FOI Exemption Section References

Name: FOI Exemption Section References
Creator: TestPattern Community
License: https://opensource.org/licenses/MIT

Detects Freedom of Information Act exemption section references (sections 33-38 and 42-47) in Australian government documents. Requires FOI/freedom of information keyword context.

Type: regex
Engine: universal
Confidence: medium
Confidence justification: Medium confidence: section number references are somewhat specific to FOI contexts when combined with the s/section prefix and constrained number ranges. However, legislative section references appear in many legal contexts, so corroborative keywords improve accuracy.
Detection quality: Verified
Jurisdictions: au
Regulations: IPA 2009 (Qld), Privacy Act 1988 (Cth), SOCI Act 2018 (Cth)
Frameworks: DISP, ISO 27001, NIST CSF
Data categories: government, security
Scope: narrow
Risk rating: 7
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:s(?:ection|ect)?\.?\s*(?:3[3-8]|4[2-7][A-Za-z]?))\b

Corroborative evidence keywords

FOI, freedom of information, exemption, s33, s34, s37, s38, s42, s45, s47, s47F, FOI request, FOI exemption, FOI Act, information access, right to information, RTI

Proximity: 300 characters

Should match

s33 — FOI Act section 33 exemption
s47F — FOI Act section 47F personal privacy
s38 — FOI Act section 38 secrecy provisions

Should not match

s32 — Section number below valid range (32 instead of 33-38)
s39 — Section number above valid range (39 instead of 33-38)
s41 — Section 41 not in valid range (42-47)

Known false positives

Legislative section references in non-FOI contexts such as other acts, regulations, or legal documents that use sections 33-38 or 42-47. Mitigation: Require proximity to FOI-specific keywords such as FOI, freedom of information, exemption, or right to information to confirm FOI context.
Code snippets and configuration examples containing section-related keywords or numeric references in developer documentation. Mitigation: Check for common source code patterns (function, import, class) and exclude technical contexts to reduce false positives.