EXPLANATORY STATEMENT

Issued by authority of the Assistant Treasurer, Minister for Housing and Minister for Homelessness, Social and Community Housing

Competition and Consumer Act 2010

Competition and Consumer (Motor Vehicle Service and Repair Information Sharing Scheme) Rules 2021

Section 57GE of the Competition and Consumer Act 2010 (the Act) provides that the Minister may, by legislative instrument, make rules prescribing matters required or permitted by Part IVE of the Act to be prescribed, or necessary or convenient to be prescribed, for carrying out or giving effect to that Part.

The purpose of the Competition and Consumer (Motor Vehicle Service and Repair Information Sharing Scheme) Rules 2021 (the Rules) is to prescribe technical and administrative details necessary to implement the Motor Vehicle Service and Repair Information Sharing Scheme (the scheme), established by the Competition and Consumer Amendment (Motor Vehicle Service and Repair Information Sharing Scheme) Act 2021.

The scheme mandates all service and repair information provided to car dealership networks and manufacturer preferred repairers be made available for Australian repairers and Registered Training Organisations (RTOs) to purchase. The scheme commences on 1 July 2022 and is incorporated into a new Part IVE of the Act.

The scheme as outlined in Part IVE of the Act operates by imposing obligations on data providers (generally scheme vehicle manufacturers), including:

• offering to supply information used for conducting diagnostic, service or repair activities (scheme information) for certain vehicles (scheme vehicles) to all Australian repairers and scheme RTOs;

• charging no more than the fair market value for the information;

• supplying scheme information (immediately in most circumstances) once the repairer has paid the agreed price; and

• restricting access to safety and security information to individuals who meet specified access criteria.

A data provider is a corporation or person whose business includes supplying scheme information to an Australian repairer or scheme RTO. A data provider may be a vehicle manufacturer, information owner, or licensee. The Act provides for significant penalties to be imposed on data providers for non‑compliance with their obligations under the scheme.

Under the scheme, Australian repairers and scheme RTOs have unrestricted access to purchase general information about a scheme vehicle. However, access to certain information about a scheme vehicle – safety and security information – is restricted to individuals who meet prescribed criteria and are fit and proper persons to use the information for the purposes of the scheme. This restriction on access to safety and security information is appropriate and necessary to protect vehicle security, and to protect the safety of information users, the vehicle and the public.

To enable the scheme to keep pace with changes to technology as well as provide administrative flexibility, the Act empowers the Minister to make rules about specified matters to ensure that the scheme operates effectively and efficiently.

The Rules prescribe technical and administrative details in relation to restricted access to safety and security information under the scheme:

• what is classified as safety and security information;

• the access criteria used to assess whether an individual is a fit and proper person to access and use safety or security information; and

• the types of, and circumstances in which, personal information may be sought when assessing whether an individual meets the criteria to be a fit and proper person to access and use safety or security information.

Details of the Rules are set out in Attachment A.

Between March 2021 and September 2021, Treasury consulted closely with the five signatories to the current voluntary agreement in developing the Rules. Treasury released an exposure draft of the Rules for public consultation between 2 September 2021and 24 September 2021. Nine submissions were received from various industry bodies (representing dealerships, manufacturers, repairers, aftermarket, motoring clubs and trainers), industry participants and the Australian Small Business and Family Enterprise Ombudsman, and were generally supportive of the proposed Rules. Minor modifications were made to the Rules in response to the feedback received.

Treasury also consulted with other Commonwealth Departments in developing the Rules, including the Australian Government Solicitor and the Australian Federal Police. Treasury also consulted relevant State and Territory agencies to discuss how the Rules may interact with existing motor vehicle service and repair licensing regimes in those jurisdictions.

Treasury has certified the Market Study by the Australian Competition and Consumer Commission (ACCC) as a process and analysis equivalent to a Regulation Impact Statement, for the purposes of developing the scheme. This Market Study can be accessed via the ACCC website.[1]

A statement of Compatibility with Human Rights is at Attachment B.

The Act specifies no conditions that need to be satisfied before the power to make the Rules may be exercised. Section 4 of the Acts Interpretation Act 1901 enables the Rules to be made in anticipation of its authorising provisions in Part IVE of the Act.

The Rules are a legislative instrument for the purposes of the Legislation Act 2003, and therefore subject to disallowance under section 42 of that Act. This provides appropriate parliamentary scrutiny and oversight.

The Rules commenced on 1 July 2022.

ATTACHMENT A

Details of the Competition and Consumer (Motor Vehicle Service and Repair Information Sharing Scheme) Rules 2021

Part 1—Preliminary

Section 1 – Name of the instrument

This section provides that the name of the instrument is the Competition and Consumer (Motor Vehicle Service and Repair Information Sharing Scheme) Rules 2021 (the Rules).

Section 2 – Commencement

This section provides that the instrument commences on 1 July 2022.

Section 3 – Authority

This section provides that the instrument is made under section 57GE of the Competition and Consumer Act 2010 (the Act).

Section 4 – Definitions

This section defines a number of key terms used in the Rules. Details of these terms are provided in the relevant sections below.

Parts 2 and 3—Prescribed rules governing restricted access to safety and security information in scheme vehicles

Overview

Under the scheme, data providers must offer and supply scheme information to Australian repairers and scheme RTOs if they meet the eligibility criteria.

Australian repairers are eligible to access information under the scheme if they are operating a business of diagnosing faults with, servicing, repairing, modifying or dismantling motor vehicles in Australia. Similarly, scheme RTOs are eligible if they offer a course in Australia which provides training in diagnosing faults with, servicing, repairing, modifying or dismantling scheme vehicles.

The scheme is not prescriptive as to how repairers can demonstrate they are operating a relevant business to data providers – this can be achieved in a variety of ways. For example, in some States and Territories, a licence is needed to run such a business so details of the licence would be acceptable. Alternatively, businesses may have an ABN, registered business name or be able to demonstrate their activities are planned, organised or carried out in a businesslike manner. For example, business.gov.au indicates this may include keeping business records or operating from business premises.

All repairers and RTOs can access general information about a scheme vehicle for the purposes of operating their repair business or providing a training course.

However, access to safety and security information is restricted to individuals who meet prescribed criteria and are fit and proper persons to use the information for the purposes of the scheme. This restriction on access to safety and security information is designed to protect vehicle security or the safety of information users, the vehicle and the public. The Act provides that civil penalties may apply to a data provider for supplying prescribed safety or security information to a person who does not meet the prescribed criteria to access that restricted information. [Section 57DB(1) of the Act]

What is safety and security information?

The Act empowers the scheme rules to prescribe the kinds of information that are safety information or security information in a scheme vehicle. [Section 57BF of the Act]

Who can access safety and security information?

The Act empowers the scheme rules to prescribe safety and security criteria, for the purposes of assessing whether an individual is a fit and proper person to access and use safety and security information. [Section 57DB(4) of the Act]

The Act also provides that different access criteria may be prescribed for safety information and security information. [Section 57DB(5) of the Act]

What information needs to be provided in order to access safety and security information?

The Act outlines the personal information about an individual that a data provider may request, for the purposes of working out if that individual is a fit and proper person to access the safety or security information they have requested:

(a) the individual’s name and residential address;

(b) information about the individual’s relationship to the Australian repairer or scheme RTO;

(d) a criminal records check about the individual; and

(e) any other information (other than sensitive information, as defined in the Privacy Act 1988 (Privacy Act)) prescribed by the scheme rules relevant to working out whether the individual is a fit and proper person to access and use the safety and security information.

[Section 57DB(6) of the Act]

The Act also empowers the scheme rules to prescribe matters in relation to the circumstances in which personal information about an individual may be sought or given, for the purposes of assessing whether they are a fit and proper person to access and use safety and security information. [Section 57DB(7) of the Act]

The rules prescribing access to safety information and security information are described separately below. All legislative references in this attachment are to the Rules unless otherwise stated.

