Privacy (International Money Transfers) Generalising Determination 2015

Administered by Attorney-General's Department

Legislation au F2015L00201 Not in force Legislative Instrument

Legislation content

Explanatory Statement

Issued by the authority of the Privacy Commissioner (the Commissioner), in accordance with the functions and powers conferred on him by s 12 of the Australian Information Commissioner Act 2010 (Cth) (the Australian Information Commissioner Act).

Privacy (International Money Transfers) Public Interest Determination 2015 (No. 1), Privacy (International Money Transfers) Public Interest Determination 2015 (No. 2) and Privacy (International Money Transfers) Generalising Determination 2015

This explanatory statement relates to the Privacy (International Money Transfers) Public Interest Determination 2015 (No. 1) (PID 2015-1), the Privacy (International Money Transfers) Public Interest Determination 2015 (No. 2) (PID 2015-2) and the Privacy (International Money Transfers) Generalising Determination 2015 (GD 2015).

This explanatory statement fulfils the Commissioner’s obligations under s 26(1) of the Legislative Instruments Act 2003 (the Legislative Instruments Act).

Authority for the making of the determinations

The Commissioner is empowered by s 72(2) of the Privacy Act 1988 (Cth) (the Privacy Act) to make PID 2015-1 and PID 2015-2. Under s 72(2) the Commissioner may, by legislative instrument, make a public interest determination (PID) by declaring that a specific act or practice of an APP entity will not be in breach of the Australian Privacy Principles (APPs), where the Commissioner is satisfied that the public interest in doing so substantially outweighs the public interest in adhering to the APP in question.

The Commissioner is also empowered by s 72(4) of the Privacy Act to make GD 2015. Where the Commissioner has made a PID under s 72(2), the Commissioner may issue a determination under s 72(4) giving general effect to that PID. A generalising determination has the effect of permitting other APP entities to do an act or practice that is the subject of the PID without breaching the APPs.

Under s 73(1) of the Privacy Act an APP entity may apply to the Commissioner for a determination under s 72 in relation to an act or practice of that entity. The Commissioner received two such applications. The first application was received from the Australia and New Zealand Banking Group Limited (ANZ) on 24 February 2014, and the second was received from the Reserve Bank of Australia (RBA) on 7 May 2014. ANZ’s application also sought a generalising determination under s 72(4) to apply to all authorised-deposit taking institutions within the meaning of the Banking Act 1959 (ADIs). The RBA is not an ADI and, therefore, sought its own determination under s 72(2). The applications can be viewed on the Register of Public Interest Determinations on the Office of the Australian Information Commissioner’s website, www.oaic.gov.au.

Purpose of the determinations

The purpose of PID 2015-1 and PID 2015-2 is to permit the Applicants, ANZ and the RBA, to disclose the personal information of a beneficiary of an international money transfer (IMT) to an overseas financial institution when processing an IMT without breaching the APPs, following the commencement of the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Privacy Amendment Act). The purpose of GD 2015 is to give PID 2015-1 general effect in relation to all other ADIs.

The Privacy Amendment Act

The Privacy Amendment Act, which commenced on 12 March 2014, replaced the National Privacy Principles (NPPs), which applied to some private sector organisations, and the Information Privacy Principles (IPPs), which applied to by Australian Government agencies, with a single set of harmonised principles, the Australian Privacy Principles (APPs).

Relevant to the Application, a new APP 8 dealing with cross-border disclosure of personal information replaced the old NPP 9. APP 8.1 requires an APP entity that discloses personal information to an overseas recipient to take reasonable steps to ensure that the overseas recipient does not breach the APPs (other than APP 1) in relation to the information, unless an APP 8.2 exception applies.

Prior to the commencement of the Privacy Amendment Act, the Applicants, and other ADIs, relied on the exceptions contained in NPP 9(d) and NPP 9(e) to disclose the personal information of beneficiaries to overseas financial institutions when processing IMTs. Those exceptions applied where:

  • the transfer was necessary for the conclusion or performance of a contract concluded in the interest of the individual between the organisation and a third party (NPP 9(d)), or
  • all of the following apply:
    • the transfer is for the benefit of the individual,
    • it is impracticable to obtain the consent of the individual to that transfer, and
    • if it were practicable to obtain such consent, the individual would likely give it (NPP 9(e)).

