3.1
The annual reports for the 2020–21 financial year (the reporting period) from the agencies with the Attorney-General's and Home Affairs portfolios were referred to the committee for examination and report between 1 May 2021 to 30 April 2022 are set out in paragraph 1.12.
3.2
On this occasion, the committee has examined in more detail the reports of the Office of the Australian Information Commissioner (OAIC) and the Office of Parliamentary Counsel (OPC).
Office of the Australian Information Commissioner
Tabling of the report
3.3
The Office of the Australian Information Commissioner Annual Report 2020–21 was tabled in the Senate on 23 November 2021, after having been tabled in the House of Representatives on 21 October 2021. The annual report was presented to the Attorney-General on 8 October 2021, meeting the requirements under section 46 of the Public Governance, Performance and Accountability Act 2013 (PGPA Act).
Commissioner's review
3.4
In her review, Privacy Commissioner Angelene Falk noted that the COVID-19 pandemic continued to dominate the work of the OAIC during 2020–21. The pandemic was a key theme of new OAIC guidance and advice to agencies and organisations. During the reporting period, the OAIC released two reports and the first of five assessments on the COVIDSafe app.
3.5
Ms Falk reported that during the reporting period, the OAIC:
issued a record number of determinations in relation to complaints alleging breaches of the Australian Privacy Principles;
finalised 10 privacy Commissioner-initiated investigations (CIIs); and
established the Regulatory Action Committee, an internal governance mechanism to assist the OAIC in assessing regulatory options for responding to emerging privacy risks.
3.6
Ms Falk also provided an update on the OAIC's delivery of core services during the reporting period. She reported that applications for Information Commissioner (IC) reviews increased by 15 per cent and privacy complaints declined by seven per cent. While the number of closed IC reviews increased by 23 per cent compared to 2019-20, a gap between incoming freedom of information work and finalisation rates remained. The Commissioner stated that the appointment of a new Freedom of Information (FOI) Commissioner will assist the OAIC to manage this growing workload.
Performance reporting
3.7
The Attorney-General’s Portfolio Budget Statements 2020–21 (PBS) outlined the OAIC’s outcome and program and set out six outcomes-based key performance indicators (KPIs). The Corporate Plan 2020–21 (corporate plan) identified four strategic priorities:
advance online privacy protections for Australians;
influence and uphold privacy and information access rights frameworks;
encourage and support proactive release of government-held information; and
contemporary approach to regulation.
3.8
The corporate plan also set out 25 performance indicators and corresponding measures to evaluate success. It indicated which of these measures incorporate the six outcome-based KPIs from the PBS.
3.9
The performance statement in the annual report evaluated the agency's performance against the measures included in the corporate plan. Read together, the PBS, corporate plan, and annual report provide a 'clear read' of the OAIC's performance.
3.10
During the reporting period, the OAIC achieved 19, partially achieved one, and did not achieve four of the 25 performance indicators. The OAIC indicated that one further performance indicator did not apply during the reporting period because the legislation to support the Online Privacy Code was delayed.
3.11
The performance indicators not achieved were:
indicator 2.2: finalise 90 per cent of written privacy and information access enquiries from the public within ten working days;
indicator 2.6: finalise 80 per cent of CIIs within eight months;
indicator 2.7: complete 80 per cent of IC reviews within 12 months; and
indicator 4.6: recruitment and training aligned to staff capability map.
3.12
The OAIC reported that 65 per cent of written enquiries from the public were finalised within 10 working days in 2020–21. The OAIC explained that this result was caused by an increase in the number of enquiries and changes to procedures due to the COVID-19 pandemic.
3.13
During the reporting period, the OAIC finalised 11 CIIs, with two of those finalised within the eight-month target.
3.14
The OAIC explained that a significant increase in the number of IC review applications and a focus on reducing the number of cases over 12 months resulted in it finalising 73 per cent of IC reviews within 12 months. The OAIC reported that the number of IC review applications received during the reporting period increased by 15 per cent compared to the previous reporting period. Over the same period, the number of IC reviews finalised by the OAIC increased by 23 per cent compared to the previous reporting period.
3.15
The OAIC reported that it was prevented from developing a staff capability map due to resourcing challenges. The OAIC aims to develop a revised capability approach in 2021–22 to ensure that recruitment and training in areas of emerging technical capability requirements are met.
Other matters
3.16
While the annual report largely meets the requirements of the PGPA Act and Public Governance, Performance and Accountability Rule 2014 (PGPA Rule) (collectively referred to as the Commonwealth performance framework) for annual reports, this report appears to be lacking with respect to five mandatory requirements, including:
a direct electronic address for the report (PGPA Rule 17AJ(g));
statistics on the number of employees at the end of the previous reporting period (PGPA Rules 17AG(4)(aa) and 17AG(4)(b));
statistics on staff location (PGPA Rules 17AG(4)(aa) and 17AG(4)(b));
an outline of the ways in which the procurement practices of the entity support small and medium enterprises (PGPA Rule 17AG(10)(b)); and
a statement that information on advertising campaigns is available in the reports on Australian government advertising prepared by the Department of Finance and that those reports are available on the Department of Finance’s website (PGPA rule 17AH(1)(a)(i)).
3.17
The committee notes that the OAIC's electronic address for the report appears to have been omitted from the report. While the committee commends the OAIC for including its website address in the report (as required by PGPA Rule 17AJ(f)), the committee encourages adherence to the Commonwealth performance framework, which requires explicit reference to both addresses.