Matters the Rules do not prescribe

These Rules do not create any offences or civil penalties. The Rules operate within the scheme’s civil penalty framework set out in the Act. The Act provides that significant pecuniary penalties may be imposed for contraventions of key provisions in the Act, including where the technical details about the operation of those provisions are prescribed in the Rules. The Act expressly prohibits scheme rules creating any offences or civil penalties. [Section 57GE(2) of the Act]

Safeguards relating to the protection, handling, use and storage of personal information disclosed under the scheme are set out in the Act. The Rules prescribe matters which operate under the safeguards set out by the Act.

The Rules do not involve any administrative powers or functions nor any coercive powers, and do not abrogate the privilege against self-incrimination.

Dispute resolution

The supply of scheme information by data providers is by contractual agreement with repairers and RTOs. The Act sets out a mediation mechanism for parties to resolve disputes to assist with the operation of the scheme. [Division 5 of Part IVE of the Act] Disputes may arise, for example, in relation to whether particular vehicles are scheme vehicles or whether particular information is safety information, security information or general scheme information. Disputes might also arise regarding whether an individual satisfies the criteria to access safety or security information, or in relation to the price for scheme information or the terms and conditions attached to a scheme offer.

The Rules operate within the dispute resolution framework provided by the Act. The dispute resolution framework does not affect the rights of a party to bring legal proceeding under the Act. [Section 57EC of the Act]

Restricted access to safety information in scheme vehicles

What is safety information?

Safety information is a subset of the information that must be supplied under the scheme. Repairers or RTOs who wish to gain access to safety information will be required to meet additional access criteria (see below for details). The Act provides that information relating to any of the following systems installed in a scheme vehicle may be prescribed as safety information in the scheme rules:

(a) the hydrogen system;

(b) the high voltage system;

(d) the electric propulsion system;

(e) another system prescribed by the scheme rules for the purposes of this paragraph.

[Section 57BF(2) of the Act]

These types of systems are powered, to varying degrees, by alternative fuel sources. While technical definitions may vary, these systems are broadly understood by industry to mean:

• hydrogen system – has one or more hydrogen (gas) fuel containers fitted to the vehicle;

• hybrid system – is powered by an internal combustion engine (regardless of fuel type) and at least one electric motor or traction (which may or may not be high voltage systems);

• electric propulsion system – is powered by one or more electric motors or traction motors; and

• high voltage system – includes a system that has a hazardous voltage (if its working voltage is greater than 60 V and less than 1,500 V direct current (DC) or greater than 30 V and less than 1,000 V alternating current (AC)). This is compared to a standard starting, lighting and ignition battery which is generally 12 V DC.

The Rules prescribe the following kinds of information as safety information:

• all scheme information relating to the hydrogen, high voltage and electric propulsion systems installed in the scheme vehicle; and

• all scheme information relating to a system connected to the hydrogen, high voltage and electric propulsion systems installed in the scheme vehicle.

[Section 5 of the Rules]

The rule-making power in the Act is intended to restrict access to safety information due to the risks involved in relation to the safety of repairers. For example, a repairer could be electrocuted (resulting in death) when disconnecting a high voltage system to prepare to work on the vehicle if they are not properly trained. This training includes following appropriate procedures, using personal protective equipment and noticing and avoiding workshop hazards such as a wet floor. The risk also exists when working on other systems connected to that system (such as the electric motor or the traction battery pack) as it still carries a high voltage electric charge.

A single vehicle may contain one or more of the above systems. For example, a hydrogen vehicle may include both a hydrogen system (the fuel source) and a high voltage system (which converts the hydrogen fuel into electricity to move the drivetrain and propel the vehicle). Similarly, a battery electric vehicle may include both a high voltage battery (the fuel source) and an electric propulsion system (the energy source).

The prescribed safety information means that no information about systems in a standard combustion engine vehicle as supplied to market are prescribed as safety information, while the (interconnected, higher risk) systems in hydrogen and high voltage electric propulsion vehicles are prescribed.

The majority of scheme information about systems in hydrogen and high voltage battery-electric vehicles is effectively prescribed as safety information. Depending on the design of the vehicle there will however still be some scheme information for these vehicles which will not be captured as safety information. For example, tyres, oil changes, air conditioning, suspension, basic sensor replacement and panels not connected to electric sensors, as well as internal components and mechanical systems. This will vary across different vehicle makes and models. In relation to a high voltage system, a connected system would not include for example the wheels of the vehicle, wheel nuts or oil changes.

The Rules do not specifically prescribe information about hybrid systems as safety information. Restricting access to scheme information about hybrid vehicles depends on whether or not the vehicle includes a high voltage motor, as this more appropriately reflects the risks associated with working on these vehicles.

• High voltage hybrid vehicles: All scheme information relating to the interconnected high voltage and hybrid systems is prescribed safety information.

• Mild hybrid vehicles: In contrast, hybrid vehicles which do not include a high voltage motor do not have a high electrocution risk. The risk profile for working on these hybrid vehicles is more comparable to standard combustion engine vehicles. Accordingly, information about hybrid systems in a mild hybrid vehicle is not prescribed as safety information.

The Act provides that the data provider must separate (restricted access) safety and security information from other (unrestricted) scheme information to the extent that it is reasonably practicable to do so. [Section 57DA of the Act] This provision recognises that information about some systems is so interconnected it cannot be split (for example, wiring diagrams. It also recognises that, in electronic repair manuals, it may not be practicable to separate access to restricted and unrestricted information which is interwoven throughout the manual (for example, information about the high voltage system may not be confined to a discrete part/chapter). If the information cannot be reasonably separated the data provider must not provide access unless the individual meets the relevant access criteria.

Who can access safety information?

An individual must meet the prescribed safety criteria to access safety information under the scheme.

Safety criteria – general

The Act provides that safety and security information can only be provided to an individual if that information is solely for use by that individual:

- for the purposes of an Australian repairer’s business; or

- for the purposes of providing an RTO course.

[Section 57DB(2)(a) of the Act]

The Rules prescribe that anyone accessing safety information under the scheme must have an appropriate relationship with an Australian repairer or scheme RTO, to ensure that the restricted information will be used solely for the purpose of that repair business or training course. [Section 7(1) of the Rules]

For example, an auto-electrician may be self-employed and work with multiple different independent repair workshops. If the auto-electrician is seeking access to scheme information, they could demonstrate they own and operate an auto‑electrician business (and qualify in their own right) or they could provide information about their relationship to the repair workshop they are working for.

This criterion is necessary and appropriate to be prescribed in the Rules because the Act does not permit individuals to access restricted information under the scheme for personal or private use, for example, to repair their own vehicle.

Safety criteria – qualifications for high voltage and electric propulsion systems

In relation to safety information, it is important to ensure that an individual has the technical competency to safely work on the kinds of automotive systems which are considerably more dangerous than standard combustion engine systems. Hence, the key criteria for access to safety information is that an individual must have the relevant training to safely undertake their work.

For example, the high voltage battery (or system) installed in these vehicles is a key risk that needs to be addressed. Many other systems in these vehicles are connected to the high voltage battery, so it is critical that repairers know how to depower or isolate it in order to safely work on the vehicle.

The Rules prescribe that, for access to safety information related to the high voltage or electric propulsion system(s) (or a system connected to any of those systems) installed in a scheme vehicle, the individual must have successfully completed training that teaches competency in safely depowering, isolating and re‑initialising a high voltage battery installed in a scheme vehicle. [Section 7(2)(b) of the Rules]

This training may be provided by an RTO (such as a TAFE), or provided directly by or on behalf of the manufacturer of one of those systems or a scheme vehicle in which one of those systems is installed (such as the BMW Training Academy). This means that the training is interchangeable – that is, if a repairer is trained to work on an electric system in one make/model electric vehicle, those skills are transferable to an electric system in a different make/model electric vehicle.

