Legislation (Deferral of Sunsetting—Privacy Regulation) Certificate 2024
EXPLANATORY STATEMENT
Issued by the Attorney-General in compliance with
section 15G of the Legislation Act 2003
INTRODUCTION
The Legislation (Deferral of Sunsetting—Privacy Regulation) Certificate 2024 (the Certificate) is made under paragraph 51(1)(c) of the Legislation Act 2003 (the Legislation Act). It is a legislative instrument for the purposes of the Legislation Act and must be registered on the Federal Register of Legislation. The Certificate will be subject to the disallowance provisions of the Legislation Act as the deferred sunsetting day specified in the Certificate is after the first anniversary of the originally scheduled sunsetting day, which means that subsection 51(4) of that Act (which provides an exemption from disallowance for deferrals of 12 months or less) does not apply.
OUTLINE
Sunsetting is the automatic repeal of legislative instruments after a fixed period. The Australian Government’s sunsetting framework is established under Part 4 of Chapter 3 of the Legislation Act. The purpose of the sunsetting framework is to ensure that legislative instruments are kept up to date and only remain in force for so long as they are needed.
Subsection 50(1) of the Legislation Act provides that a legislative instrument is automatically repealed on 1 April or 1 October immediately on or following the tenth anniversary of its registration. Under paragraph 51(1)(c) of the Legislation Act, the Attorney-General can issue a certificate to defer the sunsetting day of an instrument for a period of either 6, 12, 18 or 24 months.
The instrument will then be repealed on the day specified in the certificate instead of the previously scheduled sunsetting day. This allows instruments to continue to be in force for a further but limited period of time when they would otherwise sunset. This removes the administrative burden of remaking instruments which would have a limited duration prior to their repeal and potential replacement, or where circumstances prevent the making of replacement instruments prior to the sunsetting day.
The Certificate defers the sunsetting date of the Privacy Regulation 2013 (‘Privacy Regulation’) by 24 months from 1 April 2024 to 1 April 2026.
The ability to defer sunsetting dates is an integral part of the sunsetting framework. It provides the necessary flexibility to ensure the standard 10-year sunsetting period does not result in unintended consequences or impose an unreasonable administrative burden on Commonwealth agencies or the Parliament. In this case, the Privacy Regulation is expected to be remade within 24 months of the sunsetting date in order to implement significant reforms arising from the Government’s Response to the Privacy Act Review Report, and the Credit Reporting Review. This 24-month deferral date would allow sufficient time for the Government to consider and implement substantial privacy reforms, and avoid operational disruption and confusion to entities subject to the Privacy Act 1988 (the Privacy Act). If the Certificate were to be disallowed, there would not be enough time to review and remake the Privacy Regulation prior to the sunsetting day.
PROCESS BEFORE CERTIFICATE WAS MADE
Regulatory impact analysis
Certificates of deferral of sunsetting are machinery of government instruments, and are therefore not subject to the regulatory impact assessment requirements set out by the Office of Impact Analysis (OIA). The OIA reference for this standing exemption is ID19633.
Consultation before making
Before the Certificate was issued, the Attorney-General considered the general obligation to consult imposed by section 17 of the Legislation Act.
The Privacy Regulation is made under the Privacy Act.
Amongst other matters, the Privacy Regulation prescribes that small business operators that operate residential tenancy databases, and particular state authorities and instrumentalities, are organisations that are subject to the Privacy Act. It also provides clarification as to what types of entities are considered credit reporting businesses and credit providers.
The department is currently progressing reforms to the Privacy Act consistent with the Government Response to the Privacy Act Review Report (the Report). The department is working toward introduction of privacy reform legislation in 2024.
The department is also facilitating a Credit Reporting Review, which will examine whether the credit reporting provisions in the Privacy Act are fit-for-purpose. This review must be completed before 1 October 2024 and is expected to consider a variety of matters, which may include the efficacy of prescribing credit providers, access to categories of credit information, and other matters linking credit reporting under the Act with the Privacy Regulation.
