Hidden in Plain Sight: Freedom of Information, the COVID Procurement Contracts, and Australia's Transparency Gap

Part 2 of The Accountability Gap: A three-part investigation into Australia’s information environment, transparency architecture, and the conditions necessary for democratic accountability.

Key Points

• Most Australians carry a second assumption alongside the one examined in Part One. The first was: if something of genuine national importance were happening, someone in the media would tell them. The second is quieter but just as foundational: if I wanted to find out what my government decided and why, I could ask. The Freedom of Information Act 1982 (Cth) exists precisely to honour that assumption. This piece asks whether it does.

  
  

• Australia’s FOI Act was designed to make government transparent. In practice, a combination of broad exemptions, a slow and under-resourced review mechanism, and an institutional culture that treats non-disclosure as the default has produced a system that protects institutional self-interest more reliably than it serves public accountability.

  
  

• The COVID-19 vaccine procurement contracts are the most consequential recent case study: billions of dollars of taxpayer commitments made under agreements the public cannot read, for a product administered to the entire population. The Australian Government’s own vaccine agreements page states the position plainly: ‘The contract documents/supply agreements themselves are not appropriate for release as they contain confidential and commercially sensitive information.’

  
  

• The indemnities granted to manufacturers create liabilities the federal budget papers themselves describe as unquantifiable.

  
  

• Governments routinely assume contingent liabilities in major procurement agreements. What makes this case unusual is not the existence of those liabilities, but their scale, their public health significance, and the inability of citizens to examine the agreements under which they were accepted.

  
  

• A second transparency failure runs alongside the procurement question. In February 2026, I lodged a narrowly scoped FOI request with the Department of Health, Disability and Ageing. I sought the Department’s own internal policy documents, legal interpretations, and senior-level briefings on how it understood and applied the concepts of voluntary, informed, free, valid, and un-coerced consent during the COVID-19 vaccination period. The Department refused, citing unreasonable diversion of resources, even after the scope was significantly narrowed. No partial access, staged release, or extraction of identifiable final documents was offered. The request is now under review by the Office of the Australian Information Commissioner. The architecture asked me to wait. It continues to ask.

  
  

• Three structural failures produced both outcomes: the exemption architecture of the FOI Act itself, the capacity and pace of the review mechanism, and the application of exemptions in circumstances where the public has no means of assessing whether the statutory public interest balancing exercise was properly conducted. None of these failures is specific to the COVID period. Together, they describe a transparency architecture that was inadequate before 2020, was tested at scale from 2021, and remains unreformed.

  
  

• An informed citizenry that cannot access the reasoning behind decisions made in its name is not equipped to act on that information. Where Part One documented how the conversation was shaped before it reached the public, this piece documents what citizens find when they try to examine what happened after. The answer, too often, is a wall.

There is a moment that most people who engage seriously with Australia’s Freedom of Information system eventually reach. They have framed their request carefully. They have waited, sometimes thirty days, sometimes considerably longer. They have received a decision that grants access to some documents, and then a list of exemptions covering the rest. They look at the list, and they recognise that the documents they most needed are precisely the ones that have been withheld. The experience is not dramatic. It is quiet and bureaucratic. But what it discloses, if you keep looking, is a structural design.

This piece examines that design: what the FOI Act promises, how the exemption architecture operates in practice, what happened when Australians tried to access the COVID-19 vaccine procurement contracts, what happened when a citizen tried to access the Department of Health’s own reasoning about consent during that period, and what both refusals reveal about the conditions under which democratic stewardship can or cannot function.

The Promise of the Act

The Freedom of Information Act 1982 (Cth) opens with a statement of purpose. Section 3 declares that its object is to give the Australian community access to information held by the government and its agencies. The Act is founded on the principle that government information is a public resource, held on behalf of the people it serves, and that access to it, except where specific public interest grounds justify non-disclosure, is a right rather than a privilege.