The safety criteria prescribed in the Rules is the minimum level of training needed to safely access these high-risk systems. Currently, a repairer can undertake a TAFE training course known as AURETH101 Depower and reinitialise battery electric vehicles – or an equivalent course or on-the-job training provided by or on behalf of a manufacturer – which will provide the minimum competency required to safely undertake work on a high-voltage or electric propulsion system. AURETH101 can be undertaken as a standalone course without the need for any pre-requisite qualifications, takes around 10 hours to complete and could be expected to cost $100‑$150.

Although the various safety systems may vary slightly across different make/model electric vehicles, a data provider is not able to refuse access to safety information on the basis that the repairer has not completed specific training provided by or on behalf of the manufacturer of that vehicle or system. If the repairer can demonstrate competency in ensuring the vehicle high voltage (HV) rechargeable energy storage system (RESS) is isolated before commencing any service or repair work, the repairer will have satisfied the prescribed access criteria. As scheme vehicles continue to develop and training courses are updated, it may be necessary to amend the qualification requirements to ensure repairers are appropriately trained to manage safety information in relation to these systems.

Employers are also expected to continue to comply with existing occupational health and safety (OH&S) laws which reference safety requirements for workplaces. While the exact guidance in relation to these types of systems may vary in each jurisdiction, these generally cover requirements such as ensuring safe premises, personal protective equipment and other safety requirements that must be adhered to when working on electric vehicles or systems.

Safety criteria – qualifications for hydrogen systems

The Rules prescribe that, for access to safety information related to the hydrogen system (or a system connected to the hydrogen system) installed in a scheme vehicle, the individual must have successfully completed training that teaches competency in safely working on a scheme vehicle with a hydrogen system installed. [Section 7(2)(a) of the Rules]

Hydrogen vehicles are not yet readily available in Australia. As such, there are currently no training courses offered by RTOs to equip independent repairers to safely work on these types of vehicles. At this stage (until the Australian market for hydrogen vehicles becomes more developed), the relevant training for hydrogen systems is limited to that provided by, or on behalf of, the manufacturer of the system or scheme vehicle in which the system is installed.

Unlike the qualification criteria for high voltage/electric vehicles, for hydrogen vehicles a repairer needs to be suitably qualified to repair the specific hydrogen system in the specific scheme vehicle – that means training is not transferrable between different brands.

Whilst a hydrogen vehicle includes both a hydrogen system and a high voltage system, due to the interconnectedness of these systems, a repairer who is appropriately trained to handle high voltage systems in another scheme vehicle is not able to transfer these skills to work on a hydrogen vehicle without appropriate training specific to the hydrogen system.

As per other safety systems, employers are also expected to comply with existing OH&S laws which reference safety requirements for workplaces.

What information needs to be provided in order to access safety information?

The Rules set out how and when a data provider (or their representative) can seek personal information from an individual who has requested access to safety information under the scheme. This limits what the data provider (or their representative) can reasonably ask the individual to provide, to enable the data provider to be satisfied that the individual meets the prescribed safety criteria to access the relevant safety information. [Section 9(1) of the Rules]

The Rules minimise the regulatory burden as much as reasonably practicable, whilst maintaining integrity of the scheme. This balances the needs of:

• the data provider – to have sufficient personal information about the individual to be satisfied that the individual meets the prescribed safety criteria to access the relevant safety information; and

• the repairer or RTO – to access safety and security information in a timely and cost-effective manner.

While this section limits what personal information may be sought by the data provider, it does not limit what personal information may be given by the individual. [Section 9(9) of the Rules]

Personal information – general

Each time an individual requests access to safety information under the scheme, the data provider (or their representative) can ask for the individual’s name and residential address, as well as information about that individual’s relationship to the Australian repairer or scheme RTO. The data provider can only request this information in the form of a written declaration. That is, they cannot request or require the individual to provide evidence of this information. [Section 9(2) of the Rules]

Personal information – qualifications

The Rules aim to minimise the regulatory burden as much as reasonably practicable, whilst maintaining integrity of the scheme. To this end, it is not necessary or appropriate for an individual to provide evidence of relevant training/qualifications each and every time they seek to access safety information under the scheme. The Rules impose limits around when a data provider (or their representative) can ask for evidence of an individual’s training/qualifications. [Sections 9(3) and (4) of the Rules]

If an individual requests access to a particular kind of safety information under the scheme, and they have not previously provided evidence of their training/qualifications for that type of system to that data provider (or their representative), the data provider (or their representative) can ask for evidence of relevant training/qualifications. For example, the individual may provide an electronic copy of a certificate, letter or other formal documentation confirming that they had successfully completed the relevant training for the kind of safety information requested (for example, a high voltage system installed in a scheme vehicle).

If that individual submits subsequent requests for safety information covered by the same training/qualifications, the data provider (or their representative) cannot again ask for evidence. They can only ask for this personal information to be provided in the form of a written declaration, for example, asking the individual to tick a box confirming that they have the relevant training/qualifications and that they have previously provided evidence to that data provider (or their representative).

As there are different training/qualification criteria for accessing different kinds of safety information, the data provider can ask for evidence of an individual’s training/qualifications the first time that individual seeks to access safety information relating to:

• high voltage and electric propulsion systems [Section 7(2)(b) of the Rules]; and

• hydrogen systems. [Section 7(2)(a) of the Rules]

Business details

In addition to the rules about seeking personal information (above), the Rules provide that other relevant (non-personal) information may be sought when an individual requests access to safety information. [Section 10 of the Rules]

The Rules prescribed in section 10 are made under the general rule-making power available to the Minister under subsection 57GE of the Act, and are considered necessary for giving effect to the scheme. Given that safety information can only be provided for the purposes of an Australian repairer’s business or providing an RTO course, it is appropriate for the data provider (or their representative) to ask for the name and ABN of the repairer or RTO for the purpose of establishing the relationship between the individual requesting safety or security information and the repairer business or RTO.

As with a repairer demonstrating they are operating a repair business to be eligible to access general scheme information, the scheme is not prescriptive about whether an ABN is required to demonstrate that work related to a safety system is being performed for the purposes of an Australian repairer’s business. The ABN however can be requested by a data provider if it is available. If it is not available, the data provider may be able to use the name of the Australian repairer and link it with details they may already have about that business, for example when that repairer had previously sought to access general scheme information.

Restricted access to security information in scheme vehicles

What is security information?

Security information is another subset of the information that must be supplied under the scheme, provided the repairer or RTO meets additional access criteria (see below for details). The Act provides that information relating to any of the following systems installed in a scheme vehicle may be prescribed as security information in the rules:

(a) the vehicle’s mechanical and electrical security system;

(b) another system prescribed by the scheme rules for the purposes of this paragraph.

[Section 57BF(3) of the Act]

The Rules prescribe the kind of information that is security information is all scheme information relating to the security of the vehicle (including the locking and immobilising of the vehicle), where that information is:

• unique to the vehicle; and/or

• time limited (i.e., only usable for a limited period of time).

[Section 6 of the Rules]

The rule-making power in the Act is intended to restrict access to security information due to the risks involved in relation to potential vehicle theft or associated crime.

In modern vehicles, security information is generally unique to the vehicle identification number (VIN). Some examples of the types of security information may include: a code used to cut a key that fits a particular vehicle; a code used to program an electronic component of the vehicle’s locking or immobilisation systems; and a code used to allow the operation of a component to the vehicle (for example, audio PIN code).

Security information also includes information that is time limited (for example, a reset code which changes every 24 hours). Some manufacturers use system‑to‑system security management or pass-through technology requiring programming to be completed within certain time limits. Prescribing security information in this way also ensures that any system of the vehicle which passes through a security system (that is, needs a unique code) is captured by the definition, as the risks associated with the release of the information are the same.

Who can access security information?

