Introduction
Writing in the United Kingdom, Julia Feast (Reference Feast2010: 77) has noted that ‘social workers, adoption workers and access to record officers grapple with . . . making decisions about what information can and should be shared’. Access to personal records in the UK, using the key legislation of the Data Protection Act 1998 (DPA), Feast argues, is a ‘complex’ area. In Australia, too, it is similarly complex. This complexity relates to the need for those releasing records to be compliant in the application of relevant legislation but, at the same time, compassionate in attempting to meet the needs of those seeking information about their family and personal history. Australian state and federal privacy, freedom of information (FOI) and other legislation have relevance to the release of personal records. This article case studies record-holders’ use of the state of Victoria's Information Privacy Act 2000 (Government of Victoria, 2000) and Freedom of Information Act 1982 (Government of Victoria, 1982) (henceforth referred to as the Privacy Act and the FOI Act respectively).
In particular, this article discusses the release of personal records to care-leavers, or people who grew up in orphanages, children's homes, other institutions and foster care. In Australia, there are four major groups who experienced care: former child migrants who were brought from the UK as unaccompanied children; members of the Stolen Generations, including Aboriginal and Torres Strait Islander people who were removed from their families as children under government policy; Forgotten Australians, typically aged over thirty years who are neither Indigenous Australians nor former child migrants; and young people aged under thirty years who have left care. Access to personal records has been identified as important in assisting care-leavers to find out about their family and personal history and make sense of their time in care (for example, Pugh, Reference Pugh1999; Kirton et al., Reference Kirton, Peltier and Webb2001; Horrocks and Goddard, Reference Horrocks and Goddard2006; Golding, Reference Golding, Hill and Branigan2010; Murray and Humphreys, Reference Murray and Humphreys2012). As Feast (Reference Feast2010: 1) explains:
Sharing memories and photographs, and recounting family stories and significant events are integral parts of normal family life, helping build children's sense of belonging, identity and security. However, for people brought up in care outside their family, this may not have happened. As a result, they may well lack the basic information that people who grew up in their own families take for granted.
The lack of such information-sharing experiences is particularly pertinent for older care-leavers. In contrast, for young people growing up in care today, ‘there is a clear expectation that they should be provided with comprehensive information about their family and time in care’ (Feast, Reference Feast2010: 1). Practice with children in care today supports the development of life-story books and their age-appropriate participation in reviews and decision-making that affects them (Feast, Reference Feast2010; Humphreys and Kertesz, Reference Humphreys and Kertesz2012). Typically, this was not the case for older care-leavers; nor was it expected that post-care adults would return to access their records. What these shifts in practice indicate is that while children who grow up in their natural family and younger care-leavers could be expected to have information about their family and personal history, older care-leavers may not.
In Victoria, regardless of care and protection status, historically, most children were accommodated in children's homes run by the non-government sector. Over the past four decades, it is most likely that such children will have been in foster care, also managed by the non-government sector. While some children were in care in the past without State intervention, both non-government or community service organisations (CSOs) and the relevant government department (now called the Department of Human Services (DHS)) hold records about many children's lives in care. Moreover, a care-leaver's ‘record’ is typically a composite of a variety of information kept for a range of purposes. Indeed, it is likely that there is not ‘one record’, but rather a number of ‘files’ in a range of locations (Murray and Humphreys, Reference Murray and Humphreys2012). In addition, care-leavers’ records vary in their volume and contents. They may be as little as entries in an orphanage registry written at the time of the child's arrival and departure, with little information to help a care-leaver understand their personal and family history. Or these records may include much more, such as social work case notes, letters from a parent to the home making arrangements to visit their child, receipts for clothes and school reports. A younger care-leaver, with greater attention paid in recent times to their long-term needs for personal information, is more likely to find additional items such as their birth certificate, contacts for family members, medical information and life-story books (Goddard et al., Reference Goddard, Murray and Duncalf2012; Humphreys and Kertesz, Reference Humphreys and Kertesz2012).
