Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019

Administered by Attorney-General's Department

Legislation au F2019L01644 Regulations Not in force Legislative Instrument

Legislation content

EXPLANATORY STATEMENT
 

Issued by the authority of the Attorney-General

Privacy Act 1988

Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019

 

The Privacy Act 1988 (Cth) (the Privacy Act) contains 13 Australian Privacy Principles (APPs) which regulate the collection, use, disclosure and storage of individuals’ personal information. The APPs apply to government agencies and certain private sector organisations with an annual turnover of $3 million or more, as well as certain smaller organisations.

Subsection 100(1) of the Privacy Act provides that the Governor-General may make regulations, not inconsistent with the Act, prescribing matters required or permitted to be prescribed, or necessary or convenient to be prescribed, for carrying out or giving effect to the Act.

Part IIIA of the Privacy Act sets out the regulatory scheme for credit reporting in Australia. Under subparagraph 21D(2)(a)(i), credit providers, including energy or water utilities companies, must be a ‘member’ of an external dispute resolution (EDR) scheme recognised by the Australian Information Commissioner (the Commissioner) in order to participate in the  credit reporting system. The Commissioner’s power to recognise EDR schemes to handle particular privacy-related complaints is set out at section 35A of the Privacy Act.

The policy intention of the credit reporting EDR requirement and the Commissioner EDR recognition process was to allow any EDR schemes already in place to be recognised for the purposes of the credit reporting provisions. In the Australian energy and water utility sector, states and territories either had existing EDR schemes that were recognised by the Commissioner for the purposes of the credit reporting provisions, or the energy and water utilities in a jurisdiction have joined other EDR schemes that had been recognised by the Commissioner.

EDR in relation to ACT energy and water utilities, however, is provided through the ACT Civil and Administrative Tribunal (the ACAT). The ACAT is not an organisation of which credit providers can become ‘members’. As such, it is not possible for the Commissioner to recognise the ACAT as an EDR scheme under section 35A of the Privacy Act, since subparagraph 21D(2)(a)(i) requires that a credit provider be a ‘member’ of the EDR scheme.

Subparagraph 21D(2)(a)(i) of the Privacy Act provides, as an alternative to being a member of an EDR scheme, that a credit provider can be prescribed by regulations (the exemption). To clarify that ACT energy and water utilities can continue to participate in the credit reporting system, such regulations have been made. Previous regulation 14B of the Privacy Regulation 2013 (the Principal Regulation) provided utilities in the Australian Capital Territory with an exemption to the EDR membership requirement until 1 January 2020.

Purpose and Operation of the Instrument

The purpose of the Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019 (the new Regulations) is to amend the Principal Regulation to extend the prescription of energy or water utilities in the ACT, for the purposes of subparagraph 21D(2)(a)(i) of the Privacy Act, until 31 December 2021. This 24-month extension for ACT utilities is to allow time to progress necessary amendments to the Privacy Act such that there is no longer a requirement under subparagraph 21D(2)(a)(i) for providers to be a ‘member’ of an EDR scheme in order for the Commissioner to recognise such a scheme.

Details of the new Regulations are set out in Attachment A.

A Statement of Compatibility with Human Rights is set out in Attachment B prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny Act) 2011.

Consistent with the requirements of section 17 of the Legislation Act 2003 (Legislation Act), the new Regulations have been the subject of consultation with the ACT Justice and Community Safety Directorate and the Office of the Australian Information Commissioner (OAIC). 

The Office of Best Practice Regulation (OBPR) was consulted and has stated that a Regulation Impact Statement is not required for the new Regulations (OBPR ID: 25832).

The new Regulations are a legislative instrument for the purposes of the Legislation Act.

The new Regulations commence on 1 January 2020.

 

 

 

 

 

 

 

 

 

 

 

 

Attachment A

Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019

 

Preliminary

Section 1 – Name

Section 1 provides that the title of the instrument is the Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019. 

Section 2 – Commencement

Section 2 provides that the Regulations commence on 1 January 2020.

Subsection (1) provides that each provision of the instrument specified in column 1 of the table commences in accordance with column 2 of the table. Columns 1 and 2 provide that the Regulations commence on 1 January 2020.

The note to subsection (1) clarifies that the table only relates to the provisions of this instrument as originally made, and that it will not be amended to deal with any later amendments to the instrument.

Subsection (2) provides that information in column 3 of the table is not part of the instrument. It is designed to assist readers, and may be updated or changed in any published version of the Regulations.

Section 3 – Authority

Section 3 provides that the Regulations are made under the Privacy Act 1988 (Privacy Act).

Section 4 – Schedules

Section 4 provides that each instrument that is specified in Schedule 1 to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in that Schedule has effect according to its terms.


SCHEDULE 1 – Amendments

Item 1

Item 1 repeals and replaces previous section 14B in the Privacy Regulation 2013. Subsection 14B(1) states that entities that engage in the retail sale of electricity, gas, water, sewerage or draining services in the Australian Capital Territory are prescribed credit providers for the purposes of subparagraph 21D(2)(a)(i) of the Privacy Act beginning on 1 January 2020 and ending on 31 December 2021.

Subsection 14B(2) provides that section 14B is repealed at the start of 1 January 2022.


Attachment B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Privacy Regulation 2013

This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instrument

The Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019 (the new Regulations) amend the Privacy Regulation 2013 to extend, until 31 December 2021, the exemption of energy and water utilities in the Australian Capital Territory from the requirement to be a ‘member’ of a recognised external dispute resolution (EDR) scheme in order to participate in the credit reporting system regulated by the Privacy Act 1988 (Privacy Act).