Certificates of deferral are machinery in nature, and enable legislative instruments that would otherwise sunset to remain in force for a further, but strictly limited, period of time. This will minimise the administrative burden on stakeholders associated with consultation on a deferral that will only have effect for a limited amount of time. Any replacement Regulation will be subject to further consultation and parliamentary oversight, including oversight of whether adequate consultation occurred with persons likely to be affected by the replacement instruments.
A 24-month deferral will:
- enable implementation of the Government Response to the Report, including to ensure privacy reforms are informed by stakeholder feedback and policy
- allow the department to facilitate the Credit Reporting Review and allow the Government to consider any proposals to amend the credit reporting provisions under the Privacy Act
- enable the department to effectively prioritise work with the Office of Parliamentary Counsel to prepare legislative amendments to the Privacy Act
- minimise disruption and confusion for entities subjected to the Privacy Act while reforms are considered and progressed by government; and
- avoid the need to remake the Privacy Regulation in its current form for the short period of time before it is repealed and a replacement instrument is made.
As such, given that deferral of the sunsetting date of the Privacy Regulation is consistent with the policy intent of the sunsetting regime and does not significantly alter existing arrangements, appropriate consultation has occurred for the purposes of section 17 of the Legislation Act.
Statutory preconditions relevant to the Certificate
If the statutory conditions in section 51 of the Legislation Act are met, an instrument’s sunsetting day can be deferred for 6, 12, 18 or 24 months by means of a certificate made under that section. In terms of process, the Legislation Act requires:
(a) the responsible rule-maker to apply to the Attorney-General in writing, and
(b) the Attorney-General to be satisfied that:
(i) the instrument would (apart from the operation of the sunsetting provisions) be likely to cease to be in force within 24 months after its sunsetting day
(ii) the proposed replacement instrument will not be able to be completed before the sunsetting day for reasons that the rule-maker could not have foreseen and avoided
(iii) the dissolution of expiration of the House of Representatives or the prorogation of the Parliament renders it inappropriate to make a replacement instrument before a new government is formed, or
(iv) the Attorney-General has approved Part 4 of Chapter 3 of the Legislation Act (Sunsetting) not applying to that instrument, and
(c) the Attorney-General to issue a certificate. The explanatory statement for the certificate must include a statement of reasons for the issue of the certificate.
As the rule-maker for the Privacy Regulation is the Attorney-General, the Hon Mark Dreyfus KC, there is no written application associated with this Certificate.
On the basis of the information contained in the statement of reasons below, the Attorney‑General is satisfied that the Privacy Regulation would, apart from the operation of Part 4 of Chapter 3 of the Legislation Act, be likely to cease to be in force within 24 months after its sunsetting day. As such, the criterion in subparagraph 51(1)(b)(i) of the Legislation Act is met.
Statement of Reasons for issuing of the Certificate
For the purposes of subsection 51(5) of the Legislation Act this section sets out the statement of reasons for issuing the Certificate.
The Certificate defers the sunsetting date of the Privacy Regulation by 24 months to 1 April 2026 to enable the Attorney-General’s Department to implement significant reforms arising from the Government’s Response to the Privacy Act Review Report, and the Credit Reporting Review. The department is working toward introduction of privacy reform legislation in 2024. The department is also undertaking a Credit Reporting Review, which will examine whether the credit reporting provisions in the Act are fit-for-purpose. This review must be completed before 1 October 2024.
Accordingly, the Privacy Regulation will likely cease to be in force in its current form within 24 months of the original sunsetting date.
More information
Further details on the provisions of the Certificate are provided in Attachment A.
The Regulation which is subject to the Certificate, and which will now sunset at a later day as specified in the Certificate, is available on the Federal Register of Legislation.
Further information may be requested from the Attorney‑General’s Department about the operation of the Certificate, and about the Regulation to which the Certificate applies.
STATEMENT OF COMPATIBILITY WITH HUMAN RIGHTS
The Legislation Deferral of Sunsetting—Privacy Regulation Certificate 2024 (the Certificate) is compatible with human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (the Human Rights Act).