There is an increasing number of Australian care-leavers coming forward to seek their records, partly as a result of three national enquiries (Human Rights and Equal Opportunity Commission (HREOC) 1997; Senate Community Affairs References Committee (SCARC) 2001 and 2004) and their subsequent (but delayed) apologies and other policy initiatives (Macklin, Reference Macklin2011). In Victoria, at least 1,700 records were released in 2012 (Murray, Reference Murray2012). However, problems can arise because of the mismatch between the purposes of the writers of the records, the needs of the people about whom the records were compiled and the record-holders’ understanding of the relevant legislation today. One of the main concerns is the redaction of ‘third party data’, or the deletion from the record of information about those other than the subject of the record – often information crucial for care-leavers, such as that about their parents or siblings. This article discusses these issues and considers how policy in this area could be improved. Before proceeding to discuss the relevant features of the Privacy and FOI Acts, a brief overview of the research process is presented.
Research process
The research which informed this article was a nested study within a larger project known as ‘Who am I?: Making records meaningful’, a multi-disciplinary qualitative action research project based in Victoria investigating the role played by records in the health, well-being and identity construction of children and young people in care and of adults who were in care as children. The purpose of the nested study was to find out about care-leavers’ experiences of accessing their records in an effort to inform policy and practice in this area. The research involved in-depth, face-to-face, semi-structured interviews with eighteen care-leavers, conducted between January and June 2011 and ranging in length from forty-five minutes to three hours. Telephone interviews of up to one hour each were conducted with key staff of nine record-holding organisations and two support services, during the period April to August 2012. In addition, consistent with the ‘Who am I’? action research methodology, a workshop held in July 2011 with fifty participants from across the sector discussed the findings of the research, and their contributions also inform this article.
The research was guided by a reference group with membership from five Victorian CSOs that provide support and advocacy to care-leavers and two care-providers that hold records. The research was approved by the Human Research Ethics Committees at RMIT University and the University of Melbourne and all standard ethical research procedures were in place, such as ensuring that participation was voluntary and that participants provided written informed consent (Australian Government, 2007).
The eighteen care-leaver participants comprised three young care-leavers aged under thirty years, ten Forgotten Australians and five members of the Stolen Generations, among this group there were no former child migrants. Eleven women and seven men were interviewed. The average age of the young care-leavers was twenty-two years, and among the older age group (Forgotten Australians and members of the Stolen Generations), it was sixty-one years, with a range of forty-seven to eighty-three years. Common among the group were long periods of time in care and being in care from an early age. All older participants had spent at least some time in institutional care, and many had also been placed in foster care or family group homes, reflecting policy changes over time. Among the younger care-leavers there were experiences of residential care, foster care and kinship care. Elsewhere, I have written about the experiences of the care-leavers in accessing their records and the implications for social work practice (Murray and Humphreys, Reference Murray and Humphreys2012); here I pay attention to the record-holders’ understanding of the relevant legislation.
Those interviewed from all eleven organisations were directly involved in the release of records and the support of care-leavers accessing their records. One of these record-holders was the State government department, DHS. While subject to the Privacy Act, records’ release is handled under the FOI Act (Office of the Victorian Privacy Commissioner (OVPC), 2011). Record-holding CSOs, that had been contracted by the Victorian government to provide services for children in care at the time of the creation of the records, release them under the Privacy Act. A recent review of the FOI Act, however, has recommended that contracted CSOs’ records are the responsibility of the DHS, and there is currently discussion about the implications of release (Victorian Auditor-General, 2012). It is possible that at some time some of these organisations cared for children in a private or commercial capacity and were not contracted to do so by government, and, in such cases, records’ release is covered under similar conditions provided under the federal Privacy Act 1988. Access to information is retrospective; that is, even though many of the records were created at a time when there was no expectation of the contents being made available to the subject of the records, now they are.
