Notice of Approval under the Financial Sector (Shareholdings) Act 1998

COMMONWEALTH OF AUSTRALIA

Financial Sector (Shareholdings) Act 1998

Notice of Approval under subsection 14(1)

I, JOSH FRYDENBERG, Treasurer, have received an application from Resolution Life Australia Pty Ltd (ACN 629 568 912) and the persons specified in column A of Schedule 1 (the Persons), to each hold a stake of 100 per cent in the financial sector companies (Target Entities) specified in Column B of Schedule 1.

Pursuant to subsection 14(1) of the Financial Sector (Shareholdings) Act 1998, I am satisfied that it is in the national interest to approve the Persons to each hold a stake of 100 per cent in the Target Entities.  I hereby grant the application for approval.

Pursuant to subsection 16(1) of the Financial Sector (Shareholdings) Act 1998 the approval is given subject to the conditions specified in Schedule 2.

This approval comes into force on the date it is signed and remains in force indefinitely.

Dated:  22 June 2020

JOSH FRYDENBERG

Treasurer

Schedule 1

SCHEDULE 2

CONDITIONS

In relation to Resolution Life Group Holdings (Australia) Pty Ltd (RLGH Australia), Resolution Life NOHC Pty Ltd (Resolution Life NOHC) and Resolution Life Australia Pty Ltd (Resolution Life Australia) (each an Applicant) each acquiring a stake of 100 per cent in the following financial sector companies (each a Target Entity):

-          AMP Financial Services Holdings Limited;

-          AMP Life Limited;

-          AMP AAPH Limited; and

-          The National Mutual Life Association of Australasia Limited

(each an Acquisition), and in accordance with section 16(1) of the Financial Sector (Shareholdings) Act 1998, the following conditions have been imposed. These conditions apply to each Applicant until a termination event[1] occurs in relation to that Applicant.

Data Storage

1.  From the date that is two years after the date of the first Acquisition, each Applicant must use its best endeavours to ensure, and within its powers must ensure, that Policyholder Data[2] remains stored only in Australia, and is accessible only from within Australia, except where:

1.1. the Policyholder Data is stored or accessed outside of Australia by a reinsurer in connection with a reinsurance arrangement with a Target Entity;

1.2. the Policyholder Data is accessed outside of Australia in connection with the provision of services to a Target Entity or its subsidiaries, provided that it is in accordance with the following requirements:

1.2.1. Policyholder Data is only accessible using desktop virtualisation technology which complies with the Centre for Internet Security's (CIS) Level 1 Controls and Benchmarks and the Australian Cyber Security Centre's (ACSC) Essential Eight Maturity Model (or any successor or replacement standards);

1.2.2. any such desktop virtualisation environment employs controls to prevent Policyholder Data from being sent outside of the environment (including network segregation, environment-wide authentication and authorisation, and restrictions for email and internet access), which comply with the ACSC's Secure Administration Guidelines (or any successor or replacement standard);

1.2.3. locations outside of Australia where Policyholder Data is processed through a desktop virtualisation environment employ physical security controls to prevent Policyholder Data from being sent out of the environment, which comply with the ACSC's Guidelines for Physical Security (or any successor or replacement standard); and

1.2.4. user activity in such desktop virtualisation environments and any connected systems is routinely reviewed and monitored;

1.3. the Policyholder Data is required to be accessed outside of Australia in order to comply with an Australian law[3]; or

1.4. the Policyholder Data relates to a person who has required, or given permission[4] for, Policyholder Data to be stored, or accessible from, offshore.

Applicant use, access, disclosure, and notification of data breach

2.  Each Applicant must use its best endeavours to ensure, and within its powers must ensure, that:

2.1  the following persons will not access, use or disclose Policyholder Data:

2.1.1          directors, executive managers and employees (and their agents and representatives) of the Applicants and entities in the Applicant’s control group[5] (except the Target Entities and their respective subsidiaries);

2.1.2          limited partners of Resolution Life Group Holdings L.P (and their directors, executive managers, employees, agents and representatives); and

2.1.3          the Applicants' representatives on the board of directors of Resolution Life NOHC, Resolution Life Australia, or a Target Entity or its subsidiaries, 

except where:

2.1.4          access to, use of, or disclosure of, Policyholder Data is required to discharge duties as a director or executive manager under Australian law;

2.1.5          access to, use of, or disclosure of, Policyholder Data is required to comply with any Australian law;

2.1.6          where access to, use of, or disclosure of, specific Policyholder Data is required for the purpose of delivering and/or facilitating the delivery of a Target Entity’s or their respective subsidiaries’ business services; or

2.1.7          the recipient of the information has requested access to, or use of, their own Policyholder Data;

2.2  directors on the boards of RLGH Australia, Resolution Life NOHC and Resolution Life Australia provide written certification on an annual basis with the first report due 12 months from the date that the first Acquisition occurs.  The certificate must confirm that they have not accessed, used or disclosed any Policyholder Data, except in the circumstances permitted under condition 2.1. The certificates should be provided to an officer of the relevant Applicant (where a particular director sits on the board of that Applicant) as nominated by the Applicant.  The officer must forward the collated certificates to the Department of the Treasury (Treasury) (at FSSA‑IATA@treasury.gov.au) within 30 days of the due date;

2.3 if it becomes aware that it, or an entity in its control group, is required to give notice to the Australian Information Commissioner of an eligible data breach under the Privacy Act 1988, the Applicant must provide a report (Privacy Breach Report) to Treasury at FSSA-IATA@treasury.gov.au within 10 days of becoming so aware.[6]  The Privacy Breach Report must include the identity of the entity involved, a description of the eligible data breach, the kind or kinds of information involved and the date range of the breach; and

2.4 it has mechanisms in place to ensure that it is alerted to any eligible data breaches under the Privacy Act 1988, by Target Entities or their subsidiaries within 14 days of those Target Entities or subsidiaries becoming aware of such breaches.

