I am concerned, but less so in the case of departments in large part because the substantive part of the legislation says that this balancing, whether the public interest clearly outweighs privacy, is an assessment that is done within the discretion of a department. In the current law it is the institutional head who ultimately decides, although I would like to be able to review these and we have not seen a major issue. The combination of institutional heads having the discretion and the Supreme Court jurisprudence to the effect that privacy must not be given a narrow or cramped interpretation that binds institutional heads, that is a regime that could be perfected, but it adequately protects privacy.
With the bill the Information Commissioner will be able to order a department on the exception to this mandatory protection of personal information, including provisions that go to the balancing between the public interest and the protection of privacy. What is the net effect of giving order-making to the Information Commissioner on the exception with the discretion remaining, at least in theory, for departmental heads? That's a bit unclear to me.