The exceptions set out in APP 8.2 differ from the NPP 9 exceptions and include if:

  • the entity reasonably believes that:
    • the recipient of the information is subject to a law or binding scheme that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the APPs protect the information, and
    • there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme (APP 8.2(a)), or
  • both of the following apply:
    • the entity expressly informs the individual that if he or she consents to the disclosure of the information, subclause 8.1 will not apply to the disclosure, and
    • after being so informed, the individual consents to the disclosure (APP 8.2(b)).

Importantly, APP 8.2 does not cover either of the exceptions set out in NPP 9(d) or (e).

The Privacy Amendment Act also introduced a new accountability approach dealing with cross-border data flows. As part of this approach, a new s 16C provides that where an APP entity discloses personal information to an overseas recipient, in circumstances where the overseas recipient is not bound by the APPs and an APP 8.2 exception does not apply to the disclosure, the APP entity will be taken to have breached the APPs in instances where the overseas recipient does an act or engages in a practice in relation to that information that would be a breach of the APPs (other than APP 1) if the APPs so applied to that act or practice.

While the changes to the Privacy Act made by the Privacy Amendment Act do not prohibit the processing of IMTs by the Applicants and other ADIs, they will:

  • require that before processing an IMT, the Applicants and other ADIs take reasonable steps to ensure that the overseas financial institution to which a beneficiary’s personal information is to be disclosed, does not breach the APPs (other than APP 1) in relation to that information, and
  • in some circumstances, make the Applicants and other ADIs accountable for any acts or practices of the overseas financial institution that breach the APPs (other than APP 1) in relation to that information.

PID 2015-1, PID 2015-2 and GD 2015 will ensure that the Applicants and other ADIs do not breach APP 8.1 when disclosing the beneficiary’s personal information to the overseas financial institution, and are not held to breach another APP (other than APP 1) as a result of being held accountable for an act or practice of the overseas financial institution in relation to that information (in accordance with subsection 16C(2)).

PID 2015-1, PID 2015-2 and GD 2015 will replace Privacy (International Money Transfers) Temporary Public Interest Determination 2014 (No. 1), Privacy (International Money Transfers) Temporary Public Interest Determination 2014 (No. 2) and Privacy (International Money Transfers) Generalising Determination 2014 (No. 1) respectively.

The process for making an international money transfer

The Applications provided an outline of the IMT process.

An IMT is the term used for a payment made by a sender to an overseas beneficiary. To perform an IMT, an ADI needs to disclose to an overseas financial institution the personal information of the beneficiary of the IMT. That personal information will generally include the name and account information of the beneficiary. However, some overseas financial institutions require the ADI to provide further information, such as the account name and residential address of the beneficiary, generally because of in-country regulatory requirements, anti-money laundering and counter-terrorism financing requirements or to allow sanction checks to be performed.

Both ANZ and the RBA utilise a range of processes to effect an IMT which generally include the use of the Society for Worldwide Interbank Financial Telecommunication (SWIFT) network as part of the process. ANZ, and other ADIs, tend to use the SWIFT network directly in the majority of cases.

The SWIFT network is a member-owned cooperative established in 1973. ANZ note that the network is used by more than 10,000 financial institutions, securities institutions and corporate customers in 212 countries. The SWIFT network is a secure and highly confidential network, which facilitates the transfer of payments and other financial messages between SWIFT users. Once a financial institution becomes a SWIFT user, it can transact with other financial institutions through ‘account relationships’ (which are contractual relationships) or by using the ‘Relationship Management Application’ within SWIFT, which allows for the processing of IMTs without an account relationship.