The Privacy and FOI Acts and their relevance to care-leavers
Some brief background to the legislation will assist in identifying what is common to both Acts and relevant to the release of care-leavers’ records. First, however, it is important to highlight a significant difference. At first glance, as Turle suggests, privacy and FOI legislation seem to be at odds:
[F]reedom of information and data protection [privacy in Australia] do not sit easily together. While the former promotes openness and transparency through access to information, the latter does just the opposite – restricting access and use in the interests of privacy. (Turle, Reference Turle2007: 514)
The Office of the Victorian Privacy Commissioner (2011: 5) reiterates this point: ‘FOI is fundamentally about compelling disclosure. Privacy compels discretion.’ With FOI, ‘every person has a legally enforceable right to seek access to documents held by government, whether or not the documents relate to the requester’. In contrast, ‘Privacy only confers a right of access on the person who is the subject of the personal information’ (OVPC, 2011: 5). So while the Privacy Act compels discretion, it does allow for access to personal records of the subject of those records. Thus, both acts provide for access to personal records. Notably, however, privacy legislation was ‘never intended for such uses as care-leavers make of it’. The primary focus of privacy legislation is the ‘protection of data’, as with the DPA in the UK (Goddard et al., Reference Goddard, Murray and Duncalf2012: 5, italics in original). This, then, leads to restrictions on access to information relating to others.
In the Privacy Act, Information Privacy Principle 6 provides for access, and its restriction. The section most relevant to care-leavers is:
6.1 If an organisation holds personal information about an individual, it must provide the individual with access to the information on request by the individual, except to the extent that . . . (b) providing access would have an unreasonable impact on the privacy of other individuals. (Privacy Act, Schedule 1, 6.1(b)) (emphasis added)
The FOI Act has a similar exemption:
33 Document affecting personal privacy
(1) A document is an exempt document if its disclosure under this Act would involve the unreasonable disclosure of information relating to the personal affairs of any person (including a deceased person). (FOI Act, s. 33.1: 53) (emphasis added)
Typically the outcome of such exemptions is redacted information, but what exactly is redacted is discretionary, as explained in a FOI practice note:
The FOI cases before the courts and the VCAT [Victorian Civil and Administrative Tribunal] have come to different conclusions concerning the reasonableness of disclosure and there is no general rule, as decisions are made on a case-by-case basis. (Victorian Department of Justice (VDoJ), 2012)
Guidelines assist in determining whether disclosure is reasonable according to the nature of the information, whether the information is already in the public domain, whether disclosure is likely to endanger the life or physical safety of any person and the applicant's reasons for seeking the documents (VDoJ, 2012). However, if a determination is made that it is reasonable to release information about third parties, the FOI Act includes mechanisms by which these third parties can appeal against this decision via ‘reverse FOI rights’ (VDoJ, 2012):
the agency or Minister (as the case may be) shall if practicable notify the person who is the subject of that information (or in the case of a deceased person, that person's next-of-kin) of the decision and of the right of appeal against the decision . . . to the person or, in the case of a deceased person, to the person's next-of-kin. (FOI Act, 33.3: 54)
In contrast, the Privacy Act does not provide guidance on how to deal with affected third parties, although in guidelines developed by the OVPC, reference is made to FOI case law and other strategies have been suggested. In a similar way, the OVPC advises that:
Organisations may not always be aware of the potential impact disclosure may have on a third party. It is good practice for organisations to notify third parties, where practicable, of any proposed disclosure of their information and to provide them with an opportunity to say why their information ought not be disclosed. (OVPC, 2011: 134)
Furthermore, drawing on a case study put forward by the Australian Privacy Commissioner, the following factors were suggested as a means of assessing the impact of release of personal information of third parties:
• whether the individual would expect that their information would be disclosed to the third party, including whether any assurance of confidentiality was provided;
• the extent of the impact on the individual's privacy;
• whether any public interest reasons for providing access to the information outweigh any expectation of confidentiality; and
• whether masking the identifying details of the third parties would sufficiently protect the privacy of these individuals. (OVPC, 2011: 134)
While these assessment factors make sense in relation to a range of matters, such as that which were the focus of the OVPC case studies concerning insurance claims and industrial disputes (OVPC, 2011), they are less readily applied when the person seeking access to information is, for example, looking for the name of their mother or the events leading up to their admission to an orphanage. So while the legislation is useful in providing access, it is complicated by the real or perceived restrictions it imposes on what can be released. As noted by Kirton et al. (Reference Kirton, Feast and Goddard2011: 920) in their study of records’ release in the UK: ‘The crucial tension is that between the identity needs and rights of post-care adults and the rights of other family members to privacy and confidentiality.’
