EXPLANATORY STATEMENT
Select Legislative Instrument No. , 2016
Issued by the authority of the Attorney-General
Privacy Act 1988
Privacy Amendment (External Dispute Resolution Scheme) Regulation 2016
The Privacy Act 1988 (Cth) (Privacy Act) establishes, among other things, the Australian Privacy Principles (APPs), which regulate the collection, use, disclosure and storage of personal information by APP entities.
Subsection 100(1) of the Privacy Act provides that the Governor-General may make regulations prescribing matters required or permitted by the Privacy Act to be prescribed, or necessary or convenient to be prescribed, for carrying out or giving effect to the Privacy Act.
External dispute resolution membership obligation for credit reporting
Pursuant to subparagraph 21D(2)(a)(i) of the Privacy Act, credit providers are required to be members of an external dispute resolution (EDR) scheme recognised by the Australian Information Commissioner in order to disclose credit information about an individual to a credit reporting body and thereby participate in the credit reporting system. The purpose of this requirement is to ensure that consumers have access to a convenient, speedy and independent avenue of redress for complaints or other issues that might arise between the individual and the organisation on credit reporting matters. Utilities (water, gas and electricity providers) are considered credit providers under the Privacy Act.
Exemption for utilities
All Australian jurisdictions require utilities in that jurisdiction to participate in EDR arrangements, in most cases through an energy and water ombudsman service. To minimise the compliance burden, the simplest solution for utilities is if existing State or Territory-based EDR schemes are also recognised as EDR schemes by the Australian Information Commissioner for credit reporting purposes. Legislative amendments or other arrangements are required to enable the recognition of EDR schemes in Tasmania, the Australian Capital Territory and the Northern Territory. Therefore, a temporary exemption from the EDR obligation, expiring on 1 January 2017, is required for these jurisdictions.
The Regulation amends the Privacy Regulation 2013 to prescribe utilities in Tasmania, the Australian Capital Territory and the Northern Territory as exempt from the EDR obligation until 1 January 2017. This time-limited exemption enables those utilities to continue to access the credit reporting system whilst necessary legislative changes or other arrangements are made.
Details of the Regulations are set out in Attachment A.
A Statement of Compatibility with Human Rights is set out in Attachment B prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny Act) 2011.
Consistent with the requirements of the Legislation Act 2003 the following were consulted in making the Regulations: the Department of Treasury, the Office of the Australian Information Commissioner and certain State and Territory energy and water ombudsmen, relevant State and Territory departments responsible for energy and water and relevant State and Territory departments of the Attorney-General.
The Office of Best Practice Regulation was consulted on this Regulation and advised that no Regulation Impact Statement was required.
The Regulation is a legislative instrument for the purposes of the Legislation Act 2003.
The proposed Regulation would commence the day after registration.
ATTACHMENT A
Privacy Amendment (External Dispute Resolution Scheme) Regulation 2016
Preliminary
Section 1 – Name of Regulation
This section provides that the title of the Regulation is the Privacy Amendment (External Dispute Resolution Scheme) Regulation 2016.
Section 2 – Commencement
This section provides that the Regulation commences the day after registration.
Section 3 – Authority
This section provides that the Regulation is made under the Privacy Act 1988.
Section 4 – Schedule(s)
This section provides that amendments or repeals have effect according to the terms set out in the Schedule(s).
Section 14A – Permitted disclosure of credit information by energy and water utilities
Subsection 14A(1) provides that subparagraph 21D(2)(a)(i) of the Privacy Act 1988 does not apply in relation to a disclosure of credit information by a credit provider that is an energy or water utility operating in Tasmania, the Australian Capital Territory or the Northern Territory.
Subsection 14A(2) provides that section 14A is repealed on 1 January 2017.
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Privacy Regulation 2013
This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Legislative Instrument
The Privacy Amendment (External Dispute Resolution Scheme) Regulation 2016 (the Regulation) amends the Privacy Regulation 2013 to prescribe utilities in Tasmania, the Australian Capital Territory and the Northern Territory as exempt from the external dispute resolution (EDR) obligation under subparagraph 21D(2)(a)(i) of the Privacy Act 1988 until 1 January 2017. The effect of the Regulation is to temporarily exempt utilities (providers of water, gas, and electricity services) in Tasmania, the Australian Capital Territory and the Northern Territory from the requirement to be a member of an external dispute resolution (EDR) scheme in order to disclose credit information to a credit reporting body.
Human rights implications
This Legislative Instrument engages the right to the protection against arbitrary interference with privacy, protected in Article 17 of the International Covenant on Civil and Political Rights (ICCPR). The right to privacy in Article 17 of the ICCPR prohibits unlawful or arbitrary interferences with a person’s privacy, family, home and correspondence. In order for an interference with a right not to be ‘arbitrary’, the interference must be for a reason consistent with the relevant Convention and reasonable in the particular circumstances.
The Regulation engages with the use and disclosure of credit information. By providing that the exemption for utilities from the EDR membership obligation is time limited to 1 January 2017, and by limiting the application of the exemption to only those utilities operating in Tasmania, the Australian Capital Territory and the Northern Territory, the Regulation ensures that consumers are not disadvantaged simply because of their jurisdiction of residence. The measures are time limited, reasonable, necessary and proportionate as they ensure that a discrete subset of personal data is used for the purpose of providing essential services to Australians. These are legitimate objectives consistent with the Privacy Act.
Conclusion
This Legislative Instrument engages with the right to privacy, through the use and disclosure of personal data, and does so in a reasonable and proportionate way.