3. Each Applicant must use its best endeavours to ensure, and within its powers must ensure, that where there is unauthorised access to, or loss of, the following:

3.1  Policyholder Data; or

3.2               systems or mechanisms which hold or access Policyholder Data, including systems of an a Target Entity (or its subsidiaries) which are used in the course of the Target Entity (or its subsidiaries) providing services to an Australian policyholder,

policy holders whose Policyholder Data was, or may have been, affected by that incident are given written notification of the incident within 14 days of the Target Entity or its subsidiaries becoming aware of the incident occurring.

Independent audit reporting

4.              Each Applicant[7] must provide written notification to Treasury, at FSSA-IATA@treasury.gov.au within 30 days of making each Acquisition that it has done so.

5.              Each Applicant must, no later than 3 months after the end of the Applicant’s financial year, provide a written report to Treasury at FSSA-IATA@treasury.gov.au on compliance with conditions 1 to 3 (the Audit Report). The first Audit Report will be in respect of the period from the date that the Applicant first makes an Acquisition specified in this no objection notification to the end of the Applicants’ financial year.[8] If the Acquisition takes place less than 90 days before the end of the first financial year, then that period can be incorporated in the next Audit Report. Each Applicant will provide Audit Reports in respect of each subsequent financial year. Audit Reports will be prepared at the cost of the entity to which the Audit Report relates.

6.              Each Applicant must ensure that Audit Reports prepared pursuant to condition 5 are prepared in accordance with Relevant Australian Standards[9] by one or more independent audit firms and/or other Relevant Expert.[10]

7.              Each Applicant must ensure that the identity of the independent audit firm(s) and/or Relevant Expert(s), the scope of work underlying the Audit Report, the level of assurance provided by the Audit Report, and the individuals from the independent audit firm(s) and/or Relevant Expert(s) that will undertake the work referred to in condition 5 are approved by the Commonwealth in advance of the audit work commencing, with approval to be sought no less than 60 days before the end of the relevant reporting period. The Commonwealth will be able to provide instruction directly to the audit firm in advance of the audit work commencing.

8.              Each Applicant will use its best endeavours to ensure, and within its powers must ensure, that each Applicant, Target Entities and their subsidiaries will authorise the independent audit firm(s) and/or Relevant Expert(s) to provide to Treasury, on request, details of the enquiries made in order to make the Audit Report, and the data produced as a result of those enquiries.

9.              Each Applicant must use its best endeavours to ensure, and within its powers must ensure, that the Applicant, Target Entities and their subsidiaries will consent to any reasonable access by the Commonwealth to premises and/or systems, and will provide assistance to support the Commonwealth, for the purposes of the Commonwealth reviewing Audit Reports prepared pursuant to condition 5.

11.          If the Commonwealth does not approve the Program, the relevant Applicant will have a further three months to submit a revised Program to the Commonwealth for approval.

[1] For the purposes of these conditions a termination event occurs in relation to an Applicant where the Applicant no longer holds a stake in the Target Entities.

[2] Policyholder Data means any “personal information” as defined by the Privacy Act 1988 in relation to past, current and future Australian policyholders of the Target Entities or their subsidiaries and their past, current and future Australian policyholders, which is held or collected by, or provided to Target Entities or their subsidiaries, in connection with their Australian operations.

[3] Australian Law means any law of the Commonwealth of Australia or of a State or Territory of Australia.

[4] "Permission" can include express or implied consent.

[5] For the purposes of these conditions, a person's control group consists of entities:

(a)      that control the person (a controller);

(b)      that a controller controls;

(c)       that the person controls, which includes for the purposes of these conditions an entity that is the subject of the application.

For the purposes of determining a control group, control has the meaning in section 50AA of the Corporations Act 2001.

[6] For the purposes of this condition, an Applicant may provide a Privacy Breach Report on behalf of all Applicants which includes the relevant information. A Target Entity or its subsidiary which is required to give notice to the Australian Information Commissioner of an eligible data breach may give a Privacy Breach Report to Treasury on behalf of one or more Applicants under this condition.

[7] A single notification may be provided on behalf of more than one Applicant if the person making the notification is authorised to do so.

[8] For the purposes of this condition, Applicants may engage an Auditor to provide a single report on behalf of each of them..

[9] Relevant Australian Standards means relevant Australian audit standards issued by the Auditing and Assurance Standards Board, as in force or applicable from time to time.

[10] Relevant Expert means an independent professional advisory firm with appropriate technical skills that is able to prepare an Audit Report on an Applicant’s compliance with conditions 1 to 3 with that report being prepared in accordance with Relevant Australian Standards.