If ANZ or another ADI does not have an account relationship with the beneficiary’s overseas financial institution, it may still transfer money using SWIFT by sending payment instructions to an ‘intermediary bank’ (that is also a SWIFT user), which will then route the payment instructions to the beneficiary’s financial institution. More than one intermediary bank may be involved in the process before the money reaches the beneficiary’s financial institution.

High levels of confidentiality are imposed and security is reinforced in the SWIFT network through encryption of messages. SWIFT is also subject to a governance structure and publicly available data retrieval policies that enable SWIFT to meet the security commitments required by users. There are three categorised groups of users: supervised financial institutions, non-supervised entities active in the financial industry and closed user groups/corporate entities. SWIFT users are only able to send financial messages within their user category. For example, ANZ is only able to send financial messages via SWIFT to other supervised financial institutions.

IMTs are also processed via ANZ’s or another ADI’s own commercial arrangements, sometimes without the use of the SWIFT network. For example, ANZ and other ADIs may transfer funds to an offshore branch or subsidiary that will then make a payment to the beneficiary’s financial institution within that jurisdiction using the local payment and settlement system.

In some instances, the RBA also uses the SWIFT network in the same way as ANZ and other ADIs, as described above. In other instances, the RBA initially transfers the relevant payment instructions through a secure dedicated network to an overseas centre operated by a foreign financial institution whose Australian branch is an ADI (referred to in RBA’s application as the Agent). That Agent then uses the SWIFT network.

However, in most instances, the RBA transfers the relevant payment instructions through a secure dedicated network to the Agent. That Agent (or its related entity or agent) then arranges for payment to the beneficiary’s financial institution using the local payment and settlement system. The RBA’s application notes that these types of local settlement system payments operate in a regulated and secure environment in which transfers are completed.

The applications from ANZ and the RBA outline in considerable detail (and with diagrams) the IMT processes used by ANZ and other ADIs, and the RBA respectively. Interested parties should refer to the applications for a full explanation of those processes.

Compliance with the APPs when processing an international money transfer

Compliance with APP 8

Both Applicants submitted that they would be unable to rely on any of the relevant exceptions to APP 8.1, contained in APP 8.2, when processing IMTs.

In relation to the exception in APP 8.2(a), both Applicants submitted that:

  • it would not be practical to obtain up-to-date legal advice on the privacy regimes of every jurisdiction to which IMTs may be sent (which may include any jurisdiction that has a functioning banking system)
  • even if they did obtain such legal advice, those countries which do not have substantially similar privacy schemes and do not allow individuals to take action to enforce protection of their personal information, would fall outside of the exception in APP 8.2(a).

This would result in an inability to send IMTs to beneficiaries in particular countries and likely disadvantage both the sender and the beneficiary.

In relation to the exception in APP 8.2(b), both Applicants submitted that their role in the IMT process is limited to collecting the information about the beneficiary from the sender of the IMT. There is no legal (or other) relationship between either applicant and the beneficiary, and there would not be an opportunity for ANZ or the RBA to seek the beneficiary’s consent in accordance with the exception in APP 8.2(b) prior to processing the IMT. Further, due to the large volume of IMTs processed, it would not be feasible to contact each beneficiary across a wide range of jurisdictions to obtain their consent before disclosing their personal information.

As the Applicants cannot rely on any of the relevant APP 8.2 exceptions, the Applicant will need to comply with APP 8.1 when processing IMTs and take reasonable steps to ensure that the overseas financial institution receiving the beneficiary’s personal information does not breach the APPs in handling that information.

Chapter 8 of the APP guidelines states that it is generally expected that to comply with APP 8.1, the relevant APP entity will enter into an enforceable contractual arrangement with an overseas recipient that requires the overseas recipient to handle personal information in accordance with the APPs. However, the APP guidelines acknowledge that whether a contract is required, and the terms of the contract, will depend on the circumstances, including the practicability of taking that step.

