Legislation (Deferral of Sunsetting—Privacy (Tax File Number) Rule) Certificate 2025
EXPLANATORY STATEMENT
Issued by the Attorney-General in compliance with
section 15G of the Legislation Act 2003
INTRODUCTION
The Legislation (Deferral of Sunsetting—Privacy (Tax File Number) Rule) Certificate 2025 (the Certificate) is made under paragraph 51(1)(c) of the Legislation Act 2003 (the Legislation Act). It is a legislative instrument for the purposes of the Legislation Act and must be registered on the Federal Register of Legislation. The Certificate will be subjected to the disallowance provisions of the Legislation Act as the deferred sunsetting day specified in the Certificate is after the first anniversary of the originally scheduled sunsetting day, which means that subsection 51(4) of that Act (which provides an exemption from disallowance for deferrals of 12 months or less) does not apply.
OUTLINE
Sunsetting is the automatic repeal of legislative instruments after a fixed period. The Australian Government’s sunsetting framework is established under Part 4 of Chapter 3 of the Legislation Act. The purpose of the sunsetting framework is to ensure that legislative instruments are kept up to date and only remain in force for so long as they are needed.
Subsection 50(1) of the Legislation Act provides that a legislative instrument is automatically repealed on 1 April or 1 October immediately on or following the tenth anniversary of its registration. Under paragraph 51(1)(c) of the Legislation Act the Attorney-General can issue a certificate to defer the sunsetting day of an instrument for a period of either 6, 12, 18 or 24 months.
The instrument will then be repealed on the day specified in the certificate instead of the previously scheduled sunsetting day. This allows instruments to continue to be in force for a further but limited period of time after the date on which they would otherwise sunset. This removes the administrative burden of remaking instruments which would have a limited duration prior to their repeal and potential replacement, or where circumstances prevent the making of replacement instruments prior to the sunsetting day.
The Certificate defers the sunsetting date of Privacy (Tax File Number) Rule 2015 (Privacy Rule) by 24 months from 1 April 2025 to 1 April 2027.
The ability to defer sunsetting dates is an integral part of the sunsetting framework. It provides the necessary flexibility to ensure the standard 10-year sunsetting period does not result in unintended consequences or impose an unreasonable administrative burden on Commonwealth agencies or the Parliament. In this case, the Privacy Rule is expected to be remade within 24 months of the sunsetting date as a result of a review by the agency. If the Certificate were to be disallowed, there would not be enough time to review and remake the Instrument prior to the sunsetting day.
PROCESS BEFORE CERTIFICATE WAS MADE
Regulatory impact analysis
Certificates of deferral of sunsetting are machinery of government instruments, and are therefore not subject to the regulatory impact assessment requirements set out by the Office of Impact Analysis (OIA). The OIA reference for this standing exemption is ID19633.
Consultation before making
Before the Certificate was issued, the Attorney-General considered the general obligation to consult imposed by section 17 of the Legislation Act
The Privacy Rule is issued by the Privacy Commissioner under section 17 of the Privacy Act 1988. The Rule protects the Tax File Number (TFN) information of individuals and provides a framework that limits the recording, collecting, use or disclosure of TFN information to circumstances where it is permitted under taxation, personal assistance or superannuation law.
The Privacy Rule has not been reviewed since it was first made in 2015. The Office of the Australian Information Commissioner (OAIC) anticipates commencing a review in early 2025, in light of the findings of the Royal Commission into the Robodebt Scheme. The Royal Commission considered the data-matching program, and the use of TFNs, that was conducted under the Robodebt Scheme. The OAIC considers that there is therefore a need for a comprehensive review of the Privacy Rule before it is remade.
Certificates of deferral are machinery in nature, and enable legislative instruments that would otherwise sunset to remain in force for a further, but strictly limited, period of time. This will minimise the administrative burden on stakeholders associated with consultation on a deferral that will only have effect for a limited amount of time. Any replacement instrument will be subject to further consultation and parliamentary oversight, including oversight of whether adequate consultation occurred with persons likely to be affected by the replacement instruments.