Findings: how are the Privacy and FOI Acts applied in practice?
Having established the relevance of the legislation to care-leavers’ access to their records, I now turn to what happens in practice. The findings of the research are discussed around three themes related to the application of the Privacy and FOI Acts to the release of care-leaver records. First, the article discusses the level of general understanding among record-holders about the legislation and their relevance. Second, the significance of the entitlement to access and its implications for the quality of redacted records are highlighted and, third, decisions about ‘unreasonable disclosure’ and redaction are considered.
Record-holders understanding of the legislation
Among the CSOs at the time of the workshop in 2011 there were varying levels of understanding of the Acts and their application. Some were well-versed in the intention of the legislation and were highly skilled in their application. Others had received little guidance and thought that the legislation was concerned with the privacy (and protection) of the organisation that held the records, rather than the subject of the records. This is not dissimilar to what has been found in relation to the DPA in the UK. Feast (Reference Feast2009: 9) notes that:
There continues to be a great deal of confusion surrounding the access to information for post-care adults . . . A common misperception is that the Act is a tool that organisations should use to restrict access to information. (emphasis added)
As we have seen in the discussion of the intersection of privacy and freedom of information legislation, the association between access to personal information and ‘privacy’ is not necessarily obvious, and is seemingly contradictory. To overcome this confusion, the OVPC has an educative role and offers its services to individual agencies to assist with providing guidance in relation to records release, as well as sector-wide training, but before 2011 this had been little known.
Entitlement to records
As well as some confusion about the intention of privacy legislation, at the time of the workshop (in 2011), the view held by some was that records’ release was discretionary. It appeared not to be well known among CSOs that, underpinning the release of records, was an entitlement to access personal information. The starting point, then, is to release all information in the records, and to exclude only information that meets the grounds for exemption. In contrast, it was believed by some that there was no requirement to provide any records when requested. Hence, some record-holders released only what they wanted to release or what they thought care-leavers should see.
Illustrative of the lack of understanding of the entitlement was the practice of deleting a whole page of information from the records if any part of it was grounds for exemption. Not redacting the minimum amount was a source of a complaint made to the OVPC (2011). The complainant expressed concern that multiple pages had been removed from her record, rather than just those specific pieces of information that were exempted. In response, the OVPC directed the CSO to release all that was not specifically exempted. Here we see the OVPC being more concerned with releasing too little rather than too much – in contradiction to the expectations of some of those working in the field. As one record-holder noted at the research workshop: ‘[This case] highlights the need for clear policies and guidelines around release of data which includes other people; see “privacy” from the point of view of the rights of the “consumer”.’ Since then, as evident in the findings of the record-holders’ survey, a significant shift in understanding has occurred.
Reasonable and unreasonable disclosure
Record-holders were generally aware of the need to take care when releasing information about people other than the subject of the record. This is more obviously about privacy – other people's privacy. As Kirton et al. (Reference Kirton, Feast and Goddard2011: 921) found, there were distinct positions evident among the record-holders. One position was ‘towards . . . disclosure’ and the maximum release of information. This meant, according to one of the participants at the workshop, that redaction involved the ‘absolute minimum to protect others’ privacy’. Some record-holders went further than this, actively seeking out additional information from the records of other family members. Where siblings were known, their files were also searched so as to include all possible relevant family information. This information, one record-holder noted, was not ‘third party data’ – it was shared family information. Doing this ensured that as much as possible was explained about the family circumstances. It also meant that some family members did not receive more information than others, as reflected in the practice of using the eldest siblings’ file as the repository for reporting about the family. In contrast, Frank Golding (Reference Golding, Hill and Branigan2010: 89), who was in care during the 1940s and 1950s, was limited in his access to information for many years because his siblings’ files were not investigated. In the current practice of record-holders, where sensitive information was not released and it was believed there was ‘an unreasonable impact on the privacy of other individuals’, an explanation was provided to this effect.