The Act provides an independent review mechanism, the Office of the Australian Information Commissioner. It establishes statutory timeframes: thirty days, in most cases, to process a request. It requires that decisions to withhold information be justified against specific exemptions, each of which carries a public interest test. It mandates that where partial disclosure is possible, it must be provided. In its structure, the Act looks like a working accountability mechanism. The question this piece asks is whether, in practice, it functions as one.

The Exemption Architecture

The FOI Act contains two categories of exemption. Absolute exemptions, covering national security documents (section 33) and Cabinet documents (section 34), require no public interest balancing: if the document fits the category, it is exempt. Conditional exemptions, covering commercial documents (section 47), operations of agencies (section 47E), and several others, require an agency to establish not merely that the exemption category applies, but that disclosure would be contrary to the public interest.

The Act also provides a practical refusal power under section 24, which allows an agency to refuse a request without engaging with any substantive exemption at all, on the grounds that processing would constitute an unreasonable diversion of resources. This is a separate mechanism from the exemption architecture, and it is significant: it can be invoked against a narrowly scoped, carefully framed request, declining to engage with whether the underlying information is actually exempt. Its operation is documented later in this piece.

On paper, the conditional exemption structure is a meaningful constraint. In practice, the picture documented by the OAIC’s own annual reports is more complicated. Applications for Information Commissioner review rose 35% in 2020-21 and a further 23% in 2021-22, before falling 16% in 2022-23. Despite that fall in new applications, the backlog remained severe (OAIC Annual Report 2022-23).

By the end of the 2022-23 financial year, the OAIC had 2,004 IC reviews on hand, of which more than half were more than twelve months old. An accountability mechanism that takes more than a year to resolve an access dispute is not an effective check on institutional non-disclosure: by the time a decision is made, the moment for the information to influence public debate has often passed.

The National Cabinet question illustrates how the rules can be extended when a transparency outcome proves inconvenient. When Prime Minister Morrison declared in March 2020 that National Cabinet had the same status as the federal Cabinet, the practical implication was that its documents would be shielded from FOI under section 34’s Cabinet exemption. Senator Rex Patrick challenged that position. The AAT found, in Patrick and Secretary, Department of Prime Minister and Cabinet [2021] AATA 2719 (5 August 2021), that the National Cabinet was not a committee of the federal Cabinet and its documents did not fall within the exemption.

The government’s response was to introduce the COAG Legislation Amendment Bill 2021, seeking to amend the FOI Act to achieve by statute what the declaration could not. The Law Council of Australia described the proposed changes as going ‘too far’.

The episode is instructive as evidence of how the architecture can be adjusted when accountability produces outcomes the executive finds uncomfortable.

The Procurement Contracts: Commercial in Confidence

The most consequential application of the exemption architecture to the COVID period concerned the vaccine procurement contracts. The Australian Government invested, by its own account, over $18 billion in COVID-19 vaccine and treatment supply, through advance purchase agreements with Pfizer/BioNTech, AstraZeneca, Moderna, Novavax, and others. The terms of those agreements, pricing, supply conditions, liability provisions, indemnity arrangements, and the consequences for taxpayers if things went wrong, have not been publicly disclosed.

The government’s own vaccine agreements page states the standing position: the contract documents are ‘not appropriate for release as they contain confidential and commercially sensitive information.’

According to reporting on the refusal decision, Australian solicitor Tony Nikolic, of Ashley, Francina, Leonard & Associates, lodged a formal FOI request with the Department of Health seeking access to the Pfizer procurement contract, and the request was refused. The Department’s decision is reported to have stated that the contracts ‘contain information that is confidential in nature’ including ‘trade secrets and commercially valuable information’ and ‘commercial information regarding the procurement of vaccines to Australia’ including ‘indicative prices, payment terms, professional indemnity, ongoing funding measures, manufacturing details and production measures.’

At a Senate legislation committee hearing on 3 August 2023, in which Senator Malcolm Roberts questioned Pfizer Australia's Country Medical Director Dr Krishan Thiru under oath, Thiru confirmed the position directly: 'The contents of Pfizer's contract with the Australian Government remains confidential.' The exchange is recorded in the official Hansard of the Senate Education and Employment Legislation Committee and is available in full on Senator Roberts' YouTube channel.’