Both Applicants submitted that, given that the SWIFT network is used by more than 10,000 members, it is not practicable to have enforceable contractual arrangements with every potential overseas financial institution to which they might disclose the beneficiary’s personal information when processing an IMT. Rather, when using the SWIFT network to process IMTs, ANZ, other ADIs and the RBA rely on the relationships created by the SWIFT network. In addition, it is unlikely that foreign financial institutions would agree to enter into contracts requiring them to handle personal information in accordance with the APPs in relation to payments that occur outside the SWIFT network. ANZ explains that this is because:

  • where the payment is made through the foreign payment and clearing system, it would be treated as a domestic payment by the foreign financial institution
  • foreign payment and clearing systems are regulated by rules overseen by the central bank of the relevant country, and
  • foreign financial institutions would be reticent to enter into binding contractual relationships which obliged them to comply with the APPs where they are already bound by domestic privacy law.

Additionally, Australian ADIs do not have the voting power to try to alter SWIFT to impose obligations on other SWIFT users to comply with the APPs in relation to the personal information of IMT beneficiaries.

Publicly available information about SWIFT oversight arrangements and privacy safeguards support the veracity of the information provided by ANZ and the RBA in their applications about SWIFT and that it is not possible for the Applicants, or other ADI, to seek to amend SWIFT to ensure that any personal information handled in the IMT process is handled in accordance with the APPs.

The RBA indicated in its application that it mostly uses an Agent to process IMTs (as explained above) and that it has a contract with the Agent which contains obligations in relation to the handling of personal information by the Agent. The RBA envisages that the agent is unlikely to accept an obligation to ensure that all organisations in the payment chain agree to comply with the APPs.

Both Applicants submitted that although they take steps to protect the beneficiary’s information where it is disclosed overseas during the processing of an IMT (for example, whether the transfer occurs as part of the SWIFT network or outside of this network, there are mechanisms in place to ensure the security and confidentiality of that information), there is uncertainty about whether these steps would satisfy the ‘reasonable steps’ test in APP 8.1. For this reason, ANZ, any other ADI or the RBA may breach APP 8.1 when disclosing a beneficiary’s personal information to an overseas financial institution during the processing of IMTs.

Section 16C and compliance with the other APPs

Both Applicants submitted that, because they cannot take further steps to ensure that the overseas financial institution does not do an act or engage in a practice that would breach the APPs, there is a risk that they will be taken to have breached the APPs (other than APP 1) as a result of s 16C(2).

The Commissioner’s view

Should the Applicants process an IMT in the manner described in their applications, the Commissioner considers it likely that they could be considered to have taken reasonable steps to ensure the overseas recipient does not breach the APPs, and would therefore not breach APP 8.1. In reaching this preliminary view, the Commissioner took into account that:

  • disclosures by ANZ generally occur within a secure and confidential environment to users of the SWIFT network with which it has account relationships
  • disclosures by the RBA are generally made to an agent through a secure dedicated network under a contract that contains obligations in relation to the handling of personal information in line with the APPs.

In terms of the expectation that reasonable steps includes entering into enforceable contractual arrangements with the overseas financial institutions to which the beneficiary’s personal information is disclosed, the Commissioner considers that this is unlikely to be practicable in the circumstances of the IMT process for the ANZ and other ADIs. This will also be the case for some IMTs processed by the RBA. On the other hand, RBA IMTs processed through an agent would appear to already be subject to enforceable contractual arrangements.

However, were the Commissioner to receive a complaint by a beneficiary related to the mishandling of their personal information during the IMT process, the Commissioner would investigate the steps taken by ANZ, any other ADI or the RBA in the particular circumstances of the complaint. Nonetheless, the Commissioner considers that where the overseas financial institution mishandles that personal information it likely that the Applicants, and any other ADI, where it is using an IMT process that does not involve an enforceable contractual arrangement, would breach an APP (other than APP 1) by reason of s 16C. Further, there would be no recourse available to either Applicant, or another ADI, against the overseas financial institution.

Consultation

The Commissioner is required under s 75 to prepare a draft of a determination made in response to an application received under s 73 and, if requested, hold a conference on that draft determination.