As with safety information (outlined above), an individual must meet the prescribed security criteria to access security information.

Security criteria – general

As with safety information (outlined above), the Rules prescribe that anyone accessing security information under the scheme must have an appropriate relationship with an Australian repairer or scheme RTO, to ensure that the restricted information will be used solely for the purpose of that repair business or training course. [Section 7(1) of the Rules]

Security criteria – standard pathway: national police check

The key criteria for access to security information is that the individual must not have a criminal record of vehicle-related offences, or other relevant or serious criminal convictions.

The standard pathway to meet the prescribed security criteria to access security information is via a national police check.

A national police check means a criminal records check which covers convictions recorded in any jurisdiction in Australia – that is, including offences under all Commonwealth, State and Territory laws. [Section 4 of the Rules]

Individuals can obtain a national police check directly from the Australian Federal Police. Information about this service and the steps involved to obtain a national police check is available online at www.afp.gov.au [www.afp.gov.au/what-we-do/services/criminal-records/national-police-checks]. An application for a national police check by the Australian Federal Police can be submitted online.

Alternatively, individuals can obtain a national police check from an organisation accredited by the Australian Criminal Intelligence Commission (ACIC). The ACIC is established by the Australian Crime Commission Act 2002. [Section 4 of the Rules] The ACIC administers a national database to provide nationally coordinated criminal history checks, and gives accreditation to organisations to provide national police check services to the public. Information about the national police check service administered by the ACIC is available online at www.acic.gov.au and includes further details about accredited organisations. A number of ACIC accredited organisations – including Australia Post – allow members of the general public to submit online applications for a national police check.

A national police check report shows the results of a national police check. The report may be issued by the Australian Federal Police, the ACIC or an ACIC‑accredited organisation upon completion of a national police check. [Section 4 of the Rules]

An individual is not eligible to access security information if their national police check report shows they have been found guilty/convicted of any of the following offences against any law of the Commonwealth or of a State or a Territory (which may be expressed differently in different jurisdictions):

• an offence involving theft of a motor vehicle or motor vehicle component, where the individual did not receive a custodial sentence (that is, they paid a fine or were required to complete community service)

• an offence involving theft, where a custodial sentence was imposed;

• an offence involving deception, fraud or dishonesty, whether or not a custodial sentence was imposed;

• any other offence involving tampering with a motor vehicle or motor vehicle component, whether or not a custodial sentence was imposed.

[Sections 7(3)(a) and (4) of the Rules]

For the purposes of the scheme, motor vehicle component includes any of the following:

• vehicle parts and items attached to the vehicle which would ordinarily be considered a component of a motor vehicle – for example, the engine, the engine number plate/label attached to the engine, the vehicle identification number (VIN) plate/label attached to the vehicle;

• unique vehicle identifiers – for example, the VIN or engine number;

• the registration number or registration plate allocated to the vehicle under a State or Territory registration regime.

[Section 4 of the Rules]

A national police check report is a point-in-time document – it shows the details of criminal convictions recorded against an individual as at the date the report was issued. This document is not intended to be used for the purposes of validating an individual’s criminal records check for an extended period – a new police check is ordinarily required to be undertaken at appropriate intervals, and a new report issued. For the purposes of the security criteria, the national police check is only valid for two years from the date of issue.

However, the national police check report will no longer be valid within that two‑year period if it no longer provides an up-to-date record of that individual’s criminal convictions. That is, if the individual has been convicted of an offence since the date of the report, it is appropriate that a new police check be conducted for the purposes of reassessing that individual’s eligibility against the security criteria.

Details regarding spent convictions are not ordinarily disclosed on an individual’s national police check report. A spent conviction is a criminal conviction that lapses after a period of time. The Commonwealth spent convictions scheme is contained in Part VIIC of the Crimes Act 1914 and limits the use and disclosure of certain criminal history information. Convictions that are ‘spent’ under a State or Territory law are also not disclosed on a national police check report. [Section 7(5) of the Rules]

In relation to offences involving theft that are considered inappropriate for an individual to access security information, the Rules take a different approach depending on whether or not the offence was motor vehicle related and whether or not a custodial sentence was imposed. This provides an appropriate balance between protecting vehicle security and allowing more minor offences to be disregarded. An individual convicted of theft of a motor vehicle or motor vehicle component – irrespective of whether or not a custodial sentence was imposed – is not considered a fit and proper person to access security information until that offence is spent. An individual convicted of a theft offence that does not involve a motor vehicle or motor vehicle component will only be disqualified from accessing security information if they received a custodial sentence. If they received a non-custodial sentence (for example, community service or a fine), that individual may access security information if they have not been convicted of any other relevant offence.

Sentencing is a highly contextual matter. Courts consider a range of matters when determining appropriate sentences, including the items stolen, the individual’s age, evidence of reoffending and personal circumstances. It is considered appropriate to allow access to security information in some circumstances where the offending was minor. For example, if an individual is convicted of stealing several DVDs from a store:

• as a first offence: that individual may receive a fine or community service – they may still access security information;

• where that individual has a prior history of repeat offending: they may receive a one-month jail suspended sentence – they will not be able to access security information.

A broad view is taken of offences involving deception, fraud or dishonesty as these types of offences relate directly to whether security information obtained under the scheme may be used inappropriately. These offences will vary by jurisdiction but may include: obtaining property belonging to another by deception; identify fraud; or forgery.

Offences relating to the tampering of a motor vehicle or motor vehicle component captures those offences relating to the vehicle itself (or part of the vehicle), for example, interfering with vehicle identifiers (VIN, engine number, vehicle registration number or plate). It is not intended to cover offences relating to the operation of a motor vehicle, such as speeding or driving without a licence.

Security criteria – alternative pathway: recognition of State and Territory repairer licence

Some States and Territories have legislated licensing or registration regimes which apply to motor vehicle repairers operating in their jurisdiction. These regimes may include some type of fit and proper person test, which may include a national police check.

To reduce the regulatory burden on an individual who has recently provided a copy of their national police check report to the relevant State or Territory as part of a licencing or registration regime, the Rules provide an alternative pathway for these individuals to meet the prescribed security criteria to access security information. [Sections 7(3)(b) and 8 of the Rules]

To enable this alternative pathway for meeting the security criteria, section 8 of the Rules prescribes that personal information relating to an individual’s repairer licence may also be taken into account for the purposes of working out if that individual is a fit and proper person to access security information.

For the purposes of this scheme, the Rules define repairer licence as a licence or registration issued (or renewed) under a law of a State or Territory that:

• authorises the individual to diagnose, repair, service, modify or dismantle a scheme vehicle, or to operate a business that diagnoses, repairs, services, modifies or dismantles a scheme vehicle (this is consistent with the definition of Australian repairer in the Act for the purposes of this scheme); and

• included an assessment of the individual’s fitness to hold the licence or registration which took into account a recent national police check report about the individual.

[Section 4 of the Rules]

This ensures that a State or Territory licence or registration regime will only be recognised for the purposes of this scheme if its police check requirements are at least comparable. For example, if a State licence or registration regime only requires a State-based police records check, an individual holding this type of licence or registration would not be eligible for the alternative pathway and would instead need to meet the standard (national police check) criteria to access security information under the scheme.

The definition of repairer licence includes a licence or registration issued by a State or Territory which authorises the individual to operate a business that diagnoses, repairs, services, modifies or dismantles vehicles. This allows ‘business licences’ to be recognised for the purposes of this scheme, where the issuing of that licence included an assessment of the individual’s fitness to hold the licence and took into account a recent national police check about that individual, and therefore aligns with the requirements under the scheme.

Example 1: Repairer holds State-issued business licence

Sam holds a State-issued business licence, which authorises her to operate Sam’s Smash Repairs. The business licence was issued six months ago, and included an up‑to‑date national police check about Sam as part of the assessment process. Sam’s business licence would be recognised as a ‘repairer licence’ for the purposes of the scheme.