3.18
The committee commends the OAIC for including employment statistics for the 2020–21 reporting period. However, to fully comply with PGPA Rules 17AG(4)(aa) and 17AG(4)(b), statistics from the previous reporting period must also be included.
3.19
While the committee understands that the OAIC may be based in one location, it encourages the agency to include a statement to this effect, or an outline of staff locations in its staffing profile in order to comply with all requirements in PGPA Rules 17AG(4)(aa) and 17AG(4)(b).
3.20
The OAIC's annual report does not appear to outline the ways in which the procurement practices of the agency support small and medium enterprises. The committee encourages the OAIC to include this information to the extent possible in order to comply with the mandatory obligations under PGPA Rule 17AG(10)(b).
3.21
While the committee notes that an electronic address to the OAIC's advertising website is included in the report, to fully comply with PGPA Rule 17AH(1)(a)(i) agencies must also include a statement that further information on the agency's advertising campaigns is available in the reports prepared by the Department of Finance.
Conclusion
3.22
While the committee has identified a number of shortcomings with the OAIC's report, on balance it considers the report to be 'apparently satisfactory'. The committee encourages the OAIC to address the matters outlined above in order to comply to the fullest extent possible with the requirements of the annual reporting framework under the PGPA framework.
Office of Parliamentary Counsel
Tabling of the report
3.23
The Office of Parliamentary Counsel Annual Report 2020–21 was tabled in the House of Representatives and the Senate on 20 October 2021. The report was presented to the Attorney-General on 28 September 2021, meeting the requirements under section 46 of the PGPA Act.
Review by the Acting First Parliamentary Counsel
3.24
In her annual review, the Acting First Parliamentary Counsel, Ms Meredith Leigh, reflected on the retirement of the First Parliamentary Counsel, Mr Peter Quiggin PSM QC, after 17 years in the role.
3.25
Ms Leigh's review highlighted the development of a new performance program to be launched during the 2021–22 financial year. She noted that the program aims to modernise staff development, with a strong focus on technical and people skills.
3.26
Ms Leigh reported that significant progress was made on the redevelopment of the Federal Register of Legislation during the reporting period. It is anticipated that the new Register will be launched during 2021–22. During the reporting period, OPC also completed a project that it began in 2015 to ensure that every Act made since 1901 is on the Legislation Register in an accessible format.
Performance reporting
3.27
The relevant Attorney-General's Portfolio Budget Statements 2020–21 (PBS) outlined the OPC's outcome and program. The OPC Corporate Plan 2020–24 set out two purposes that support the outcome contained in the PBS:
to enable government to carry out its legislative program by drafting bills, legislative instruments to be made or approved by the Governor-General (Federal Executive Council instruments), and a range of other instruments; and
to ensure Commonwealth laws are freely available and accessible to everyone by publishing those laws and instruments on the Federal Register of Legislation website.
3.28
In the annual report, OPC reported that it achieved six of its seven performance criteria. The one criterion that was not met related to the time taken to register Act and legislative and notifiable instrument compilations that are required to be prepared by the OPC on the Legislation Register. OPC set a target of 90 per cent of those compilations being registered on the Legislation Register 28 days after commencement of the prospective amendments. The OPC failed to reach its target and achieved a result of 68 per cent. The annual report explained that this result was due to an increase in the agency's workload, an increase in demand for user-pays compilations, and an influx of Acts at the end of the Spring 2020 sitting period.
3.29
The committee acknowledges OPC's strong performance against its targets and encourages it to continue its efforts in meeting them.
Other matters
3.30
While OPC's annual report largely met the requirements of the Commonwealth performance framework, it appears to omit:
the electronic address of the report (PGPA Rule 17AJ(g));
a certification by the accountable authority in respect of the OPC's fraud systems (PGPA Rules 17AG(2)(b)(i), (ii) and (iii));
a direct electronic address of the charter determining the functions of the OPC's audit committee (PGPA Rule 17AG(2A)(a); and
a website reference to where the OPC's Information Publication Scheme statement pursuant to Part II of the FOI Act can be found (PGPA Rule 17AH(1)(d).
3.31
While the report contained instructions on how to locate the annual report on the OPC website, the Commonwealth performance framework requires an explicit reference to the electronic address of the report.
3.32
The committee acknowledges that the annual report outlined the mechanisms in place for risk management and fraud control, and includes statements that reflect the substance of the information required under the Commonwealth performance framework. The report does not, however, make explicit reference to a certification from the accountable authority as to the existence of fraud processes. The committee encourages OPC to be fully compliant with the requirements of the Commonwealth performance framework.
3.33
While the report contained instructions on how to locate the OPC's Audit and Risk Committee Charter on the OPC website, to comply with the requirements of the Commonwealth performance framework a direct electronic address of the charter is required.
3.34
The OPC annual report stated that each agency must display on its website a plan showing what information it publishes in accordance with the requirements of the Information Publication Scheme. To fully comply with the requirements of the Commonwealth performance framework, however, a direct electronic address to that plan must be included in the annual report. The committee encourages OPC to address this omission in its subsequent annual reports.
Conclusion
3.35
While the committee acknowledges that the annual report appears to omit information required under the PGPA framework, these omissions are not substantial. Therefore, the committee considers the OPC's annual report to be 'apparently satisfactory'.
Senator the Hon Sarah Henderson
Chair