On 23 June 2014 the Commissioner publicly released a Consultation Paper that contained a draft of PID 2015-1, PID 2015-2 and GD 2015. The Consultation invited submitters to consider a range of matters.  In accordance with the requirement set out in ss 75 and 76 of the Privacy Act, the Consultation Paper also invited expressions of interest for a conference on the draft determinations. However, no expressions of interest were received and, therefore, a conference was not held.

The Commissioner received several submissions in response to the Consultation Paper, which he took into account when deciding whether to make the determinations. The Consultation Paper and submissions can be viewed on the Office of the Australian Information Commissioner’s website, www.oaic.gov.au.

Public interest

In deciding whether the public interest in allowing the Applicants and other ADIs to continue to process IMTs in the manner described in the Applicants outweighs the public interest in complying with the APPs, the Commissioner took account of the matters raised in the applications and submissions received in response to public consultation.

The Applicants made a number of arguments in their applications as to why the public interest in processing IMTs in the manner described above substantially outweighs the public interest in complying with APP 8.1, and other APPs in cases where the Applicant might be held accountable for a breach by an overseas financial institution:

Public interest benefits associated with making a longer term PID to allow the IMT process to continue in its current form

In its application, ANZ outlined a number of public interest benefits associated with making IMTs available to Australian ADI customers:

  • IMTs allow individuals to benefit from the global movement of money. They can be used to, for example, allow families to support one another over long distances, and allow private transactions to take place involving parties in different jurisdictions.
  • IMTs provide payment security and transaction certainty. This also assists government to better enforce anti-money laundering and counter-terrorism rules.
  • IMTs are an important element of international financial relations, with SWIFT processing a daily average of 10.3 million payment messages.
  • The IMT process, in its current form, is one component of the global financial system, and Australia is a significant contributor to that system. Maintaining the certainty, reliability and efficiency of IMT processing by ADIs in Australia serves an important public interest within the context of Australia’s role within the global economy. ANZ maintained that it would be detrimental for Australia’s reputation as a leading international financial participant if it becomes impracticable for ADIs in Australia to process IMTs.

The RBA submitted that the public benefits in processing IMTs by it include:

  • IMTs allow the government to meet its obligations to overseas beneficiaries in a timely and secure manner.
  • IMTs provide payment security and transaction certainty. This assists government to better enforce anti-money laundering and counter-terrorism financing requirements.
  • The IMT process, in its current form, is one component of the global financial system, and Australia is a significant contributor to that system. Maintaining the certainty, reliability and efficiency of IMT processing serves an important public interest within the context of Australia’s role within the global community.

Public interest benefits associated with not making a longer term PID to allow the IMT process to continue in its current form

ANZ and the RBA both submitted that the main public benefit associated with APP 8 compliance during IMT processing is to ensure the protection of the personal information of beneficiaries.

ANZ noted that, in this respect, personal information is already protected in a number of ways when processing IMTs:

  • Disclosure to an overseas financial institution is conducted within a secure environment. IMTs are processed in a heavily regulated and controlled environment, the basis of which is a trusted network of relationships between financial institutions.
  • The disclosures that do occur as part of the IMT process are the minimum needed to allow the IMT to be processed.
  • The current IMT process is a successful and secure means of conducting international money transfers. ANZ stated that it is not aware of any complaint being made by a beneficiary in relation to the offshore disclosure of their personal information in order to process an IMT.

The RBA indicated that, in line with the practices of other Australian banks, it is currently protecting the security and confidentiality of any personal information that needs to be sent overseas in order to process an IMT.

The Commissioner’s view

The Commissioner considers that:

  • the public interest in ANZ and the RBA being able to process IMTs in the manner described in their applications with confidence that they are not breaching the APPs, substantially outweighs the public interest in requiring ANZ and the RBA to adhere to the requirements of APP 8.1 in all circumstances
  • the public interest in ANZ and the RBA being able to process IMTs in the manner described in their applications substantially outweighs the public interest in ANZ and the RBA being held accountable for an act or practice of an overseas financial institution in relation to in relation to personal information disclosed when processing an IMT, through the operation of s 16(2) of the Privacy Act, and
  • that the same public interest considerations make it appropriate for the Commissioner to make a generalising determination that applies to other ADIs that process IMTs.