In 2021, a legal challenge in the NSW Supreme Court that sought to subpoena the Pfizer contract was blocked. The Department of Health’s FOI 4049, the Halton Review of COVID-19 vaccine and treatment purchasing released in February 2023, contains redactions across the most commercially sensitive sections despite being released under FOI.

The OAIC’s guidance on conditional exemptions is clear on the legal standard: the presence of a Commercial in Confidence label does not automatically satisfy the public interest test. The FOI Act requires an overriding public interest against disclosure. Legal commentary is equally clear: the Freedom of Information Act 1982 (Cth) requires an overriding public interest against disclosure, and government contracts have an obligation to the public that private contracts do not.

The core difficulty, documented rather than merely alleged, is this: the public is unable to assess whether the statutory public interest balancing exercise was properly conducted, because the underlying material that would allow that assessment remains unavailable. The reasoning for the exemption cannot be scrutinised because scrutinising it requires access to the exempted material.

What is publicly known tells its own story. The federal budget papers for 2023-24 acknowledge multiple ‘unquantifiable contingent liabilities’ arising from the vaccine indemnities granted under the procurement agreements. Unquantifiable means that the Commonwealth’s potential exposure cannot be given a dollar figure. The taxpayer carries an unknown liability, under terms no one outside the negotiating parties can read, for a product administered to the entire Australian population.

The International Pattern

The comparison with comparable liberal democracies is instructive without being dispositive, and it strengthens rather than weakens the structural argument.

New Zealand did not release its full COVID vaccine contracts either. But after receiving seventeen complaints about Official Information Act refusals, New Zealand’s Chief Ombudsman personally reviewed the contracts and recommended that the Ministry of Health publish a substantive public summary by 18 September 2023, addressing the nature of the government’s commitments, the indemnity arrangements, and the question of whether any terms assigned sovereign resources as collateral. New Zealand complied. Australia has produced no equivalent.

In the United Kingdom, Mr Justice Chamberlain found in R (Good Law Project Ltd) v Secretary of State for Health and Social Care [2021] EWHC 346 (Admin), handed down on 18 February 2021, that the Secretary of State had breached his legal obligation to publish contract award notices within 30 days of awarding COVID-related contracts. The judge stated that these obligations ‘serve a vital public function and that function was no less important during a pandemic.’

Separately, reports by STOPAIDS and Just Treatment documented that UK vaccine contracts remained heavily redacted even where released under FOI, with a secrecy clause unique to the UK’s Pfizer agreement requiring any arbitration between the government and the company to be held in private.

The pattern is consistent across comparable democracies. The justification in each jurisdiction was substantively identical: commercial in confidence, applied at the instruction of the same manufacturers in each country. The outcome was substantively identical: citizens in Australia, New Zealand, and the United Kingdom could not examine the terms under which their governments committed ‘unquantifiable obligations’ on their behalf.

The transparency failures were not unique to any one government. They were an architecture deployed in parallel. The question this observation raises for Australia is specific: given that comparable jurisdictions found mechanisms to release more than Australia has, what structural conditions explain the difference?

The Consent Documents: A Different Refusal

Alongside the procurement transparency question runs a second and, in some ways, more revealing failure.

In February 2026, I lodged FOI 26-2668 with the Department of Health, Disability and Ageing, carefully scoped to avoid unnecessary burden, excluding personal medical records, Cabinet materials, and broad operational documents. The request sought a specific and modest category of information: the Department’s final policy positions, summarised or final legal advice, and senior-level correspondence on how it understood and applied the concepts of voluntary consent, informed consent, free consent, valid consent, and un-coerced consent, in the context of public health policy and COVID-19 vaccination between 2020 and 2023.

This was not a request for raw data. It was a request for the government’s own reasoning about a foundational ethical concept, as applied during one of the most significant public health interventions in Australian history.

