Privacy (Private Sector) Amendment Regulations 2006 (No. 3)

Administered by Attorney-General's Department

Legislation au F2006L04002 Regulations Not in force Legislative Instrument

Legislation content

EXPLANATORY STATEMENT

 

Select Legislative Instrument 2006 No. 333

 

Issued by the Authority of the Attorney-General

 

Privacy Act 1988

 

Privacy (Private Sector) Amendment Regulations 2006 (No. 3)

The Privacy Act 1988 (the Act) establishes, among other things, the National Privacy Principles (NPPs) which regulate the collection, use, disclosure and storage of personal information by private sector organisations.

The primary purpose of the Regulations is to allow greater access to Centrelink records, in order to determine whether a person is entitled to receive a service or assistance, or is entitled to early release of superannuation on the grounds of hardship.

NPP 7.2 provides that a private sector organisation must not use or disclose an identifier assigned to an individual by a Commonwealth agency, or by an agent or contracted service provider to that agency, except in specified circumstances, including where the use or disclosure is by a prescribed organisation of a prescribed identifier in prescribed circumstances (paragraph 7.2(c)).

Subsection 100(1) of the Act provides that the Governor-General may make regulations, not inconsistent with the Act, prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.

In determining the need for a Regulation under section 100 of the Act, Centrelink has consulted the Office of the Privacy Commissioner and the Attorney-Generals Department.

The Privacy (Private Sector) Regulations 2001 prescribe exceptions to NPP 7.2 for the purpose of accessing the Centrelink Confirmation eServices.

Centrelink’s Confirmation eServices comprises three distinct services:  Customer Confirmation; Income Confirmation; and Superannuation Confirmation.  The purpose of these amendment Regulations was to insert 25 additional organisations into the lists of prescribed organisations allowed to use and disclose the Centrelink Customer Reference Number for the purpose of making a Customer Confirmation, Income Confirmation or Superannuation Confirmation enquiry. 

The release of Centrelink customers’ information through the Centrelink Confirmation eServices will only occur with the customers’ consent.  In addition, the use and disclosure of the Customer Reference Number by these private sector organisations is in each case for the benefit of the individual concerned.  It removes the need for customers to go into a Centrelink office to obtain written proof of their eligibility and verification will occur on‑line in real time, providing up to date eligibility information.

Details of the Regulations are set out in the Attachment. The lists in the Regulations have been renumbered and the 25 additional organisations inserted at items 3, 7, 8, 11, 16, 26, 30 and 31 of Part 1 of Schedule 3, items 8, 16, 17, 29, 52, 60, 62, 68, 69, 73, 86, 95, 96 and 97 of Schedule 4, and items 1, 19 and 22 of Schedule 5.  There have also been some minor amendments to the names of prescribed organisations and an organisation has been removed from the list in Part 1 of Schedule 3.

The Regulations commenced on the day after they were registered.


ATTACHMENT

PRIVACY (PRIVATE SECTOR) AMENDMENT REGULATIONS 2006 (NO. 3)

Regulation 1 describes how the Regulations are to be cited.

Regulation 2 provides that the Regulations commence on the day after they are registered.

Regulation 3 provides that the Privacy (Private Sector) Regulations 2001 (the Principal Regulations) are amended in accordance with Schedule 1 to the Regulations.

Schedule 1, Item 1 substitutes the lists in Parts 1 and 2 of Schedule 3, Schedule 4 and Schedule 5 to the Principal Regulations.  

The substituted Part 1 of Schedule 3 renumbers the listed organisations and includes 8 additional organisations as prescribed organisations that may use or disclose the Centrelink Customer Reference Number for the purpose of making a Customer Confirmation enquiry.  The substituted Part 1 also makes minor amendments to the names of some of the prescribed organisations and removes an organisation (‘The Trustee for Our Neighbourhood Energy Unit Trust, ABN 24 168 557 374’) from the list.

The substituted Part 2 of Schedule 3 renumbers the listed organisations and makes minor amendments to the names of some of the prescribed organisations.

The substituted Schedule 4 renumbers the listed organisations and includes 14 additional organisations as prescribed organisations that may use or disclose the Centrelink Customer Reference Number for the purpose of making an Income Confirmation enquiry.  The substituted Schedule 4 also makes minor amendments to the names of some of the prescribed organisations.

