Respond to a request for access to personal information the practice holds
Key facts
- Human involvement
- RedLawyer-led
- How AI is used
- List the personal information the practice holds about the person who has asked, including information a contractor stores where the practice still has the right to deal with the record. Note what was used to check identity, and whether a document was sighted rather than copied. List the ten grounds in APP 12.3 without selecting one: serious threat to life, health or safety, or to public health or public safety; unreasonable impact on the privacy of other individuals; frivolous or vexatious request; existing or anticipated proceedings between the organisation and the individual where the information would not be obtainable on discovery; prejudice to negotiations; access would be unlawful; denial required or authorised by an Australian law or a court or tribunal order; suspected unlawful activity or serious misconduct where access would be likely to prejudice appropriate action; prejudice to an enforcement body's enforcement related activities; and evaluative information tied to a commercially sensitive decision. Do not choose a ground. Do not draft the notice.
- What the lawyer must review
- Decide whether to give access and write any refusal notice. APP 12.1 requires an APP entity that holds personal information about an individual to give that individual access on request. For an organisation the response is within a reasonable period. The guidelines say that, as a general guide, a reasonable period should not exceed 30 calendar days, and that the response is either access or notice of refusal. An organisation must not charge for the making of the request. It may charge for giving access if the charge is not excessive, and the charge must not be used to discourage the request. If access is refused, or not given in the manner requested, APP 12.9 requires a written notice of the reasons, except to the extent that giving reasons would be unreasonable having regard to the grounds, the complaint mechanisms, and any other matter prescribed by regulation. The guidelines give a breach of legal professional privilege as one example of access that would be unlawful. The lawyer decides whether that example applies. Consider redaction before a refusal. Confirm the practice is an organisation, and read the regulations, before the notice is sent.
- Written for / version
- US
Open a jurisdiction version of this task to see which instruments apply: US
Who does what
| Role | What they do |
|---|---|
| Assistance | Supporting preparation only. List the personal information the practice holds about the person who has asked, including information a contractor stores where the practice still has the right to deal with the record. Note what was used to check identity, and whether a document was sighted rather than copied. List the ten grounds in APP 12.3 without selecting one: serious threat to life, health or safety, or to public health or public safety; unreasonable impact on the privacy of other individuals; frivolous or vexatious request; existing or anticipated proceedings between the organisation and the individual where the information would not be obtainable on discovery; prejudice to negotiations; access would be unlawful; denial required or authorised by an Australian law or a court or tribunal order; suspected unlawful activity or serious misconduct where access would be likely to prejudice appropriate action; prejudice to an enforcement body's enforcement related activities; and evaluative information tied to a commercially sensitive decision. Do not choose a ground. Do not draft the notice. The tool writes nothing into the document. Substantive advice, judgement and any restricted content remain with the responsible human. |
| Lawyer | Perform the substantive analysis and decisions. Independently check any permitted supporting work and approve the exact output for its intended use. |
Checklist
- Do not refer the person to a storage provider if the practice still controls the record.
- Seek only the minimum identity information, and prefer sighting a document to copying it.
- Do not select an APP 12.3 ground. The lawyer does, after considering redaction.
- The lawyer writes the notice, including reasons and complaint mechanisms where access is refused.
Sources
These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.