In forming this view, the Commissioner acknowledges the importance of the IMT process for individuals that send and receive IMTs, for international financial relations and for the global financial system. Further, the Commissioner recognises the significant detrimental consequences that might result from a disruption to the IMT process.

Following consideration of both applications, the Commissioner recognises that the IMT processes, as described in the applications, ensure that personal information is disclosed within secure and confidential environments. This is supported by publicly available information about SWIFT oversight arrangements and privacy safeguards.

In addition, the Commissioner has taken into account ANZ’s assertion that it has not received any complaints by beneficiaries of IMTs in relation to the handling of their personal information during the IMT process.

Operation

PID 2015-1, PID 2015-2 and GD 2015 will remain in force for a period 5 years from the day they commence.

GD 2015 applies to all authorised deposit-taking institutions within the meaning of the Banking Act 1959. A list of the ADIs is maintained by the Australian Prudential Regulatory Authority. As at February 2015, there are approximately 169 ADIs in Australia.


Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Privacy (International Money Transfers) Public Interest Determination 2015 (No. 1) (PID 2015-1), Privacy (International Money Transfers) Public Interest Determination 2015 (No. 2) (PID 2015-2) and Privacy (International Money Transfers) Generalising Determination 2015 (GD 2015)

These three Legislative Instruments are compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Legislative Instruments

The purpose of PID 2015-1, PID 2015-2, GD 2015 is to permit the Applicants, ANZ and the RBA, and all authorised deposit-taking institutions within the meaning of the Banking Act 1959 to disclose the personal information of a beneficiary of an international money transfer (IMT) to an overseas financial institution when processing an IMT without breaching the APPs, following the commencement of the Privacy Amendment (Enhancing Privacy Protection) Act 2012 (Privacy Amendment Act).

The central public interest objective served by PID 2015-1, PID 2015-2 and GD 2015 is to permit the Applicants and other ADIs to continue to process IMTs, which has benefits for individuals who might send or receive money using IMTs, Australia and its reputation as a participant in the global financial system, and the stability of the global financial system.

Human rights implications

The determinations engage Article 17 of the International Covenant on Civil and Political Rights (ICCPR), which provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence, nor to unlawful attacks on his or her honour and reputation, and that everyone has the right to the protection of the law against such interference and attacks. The Preamble to the Privacy Act makes clear that the legislation was intended to implement, at least in part, Australia’s obligations relating to privacy under the ICCPR.

PID 2015-1, PID 2015-2 and GD 2015 limit the right against the arbitrary interference with privacy and the right to the protection of the law against such interference, by limiting the application of protections in the Privacy Act in relation to the cross-border disclosure of personal information.

 

However, the right to privacy is not absolute and there may be circumstances in which the guarantees in article 17 can be outweighed by other considerations. Importantly, the Commissioner must have regard to the objects of the Privacy Act when exercising his functions and powers. These objects include:

  • to promote the protection of the privacy of individuals (paragraph 2A(a))
  • to recognise that the protection of the privacy of individuals is balanced with the interest of entities in carrying out their functions and activities (paragraph 2A(b))
  • to promote responsible and transparent handling of personal information by entities (paragraph 2A(d))
  • to facilitate the free flow of information across national borders while ensuring that the privacy of individuals is respected (paragraph 2A(f)).

The Privacy Commissioner was satisfied that the public interest in permitting the acts or practices the subject of PID 2015-1, PID 2015-2 and GD 2015 substantially outweigh the public interest in adhering to the APPs.

Conclusion

It is considered that to the extent that the acts or practices authorised by PID 2015-1, PID 2015-2 and GD 2015 limit human rights, those limitations are reasonable and proportionate.

 

Timothy Pilgrim,

Privacy Commissioner

 

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.