Record-holders used various strategies to facilitate the release of sensitive information about others (such as siblings) that could help care-leavers understand their broader family or personal circumstances. Depending on the circumstances, consent could be sought from the person(s) concerned (as suggested by OVPC) – they could be invited to access their files and have the possibility of sharing information. Record-holders explained that sometimes this happens anyway, when one sibling applies for their records and others follow. They emphasised that central to this process was open communication with the care-leaver requesting the information.
The other position evident among record-holders was lack of confidence about what could be released, and this resulted in redaction of much or even all third-party data. As explained by Kirton et al. (Reference Kirton, Feast and Goddard2011: 921), this was an orientation ‘away from disclosure’. One reason for this greater cautiousness was to protect the privacy of people other than the subject of the file. Another reason was fear that action may be taken against the organisation for revealing ‘third party data’, regardless of how sensitive the information may be or whether the subject of the record may reasonably have been expected to know this information anyway. One CSO record-holder expressed the view that they were ‘frightened of being sued’ due to a breach of privacy of another person. Another said, in reflecting upon their organisation's policies and practice: ‘we focus on the privacy breaches aspect rather than having fair access to information’. It is likely that in many instances the redacted information would not have had ‘an unreasonable impact on the privacy of other individuals’ had it been released. Instead, distress was caused to the care-leaver as a result of not receiving information and not knowing what had been redacted.
An example of the way in which information was redacted in this overly cautious way is provided by Scott, a young man who was in care during the 1990s and who sought information from the CSO which had managed his foster care. When he received his records, there had been a blanket removal of any information that concerned anyone else other than himself – all information related to his parents, siblings and foster mother was redacted, including the most mundane. Some of this information he was already aware of – and could have been expected to have been aware of – and he did not consider it in any way sensitive. Here, we can see ‘unreasonable’ being interpreted in a highly restrictive way. But there was an odd twist to Scott's access to his records, perhaps reflecting something of the conflicted attitudes of staff to these activities, as he explained:
when I did get the folders [records] . . . a lot of it was blacked out . . . all [the pages are] there but most of it's blacked out, except for the things to do with me. But some of it you can read. It's a bit silly – it's like they've blacked it out but you can still read people's names . . . so if you actually looked close enough and concentrate enough you can read it so I don't know what the point was.
Like Scott, Debbie was also unhappy with what she found in her records. Debbie came into care as a baby and remained there during the 1960s and 1970s. She believed that some of what was written in her DHS records was untrue, but she was more concerned about what she was unable to read due to redaction. What else had been written about her and her family that did not reflect her memories of her childhood and that she did not know about? Frank Golding (Reference Golding, Hill and Branigan2010) requested reviews of FOI decisions that limited access to his records, and he did finally get to see the content of redacted information. Some of this information was significant in that it helped explain the reasons why he had been in care during his childhood; other information was not new and nor was it sensitive. He questioned whether revealing this information at the time of his initial request would have resulted in the ‘unreasonable disclosure’ of information relating to the personal affairs of these other people.
Included in the application form of some CSOs was a directive to care-leavers to seek the consent of other family members to ascertain if they wanted any information released about them, even the most mundane. This directive was a variation on the OVPC's suggested approach with the applicant doing the work of contacting third parties, but it could be highly problematic. In seeking information about his childhood, Scott had been advised to do this but he did not. Scott found it too time-consuming to contact the various parties likely to be identified in his records but more dauntingly, he found it:
a personal thing as well . . . for me to access those folders [records], I felt it was the right time for me, but bringing that up with other people such as my Dad, he might have thought ‘well I don't want to go back there, I don't want to bring all that stuff up’ so he might have not given me permission. Or my brother and sister, they might not have been ready as well.