Overview of the Certificate
The Certificate is made under paragraph 51(1)(c) of the Legislation Act 2003. Under that paragraph the Attorney-General can issue a certificate to defer the sunsetting day of an instrument for a period of either 6, 12, 18 or 24 months. The instrument will then be repealed on the day specified in the Certificate instead of the originally scheduled sunsetting day. The Instrument specified in the Certificate is the Privacy Regulation 2013 (the ‘Privacy Regulation’)
The Privacy Regulation is expected to be repealed and replaced within 24 months of its scheduled sunsetting day in order to implement significant reforms arising from the Government’s Response to the Privacy Act Review Report, and the Credit Reporting Review.
The Certificate allows the Privacy Regulation to continue to be in force for a further, but limited, period of time when it would otherwise sunset. This removes the administrative burden of remaking the Privacy Regulation which would have a limited duration prior to its expected repeal and replacement, or where circumstances prevent the making of a replacement instrument prior to the sunsetting day.
Human Rights Implications
A certificate of deferral of sunsetting extends the operation of the instrument but does not change or affect the rights engaged under the original instrument.
The Privacy Regulation engages certain rights and freedoms declared by the international instruments set out in section 3 of the Human Rights Act.
Article 17 of the International Covenant on Civil and Political Rights (ICCPR) prohibits unlawful or arbitrary interferences with a person’s privacy, family, home and correspondence. Any interference with this right must be for a reason consistent with the relevant Convention and reasonable in the particular circumstances, in order to avoid being ‘arbitrary’.
The Privacy Regulation supports the right to privacy by protecting against arbitrary interferences with privacy that concern such personal information. It does this by prescribing the terms and conditions of consumer credit that may be included in an individual’s credit information, and defining the meaning of monthly cycle in repayment history information. It clearly stipulates the personal information comprised in an individual’s credit information, which may be included in a data set within the credit reporting system.
To the extent that the Privacy Regulation limits the prohibition against arbitrary interference with privacy, it does so in a clearly and narrowly defined way for a purpose that is proportional, appropriate and legitimate. The Privacy Regulation permits specified agencies to disclose certain government identifiers, such as employee payroll numbers, to superannuation organisations for staff superannuation purposes. The Privacy Regulation also prescribes the circumstances in which personal information held in Commonwealth identifiers, such as the Centrelink Customer Reference Number, may be used or disclosed, and prescribes those organisations permitted to use or disclose such information. Such use or disclosure is necessary to determine whether an individual is entitled to concessions or to access other services, such as subsided housing provided by the organisation, for the benefit of the individual.
Accordingly, the Privacy Regulation is compatible with human rights because it supports the right to privacy under Article 17 of the ICCPR. To the extent it may limit human rights, those limitations are reasonable, necessary and proportionate.
Before issuing the Certificate, the Attorney-General was satisfied that the Privacy Regulation would, apart from the operation of the sunsetting provisions, cease to be in force within 24 months of its sunsetting date. Issuing a certificate of deferral therefore avoids the need to replace the Privacy Regulation in its current form for a short period of time before it is expected to be repealed and replaced.
Instruments that are replaced will be subject to parliamentary scrutiny and oversight through the disallowance processes unless otherwise exempt. The human rights impact of the remade Privacy Regulation will be assessed at the time it is made, including through the requirement to prepare a Statement of Compatibility with Human Rights.
Conclusion
This Certificate is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights Act, as it does not raise any human rights issues, and ensures that any proposal to make a replacement instrument will be subject to parliamentary oversight and scrutiny.
ATTACHMENT A
NOTES ON THE CERTIFICATE
Section 1 Name
This section provides that the Certificate is named the Legislation (Deferral of Sunsetting—Privacy Regulation) Certificate 2024. The Certificate may be cited by this name.
Section 2 Commencement
This section provides for the Certificate to commence on the day after it is registered.
Section 3 Authority
This section provides that the Certificate is made under paragraph 51(1)(c) of the Legislation Act 2003.
Section 4 Deferral of sunsetting
This section provides that the Privacy Regulation 2013, for which the sunsetting day is 1 April 2024, is repealed by section 51 of the Legislation Act 2003 on 1 April 2026.
Section 5 Repeal of the instrument
This section provides that the Certificate is repealed at the start of 2 April 2026.