Human Services (Centrelink) Amendment (Functions of the Chief Executive Centrelink) Regulations 2024

EXPLANATORY STATEMENT

Issued by the authority of the Governor General

Human Services (Centrelink) Act 1997

Human Services (Centrelink) Amendment (Functions of the Chief Executive Centrelink) Regulations 2024

Purpose

The Human Services (Centrelink) Amendment (Functions of the Chief Executive Centrelink) Regulations 2024 (the Amendment Regulations) amend the Human Services (Centrelink) Regulations 2021 (the Primary Regulations). The Amendment Regulations will give effect to certain accredited roles that Services Australia will perform under the Digital ID Act 2024 (Digital ID Act) as an identity exchange provider and an attribute service provider.

Background

Digital ID legislative framework

The Australian Government has been developing and administering an unlegislated Australian Government Digital ID System (AGDIS) since 2015. This has provided an online environment for identity verification and management transactions. The unlegislated AGDIS was underpinned by a policy framework that provided an accreditation framework for entities who provided specified digital ID services for the unlegislated AGDIS and elsewhere. The policy framework also sets out technical standards for entities providing services in the unlegislated AGDIS. On commencement of the Digital ID Act, arrangements under the policy and accreditation framework will cease, and be replaced by the (legislated) AGDIS.

Services Australia has been accredited to provide digital ID services as an identity exchange provider since 2019 and as an attribute service provider since 2021.

The Digital ID Act provides a legislative basis for this framework that gives individuals secure, convenient, voluntary and inclusive ways to verify their identity in online transactions with government and businesses. It also facilitates the inclusion of individuals in digital society by supporting the provision of digital ID services that are accessible for individuals who experience barriers in using such services. The Digital ID Act does this by:

• legislating a voluntary statutory Accreditation Scheme for digital ID service providers
• legislating and enabling the expansion of the AGDIS for use by the Commonwealth, State and Territory governments and private sector
• embedding strong privacy and consumer safeguards, in addition to the Privacy Act 1988
• establishing governance arrangements including the Australian Competition and Consumer Commission as the Digital ID Regulator and an expanded role for the Australian Information Commissioner as privacy regulator. 

The Digital ID (Transitional and Consequential Provisions) Act 2024 (Transitional ID Act) provides that immediately after the commencement of the Digital ID Act, Services Australia will be taken to have been accredited, and approved to participate in the AGDIS, as an accredited identity exchange provider under sections 15(2) and 62 of the Digital ID Act. This allows Services Australia to provide a service that conveys, manages and coordinates the flow of data or other information, including identity and attribute information, between approved participants in the legislated AGDIS.

The Digital ID (Transitional and Consequential Provisions) Rules 2024 will also provide that immediately after the commencement of the Digital ID Act, Services Australia will be taken to have been accredited, and approved to participate in the AGDIS, as an accredited attribute service provider under sections 15(2) and 62 of the Digital ID Act. This accreditation will be subject to the condition that Services Australia is accredited to issue and manage the myGov linkID attribute. As an attribute service provider, Services Australia will issue and manage the myGov linkID, which is used to link a myGov account to a myGov member service for a particular user.

Amendment Regulations

In order for Services Australia to carry out functions as part of the AGDIS as an identity exchange provider and an attribute service provider, equivalent functions must be provided to the Chief Executive Centrelink (CEC).

The Human Services (Centrelink) Act 1997 (the Act) relevantly creates the statutory office of the Chief Executive Centrelink (CEC) within Services Australia. Section 8 of the Centrelink Act sets out the functions of the CEC. It provides that the CEC has the following functions:

1.   the service delivery functions mentioned in section 8A
2.   any functions conferred on the CEC under any other Act
3.    any functions that are prescribed by the regulations
4.   doing anything incidental, conducive or related to the performance of any or his or her other functions.

Section 41 of the Act provides that the Governor‑General may make regulations, prescribing matters required or permitted by the Act, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.

The Amendment Regulations prescribe new functions of the CEC to facilitate Services Australia’s participation in the legislated AGDIS.

Consultation

The Department of Social Services undertook consultation with Services Australia in relation to the Amendment Regulations. Consultation outside the Australian Government was considered unnecessary as the Amendment Regulations are procedural in nature.

Regulation Impact Statement (RIS)

The Amendment Regulations do not require a Regulatory Impact Statement.

Explanation of the provisions

Section 1 – Name

This section provides that the title of the Amendment Regulations is the Human Services (Centrelink) Amendment (Functions of the Chief Executive Centrelink) Regulations 2024.

Section 2 – Commencement

This section provides that the Amendment Regulations commences on the later of the day after the instrument is registered and the day the Digital ID Act commences.

Section 3 – Authority

This section provides that the Amendment Regulations are made under the Human Services (Centrelink) Act 1997.

Subsection 33(3) of the Acts Interpretation Act 1901 relevantly provides that where an Act confers a power to make, grant or issue any instrument of a legislative character (including regulations), the power shall be construed as including a power exercisable in the like manner and subject to the like conditions (if any) to amend or vary any such instrument.

Section 4 – Schedules

This section provides that each instrument that is specified in a Schedule to the Amendment Regulations is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to the Amendment Regulations has effect according to its terms.

Schedule 1 – Amendments

This Schedule amends the Human Services (Centrelink) Regulations 2021 by inserting a new section 10A at the end of Part 2, which deals with the functions of the CEC.

New section 10A provides that the following are prescribed functions of the CEC:

• to provide the service performed by an attribute service provider (within the meaning of the Digital ID Act)
• to provide the service performed by an identity exchange provider (within the meaning of the Digital ID Act).