Where a licence is being renewed, the renewal will only be valid if the renewal process includes an assessment of the individual’s fitness to hold the licence or registration. If the renewal simply involves for example, payment of a fee and updating of personal information, it will not be recognised for the purposes of this scheme.

For the purposes of the security criteria, the repairer licence is only valid for two years from the date of the licence being issued or renewed. This means that the national police check report which underpinned the repairer licence would effectively only be valid for two years, consistent with the standard (national police check) criteria.

However, also consistent with the standard (national police check) criteria, it is not appropriate for the repairer licence to continue to be valid within that two‑year period if the underlying national police check report no longer reflects an up-to-date record of that individual’s criminal convictions. That is, if the individual has been convicted of an offence since the date of the report, it is appropriate that a new police check be conducted for the purposes of reassessing that individual’s eligibility against the security criteria. This means that the individual no longer meets the security criteria under the alternative (repairer licence) pathway, but once they obtain a new national police check report they will be eligible to access security information under the scheme if they meet the standard (national police check) security criteria.

The alternative (repairer licence) pathway is only available if the individual continues to hold that licence at the time they request access to security information under the scheme. If the repairer licence is suspended, cancelled, expired or otherwise not renewed, the individual would still be eligible to access security information under the scheme if they obtain a new national police check report and meet the standard (national police check) security criteria.

What information needs to be provided in order to access security information?

As with safety information (outlined above), the Rules set out how and when a data provider (or their representative) can seek personal information from an individual who has requested access to security information under the scheme. This limits what the data provider (or their representative) can reasonably ask the individual to provide, to enable the data provider to be satisfied that the individual meets the prescribed security criteria to access the relevant security information. [Section 9(1) of the Rules]

For the purposes of satisfying the prescribed security criteria, the Act allows the data provider to ask the individual requesting access to the security information to provide a criminal records check. [Section 57DB(6)(d) of the Act] The Rules prescribe that for the purposes of the security criteria, the individual must, in effect, provide a national police check report. This national police check report is the only sensitive information (as defined by the Privacy Act) a data provider is authorised to request from an individual and only for the purpose of enabling the data provider to be satisfied that the individual meets the prescribed security criteria. With the exception of authorising the disclosure of a criminal records check, the Act expressly prohibits the scheme rules requiring or authorising the disclosure of sensitive information. [Section 57GE(2)(f) of the Act]

Personal information – general

As with safety information (outlined above), each time an individual requests access to security information under the scheme, the data provider (or their representative) can ask for the individual’s name and residential address, as well as information about that individual’s relationship to the Australian repairer or scheme RTO. The data provider can only request this information in the form of a written declaration. That is, they cannot request or require the individual to provide evidence of this information. [Section 9(2) of the Rules]

Personal information – standard pathway: national police check

The Rules aim to minimise the regulatory burden as much as reasonably practicable, whilst maintaining integrity of the scheme. To this end, it is not necessary or appropriate for an individual to provide a copy of their national police check report, or to obtain a new report, each and every time they seek to access security information under the scheme. The Rules prescribe strict limits around when a data provider (or their representative) can ask for an individual’s national police check report. [Sections 9(5) and (6) of the Rules]

If an individual requests access to security information under the scheme, and they have not previously provided a copy of their national police check report to that data provider (or their representative), the data provider (or their representative) can ask for a copy.

Given that a criminal records check is a ‘point in time’ document, it is reasonable that an individual be required to update their national police check report periodically. The prescribed security criteria provides that a national police check report is only valid for two years. Accordingly, a data provider (or their representative) may ask an individual to provide a new national police check report every two years.

In the intervening period, with each request for security information the individual must provide a written declaration that they have not been convicted of an offence since the date of their previous report (in accordance with the prescribed security criteria at 7(3)(a)(ii)). A data provider (or their representative) may only ask an individual to provide a new national police check report if that individual has failed to provide such a declaration. If an individual has been convicted of any offences after their national police check report was issued, it is appropriate that they obtain a new national police check report to enable the data provider to reassess that individual’s eligibility against the prescribed security criteria.

Given the sensitive nature of information contained in a national police check, the Act includes additional safeguards surrounding the handling of this sensitive information that go beyond the requirements of the Privacy Act. An individual’s national police check is only permitted to be accessed and stored within Australia. The Act provides that civil penalties will apply for breaching these information management protections. [Sections 57DD(2) and (3) of the Act] The Act also ensures the Privacy Act applies to all persons handling national police checks, including those that would not otherwise be subject to the Privacy Act (for example, small business exemptions). [Sections 57DD and 57DC of the Act]

As a result of these additional privacy safeguards, in some instances a data provider may need to appoint a representative (who is based in Australia and subject to the Privacy Act) to handle national police checks provided by individuals seeking to access security information. Even if a data provider is located in Australia, they may also choose to appoint a representative to handle national police checks as a matter of efficiency or convenience. It is anticipated industry may develop a market-based mechanism to receive and consider national police checks (and information about accessing safety information) as this may provide an efficient solution for data providers, Australian repairers and scheme RTOs to participate in the scheme.

Example 2: Data provider handles national police check assessments directly

An individual repairer obtains a national police check, issued on 1 July 2022.

In January 2023, the repairer submits a request for security information directly to Data Provider Alpha, including a copy of a national police check (showing no convictions) and a declaration that they have not been convicted of any offences since that police check was issued. Data Provider Alpha would be required to provide that information without seeking a new police check.

In February 2024, the repairer submits a request for security information directly with Data Provider Beta, including a copy of that same national police check and a declaration that they have not been convicted of any offences since that police check was issued. Data Provider Beta would be required to provide that information without seeking a new police check.

In July 2024, the repairer submits another request for security information directly with Data Provider Beta. As the repairer’s previous national police check is older than two years it is no longer valid for this purpose, they must obtain a new national police check and provide a copy to Data Provider Beta.

Example 3: Data provider uses a representative to assess national police checks, such as through a national online portal

Data Provider Red and Data Provider Blue both use the services of a national online portal to provide scheme information to Australian repairers and scheme RTOs.

An individual repairer obtains a national police check, issued on 1 July 2022.

In August 2022 the repairer submits a copy of that national police check to that national online portal. The repairer doesn’t request access to any security information at that time.

In January 2023 the repairer submits a request for security information from Data Provider Red through the national online portal (as that data provider’s representative). As the repairer has already provided a copy of their national police check to the national online portal, they only need to provide a declaration that they have not been convicted of any offences since that police check was issued. Data Provider Red would be required to provide that information (either directly to the repairer or via the national online portal) without seeking a new police check.

In February 2024, the repairer submits a request for security information from Data Provider Blue through the national online portal (again, as that data provider’s representative). The repairer includes a declaration that they have not been convicted of any offences since the police check they previously submitted to the online portal was issued. Data Provider Blue would be required to provide that information (either directly to the repairer or via the national online portal) without seeking a new police check.

In July 2024, the repairer submits another request for security information from Data Provider Blue through the national online portal. As the repairer’s previous national police check is older than two years it is no longer valid for this purpose, they must obtain a new national police check and provide a copy to the national online portal.

Personal information – alternative pathway: recognition of State and Territory repairer licence

Consistent with the rules about providing evidence of training/qualifications and national police checks, if an individual meets the alternative pathway (repairer licence) criteria it is not necessary or appropriate for them to provide evidence of their repairer licence each and every time they seek to access security information under the scheme. The Rules impose limits around when a data provider (or their representative) can ask for evidence of an individual’s repairer licence. [Sections 9(7) and (8) of the Rules]

If an individual requests access to security information under the scheme via the alternative pathway (repairer licence) criteria, and they have not previously provided evidence of their repairer licence to that data provider (or their representative), the data provider (or their representative) can ask for evidence of the repairer licence. For example, the individual may provide an electronic copy of a certificate or other formal documentation confirming that they hold a relevant licence or registration issued by a State or Territory.