The Australian Immunisation Handbook, the Department’s own official clinical guideline, defines valid consent as ‘the voluntary agreement by an individual to a proposed procedure, which is given after sufficient, appropriate and reliable information… in the absence of undue pressure, coercion or manipulation.’ The FOI sought to understand how the Department, in its own internal reasoning, applied that standard during a period when employment, education, travel, and participation in ordinary life were in many contexts conditional on vaccination.

On 11 March 2026, the Department issued a practical refusal notice under section 24 of the FOI Act, estimating more than 100,000 documents and thousands of processing hours. In response, I significantly narrowed the request to final policy documents, summarised or final legal advice, and senior-level correspondence with key regulatory bodies.

On 8 April 2026, the Department refused the narrowed request in full, concluding that even this reduced scope would involve 620 documents and constitute an unreasonable diversion of resources. No attempt was made to offer partial access, staged release, or extraction of clearly identifiable final documents. I lodged an internal review on 13 April 2026. The matter is now before the OAIC.

The section 24 mechanism is worth pausing on. It is distinct from the exemption architecture: it does not require the agency to establish that the requested documents are exempt. It requires only that processing them would be unduly burdensome. Applied to a narrowed, scoped request for final policy positions on a foundational ethical concept, from the agency responsible for that policy, section 24 functions not as a precision instrument but as a blunt one. It closes the door before the public interest balancing exercise that the conditional exemption framework would otherwise require.

The timing of the refusal is instructive. On 27 March 2026, the Supreme Court of Victoria handed down Gawthrop v Bendigo Health [2026] VSC 157, finding that consent obtained under institutional pressure or conditional access to care is not free and voluntary. It confirmed that consent requires capacity, understanding, and a true, free choice. It is not satisfied by what the Court called ‘non-consenting mere submission.’

Days later, the Department of Health refused to release its own internal reasoning about how it applied the same foundational principles during the period in question. The proximity of the two events is not incidental. It illustrates, with some precision, the gap this piece is documenting: the legal standard for valid consent has been confirmed; the Department’s own reasoning on whether it met that standard, during the most consequential public health intervention of the era, remains inaccessible.

The Review Architecture

When an FOI request is refused, an applicant may seek internal review from the agency, and then external review from the OAIC. The OAIC review process is the primary accountability mechanism for FOI refusals. Its adequacy is therefore a first-order question for any assessment of the system as a whole.

The OAIC’s own annual reports document a system under sustained pressure. IC review applications rose 35% in 2020-21 and a further 23% in 2021-22, before falling 16% in 2022-23 as the OAIC focused on clearing its backlog. By the end of the 2022-23 financial year, the OAIC had 2,004 IC reviews on hand, of which more than half were more than twelve months old. The average time to finalise an IC review increased again in 2023-24. The OAIC itself had been seeking additional resourcing since 2018. Additional funding was provided in the May 2023 Budget, and the government announced the reinstatement of a three-commissioner model with a dedicated FOI Commissioner.

These are welcome developments. They do not undo the years in which the review mechanism was operating below the capacity the volume of requests required.

A citizen who lodges an FOI request, receives a refusal, seeks internal review, is refused again, and then applies to the OAIC for IC review faces a realistic prospect of waiting more than a year for a substantive decision.

During that year, the information’s capacity to inform public debate about the decisions that produced it is diminished. A transparency mechanism that operates at this pace is not a real-time accountability tool. It is an archival process. In matters where decisions are being made, mandates are being implemented, and public debate is actively underway, that distinction matters considerably.

FOI 26-2668 is live as this piece goes to publication. I note it here not because the experience is exceptional, but because it is typical of what this design produces. The transparency mechanism asked me to wait. It continues to ask.

The Entanglement

Part One of this series documented the relationship between concentrated media ownership and government advertising spend during the COVID period. The numbers are on the public record. In 2021-22, the Morrison government spent a record $339 million on taxpayer-funded advertising, the highest in Australian history to that point. Of that, $89 million was spent on the COVID-19 vaccine campaign alone, administered by the same Department that simultaneously withheld the procurement contracts and the consent policy documents being sought through FOI.

