EXPLANATORY STATEMENT
SELECT LEGISLATIVE INSTRUMENT 2006 NO. 222
PRIVACY (PRIVATE SECTOR) AMENDMENT REGULATIONS
2006 (NO. 2)
The Privacy Act 1988 (the Act) establishes, among other things, the National Privacy Principles (NPPs) which regulate the collection, use, disclosure and storage of personal information by private sector organisations.
The primary purpose of the Regulations is to allow greater access to Centrelink records, in order to determine whether a person is entitled to receive a service or assistance, or is entitled to early release of superannuation on the grounds of hardship.
NPP 7.2 provides that a private sector organisation must not use or disclose an identifier assigned to an individual by a Commonwealth agency, or by an agent or contracted service provider to that agency, except in specified circumstances, including where the use or disclosure is by a prescribed organisation of a prescribed identifier in prescribed circumstances (paragraph 7.2(c)).
Subsection 100(1) of the Act provides that the Governor-General may make regulations, not inconsistent with the Act, prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.
In determining the need for a Regulation under section 100 of the Act, Centrelink has consulted the Office of the Privacy Commissioner and the Attorney‑General's Department.
The Privacy (Private Sector) Regulations 2001 prescribe exceptions to NPP 7.2 for the purpose of accessing the Centrelink Confirmation eServices.
Centrelink’s Confirmation eServices comprises three distinct services: Customer Confirmation; Income Confirmation; and Superannuation Confirmation. Prior to this amendment, the Regulations supported only the Customer Confirmation service. The purpose of these amendment Regulations was to insert two additional exceptions to NPP 7.2 which support access to the Income Confirmation and Superannuation Confirmation eServices.
In particular, the exceptions authorise the use and disclosure of the Centrelink Customer Reference Number by certain private sector organisations so that they can access the Centrelink Confirmation eServices for the purpose of:
1. making an Income Confirmation enquiry to obtain a customer’s income statement (which details the customer’s Centrelink payments, other income, and assets). This information will assist the organisation in determining whether the individual is entitled to receive a service or assistance from the organisation. Private sector organisations able to use the Income Confirmation service are listed in Schedule 4.
2. making a Superannuation Confirmation enquiry to determine whether an individual is receiving income support. The Yes/No response will assist the organisation in determining whether the individual is entitled to the early release of superannuation on the grounds of financial hardship. Private sector organisations able to use the Superannuation Confirmation service are listed in Schedule 5.
The release of the information outlined above will only occur with the customers’ consent. In addition, the use and disclosure of the Customer Reference Number by these private sector organisations is in each case for the benefit of the individual concerned. It removes the need for customers to go into a Centrelink office to obtain written proof of their eligibility and verification will occur on‑line in real time, providing up to date eligibility information.
The Regulations also make minor changes to the prescribed organisations allowed to use and disclose the Customer Reference Number for the purpose of making a Customer Confirmation enquiry. Specifically, Central Area Regional Training Scheme (Inc), Palmerston Association Inc and Yura Yungi Aboriginal Medical Service have been added to the private sector organisations listed in Part 1 of Schedule 3 to the Regulations.
Details of the Regulations are set out in the Attachment.
The Regulations commenced on the day after they were registered.
ATTACHMENT
PRIVACY (PRIVATE SECTOR) AMENDMENT REGULATIONS 2006 (NO. 2)
Regulation 1 describes how the Regulations are to be cited.
Regulation 2 provides that the Regulations commence on the day after they are registered.
Regulation 3 provides that the Privacy (Private Sector) Regulations 2001 (the Principal Regulations) are amended in accordance with Schedule 1 to the Regulations.
Schedule 1, Item 1 inserts two new regulations into the Principal Regulations which provide for additional exceptions to National Privacy Principle 7.2.
The original exception to National Privacy Principle 7.2 in regulation 9 authorises the use and disclosure by prescribed organisations of the Centrelink Customer Reference Number and the Department of Veterans’ Affairs File Number for the purpose of accessing the Centrelink Confirmation eServices to make a Customer Confirmation enquiry.
New regulation 10 authorises the use and disclosure of the Customer Reference Number by 83 organisations (those listed in Schedule 4) for the purpose of accessing the Centrelink Confirmation eServices to make an Income Confirmation enquiry to determine whether an individual is entitled to receive a service or assistance.
New regulation 11 authorises the use and disclosure of the Customer Reference Number by 21 organisations (those listed in Schedule 5) for the purpose of accessing the Centrelink Confirmation eServices to make a Superannuation Confirmation enquiry to determine whether an individual is entitled to early release of superannuation on the grounds of financial hardship.
Schedule 1, Item 2 inserts a new organisation (‘Central Area Regional Training Scheme (Inc)’) into the list of organisations in Part 1 of Schedule 3 to the Regulations that are allowed to use and disclose the Customer Reference Number for the purpose of making a Customer Confirmation enquiry. In doing so, it re-numbers the organisation, ‘Blind Citizens Australia’, as item 2 in Part 1 of Schedule 3 to the Regulations.
Schedule 1, Item 3 inserts a new organisation (‘Palmerston Association Inc’) into the list of organisations in Part 1 of Schedule 3 to the Regulations that are allowed to use and disclose the Customer Reference Number for the purpose of making a Customer Confirmation enquiry.
Schedule 1, Item 4 inserts a new organisation (‘Yura Yungi Aboriginal Medical Service’) into the list of organisations in Part 1 of Schedule 3 to the Regulations that are allowed to use and disclose the Customer Reference Number for the purpose of making a Customer Confirmation enquiry.
Schedule 1, Item 5 inserts a new Schedule 4 into the Principal Regulations which lists 83 organisations that may use or disclose the Customer Reference Number for the purpose of accessing the Centrelink Confirmation eServices to make an Income Confirmation enquiry.
This item also inserts a new Schedule 5 into the Principal Regulations which lists 21 organisations that may use or disclose the Customer Reference Number for the purpose of accessing the Centrelink Confirmation eServices to make a Superannuation Confirmation enquiry.