If that individual submits subsequent requests for security information, the data provider (or their representative) cannot again ask for evidence of the repairer licence. However, they may ask for details about the repairer licence to be provided in the form of a written declaration each time security information is requested. For example, the data provider (or their representative) may ask for details such as type of licence or registration, identification number, State/Territory, date of issue and expiry. They may also ask the individual to tick a box confirming that they still hold the relevant repairer licence and that they have previously provided evidence to that data provider (or their representative).

The repairer licence is only valid for two years, to bring it in line with the two-year period for national police checks. Consistent with the approach for the standard (national police check) pathway, with each request for security information via the repairer licence pathway the individual must provide a written declaration that they have not been convicted of an offence since the date of their previous national police check report (in accordance with the prescribed security criteria at 7(3)(b)(ii)). In this case, the previous national police check means that which was taken into account when the repairer licence was issued or renewed.

If an individual has been convicted of any offences after that national police check report was issued, it is appropriate that they obtain a new national police check report to enable the data provider to reassess that individual’s eligibility against the prescribed security criteria.

If the individual fails to provide the requisite declaration, this means that they no longer meet the security criteria under the alternative (repairer licence) pathway, but once they obtain a new national police check report they will be eligible to access security information under the scheme if they meet the standard (national police check) security criteria.

Business details

As with safety information (outlined above), the Rules provide that other relevant (non-personal) information may be sought when an individual requests access to security information. [Section 10 of the Rules] The Rules prescribed in section 10 are made under the general rule-making power available to the Minister under subsection 57GE of the Act, and are considered necessary for giving effect to the scheme. Given that security information can only be provided for the purposes of an Australian repairer’s business or providing an RTO course, it is appropriate for the data provider (or their representative) to ask for the name and ABN of the repairer or RTO for the purpose of establishing the relationship between the individual requesting safety or security information and the repairer business or RTO.

ATTACHMENT B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Competition and Consumer (Motor Vehicle Service and Repair Information Sharing Scheme) Rules 2021

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The scheme as outlined in Part IVE of the Act operates by imposing obligations on data providers (generally vehicle manufacturers), including:

• charging no more than the fair market value for the information;

• supplying scheme information (immediately in most circumstances) once the repairer has paid the agreed price; and

• restricting access to safety and security information to individuals who meet specified access criteria.

Under the scheme, Australian repairers and scheme RTOs have unrestricted access to purchase general information about a scheme vehicle. However, to facilitate the integrity of the scheme and to protect vehicle security as well as the safety of repairers, vehicles and the public, access to safety and security information is restricted to individuals who meet prescribed criteria and are fit and proper persons to use the information for the purposes of the scheme. This restriction on access to safety and security information is designed to address unacceptable risks to vehicle security or the safety of the repairer, vehicle or the public. For example, a repairer without appropriate training may suffer electrocution, or the information could be used in vehicle theft and associated crime.

These Rules prescribe technical and administrative details in relation to restricted access to safety and security information under the scheme:

• what is classified as safety and security information;

• the access criteria used to assess whether an individual is a fit and proper person to access and use safety or security information; and

Human rights implications

This Legislative Instrument engages the following human rights:

• right to protection from arbitrary or unlawful interference with privacy; and

• right to freely choose and accept work, and be provided the technical and vocational guidance.

Protection from arbitrary or unlawful interference with privacy

Article 17 of the International Covenant on Civil and Political Rights (ICCPR) contains the right to protection from arbitrary or unlawful interference with privacy. The United Nations (UN) Human Rights Committee has not defined ‘privacy’ but it is generally understood to comprise of a freedom from unwanted and unreasonable intrusions into activities that society recognises as falling within the sphere of individual autonomy. The collection and sharing of information (public or otherwise) may be considered to engage and offend the right to privacy.

The right in Article 17 may be subject to permissible limitations, where these limitations are authorised by law and are not arbitrary. In order for an interference with the right to privacy to be permissible, the interference must be authorised by law, be for a reason consistent with the provisions, aims and objectives of the ICCPR and be reasonable in the particular circumstances. The UN Human Rights Committee has interpreted the requirement of ‘reasonableness’ to imply that any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case.

Importantly, participation in the scheme is by consent. If an individual discloses personal information about themselves to a data provider, the disclosure of that information is by the consent of that individual. The scheme does not compel an individual to participate in the scheme or compel the disclosure of personal information. The scheme is designed to promote competition between Australian motor vehicle repairers and establish a fair playing field by ensuring that all repairers and RTOs can access motor vehicle service and repair information on fair and reasonable commercial terms. To the extent the Rules engage the right to privacy, the Rules are necessary and proportionate to support the integrity of the scheme and are consistent with the information management framework outlined in the Act to protect sensitive personal information.

The Act provides that specific personal information may be requested by the data provider to:

• determine if there are reasonable grounds, based on the information provided by the repairer or RTO, to believe the prerequisite requirements are satisfied [Section 57DB(2)(a) of the Act]; and

• be satisfied that the individual requesting safety or security information meets the criteria as a fit and proper person prescribed by the scheme rules to access and use safety and security information. [Section 57DB(4) of the Act]

The fit and proper person criteria to access and use safety and security information is prescribed in section 7 of the Rules. The meaning of safety information and security information is set out respectively in sections 5 and 6 of the Rules.

The Act specifically limits the personal information that may be requested by data providers to satisfy the criteria that the individual is a fit and proper person to assess and use the safety or security information. [Section 57DB(6) of the Act] In this context, the personal information that may be requested is limited to:

• the individual’s name and residential address;

• information about the individual’s relationship to the Australian repairer or scheme RTO;

• the individual’s qualifications for using the safety and security information;

• a criminal records check about the individual; and

• any other information (other than sensitive information) prescribed by the scheme rules relevant to working out whether the individual is a fit and proper person to access and use the safety and security information. For this purpose, section 8 of the Rules provides, as an alternative pathway to providing a national police check, that information regarding an individual’s repairer licence issued by a State or Territory is prescribed.

The personal information permitted by the Act to be requested under the scheme and the fit and proper person criteria prescribed by the scheme rules interact to establish in the Rules three purposes for requesting personal information by data providers:

• in all cases: to establish the identity of the individual and their genuine relationship to an Australian repairer or RTO (including the name and ABN of the repairer or RTO);

• safety information only: to demonstrate a minimum training competency (such as a copy of the relevant training certificate or qualification) to safely work with certain high-voltage systems or hydrogen systems installed in a vehicle; and

• security information only: to provide a copy of a national police check or repairer licence issued within two years prior to the date of request.

These are described in more detail below, as well as the limited circumstances in which the data provider may request personal information [Section 9 of the Rules], in the context of the information management framework established in the Act to protect sensitive personal information.

The scheme does not provide for any personal information about the owner of a motor vehicle to be provided to a data provider.

General personal information – to establish identity and relationship to repairer or RTO

When an individual requests access to safety or security information, the Act sets out that the data provider can ask for the individual’s name and residential address for the purpose of establishing on reasonable grounds that the individual is a fit and proper person to access and use safety and security information. [Section 57DB(6) of the Act]

The Rules prescribe that anyone accessing safety or security information under the scheme must have an appropriate relationship with an Australian repairer or scheme RTO, to ensure that the restricted information will be used solely for the purpose of that repair business or training course. [Section 7(1)(a) of the Rules]

The data provider can only request this personal information in the form of a written declaration. That is, they cannot request or require the individual to provide evidence of this information. [Section 9(2) of the Rules]

Permitting data providers to request this information in the form of a written declaration is a means for the individual to provide their name and address as required under the Act, and to declare an appropriate relationship with the Australian repairer or RTO. This is a necessary and appropriate requirement prescribed in the Rules to further align with the Act’s intent to not permit access to restricted safety and security information under the scheme for personal or private use, for example, to enable a person to repair their own vehicle.