A 24-month deferral will allow sufficient time for the agency to conduct the review and will avoid the need to remake the Privacy Rule in its current form for the short period of time before it is repealed and a replacement instrument is made. As such, given that deferral of the sunsetting date of the Privacy Rule is consistent with the policy intent of the sunsetting regime and does not significantly alter existing arrangements, appropriate consultation has occurred for the purposes of section 17 of the Legislation Act.
Statutory preconditions relevant to the Certificate
If the statutory conditions in section 51 of the Legislation Act are met, an instrument’s sunsetting day can be deferred for 6, 12, 18 or 24 months by means of a certificate made under that section. In terms of process, the Legislation Act requires:
- the responsible rule-maker to apply to the Attorney-General in writing, and
- the Attorney-General to be satisfied that:
- the instrument would (apart from the operation of the sunsetting provisions) be likely to cease to be in force within 24 months after its sunsetting day
- the proposed replacement instrument will not be able to be completed before the sunsetting day for reasons that the rule-maker could not have foreseen and avoided
- the dissolution or expiration of the House of Representatives or the prorogation of the Parliament renders it inappropriate to make a replacement instrument before a new government is formed, or
- the Attorney-General has approved Part 4 of Chapter 3 of the Legislation Act (Sunsetting) not applying to that instrument, and
- the Attorney-General to issue a certificate. The explanatory statement for the certificate must include a statement of reasons for the issue of the certificate.
The rule-maker for the Privacy Rule, the Privacy Commissioner, Carly Kind, provided a written application to the Attorney‑General seeking a certificate of deferral of sunsetting for the Instrument. On the basis of the information contained in the statement of reasons below, the Attorney‑General is satisfied that the Privacy Rule would, apart from the operation of Part 4 of Chapter 3 of the Legislation Act, be likely to cease to be in force within 24 months after its sunsetting day. As such, the criterion in subparagraph 51(1)(b)(i) of the Legislation Act is met.
Statement of Reasons for issuing of the Certificate
For the purposes of subsection 51(5) of the Legislation Act this section sets out the statement of reasons for issuing the Certificate.
The Certificate defers the sunsetting date of the Privacy Rule by 24 months to 1 April 2027 to enable the Office of the Australian Information Commissioner to conduct the review.
The Privacy Rule protects the Tax File Number (TFN) information of individuals. TFNs are unique identifiers which increases the risk of serious breaches of personal privacy if data is lost or misused. The obligations in the Privacy Rule are additional to the secrecy provisions in the Taxation Administration Act 1953 and obligations under the Privacy Act 1988.
The Privacy Rule has not been reviewed since it was first made in 2015. The Royal Commission into the Robodebt Scheme (the Scheme) in its final report of 7 July 2023, considered the data-matching program that was conducted under the Scheme and the use of TFNs. In light of this, the OAIC considered that there is a need for a comprehensive review of the Privacy Rule before it is remade.
The OAIC has been impacted by a strategic review and funding cuts, which have limited the resources available to conduct the review. A Strategic Review of the OAIC was undertaken in October 2023 and February 2024, and the OAIC is currently in the process of implementing the recommended changes. The OAIC has also been impacted by a significant reduction in funding which has required a change to its regulatory posture and rebalancing of roles to frontline and operational staff. As a result, the OAIC anticipates being in a position to commence the review of the Privacy Rule in early 2025. A deferral until 1 April 2027 will provide the OAIC with sufficient time to consider the operation of the Rule, consult relevant stakeholders and remake the Rule.
Accordingly, the Privacy Rule will likely cease to be in force in its current form within 24 months of its original sunsetting date.
More information
Further details on the provisions of the Certificate are provided in Attachment A.
The Privacy Rule which is subject to the Certificate, and which will now sunset at a later day as specified in the Certificate, is available on the Federal Register of Legislation.