The substituted Schedule 5 renumbers the listed organisations and includes 3 additional organisations as prescribed organisations that may use or disclose the Centrelink Customer Reference Number for the purpose of making a Superannuation Confirmation enquiry.  The substituted Schedule 5 also makes minor amendments to the names of some of the prescribed organisations.

Overview

The Privacy (Private Sector) Amendment Regulations 2006 (No. 3) were enacted to amend the Privacy (Private Sector) Regulations 2001, which themselves are made under the Privacy Act 1988. This legislation was introduced to address the need for streamlined access to Centrelink records to verify eligibility for services, assistance, or early release of superannuation on grounds of hardship. The problem or gap identified was the cumbersome process of customers needing to physically visit Centrelink offices to obtain written proof of their eligibility, which could be inefficient and inconvenient. The policy objective of these regulations is to enhance the efficiency of the verification process by allowing authorised private sector organisations to access Centrelink records electronically with the consent of the individuals concerned. These regulations were issued by the authority of the Attorney-General and aim to facilitate real-time eligibility verification online, thus reducing the need for in-person visits to Centrelink offices.

Scope and Application

The Privacy (Private Sector) Amendment Regulations 2006 (No. 3) amends the Privacy (Private Sector) Regulations 2001 under the authority of the Privacy Act 1988. These Regulations specifically pertain to private sector organisations, particularly those involved in the Centrelink Confirmation eServices, which includes Customer Confirmation, Income Confirmation, and Superannuation Confirmation services. The primary aim of these Regulations is to facilitate access to Centrelink records to ascertain eligibility for services, assistance, or early release of superannuation on hardship grounds. The Regulations insert 25 additional organisations into the list of prescribed entities permitted to use and disclose Centrelink Customer Reference Numbers under specific conditions, ensuring that the release of customer information occurs with consent and benefits the individual concerned by enabling real-time verification online. The Regulations apply across Australia, as they are made under the Commonwealth’s legislative authority, and they do not introduce any new exclusions or thresholds beyond those already specified in the principal Regulations. The amendments to the Regulations took effect the day after their registration.

Key Provisions

The Privacy (Private Sector) Amendment Regulations 2006 (No. 3) amends the existing Privacy (Private Sector) Regulations 2001 to extend the list of prescribed organisations that are authorised to use or disclose Centrelink Customer Reference Numbers under certain conditions. This is achieved through modifications to Schedules 3, 4, and 5 of the Principal Regulations, which detail the lists of prescribed organisations allowed to use or disclose Centrelink Customer Reference Numbers for Customer Confirmation, Income Confirmation, and Superannuation Confirmation enquiries, respectively. These amendments include the addition of 25 new organisations to these lists, as well as minor amendments to the names of some existing organisations and the removal of one organisation from the list. The Regulations impose specific obligations on the parties involved. Centrelink, as the issuing body, must ensure that any disclosure of personal information, particularly the Customer Reference Number, is done in accordance with the Privacy Act 1988 and the amended Regulations. The prescribed organisations, which now include the 25 additional entities, must also adhere to these legal requirements, ensuring they use the Centrelink Customer Reference Number solely for the purposes of confirming customer eligibility for services, income, or superannuation assistance, and only with the customer's consent. This consent ensures that the release of information is transparent and that the customer is aware of how their data will be used. Failure to comply with the provisions of the Privacy Act 1988 and the amended Regulations can result in serious consequences. Under section 137 of the Privacy Act, unauthorised use or disclosure of personal information can attract civil penalties. The maximum penalty for an individual is $216,000, while for a body corporate, the penalty can be significantly higher, reaching up to $2,160,000. Additionally, under section 137A of the Act, the Federal Court may order the infringing party to pay damages to any individual who has suffered loss or damage due to the breach. These stringent penalties underscore the importance of compliance with privacy regulations and the need for prescribed organisations to handle personal information responsibly and lawfully.

Legal classification tags

Area of Law
Privacy Law
Instrument
Regulation
Concepts
Definitions & Interpretation
Licensing & Registration
Enforcement Powers
Compliance Obligations

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.