The Act only permits data providers to supply safety and security information about motor vehicles for the purpose of an Australian repairer carrying on their business or an RTO providing a training course. [Section 57CB(1) of the Act] The Rules provide that other relevant (non-personal) information about the name and ABN of the Australian repairer or RTO may be sought. [Section 10 of the Rules] Given that safety or security information can only be provided for the purposes of an Australian repairer’s business or providing an RTO course, it is appropriate that the data provider may ask for the name and ABN of the repairer or RTO. Therefore, the Rules provide an appropriate and necessary means for the data provider to establish the relationship between the individual requesting the safety or security information and the Australian repairer or RTO.

To access scheme safety information – evidence of competency (training/qualifications)

The scheme ensures that an individual requesting access to safety information has the technical competency to safely work on the kinds of automotive systems which are considerably more dangerous than standard combustion engine systems. Hence, the key criteria for access to safety information is that the data provider must be satisfied that the individual requesting access has the relevant training to safely undertake the work on the scheme vehicle. [Section 7(2) of the Rules]

To access safety information related to the high voltage or electric propulsion system(s) (or a system connected to those systems) installed in a scheme vehicle, the individual must have successfully completed training that teaches competency in safely depowering, isolating and re‑initialising a high voltage battery installed in a scheme vehicle. [Section 7(2)(b) of the Rules]

To access safety information related to the hydrogen system (or a system connected to the hydrogen system) installed in a scheme vehicle, the individual must have successfully completed training that teaches competency in safely working on a scheme vehicle with a hydrogen system installed. [Section 7(2)(a) of the Rules]

The Rules prescribe that a data provider may ask for the requesting individual to confirm by written declaration that they have the required safety training and to provide evidence of their training/qualifications. [Sections 9(3) and (4) of the Rules]

The Rules set out how and when a data provider can seek personal information from an individual who has requested access to safety information under the scheme. The Rules limit what the data provider can reasonably ask the individual to provide, to enable the data provider to be satisfied that the individual meets the prescribed safety criteria to access the relevant safety information. [Section 9(1)of the Rules]

The Rules prescribe that the data provider may request information about an individual’s relevant safety training, each time the individual requests access to safety information, and ask for evidence of qualifications to demonstrate their relevant safety training for certain installed systems within a scheme vehicle. [Sections 9(3) and (4) of the Rules]

If that individual submits subsequent requests for safety information covered by the same training competency/qualifications, the data provider cannot again ask for evidence. They can only ask for this personal information to be provided in the form of a written declaration, for example, asking the individual to tick a box confirming that they have the relevant safety training (that is, qualification) that they have previously provided evidence to that data provider.

To the extent that a data provider requesting information relating to an individual’s training/qualifications engages the right to privacy, the request to disclose the information is justified, necessary and proportional to ensure the safety of that individual when working with high-risk systems within certain scheme vehicles.

To access scheme security information – providing a national police check or repairer licence

The Act provides that a data provider may request a criminal records check for the purposes of assessing whether the individual is a fit-and-proper person to access and use security information. [Section 57DB(6)(d) of the Act] This is a key integrity measure for the scheme involving the release of security information and is designed to prevent vehicle theft and associated criminal activity. The Act empowers the scheme rules to specify the types of offences that would be relevant for the fit-and-proper person criteria, thereby restricting access to security information for individuals who do not satisfy the criteria. The Rules specify that a theft offence relating to a vehicle or a dishonesty based criminal offence would disqualify an individual from access to security information about a vehicle.

For the purpose of assessing whether an individual has a disclosable criminal history involving such disqualifying offences, the Rules prescribe that a national police check is a required element to be satisfied under the fit-and-proper person criteria to access security information. [Section 7(3) of the Rules] Under the scheme, a national police check is the only sensitive information, as defined by the Privacy Act 1988 (Privacy Act) that may be requested by a data provider and is an appropriate and necessary means to facilitate the integrity of the scheme and maintain the security of vehicles.

The Rules do not authorise data providers to request the disclosure of any other sensitive information from individuals seeking to access security information.

However, the Rules do provide an alternative pathway to satisfy the fit-and-proper person criteria for individuals who have a repairer licence (including a licence to operate a repair business) issued by a State or Territory, where a national police check for that individual was part of the assessment criteria for that licence. [Definition of ‘repairer licence’ in section 4 of the Rules] The Rules provide for this alternative pathway to minimise the regulatory burden on repairers whose criminal history has been considered by State or Territory authorities in the previous two-year period as evidenced by a national police check.

In general, to access and use security information, the Rules prescribe that the data provider needs to be satisfied that the individual requesting the information meets the fit-and-proper person criteria by demonstrating that they have either:

• a national police check report (no older than 2 years) recording no vehicle-related offences involving theft or tampering, or other offences involving theft, deception, fraud or dishonesty [Section 7(4) of the Rules], and a written declaration they have not been convicted of an offence since the date of the report [Section 7(3)(a)(ii) of the Rules]; or

• a repairer licence issued by a State or Territory authority (no older than 2 years) and a written declaration they have not been convicted of an offence since the date of the national police check report that was taken into account when issuing the repairer licence. [Section 7(1)(b) of the Rules]

To the extent that the information to be disclosed engages the right to privacy, the rationale for the disclosure of a national police check is not arbitrary and is justified to ensure the integrity of the scheme and for the protection of security information involving scheme vehicles.

The disclosure of a national police check is considered necessary, appropriate and proportionate to assess whether an individual satisfies the fit-and-proper person criteria to access security information and is aimed at preventing access to security information by individuals who have a criminal history involving motor vehicle related offences or dishonesty based criminal activities.

The Rules provide an appropriate balance between protecting vehicle security and allowing more minor offences to be disregarded. An individual convicted of theft of a motor vehicle or motor vehicle component – irrespective of whether a custodial sentence was imposed – is not considered a fit and proper person to access security information until that offence is spent.

Spent convictions are not disclosed on the individual’s national police check. A spent conviction is a criminal conviction that lapses after a period of time. The Commonwealth spent convictions scheme is contained in Part VIIC of the Crimes Act 1914 and limits the use and disclosure of certain criminal history information. Convictions that are ‘spent’ under a State or Territory law are also not disclosed on a national police check. [Section 7(5) of the Rules]

To access scheme security information – when personal information can be requested

The Rules prescribe that a national police check report is only valid for two years. [Section 7(3)(i) of the Rules] Because a criminal records check is a ‘point in time’ document, it is reasonable that the Rules prescribe that an individual requesting access to security scheme information is required to update their national police check report periodically every two years.

The Rules set out how and when a data provider can seek personal information from an individual who has requested access to security information under the scheme. The Rules restrict when a data provider can ask for an individual’s national police check report [Sections 9(5) and (6) of the Rules] or repairer’s licence [Sections 9(7) and (8) of the Rules].

The Rules do not allow a data provider to request a copy of a national police check report or repairer licence if the information has been previously provided to the data provider within a two-year period and the individual declares in writing when requesting access to security information, that they have not been convicted of an offence since the date of the previous national police check report. [Section 9(6) of the Rules]

A data provider may only ask an individual to provide a new national police check report if that individual has failed to provide such a written declaration. If an individual has been convicted of any offences after their national police check report was issued, it is appropriate that a data provider is able to request a new national police check to enable the data provider to reassess that individual’s eligibility against the prescribed security criteria.

A data provider can also ask for a new national police check if the national police check an individual previously provided is older than two years since the issuing of the report.

