where necessary for the AIC Act.

No civil pecuniary penalties are created by the AIC Act itself; enforcement of substantive obligations occurs under the FOI Act (e.g. vexatious applicant declarations under s 89K) or Privacy Act (civil penalties for serious or repeated interferences with privacy). The Commissioners may, however, publicly report on non-compliance (ss 8(g), 30) and may refer matters to the Commonwealth Ombudsman or other integrity agencies.

Termination of an information officer’s appointment is mandatory for bankruptcy, prolonged unauthorised absence, unauthorised outside employment, or failure to disclose interests under PGPA Act s 29 (s 20(2)). Misbehaviour or incapacity allows discretionary termination (s 20(1)).

The AIC Act is deliberately parasitic on other statutes.

• FOI Act 1982: Almost every FOI function listed in s 8 cross-references specific FOI Act provisions (ss 8E, 8F, 15, 48, Part VI, Part VII, Part VIIA, Part VIIB, s 93A). IC review decisions are made under FOI Act s 55K but may be delegated only to SES staff (AIC Act s 25(2)(a)).
• Privacy Act 1988: Privacy functions include all powers under Division 2 of Part IV, plus guideline-making, rule-making and report-making powers listed in s 12(4). Determinations under Privacy Act s 52 may be delegated only to SES staff.
• Competition and Consumer Act 2010 (Part IVD – Consumer Data Right): Section 9(1)(b) brings CDR accreditation, data standards and complaint functions within “privacy functions”. Annual reporting on CDR performance is mandatory (s 32A). Information obtained under CDR functions receives additional exceptions in s 29(2)(ac) and (5).
• PGPA Act 2013 and Public Service Act 1999: The Office is a listed entity (s 5(4)), the Information Commissioner is the accountable authority, and all officers and staff are officials. The Information Commissioner is the Agency Head for Public Service Act purposes (s 5(3)). Conflict-of-interest disclosures go to the Minister (s 22).
• Remuneration Tribunal Act 1973: Governs pay and leave (ss 17, 18).
• Inspector-General of Intelligence and Security Act 1986: IGIS officials are carved out of the s 29 offence (s 29(2)(d), (6)).

The Act also interacts with the Acts Interpretation Act 1901 (re-appointment eligibility – s 14 note) and the Administrative Review Tribunal (formerly AAT) via FOI Act Part VIIA references in annual reporting (s 31(1)(g)).

The most significant recent change was the addition of CDR functions. The Treasury Laws Amendment (Consumer Data Right) Act 2019 inserted paragraph 9(1)(b), the definition of “consumer data right matters” (s 32A), and related exceptions in s 29(2)(ac) and (5). The purpose was to give the Office a unified regulatory role over both traditional privacy and the new data-portability regime, avoiding fragmentation between the Office and the Australian Competition and Consumer Commission.

Minor amendments have aligned terminology with the replacement of the Administrative Appeals Tribunal by the Administrative Review Tribunal (reflected in s 31(1)(g)) and updated cross-references to the PGPA Act. The statutory review provision (s 33) was a two-year post-commencement obligation that has long since been discharged; no further mandatory review is required.

These changes reflect a deliberate policy shift toward treating data governance as a single regulatory domain rather than siloed FOI, privacy and competition responsibilities.

Because the AIC Act is largely machinery, most litigation concerns the exercise of delegated powers rather than the Act itself. Key cases include:

• Patrick Corporation Ltd v Attorney-General (Cth) [2021] FCA 1010 – examined the scope of “information commissioner functions” under s 7 and the extent to which strategic reporting could encompass commercial-in-confidence material.
• Multiple Federal Court appeals from IC review decisions under FOI Act s 55K (delegable only to SES staff under AIC Act s 25(2)(a)). Courts have emphasised that the delegate must form his or her “own belief or state of mind” where the statute so requires (see s 11(5) and s 12(5)).
• Privacy Act challenges concerning the interaction between s 12(4) approval requirements and the validity of guidelines issued by the Privacy Commissioner without Information Commissioner sign-off.
• Constitutional arguments about the independence of the Office when performing CDR accreditation functions that affect commercial interests (resolved by emphasising the statutory independence and immunity provisions in ss 34–35).

Controversies have centred on resourcing. Annual reports repeatedly note that FOI and privacy complaint volumes have grown faster than staffing, leading to backlogs. The dual-hatting of the Information Commissioner (strategic + FOI + privacy) has been criticised as creating workload conflicts. The 2019 CDR expansion further stretched capacity without commensurate funding, prompting calls for structural separation of the three Commissioner roles.

Most practitioners miss three subtle points.

First, the “own belief or state of mind” rule in ss 11(5) and 12(5) means that when the FOI or Privacy Commissioner exercises a power expressed to be conferred on “the Information Commissioner”, the decision is attributed to the Information Commissioner but cannot be second-guessed by him or her on the same facts. This creates genuine independence for the subordinate Commissioners even though they sit within the same statutory agency.

Second, the delegation carve-outs in s 25(1) are broader than many realise. Not only are the information commissioner functions and annual report preparation non-delegable, but so are the making of vexatious applicant declarations (FOI Act s 89K), correction of IC review errors (s 55Q), and issuance of implementation notices (s 89). Many agencies assume any senior officer can sign such documents; only a properly delegated SES employee or the Commissioner personally can do so.

Third, the s 29 confidentiality offence applies to any person who acquired the information in the course of performing an AIC Act function, including consultants and secondees. The exceptions are narrowly drafted; “lawful purpose” in s 29(2)(b) does not include routine internal audit or media requests. Organisations that receive seconded Office staff must maintain strict information barriers.

Finally, the CDR-specific exceptions in s 29(2)(ac) and (5) create a partial carve-out for data-sharing with the ACCC and Data Recipient Accreditor. This is often overlooked when advising fintech clients on information flows.

For agencies:

1. Map all statutory obligations under the FOI Act, Privacy Act and CDR rules to the relevant Commissioner.
2. Maintain accurate FOI and privacy statistics for the s 30 annual report.
3. Implement robust conflict-of-interest and information-security protocols for any secondees or consultants who may interact with the Office.
4. When responding to an IC review or privacy investigation, treat guidelines issued under FOI Act s 93A or Privacy Act s 28 as highly persuasive (though not strictly binding).
5. For CDR entities, ensure accreditation applications and data-sharing agreements expressly acknowledge the Office’s oversight powers.

For the Office itself:

• Document every delegation in writing and maintain a current register (s 25).
• Ensure that any exercise of a power expressed to be that of the Information Commissioner by a subordinate Commissioner records the decision-maker’s own belief or state of mind.
• Route all s 29-protected information through secure, auditable channels.
• Include in every annual report the full suite of statistics required by ss 31–32A; omissions have attracted parliamentary criticism.

For private parties:

• When making an FOI request or privacy complaint, address it to the Office and cite the specific statutory power relied upon.
• In CDR disputes, identify whether the issue falls under the privacy functions (s 9(1)(b)) or competition functions retained by the ACCC.
• If served with a notice or subpoena that might require disclosure of Office-acquired information, immediately notify the Commissioner so that s 29(3) can be invoked.

Compliance is best achieved by treating the three Commissioners as a single regulatory ecosystem whose statutory architecture deliberately blurs lines between FOI, privacy and data-portability oversight while preserving clear accountability through the Information Commissioner’s ultimate responsibility for the Office as a PGPA entity.