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Human Services (Centrelink) Amendment (Functions of the Chief Executive Centrelink) Regulations 2024

The Human Services (Centrelink) Amendment (Functions of the Chief Executive Centrelink) Regulations 2024 (Amendment Regulations) are compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Regulations

The Amendment Regulations amend the Human Services (Centrelink) Regulations 2021 (the Primary Regulations). The Amendment Regulations will give effect to certain accredited roles that Services Australia will perform under the Digital ID Act 2024 (Digital ID Act) as an identity exchange provider and an attribute service provider.

Digital ID legislative framework

The Australian Government has been developing and administering an unlegislated Australian Government Digital ID System (AGDIS) since 2015. This has provided an online environment for identity verification and management transactions. The unlegislated AGDIS was underpinned by a policy framework that provided an accreditation framework for entities who provided specified digital ID services for the unlegislated AGDIS and elsewhere.

Services Australia was accredited to provide digital ID services as an identity exchange provider since 2019 and as an attribute service provider since 2021 in the unlegislated AGDIS.

Digital IDgives individuals secure, convenient, voluntary and inclusive ways to verify their identity in online transactions with government and businesses. It also facilitates the inclusion of individuals in digital society by supporting the provision of digital ID services that are accessible for individuals who experience barriers in using such services. The Digital ID Act does this by:

• legislating a voluntary statutory Accreditation Scheme for digital ID service providers
• legislating and enabling the expansion of an AGDIS for use by the Commonwealth, State and Territory governments and private sector
• embedding strong privacy and consumer safeguards, in addition to the Privacy Act 1988
• establishing governance arrangements including the Australian Competition and Consumer Commission as the Digital ID Regulator and an expanded role for the Australian Information Commissioner as privacy regulator. 

The Digital ID (Transitional and Consequential Provisions) Act 2024 (Transitional ID Act) provides that immediately after commencement of the Digital ID Act, Services Australia will be taken to have been accredited, and approved to participate in the AGDIS, as an accredited identity exchange provider under sections 15(2) and 62 of the Digital ID Act. This allows Services Australia to provide a service that conveys, manages and coordinates the flow of data or other information, including identity and attribute information, between approved participants in the legislated AGDIS.

The Digital ID (Transitional and Consequential Provisions) Rules 2024 will also provide that immediately after the commencement of the Digital ID Act, Services Australia will be taken to have been accredited, and approved to participate in the AGDIS, as an accredited attribute service provider under sections 15(2) and 62 of the Digital ID Act. This accreditation will be subject to the condition that it is accredited to issue and manage the myGov linkID attribute. As an attribute service provider, Services Australia will issue and manage the myGov linkID, which is used to link a myGov account to a myGov member service for a particular user.

Amendment Regulations

In order for Services Australia to carry out functions as part of the AGDIS as an identity exchange provider and an attribute service provider, equivalent functions must be provided to the Chief Executive Centrelink (CEC).

The Human Services (Centrelink) Act 1997 (the Act) relevantly creates the statutory office of the Chief Executive Centrelink (CEC) within Services Australia. Section 8 of the Centrelink Act sets out the functions of the CEC. It provides that the CEC has the following functions:

1.   the service delivery functions mentioned in section 8A
2.   any functions conferred on the CEC under any other Act
3.    any functions that are prescribed by the regulations
4.   doing anything incidental, conducive or related to the performance of any or his or her other functions.

Section 41 of the Act provides that the Governor‑General may make regulations, prescribing matters required or permitted by the Act, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.

The Amendment Regulations prescribe new functions of the CEC to facilitate Services Australia’s participation in the legislated AGDIS.

Human rights implications

The Amendment Regulations engage the right to privacy in Article 17 of the International Covenant on Civil and Political Rights (ICCPR).

Right to Privacy

Article 17 to the ICCPR provides that no-one shall be subject to arbitrary or unlawful interference with their privacy. It also provides that persons have a right to the protection of the law against such interference. Any inference with privacy must be reasonable, necessary and proportionate having regard to the aims of a program.

The Amendment Regulations will facilitate Services Australia’s participation in the AGDIS, as legislated by the Digital ID Act and the Transitional ID Act. This facilitates the sharing of information between government entities (and private entities in the future). This sharing of information is lawful as it is authorised under the Digital ID Act. Further, the collection or use of personal information for this purpose would not constitute an arbitrary interference with the right to privacy as it would be undertaken for legitimate and necessary objectives of administering the AGDIS.

Further, the Digital ID Act sets out a series of protections to a person’s right from arbitrary or unlawful interference with privacy. These include:

• limitations on the types of information that an accredited entity may disclose without the express consent of a person, unless otherwise authorised under law, such as through a warrant.
• powers for the Minister to make Accreditation Rules which may include further privacy protections an entity must comply with on accreditation.
• powers for the Australian Competition and Consumer Commission, as the Digital ID Regulator, to impose further conditions on an entity’s accreditation.
• extending privacy obligations in addition to those set out in the Privacy Act 1988 (Privacy Act) to apply to small businesses that are accredited entities.
• extending the meaning of ‘personal information’ as defined in the Privacy Act.

The safeguards in the Digital ID Act engage with and support the right to privacy, or otherwise ensure any remaining impact is reasonable, necessary and proportionate to the Digital ID Act’s objectives. These include both positive protections, and measures to ensure any limitations are not arbitrary, and are reasonable and proportionate to the objectives of the Digital ID Act.

The limitation on the right to privacy is proportionate, as the provision of any personal information from participating entities would only be undertaken for the purposes of administering the AGDIS. Information would still be subject to secrecy provisions to prevent unauthorised disclosures as well as protections under the Privacy Act.

Conclusion

These Amendment Regulations are compatible with human rights. To the extent that they limit the right to privacy, those limitations are reasonable, necessary and proportionate.

The Hon Bill Shorten MP

Minister for Government Services