The same rationale applies to a repairer licence which as defined by the Rules will only be recognised if the issuing of that licence was subject to a national police check and assessing the fitness of the individual. [Section 4 of the Rules] Therefore, the Rules provide that a data provider can request a national police check if the individual’s repairer licence is older than two years or if the individual fails to declare that they have not been convicted of a criminal offence since their previous national police check was conducted. [Sections 9(6)(a)(ii) and (b) of the Rules]

To the extent that a data provider requesting information relating to an individual’s national police check or repairer licence engages the right to privacy, the request to disclose the information is justified, necessary and proportional to ensure the integrity of the scheme and protect the security of scheme vehicles.

The circumstances prescribed by the Rules for when and how a data provider may request information for the purpose of satisfying the fit-and-proper person criteria to access security information are reasonable and necessary to support the integrity of the scheme. The Rules are designed to provide a balanced approach for the administration of the scheme in relation to security information.

Privacy protections – personal information

Personal information, including sensitive information, is already subject to appropriate privacy protections under the Privacy Act. This includes requiring collection by consent, restrictions on its use for a secondary purpose and limitations on how that information may be shared.

Nevertheless, given the sensitive nature of information contained in a national police check, the Act includes additional safeguards surrounding the handling of this sensitive information that go beyond the requirements of the Privacy Act to avoid the misuse or mishandling of information, as this could cause financial harm or harm to an individual’s reputation.

The handling, use and recording of requested sensitive personal information by data providers is restricted under the scheme [Sections 57DC to 57DE of the Act], and the information cannot be made available to anyone outside Australia (including to any data provider). These privacy protections apply to sensitive personal information disclosed under the Rules. For the purposes of the scheme, the Privacy Act applies to sensitive information and administered as a privacy function for the purposes of the Australian Information Commissioner Act 2010. [Sections 57DE(2) and (3) of the Act]

Therefore, under the scheme an individual’s national police check is only permitted to be accessed and stored within Australia.

The Act also ensures the Privacy Act applies to all persons handling national police checks, including those that would not otherwise be subject to the Privacy Act (for example, small businesses). [Sections 57DD and 57DC of the Act]

Failure to comply with the obligations relating to the storage of, and access to, sensitive information can result in civil penalties of up to 1,500 penalty units for bodies corporate and 300 penalty units for other persons. [Sections 57DD(2) and (3) of the Act]

Conclusion

Participation in the scheme and the disclosure of personal information is by consent. The Rules do not compel participation. To the extent the Rules engage the right to privacy, the Rules are necessary and proportionate to support the integrity of the scheme and to ensure minimum criteria are met around the safety of individuals and the security of vehicles. The Rules are consistent with the Act and appropriately compliment the key concepts and information management framework set out in the Act.

The Rules are consistent with the right to protection from arbitrary or unlawful interference with privacy. The Rules prescribing the criteria for the disclosure of personal and sensitive information are reasonable, necessary and proportionate to achieve the policy objective to increase competition in the motor vehicle service and repair market while ensuring the suitability and safety of repairers and RTOs to access safety and security information.

The additional privacy protections provided under the scheme ensure that personal information is protected from mishandling and misuse.

The Rules are reasonable and proportionate to support the administration of the scheme and to minimise the regulatory burden as much as reasonably practicable, whilst maintaining integrity of the scheme by balancing the needs of:

• the data provider – to have sufficient personal information about the individual to be satisfied that the individual meets the prescribed safety and security criteria; and

• the Australian repairer or RTO – to access safety and security information in a timely and cost-effective manner.

Right to freely choose and accept work, and be provided the technical and vocational guidance

Article 6 of the International Covenant on Economic, Social and Cultural Rights (ICESCR) recognises the right to work, which includes the right of everyone to the opportunity to gain their living by work which they freely choose or accept and includes a right not to be unfairly deprived of work. The right to work also requires that the state parties provide a system of protection guaranteeing access to employment. This right must be made available in a non-discriminatory manner pursuant to article 2(1) of the ICESCR.

The scheme advances the right to work by ensuring the availability of up-to-date information that can be used to safely and efficiently service and repair motor vehicles (which are increasingly technologically advanced). It also provides information that can be used by RTOs for training for the next generation of repairers. This removes a key barrier to participation in the motor vehicle service and repair market by supporting vocational and training programs designed to promote employment.

The scheme is expected to increase competition in the market for motor vehicle service and repair. Without adequate access to service and repair information, repairers are not able to provide services in the most efficient and safe manner. This undermines competition as independent repairers can struggle to compete with vehicle dealers and affiliated repairers that are able to readily access service and repair information to meet consumer’s needs

This scheme provides Australian repairers and RTOs unrestricted access to purchase general information about a scheme vehicle. However, the scheme restricts access to certain safety and security information to individuals who meet the prescribed fit and proper person test.

Access to safety and security information under the scheme is not a right; access is a privilege, granted by the Commonwealth to suitable persons. The inclusion of this restriction is appropriate as it pursues the legislative objective of ensuring that:

• to access safety information about certain high-risk systems in motor vehicles within Australia – only individuals who demonstrate the necessary training to safely work on those vehicles are granted eligibility to access this information; and

• to access security information about motor vehicles within Australia – only individuals who demonstrate the required integrity necessary to protect vehicle security are granted eligibility to access this information.

The UN Committee on Economic Social and Cultural Rights has stated that the right to work:

affirms the obligation of States parties to assure individuals their right to freely chosen or accepted work, including the right not to be deprived of work unfairly. This definition underlines the fact that respect for the individual and his dignity is expressed through the freedom of the individual regarding the choice to work, while emphasizing the importance of work for personal development as well as for social and economic inclusion.

When assessing a request to access certain safety or security information, consideration is given to an individual’s relationship to a repairer or RTO, and their training/qualifications (for safety information) or criminal record (for security information), to determine if that individual is a fit and proper person. This ensures that the restricted information will be used solely for the purpose of that repair business or training course (in accordance with the legislated scheme) and does not unfairly restrict the motor vehicle service and repair industry. The training/qualifications requirements only involve the minimum level of training necessary to ensure that individuals working on high-risk vehicles have the basic competency to work safely on those vehicles. A criminal records check is necessary to help prevent vehicle theft and associated crime.

Without this scheme, repairers may be deprived of work unfairly, as they may not be able to access the information needed to repair a vehicle, despite being trained to do so and operating a business with that intent. RTOs offering courses that are designed to promote employment in the motor vehicle service and repair industry will also be deprived without this scheme. Access to safety information for a vehicle will also help protect the safety of repairers in performing their jobs.

This scheme advances the right to work by providing the opportunity for repairers to freely accept work and RTOs to provide vocational guidance. The fit and proper person test only limits access to certain safety and security material to individuals who have demonstrated relationship to this industry and the level of integrity required for access to this information.

Conclusion

This Legislative Instrument is compatible with human rights because to the extent that it may limit human rights, those limitations are reasonable, necessary and proportionate.

[1] https://www.accc.gov.au/publications/new-car-retailing-industry-market-study-final-report.

Competition and Consumer (Motor Vehicle Service and Repair Information Sharing Scheme) Rules 2021

Administered by Department of the Treasury

EXPLANATORY STATEMENT

Issued by authority of the Assistant Treasurer, Minister for Housing and Minister for Homelessness, Social and Community Housing

Part 1—Preliminary

Parts 2 and 3—Prescribed rules governing restricted access to safety and security information in scheme vehicles

Restricted access to safety information in scheme vehicles

Restricted access to security information in scheme vehicles

Statement of Compatibility with Human Rights

Overview of the Legislative Instrument

Human rights implications

Conclusion

Interactions

Legislation content

EXPLANATORY STATEMENT

Issued by authority of the Assistant Treasurer, Minister for Housing and Minister for Homelessness, Social and Community Housing

Part 1—Preliminary

Parts 2 and 3—Prescribed rules governing restricted access to safety and security information in scheme vehicles

Restricted access to safety information in scheme vehicles

Restricted access to security information in scheme vehicles

Statement of Compatibility with Human Rights

Overview of the Legislative Instrument

Human rights implications

Conclusion

Interactions

Authorises

All Versions