The IC Act directly affects four main groups.

1. Public sector agencies (defined by reference to the GIPA Act, s 3(1)). Every Minister, department, local council, state-owned corporation and public authority is subject to the Commissioner’s investigative, information-gathering and reporting powers. Section 25 obligations are cast in mandatory language; non-compliance attracts the offence provisions in s 43. Agencies must also respond to s 24 reports by notifying the Commissioner of action taken or proposed.

2. The Information Commissioner and their staff. The Commissioner is a statutory office holder, not a public servant (s 10). Staff are engaged under the Government Sector Employment Act 2013 but may be styled “officers or employees of the Commissioner” (s 12 and note). The Commissioner also sits as Chairperson of the Information and Privacy Advisory Committee (s 11(1)). Delegation is permitted to staff or to classes of persons prescribed by regulation (s 13), but the power of delegation itself cannot be delegated.

3. Individual complainants and members of the public. Any “person” may make a complaint (s 17). The Act is deliberately broad; there is no standing test beyond the ordinary meaning of “person”. Whistle-blowers receive additional protection: s 43(4)–(6) create indictable offences (maximum 200 penalty units or 5 years imprisonment) for reprisals against those who complain, assist the Commissioner or give evidence. The Public Interest Disclosures Act 2022 overlay in s 35(1A) further protects identifying information.

4. Oversight bodies and Parliament. The Joint Committee (defined by reference to the Ombudsman Act 1974) receives monitoring, reporting and recommendation functions (s 44). The Ombudsman, ICAC, LECC, DPP and Children’s Guardian are both recipients of information from the Commissioner (ss 31, 31A, 32) and sources of information to the Commissioner (s 34). The Presiding Officers of both Houses are the ultimate recipients of annual, GIPA-operation and special reports (ss 36–39).

The Act does not apply to the Commissioner’s own conduct in a way that creates circularity; s 44(2) expressly prevents the Joint Committee from investigating individual complaints or reconsidering the Commissioner’s decisions on particular matters.

Commissioner’s duties

• Act informally and on the substantial merits (s 15).
• Give notice to complainants of decisions to deal (or not deal) with complaints and the proposed method (s 20).
• Afford procedural fairness before making adverse comments (s 23(3)).
• Consult the relevant Minister before publishing a report containing adverse comment on an agency (s 23(4)).
• Report compliance failures to the Minister, principal officer and (for public servants) the Secretary of the Premier’s Department (s 24(1)).
• Maintain secrecy obligations (s 35) while facilitating appropriate information sharing with integrity agencies.

Agency duties

• Comply with written requirements under s 25.
• Facilitate entry and inspection (s 26).
• Notify the Commissioner of action taken on s 24 reports (s 24(3)).
• Refrain from conduct that would breach an Information Act (enforceable by injunction under s 28).

Individual rights

• Right to complain (s 17).
• Right to be heard during investigations (s 23(2)).
• Protection from reprisals (s 43(4)–(6)).
• Right to receive notice of investigation decisions and discontinuances (s 22).

Parliamentary rights

• The Joint Committee’s statutory monitoring and recommendation functions (s 44(1)).
• Automatic tabling and publication mechanisms (s 39).

The offence regime in s 43 is graduated. Summary offences (maximum 10 penalty units) cover obstruction, failure to comply with lawful requirements, misleading the Commissioner, and false representation of authority (s 43(1)–(2)). More serious indictable offences (200 penalty units or 5 years imprisonment, or both) address reprisals against complainants or witnesses (s 43(4)) and employer victimisation (s 43(5)). The reverse onus in s 43(6) is notable: once dismissal or prejudice is shown, the employer must prove it occurred for a reason other than the prohibited one.

Proceedings are normally summary before the Local Court (s 46(1)), but indictable matters may be dealt with summarily with consent and subject to reduced maximum penalties (s 46(2)–(3)).

Civil enforcement is by Supreme Court injunction on the Commissioner’s application (s 28). The Commissioner also enjoys statutory immunity (s 42) that can only be displaced by leave of the Supreme Court upon a showing of substantial grounds for bad faith. A separate good-faith protection appears in s 45.

The IC Act is deliberately embedded in a web of integrity legislation.

• GIPA Act: the primary “Information Act”. The IC Act supplies the external review and oversight layer that complements NCAT’s merits review jurisdiction. Section 35(2) expressly permits disclosure to the Privacy Commissioner during s 94 GIPA consultations.
• Privacy and Personal Information Protection Act 1998 and Health Records and Information Privacy Act 2002: the Commissioner and Privacy Commissioner are distinct offices (s 4(3A) prevents dual appointment), yet they must consult (s 35(2)) and may share non-personal information (s 33(2)).
• Ombudsman Act 1974: mandatory consultation where complaints overlap (s 40). Information exchange is bidirectional (ss 31, 34). The same Joint Committee oversees both offices.
• Law Enforcement Conduct Commission Act 2016, Independent Commission Against Corruption Act 1988, Children’s Guardian Act 2019: information-sharing gateways (ss 31A, 32) allow the Commissioner to pass material without waiving the originating Act’s restrictions.
• Royal Commissions Act 1923: supplies procedural powers for formal inquiries (s 29) but is expressly modified by s 27 privilege rules.
• Government Sector Finance Act 2018 and Government Sector Employment Act 2013: govern reporting and staffing with specific carve-outs (ss 10, 12, 36).
• Public Interest Disclosures Act 2022: overrides the general secrecy rule in s 35(1) for PID-related identifying information (s 35(1A)).

The cumulative effect is a coordinated integrity ecosystem in which the Commissioner is both a recipient and a provider of protected information.