Human rights implications

This Legislative Instrument engages the right to the protection against arbitrary interference with privacy, protected in Article 17 of the International Covenant on Civil and Political Rights (ICCPR).  The right to privacy in Article 17 of the ICCPR prohibits unlawful or arbitrary interferences with a person’s privacy, family, home and correspondence.  In order for an interference with a right not to be ‘arbitrary’, the interference must be for a reason consistent with the relevant Convention and reasonable in the particular circumstances.

The new Regulations relate to the use and disclosure of credit information, which is personal information. The Regulations ensure that consumers within the Australian Capital Territory are not disadvantaged simply due to the ACAT not being an EDR scheme with a strict ‘membership’ structure as contemplated by the Privacy Act. The prescription is limited to utilities operating in the Australian Capital Territory, where individuals are still able to make privacy complaints to an equivalent EDR scheme: the ACAT. The measures are time limited, reasonable, necessary and proportionate as they ensure that a discrete subset of personal data is used for the purpose of providing essential services to Australians.  These are legitimate objectives consistent with the Privacy Act.

Conclusion

This Legislative Instrument engages the right to privacy, by facilitating ACT utilities’ participation in the credit reporting system involving the use and disclosure of personal information. To the extent that the Legislative Instrument may limit the right to privacy, those limitations are reasonable, necessary and proportionate to achieve the legitimate aims of the Legislative Instrument.

 

 

Overview

The Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019 were introduced to address a specific issue under the Privacy Act 1988 concerning the participation of energy and water utilities in the Australian Capital Territory (ACT) within the credit reporting system. These regulations were enacted to extend the exemption for ACT utilities from the requirement to be members of an external dispute resolution (EDR) scheme, a condition mandated by the Privacy Act for credit providers to participate in the credit reporting system. The regulations were necessary because the ACT Civil and Administrative Tribunal (ACAT), which handles EDR in the ACT, does not operate as a membership-based scheme as required by the Privacy Act. The Privacy Amendment Regulations were made under the authority of the Privacy Act 1988 and were subject to consultation with relevant stakeholders, including the ACT Justice and Community Safety Directorate and the Office of the Australian Information Commissioner (OAIC). These regulations provide a 24-month extension until 31 December 2021, allowing time to progress necessary amendments to the Privacy Act. The policy objective of these regulations is to ensure that ACT utilities can continue to operate within the credit reporting system without being disadvantaged due to the structural differences of the ACAT compared to other recognised EDR schemes.

Scope and Application

The Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019 amends the Privacy Regulation 2013 to provide a temporary exemption for energy and water utilities in the Australian Capital Territory from the requirement to be a 'member' of a recognised external dispute resolution (EDR) scheme in order to participate in the credit reporting system regulated by the Privacy Act 1988. This exemption is necessary because the ACT Civil and Administrative Tribunal, which provides EDR in relation to ACT energy and water utilities, is not an organisation of which credit providers can become 'members'. The new Regulations extend this exemption until 31 December 2021, allowing time for necessary amendments to the Privacy Act. The Regulations only apply to entities that engage in the retail sale of electricity, gas, water, sewerage or draining services in the Australian Capital Territory. The Regulations are a legislative instrument for the purposes of the Legislation Act and have been the subject of consultation with relevant authorities. The Regulations commence on 1 January 2020.

Key Provisions

The Privacy Amendment (Extension of External Dispute Resolution Scheme Exemption) Regulations 2019 primarily amends the Privacy Regulation 2013, extending the exemption for energy and water utilities in the Australian Capital Territory (ACT) from the requirement to be members of a recognised external dispute resolution (EDR) scheme. This extension, as per section 14B(1) of the amended Privacy Regulation 2013, runs until 31 December 2021, ensuring that these utilities can continue to participate in the credit reporting system regulated by the Privacy Act 1988 (section 2). This amendment is necessary because the ACT Civil and Administrative Tribunal (ACAT), through which EDR is provided for ACT energy and water utilities, does not fit the 'membership' model required by subparagraph 21D(2)(a)(i) of the Privacy Act. Under these Regulations, the obligations on energy and water utilities in the ACT are primarily centred on ensuring compliance with the extended exemption period. Utilities must continue to adhere to the Australian Privacy Principles (APPs) as set out in the Privacy Act, particularly in how they collect, use, disclose, and store personal information. They must also ensure that their practices align with the broader objectives of the Privacy Act, which include protecting the privacy of individuals while allowing necessary information flows for legitimate purposes. The Regulations do not introduce new offences or penalties. However, any breach of the Privacy Act or its regulations by these utilities could lead to enforcement actions by the Office of the Australian Information Commissioner (OAIC). Potential consequences include formal complaints, investigations, and enforcement actions such as fines. For serious or repeated breaches, penalties can be substantial, with maximum fines reaching up to $2.1 million for corporations under section 13G of the Privacy Act. This ensures that compliance with privacy laws remains a critical priority for all entities covered by the Privacy Act. In summary, the new Regulations extend a specific exemption for ACT energy and water utilities, allowing them to continue participating in the credit reporting system without the need to join a recognised EDR scheme. This extension supports the Privacy Act's objectives while ensuring that essential services continue uninterrupted for consumers in the ACT. The Regulations impose clear obligations on these utilities to comply with privacy laws and avoid penalties for non-compliance, thereby maintaining the integrity of the credit reporting system.

Legal classification tags

Area of Law
Privacy Law
Instrument
Regulation
Concepts
Definitions & Interpretation
Commencement Provisions
Regulatory Standards

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.