Further information may be requested from the Attorney‑General’s Department about the operation of the Certificate, and from the Office of the Australian Information Commissioner about the Instrument to which the Certificate applies.
STATEMENT OF COMPATIBILITY WITH HUMAN RIGHTS
The Legislation (Deferral of Sunsetting—Privacy (Tax File Number) Rule) Certificate 2025 (the Certificate) is compatible with human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 (the Human Rights Act).
Overview of the Certificate
The Certificate is made under paragraph 51(1)(c) of the Legislation Act 2003. Under that paragraph the Attorney-General can issue a certificate to defer the sunsetting day of an instrument for a period of either 6, 12, 18 or 24 months. The instrument will then be repealed on the day specified in the Certificate instead of the originally scheduled sunsetting day. The Instrument specified in the Certificate is the Privacy (Tax File Number) Rule 2015.
The Privacy Rule is expected to be repealed and replaced within 24 months of its scheduled sunsetting day as part of the review of the legislative framework.
The Certificate allows the Privacy Rule to continue to be in force for a further, but limited, period of time when it would otherwise sunset. This removes the administrative burden of remaking the Instrument which would have a limited duration prior to its expected repeal and replacement, or where circumstances prevent the making of a replacement instrument prior to the sunsetting day.
Human Rights Implications
A certificate of deferral of sunsetting extends the operation of the instrument but does not change or affect the rights engaged under the original instrument.
The Privacy Rule engages certain rights and freedoms declared by the international instruments set out in section 3 of the Human Rights Act.
The Privacy (Tax File Number) Rule 2015 (Privacy Rule) engages Article 17 of the International Covenant on Civil and Political Rights (ICCPR). Article 17 provides that no one shall be subjected to arbitrary or unlawful interference with their privacy, family, home or correspondence, nor to unlawful attacks on their honour and reputation, and that everyone has the right to the protection of the law against such interference or attacks.
The Privacy Rule protects against the arbitrary interference with privacy and promotes an individual’s right to that protection by regulating the collection, storage, use and security of individuals’ Tax File Number (TFN) information. It further includes a privacy enhancing provision that ensures individuals are not prevented from being given access to their TFN information.
Therefore, overall, the Privacy Rule is compatible with human rights because in extending the operation of the instrument, the right to privacy engaged under the original instrument would continue to be promoted.
Before issuing the Certificate, the Attorney-General was satisfied that the Privacy Rule would, apart from the operation of the sunsetting provisions, cease to be in force within 24 months of their sunsetting date. Issuing a certificate of deferral therefore avoids the need to replace the Instrument in its current form for a short period of time before it is expected to be repealed and replaced.
Instruments that are replaced will be subject to parliamentary scrutiny and oversight through the disallowance processes unless otherwise exempt. The human rights impact of the remade Privacy Rule will be assessed at the time it is made, including through the requirement to prepare a Statement of Compatibility with Human Rights.
Conclusion
This Certificate is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights Act, because it promotes the protection of human rights and to the extent that it may limit human rights, those limitations are reasonable, necessary and proportionate.
ATTACHMENT A
NOTES ON THE CERTIFICATE
Section 1 Name
This section provides that the Certificate is named the Legislation (Deferral of Sunsetting—Privacy (Tax File Number) Rule) Certificate 2025. The Certificate may be cited by this name.
Section 2 Commencement
This section provides for the Certificate to commence on the day after it is registered.
Section 3 Authority
This section provides that the Certificate is made under paragraph 51(1)(c) of the Legislation Act 2003.
Section 4 Deferral of sunsetting
This section provides that the Privacy (Tax File Number) Rule 2015, for which the sunsetting day is 1 April 2025, is repealed by section 51 of the Legislation Act 2003 on 1 April 2027.
Section 5 Repeal of the instrument
This section provides that the Certificate is repealed at the start of 2 April 2027.