The Act has been amended on nine occasions since 2009. Key changes include:

• 2010 amendments (No 71) refined appointment, acting appointment and reporting provisions following early operational experience.
• 2014 amendments (No 33) updated references from the Public Sector Employment and Management Act 2002 to the Government Sector Employment Act 2013, reflecting machinery-of-government reform.
• 2016 amendments (No 61) updated cross-references to the newly created Law Enforcement Conduct Commission.
• 2018 amendments (No 70) integrated the Commissioner’s annual reporting into the Information and Privacy Commission’s whole-of-office reporting under the Government Sector Finance Act 2018, removing ministerial tabling requirements to reinforce independence.
• 2019 insertion of s 31A to permit information sharing with the Children’s Guardian.
• 2022 amendments (No 14) aligned s 35 with the new Public Interest Disclosures Act 2022, adding the current subsections (1A) and (3).
• 2023 amendments (No 35) updated references to the Premier’s Department and Cabinet Office.

These changes have been largely technical or integrative, responding to the creation of new integrity bodies, privacy convergence, and evolving public interest disclosure law. The 2018 reporting reforms were particularly significant because they removed the Commissioner from direct ministerial accountability for annual reporting, reinforcing perceived independence.

Because the Commissioner’s functions are largely facilitative and non-determinative, direct judicial review of the Commissioner is rare. The leading authorities instead concern the boundaries of the Commissioner’s coercive powers.

In CIC Insurance Ltd v Bankstown Football Club Ltd (1997) 187 CLR 384 (pre-dating the IC Act but frequently cited in GIPA litigation) the High Court emphasised that statutory powers must be read in light of their statutory purpose—here, transparency. More recent NSW cases have tested s 27 privilege limits. In Independent Commission Against Corruption v C [2014] NSWCA 87 the Court of Appeal confirmed that client legal privilege is not displaced by analogous coercive powers unless the statute clearly so provides; s 27(1) of the IC Act expressly preserves that position for non-agency privilege.

Controversy has also surrounded the relationship between the Commissioner and NCAT. Some agencies have argued that once a GIPA matter is before NCAT the Commissioner should decline to investigate parallel complaints. The Commissioner’s practice (consistent with the note to s 17) has been to focus on systemic or procedural failings rather than the correctness of individual decisions.

The absolute Cabinet exemption in s 30 has never been successfully challenged, the conclusive certificate mechanism mirroring long-standing provisions in freedom-of-information legislation. In practice the Commissioner has used s 30(2) certificates sparingly, preferring to negotiate redaction or alternative sources of information.

Most practitioners assume the Commissioner’s role is limited to GIPA. In fact s 3(1) permits any Act to be declared an “Information Act” by regulation; a future government could expand the regime overnight without primary legislation. Watch for regulatory creep.

Section 35(1) secrecy is broader than many realise. It prohibits disclosure of any information for which there is (or an agency claims there is) an overriding public interest against disclosure under the GIPA Act. The “claim” trigger means agencies can effectively freeze disclosure by assertion, forcing the Commissioner to litigate or negotiate. The 2022 PID carve-out in s 35(1A) is narrower than many expect—it applies only to “identifying information” for specific statutory purposes.

The immunity provisions (ss 42 and 45) are strong but not absolute. Both require “good faith”. The Supreme Court’s gatekeeper role under s 42(2)–(3) has never been tested in a reported decision, leaving uncertainty about the evidentiary threshold for “substantial ground”.

Section 28(5) standing for judicial review is a sleeping giant. It allows the Commissioner to challenge agency GIPA decisions directly, bypassing the usual applicant. Agencies that adopt overly cautious “neither confirm nor deny” postures on sensitive contracts may find themselves respondents in Supreme Court proceedings brought by the Commissioner rather than an individual applicant.

Finally, the two-term limit in s 4(3) is absolute. Even a person of exceptional independence cannot be re-appointed for a third term, however short. This has produced periodic transitions that can disrupt institutional memory, especially given the part-time nature of the parallel Privacy Commissioner role.

For agencies

1. Maintain a central register of s 25 notices and treat them with the same urgency as NCAT summonses.
2. Train FOI/GIPA officers on the procedural fairness obligations in s 23(2)–(3); an adverse comment in a Commissioner’s report can damage reputation even if no enforceable order is made.
3. Develop a “Commissioner response protocol” that identifies the principal officer’s personal responsibility under ss 21(2) and 24(3).
4. Never assert Cabinet exemption lightly; a s 30(2) certificate is conclusive but politically visible and may trigger special reporting.
5. Integrate IC Act complaint data into your annual GIPA statistical return so that systemic trends can be addressed before a s 21 investigation commences.

For legal practitioners advising complainants

1. Advise clients that a complaint is not a substitute for NCAT review. Use the complaint route for delay, process failures or systemic bias; use NCAT for merits override.
2. Request the Commissioner to investigate under s 21 rather than merely conciliate under s 19 where evidence of widespread non-compliance exists.
3. Remember that s 43(4)–(6) reprisal offences carry custodial penalties; document any adverse action post-complaint meticulously.

For the Commissioner’s office

1. Document the s 18 decision-making process with sufficient detail to withstand potential judicial review for Wednesbury unreasonableness.
2. Use the s 16 expert assistance power liberally when technical records (IT systems, complex contracts) are involved.
3. Maintain strict separation between conciliation (s 19(1)(c)) and investigation (Division 3) staff to avoid apprehended bias arguments.

General compliance tip Treat every Commissioner notice as if it were a parliamentary committee summons. The political accountability that flows from a special report under s 38 can be more damaging than any court order. Early, transparent cooperation almost always produces a better outcome than legalistic resistance.