In the end, given these access regulations in place at this CSO, he only received information about himself; all references to others were redacted (but ineffectively, as we have seen).
While the second position suggests a less clear understanding of the implications of the Privacy and FOI Acts, a shift was evident in the interviews. These changes could be partly to do with improved records management processes – in other words, more records were found – but it could also be that there was a greater willingness to release records due to a less restrictive view of what might be ‘unreasonable’.
Discussion: What could be done to improve this situation?
This research suggests three key policy implications. First, understanding the importance of the records is fundamental to the work of record-holders. The information held in these records can be very significant to care-leavers, making sense of who they are and what has happened to them. The records can explain the reasons why children went into care and what happened to their families when they were there, both parts of their life-story that care-leavers may not know otherwise. These records can also provide information about parents, siblings and other family members with whom they have lost contact as children, or have never known. More than this, the records may be the only traces that care-leavers have of their childhoods. The physical documents may hold importance regardless of their content. Bearing in mind the importance of these records, then, this article has argued that the discretion that record-holders exercise in the release of records needs to be both compliant and compassionate.
Second, Privacy and FOI Acts are used to access care records, but this research has shown that, while there is change occurring, there is confusion about the intent and application of this legislation. Training and guidance are needed to facilitate both compliance and compassion in the release of records. Other sources, such as a UK guide (Feast, Reference Feast2009), provide general directions for work in this area, but no such guide exists in Australia to assist or make sense of the local legislative contexts (Goddard et al., Reference Goddard, Murray and Duncalf2012).
Third, what this research demonstrates are the difficulties in the interpretation and application of legislation to circumstances for which they were not intended. These Acts were not designed to deal with access to information about the life histories of people who grew up in care. While this research shows that there has been headway in improving access to records by care-leavers, and, in Victoria, there is evidence of compassion among government and CSOs working in this area, the release of third party data remains problematic and the discretionary concepts of ‘unreasonable impact’ and ‘unreasonable disclosure’ impediments to release. An applicant may seek access to documents that include personal information of people other than themselves and that is potentially ‘unreasonable’ to disclose, but this same information may also be highly relevant to their personal and family history. As noted by Kirton et al. (Reference Kirton, Feast and Goddard2011: 922), ‘matters that are clearly highly sensitive to a family member are also central to a post-care adult's understanding of his or her history’. While ‘such matters are generally dealt with informally in families, the involvement of the state crucially mediates family relationships, not least through the production and retention of written records’ (Kirton et al., Reference Kirton, Feast and Goddard2011: 922).
The model that has been used in relation to people who were adopted could be a more suitable approach. Adopted people, in Australia and the UK, have greater legal rights to personal information than care-leavers, even though the circumstances that led them not to be brought up with their natural family may be little different. There have been unsuccessful attempts to secure such a legislative framework in the UK (Kirton et al., Reference Kirton, Feast and Goddard2011; Goddard et al., Reference Goddard, Murray and Duncalf2012) and there have been some discussions in Australia as well.
Conclusion
There is increasing recognition of the importance of personal records to care-leavers which has subsequently driven changes in the practice of records release, including in relation to the application of privacy and FOI legislation. Records’ release runs into difficulty regarding the release of third party data – information that may be crucial to a care-leaver's understanding of their personal and family history. While potentially the inclusion in records of third party data is a reason why information would be exempted in some limited circumstances, this research found evidence of uncertainty about how to apply the legislation in compliant and compassionate ways. There are calls to put in place alternative legislation to provide for greater rights to personal information for care-leavers.
Acknowledgments
The research on which this article was based was funded by an Australian Research Council Linkage grant. Professor Cathy Humphreys from the University of Melbourne was the lead Chief Investigator of the wider project, known as Who Am I? Making Records Meaningful. Frank Golding generously reviewed a draft of the paper.
