EXPLANATORY STATEMENT
Select Legislative Instrument 2007 No. 92
Issued by the Authority of the Attorney-General
Privacy Act 1988
Privacy (Private Sector) Amendment Regulations 2007 (No. 1)
The Privacy Act 1988 (the Act) establishes, among other things, the National Privacy Principles (NPPs) which regulate the collection, use, disclosure and storage of personal information by private sector organisations.
NPP 7.2 provides that a private sector organisation must not use or disclose an identifier assigned to an individual by a Commonwealth agency, or by an agent or contracted service provider to that agency, except in specified circumstances. These include where the use or disclosure is by a prescribed organisation of a prescribed identifier in prescribed circumstances (paragraph (c) of NPP 7.2).
Subsection 100(1) of the Act provides that the Governor-General may make regulations, not inconsistent with the Act, prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.
The Privacy (Private Sector) Regulations 2001 currently prescribe exceptions to NPP 7.2, including the use and disclosure of Commonwealth employee payroll numbers by two private sector superannuation bodies for the purpose of providing Commonwealth employees with superannuation services. Schedule 2 to the Regulations lists the Commonwealth agencies that have assigned employees payroll numbers which are prescribed identifiers and which are permitted to be used and disclosed by the prescribed superannuation organisations in the prescribed circumstances.
The Classification (Publications, Films and Computer Games) Amendment Act 2007 made amendments to the Classification (Publications, Films and Computer Games) Act 1995 to facilitate the integration of the Office of Film and Literature Classification (OFLC) into the Attorney-General's Department. It removed the Director’s financial powers and responsibilities for the administration of the OFLC and replaced references to that agency with more appropriate references.
The purpose of these amendment Regulations was to reflect the amendments made by the Classification (Publications, Films and Computer Games) Amendment Act 2007 by removing the reference to the OFLC in item 145 of Schedule 2 of the Privacy (Private Sector) Regulations 2001.
Details of the Regulations are set out in the Attachment.
The Regulations are a legislative instrument for the purposes of the Legislative Instruments Act 2003.
The Regulations have no or low impacts on business and individuals or the economy. Therefore no further regulatory analysis is required in accordance with the Government’s best practice regulation requirements. The Office of Best Practice Regulation has confirmed the preliminary assessment of the Attorney-General's Department.
The Regulations commenced on the day of commencement of Schedule 1 to the Classification (Publications, Films and Computer Games) Amendment Act 2007.
ATTACHMENT
PRIVACY (PRIVATE SECTOR) AMENDMENT REGULATIONS 2007 (NO. 1)
Regulation 1 describes how the Regulations are to be cited.
Regulation 2 provides that the Regulations commence on the commencement of Schedule 1 to the Classification (Publications, Films and Computer Games) Amendment Act 2007.
Regulation 3 provides that the Privacy (Private Sector) Regulations 2001 are amended in accordance with Schedule 1 to the Regulations.
Schedule 1, Item 1 removes item 145 from Schedule 2 to the Privacy (Private Sector) Regulations 2001, which is a reference to the Office of Film and Literature Classification.
Overview
The Privacy (Private Sector) Amendment Regulations 2007 (No. 1) were enacted to amend the Privacy (Private Sector) Regulations 2001 under the authority of the Privacy Act 1988. The Privacy Act established the National Privacy Principles (NPPs) governing the handling of personal information by private sector organisations, including restrictions on the use and disclosure of identifiers assigned by Commonwealth agencies. These Regulations were introduced in response to the Classification (Publications, Films and Computer Games) Amendment Act 2007, which integrated the Office of Film and Literature Classification into the Attorney-General's Department and necessitated amendments to existing privacy regulations. The objective of these Regulations was to update the Privacy (Private Sector) Regulations 2001 by removing references to the Office of Film and Literature Classification in light of the structural changes made by the 2007 Amendment Act. The Regulations, which have minimal impact on business and individuals, were issued by the Attorney-General and came into effect concurrently with the commencement of the 2007 Amendment Act.
Scope and Application
The Privacy (Private Sector) Amendment Regulations 2007 (No. 1) serve to modify the Privacy (Private Sector) Regulations 2001, which are subordinate instruments under the Privacy Act 1988. The Privacy Act establishes the National Privacy Principles (NPPs) governing the handling of personal information by private sector entities, including restrictions on the use and disclosure of identifiers assigned by Commonwealth agencies. Specifically, these Regulations amend the list of prescribed identifiers and organisations permitted to use such identifiers under NPP 7.2 by removing the Office of Film and Literature Classification as a prescribed organisation. This amendment reflects changes made by the Classification (Publications, Films and Computer Games) Amendment Act 2007, which reorganised the administrative structure of the Office of Film and Literature Classification. The Regulations apply to private sector organisations collecting, using, or disclosing personal information, with a specific focus on those entities that may use Commonwealth employee payroll numbers. These Regulations have a low impact on businesses and individuals, and they commenced on the same day as the Classification (Publications, Films and Computer Games) Amendment Act 2007.
Key Provisions
The main operative sections of the Privacy (Private Sector) Amendment Regulations 2007 (No. 1) include Regulation 2 which stipulates the commencement date of these Regulations, and Regulation 3 which provides for the amendment of the Privacy (Private Sector) Regulations 2001. Schedule 1, Item 1 specifically removes item 145 from Schedule 2, which previously referenced the Office of Film and Literature Classification (OFLC). This amendment is directly tied to the Classification (Publications, Films and Computer Games) Amendment Act 2007, which integrated the OFLC into the Attorney-General's Department and removed the Director's financial powers and responsibilities for the administration of the OFLC.
The obligations and requirements imposed by these Regulations primarily pertain to private sector organisations that handle personal information. Under the National Privacy Principles (NPPs) outlined in the Privacy Act 1988, these organisations must adhere to strict guidelines regarding the use and disclosure of personal identifiers, particularly those assigned by Commonwealth agencies. The Regulations refine these obligations by removing outdated references, thereby ensuring that the regulatory framework remains current and aligned with legislative changes. This amendment is essential for maintaining the integrity and effectiveness of privacy protections within the private sector.
The Privacy (Private Sector) Amendment Regulations 2007 (No. 1) do not explicitly outline new offences or penalties but are crucial in ensuring that existing privacy obligations are correctly referenced and applied. Breaches of the NPPs, including improper use or disclosure of personal identifiers, can lead to significant civil and criminal consequences under the Privacy Act 1988. The maximum penalties for such breaches can include substantial fines for both organisations and individuals, reflecting the serious nature of privacy violations. Ensuring compliance with these Regulations is therefore imperative to avoid these potential repercussions.
The Regulations' impact on business and individuals is minimal, as they primarily serve to update and clarify existing provisions. By removing the reference to the OFLC, the Regulations streamline the regulatory environment, making it easier for private sector entities to comply with privacy laws. The Office of Best Practice Regulation has confirmed that no further regulatory analysis is required, as these changes have low impact and do not impose significant burdens on business or individuals. The seamless integration of these amendments into the existing framework underscores the intention to maintain a balanced and effective approach to privacy regulation in the private sector.