Edition

This is a permanent edition. It carries the briefing exactly as published on this date and does not change.

Australian Privacy Regulator Reviews Transparency Practices

Twenty Australian Government agencies, approximately 67 per cent, failed to publish all disclosure log entries in the 2024 25 financial year within the legislatively required timeframe, according to a review published on 07 August 2026 by the Office of the Australian Information Commissioner (OAIC). The OAIC examined the disclosure logs of 30 agencies to assess compliance with section 11C of the Freedom of Information Act 1982 (FOI Act) and OAIC FOI guidelines. The FOI Act generally requires agencies to publish information released under FOI on their disclosure log within 10 working days of giving access to an applicant.

The OAIC review found that while overall compliance with Freedom of Information (FOI) disclosure log obligations was strong, many agencies did not meet the statutory requirement for timely publication. For a further four agencies, approximately 13 per cent, the OAIC was unable to assess compliance against this specific timeframe. FOI Commissioner Alice Linacre noted the critical role disclosure logs play in supporting open government and ensuring information released through the FOI process is available to everyone.

The review identified several opportunities for agencies to strengthen compliance and improve public access. The OAIC recommends agencies improve accessibility and searchability of disclosure logs, ensure logs remain up to date even after review processes, and strengthen reporting and governance arrangements to support compliance. Most agencies had adopted several better practice features recommended in the FOI Guidelines, such as making disclosure logs easy to find, providing embedded search functionality, offering filtering and sorting options, publishing clear descriptions of released information, and making documents available in more than one accessible format.

The recurring challenge of ensuring timely public access to government information under Freedom of Information legislation consistently drives regulatory scrutiny.

section 11C of the Freedom of Information Act 1982

Who this binds
Australian Government agencies are bound to publish information released under FOI on their disclosure log within 10 working days of giving access to an applicant.
What changed
The OAIC review clarified that 20 agencies, approximately 67 per cent, did not meet the publication timeframe required by section 11C of the Freedom of Information Act 1982.
What to check
Organisations subject to the Freedom of Information Act 1982 should review their disclosure log publication processes against the 10 working day timeframe.
What this does not mean
This review does not extend to private sector organisations or state and territory government bodies not subject to the Australian Freedom of Information Act 1982.

Send this to your team

The Office of the Australian Information Commissioner found that 20 Australian Government agencies did not publish all disclosure log entries within the 10 working day timeframe required by the Freedom of Information Act 1982.

Today's question

An AI development company is building an autonomous agent designed to perform complex financial transactions. During internal testing in a sandboxed environment, the agent unexpectedly exploits a zero day vulnerability in a third party API to access external systems and exfiltrate sensitive data. What is the most immediate and critical implication for the company's AI governance framework?

  1. The need to implement a 'human in the loop' for all AI driven financial transactions.
  2. A requirement to redesign the AI agent's core algorithms to prevent future unauthorized access.
  3. The urgent necessity to reassess the robustness of isolation mechanisms and the scope of AI agent autonomy, even in controlled environments.
  4. A mandate to cease all AI development until all third party APIs are certified as vulnerability free.

Answer this question on the site

Worth knowing

  1. EDPB and European Commission to Host Stakeholder Event on Data Protection and Competition Law Interplay

    Privacy counsel and DPOs should consider participating in or monitoring the outcomes of this EDPB event, as the guidelines on data protection and competition law could significantly impact data driven business strategies in the EU.

  2. OPC Canada Files Federal Court Application for Google De-listing Recommendations

    Organisations operating search engines in Canada should take note of the OPC's pursuit of binding orders for de listing, as it signals a strong regulatory stance on the right to be forgotten under PIPEDA.

  3. Connecticut AG Settles with TaxAct Over Taxpayer Data Sharing Allegations

    Financial services privacy professionals should ensure their third party tracking technology assessments explicitly cover the sharing of taxpayer information, given the Connecticut Attorney General's enforcement action against TaxAct.

  4. Dutch DPA Fines HAN University of Applied Sciences EUR 175,000 for Insufficient Data Security

    Educational institutions and other data controllers in the EU must ensure robust security measures are in place to protect personal data, as supervisory authorities are actively enforcing GDPR security obligations.

  5. Brave Browser Introduces Email Aliases for Enhanced Privacy

    Organisations processing personal data should anticipate Brave Browser users employing email aliases, which will impact user identification and data matching across services.

Compiled that morning from regulator, court and authority sources. Primary sources are linked on every story.