Explanatory Statement
Variation of the Queensland Club Industry Privacy Code
This Explanatory Statement has been drafted for the purpose of fulfilling the Office of the Privacy Commissioner’s obligations under s. 26(1) of the Legislative Instruments Act 2003.
1. PURPOSE
In December 2001, Part IIIAA of the Privacy Act 1988 (Privacy Act) was introduced. It permitted organisations in a particular sector to subscribe to a voluntary privacy Code.
An approved Code could increase privacy standards above the obligations contained in the National Privacy Principles of the Privacy Act.
The Queensland Club Industry Privacy Code (the Code) was first approved on 7 August 2002. The Code sets out the obligations of Code subscribers in relation to the handling of personal information of club members and patrons.
The application to vary the Code was received from Brother’s Leagues Club Ipswich Inc. following a review of the operation of the Code. The purpose of the variation to the Code is to give effect to the review undertaken by the Code proponent, Clubs Queensland.
The variation corrects several typographical errors, deletes examples and incorporates other changes to make the Code easier to understand.
1.2 Authority for making this Approval
The approval to vary the Code is made under s.18BD of the Privacy Act. Section 18BD states:
(1) An organisation may apply in writing to the Commissioner for approval of a variation of an approved privacy code by giving the Commissioner a copy of the code that incorporates the variations.
(2) The Commissioner may approve in writing the variation.
(3) In deciding whether to approve the variation, the Commissioner must consider all of the matters that the Commissioner would consider in deciding whether to approve under section 18BB a privacy code identical to the approved privacy code with the variation.
(4) However, if the Commissioner thinks that a variation is minor, he or she need not be satisfied that members of the public have been given an adequate opportunity to comment on a draft variation of the code (as would otherwise be required by paragraph 18BB(2)(f). Instead, the Commissioner may consult any person he or she thinks appropriate about the draft variation.
(5) The approval of the variation takes effect on the day specified in the approval.
(6) The day specified must not be before the day on which the approval is given.
2. REASONS FOR MAKING THE APPROVAL
2.1 Background to Approval
The Code was first approved on 7 August 2002 to come into effect from 23 August 2002. The Code is administered by Clubs Queensland, the peak body representing member clubs.
On 10 December 2008 Brothers Leagues Club Ipswich Inc. formally submitted an application to vary the Code. It advised that the application was the result of extensive consultation in relation to the first three year review of the Code.
2.2 Public interest and other relevant considerations
Relevant considerations
In deciding whether to approve a variation to a Code, under s.18BD(3) the Privacy Commissioner must consider the matters that the Commissioner would consider in deciding whether to approve a Code under s.18BB. Section 18BB(2) and 18BB(3) provide that the Commissioner should have regard to matters such as whether:
- the Code incorporates all the National Privacy Principles (NPPs) and sets out obligations that, overall, are at least equivalent to those principles, s.18BB(2)(a); and
- the Code specifies the organisations or types of organisations that will be bound by the Code and how organisations can withdraw from the Code and when cessation takes effect, s. 18BB(2)(b), (c) and (d).
The Privacy Commissioner is satisfied that the variation to the Code complies with the relevant provisions. As the Privacy Commissioner has determined that the variations are minor, she is not required to be satisfied about the requirements in s.18BB(2)(f).
In relation to complaints, the Privacy Commissioner remains the Code adjudicator. Therefore, s.18BB(2)(e) and 18BB(3) do not apply.
Public interest
The co-regulatory approach offered by Part IIIAA of the Privacy Act allows for some flexibility in how organisations approach their privacy obligations. At the same time, it ensures that minimum enforceable standards apply to the protection of personal information.
The Code currently has 54 subscribers. The Code incorporates higher privacy protections than the NPPs in some areas and incorporates recent changes to the Privacy Act. The Code also provides privacy standards which are written in industry specific language.
Public consultation
The Code administrator has advised that it undertook extensive consultation on the operation of the Code during the first three year review of the operation of the Code (under clause 13.1 of the Code).
Where a Code variation is considered to be minor, s.18BD(4) of the Privacy Act applies. Under s.18BD(4), the Privacy Commissioner does not need to be satisfied that members of the public have been given an adequate opportunity to comment on the draft variation. In the Privacy Commissioner’s Code Development Guidelines, Guideline 7.1 states that a major amendment is one that is:
“... likely to have a significant effect on the operations embodied in the code or is likely to have a measurable impact on a group of individuals”.
The Privacy Commissioner is satisfied that the Code variation is minor as defined in s.18BD(4) of the Privacy Act and 7.1 of the Code Development Guidelines. On this basis, the Commissioner did not require the Code administrator to undertake further public consultation.