My answer will have two parts.
First, under the mechanism that I call the formal access mechanism—in other words, access to information requests made to the department—there are certain provisions in the Access to Information Act and the Privacy Act to protect certain third parties, particularly those with commercial interests, but not others.
For example, if person A makes an access to information request that deals, among other things, with information about person B, the department should normally refuse to disclose information about person B. I am concerned about the impact of the Information Commissioner's orders in such cases. Normally, information about person B should be protected, but the person has no recourse if the wrong decision is made under the current act, except for certain third parties, including those with commercial interests.