The argument here is structural, not conspiratorial, and it is important to be precise about what it does and does not establish. It does not require that any individual within the Department acted improperly or that advertising decisions shaped FOI decisions by design. It establishes that a single institution managed both the largest health advertising spend in Australian history and the FOI decisions on the same subject matter.

That structural condition creates circumstances in which institutional self-interest can shape what is disclosed and when, without requiring any individual actor to intend that outcome. Institutions tend, as fallen human institutions tend, toward self-preservation. The architecture does not need bad actors to produce the outcomes documented in this piece. It needs only that tendency, operating within a design that does not adequately constrain it.

What Equipped to Act Requires

Part One of this series earned the word informed: it established that the information environment through which citizens form judgements is structurally concentrated, access-constrained, and, in the COVID period, hostile to dissenting professional voices. This piece earns the word equipped.

An informed populace that cannot access the reasoning behind decisions made in its name is not equipped to act on that information. Knowing that something happened is not the same as being able to evaluate why it happened, on what terms, and by what reasoning. The FOI Act is the formal mechanism through which Australians are supposed to be able to make that evaluation. Where that mechanism is systematically inadequate, the appearance of accountability remains without its substance.

The significance of what is documented here becomes clearer when placed alongside what informed consent actually requires. The Supreme Court of Victoria confirmed in Gawthrop v Bendigo Health [2026] VSC 157 that consent requires capacity, understanding, and a true, free choice.

The Australian Immunisation Handbook commits the Department of Health to the same standard: voluntary agreement, given after sufficient and reliable information, in the absence of undue pressure or coercion. Part Three of this series will examine those standards directly, and ask whether they could have been met in the information environment this piece and Part One have documented.

This piece establishes the prior condition: citizens cannot give or withhold informed consent in any meaningful sense if the architecture that would equip them to do so is systematically resistant to disclosure.

Australia's Transparency Gap - The Question of Stewardship

There is a way of reading everything this piece has documented that treats it as a technical argument about administrative law. The FOI Act has gaps. The OAIC has been under-resourced. Commercial in Confidence provisions have been applied in circumstances where the public cannot assess whether the statutory standard was met. Section 24 has been invoked against narrowed requests for foundational policy reasoning. These are real problems that deserve real reform.

There is another way of reading it. Every Australian who received a COVID vaccine received it as a person bearing the image of God, with the capacity to reason, to weigh evidence, and to make a decision about their own body and the bodies of their children. The question of what the government committed to on their behalf, what financial risks it accepted, what indemnities it granted, and how it understood the concept of consent during that period, is not a bureaucratic question. It is a question about what these people were owed by those who acted in their name.

The FOI Act is not merely a legal convenience. It is one of the structural conditions through which a self-governing people exercises stewardship over the institutions that act in its name. Where that mechanism is systematically inadequate, not through malice but through design, resourcing, and the predictable tendency of institutions toward self-preservation, stewardship is impaired. Not dramatically. Not obviously. Quietly, procedurally, in the language of exemptions and review timelines and unquantifiable contingent liabilities.

The gaps do not announce themselves. They are visible only when a citizen tries to walk through the door the Act holds open and finds it narrower than the promise suggested. The accountability architecture of a democracy is only as strong as the mechanisms that honour it in practice. Where those mechanisms are adequate, the second assumption Australians carry, that they could find out, if they wanted to, holds. Where they are not, the assumption does the work of accountability without its substance.

Part Three of this series will examine what was owed to every Australian who received a COVID vaccine under the consent standards the government itself had committed to, and ask whether those standards could have been met in the information environment documented across Parts One and Two. It is where the architecture and the human stakes converge.

I remain open to the answer being more complicated than this piece has been able to establish. But I am not open to the question being less important than it is.

The one who states his case first seems right, until the other comes and examines him.  — Proverbs 18:17

Thank you for reading. Part Three is coming. God bless,

Mark Neugebauer