Privacy (Private Sector) Amendment Regulations 2003 (No. 1) 2003 No. 322
EXPLANATORY STATEMENT
STATUTORY RULES 2003 NO. 322
PRIVACY (PRIVATE SECTOR) AMENDMENT REGULATIONS 2003 (NO. 1)
The Privacy Act 1988 (the Act) establishes, among other things, the National Privacy Principles (NPPs) which regulate the collection, use, disclosure and storage of personal information by private sector organisations.
NPP 7.1 provides that a private sector organisation must not adopt as its own identifier of an individual an identifier of the individual that has been assigned by:
(a) a Commonwealth agency; or
(b) an agent of a Commonwealth agency acting in its capacity as agent; or
(c) a contracted service provider for a Commonwealth contract acting in its capacity as contracted service provider for that contract.
NPP 7.1A provides that NPP 7.1 does not apply to the adoption by a prescribed organisation of a prescribed identifier in prescribed circumstances.
NPP 7.2 provides that a private sector organisation must not use or disclose an identifier assigned to an individual by a Commonwealth agency, or by an agent or contracted service provider to that agency, except where:
(a) the use or disclosure is necessary for the organisation to fulfil its obligations to the agency; or
(b) the use or disclosure is in support of measures detailed in NPP 2.1(e) to 2.1(h) inclusive to lessen or prevent a threat to the health or safety of an individual or the public, is required or authorised by law, or is in support of law enforcement or prosecution activities; or
(c) the use or disclosure is by a prescribed organisation of a prescribed identifier in prescribed circumstances.
Subsection 100(1) of the Act provides that the Governor‑General may make regulations, not inconsistent with the Act, prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.
The purpose of these Regulations is to authorise the adoption, use and disclosure of Commonwealth employee payroll numbers by two private sector superannuation bodies for the purposes of providing Commonwealth employees with superannuation services. These bodies are AvSuper Pty Ltd and the Australian Government Employees Superannuation Trust (AGEST).
AvSuper is the superannuation organisation for employees of Airservices Australia and the Civil Aviation Safety Authority. As part of its normal operations, AvSuper adopts, uses and discloses payroll numbers of these employees and has done so since its establishment in 1991.
AGEST serves as a superannuation body for individuals who are prevented from joining the mainstream Commonwealth or Public Sector Superannuation Schemes, including contractors and short‑term employees, or those who voluntarily wish to engage in salary‑sacrifice arrangements not permitted by those schemes. As part of its normal operations, AGEST uses and discloses payroll numbers of these employees. AGEST currently provides superannuation services to the employees of around 180 Commonwealth agencies.
The adoption, use and disclosure of the Commonwealth payroll numbers by AvSuper and AGEST is, in each case, only be for the benefit of the individual concerned. It enables superannuation deductions to be correctly attributed to the individual superannuation fund accounts of each individual employee as a routine procedure without the necessity of requiring every individual employee to manually confirm the deductions each time salary is paid. The practices of AvSuper and AGEST allow an individual's superannuation benefits to be calculated accurately and to be transferred to other superannuation funds when an employee's status changes, such as when an employee becomes a continuing member of the Australian Public Service and provision of his or her superannuation services moves from AGEST to the Public Sector Superannuation Scheme as a result.
Subsection 100(2) of the Act provides that before the Governor‑General makes regulations for the purposes of NPP 7.1A or NPP 7.2(c) prescribing an organisation, identifier and circumstances, the Attorney‑General must be satisfied that affected agencies have agreed to the adoption, use or disclosure, that those agencies have consulted the Privacy Commissioner, and that the adoption, use or disclosure can only be for the benefit of the individual concerned. The Attorney‑General is satisfied of these matters in relation to the adoption, use or disclosure of Commonwealth payroll numbers by AvSuper and AGEST.
Details of the Regulations are set out in the Attachment.
The Regulations commence on gazettal.
PRIVACY (PRIVATE SECTOR) AMENDMENT REGULATIONS 2003 (NO. 1)
Regulation 1 describes how the Regulations are to be cited.
Regulation 2 provides that the Regulations commence on gazettal.
Regulation 3 provides that the Privacy (Private Sector) Regulations 2001 (the Principal Regulations) are amended in accordance with Schedule 1 of the Regulations.
The regulations add Part 3 to the Principal Regulations to authorise exceptions to National Privacy Principle 7.1 and 7.2.
Schedule 1, Items 1 and 2 insert titles to describe the existing parts of the Principal Regulations.
Schedule 1, Item 3 inserts a new Part 3, titled National Privacy Principles, in the Principal Regulations. The new Part defines the agencies subject to the Part and other relevant entities, authorises AvSuper's adoption of payroll numbers assigned by Airservices Australia and the Civil Aviation Safety Authority, and authorises the use and disclosure by AvSuper and the Australian Government Employees Superannuation Trust of payroll numbers assigned by agencies.
Schedule 1, Item 4 inserts a new schedule 2 in the Regulations listing the bodies defined as agencies for the purposes of Part 3 of the Regulations.