EXPLANATORY STATEMENT
Select Legislative Instrument 2007 No. 296
Issued by the Authority of the Attorney-General
Privacy Act 1988
Privacy (Private Sector) Amendment Regulations 2007 (No. 4)
The Privacy Act 1988 (the Act) establishes, among other things, the National Privacy Principles (NPPs) which regulate the collection, use, disclosure and storage of personal information by private sector organisations.
The primary purpose of the Regulations is to allow greater access to Centrelink records, in order to determine whether a person is entitled to receive a service or assistance, or is entitled to early release of superannuation on the grounds of hardship.
NPP 7.2 provides that a private sector organisation must not use or disclose an identifier assigned to an individual by a Commonwealth agency, or by an agent or contracted service provider to that agency, except in specified circumstances. These include where the use or disclosure is by a prescribed organisation of a prescribed identifier in prescribed circumstances (paragraph (c) of NPP 7.2).
Subsection 100(1) of the Act provides that the Governor-General may make regulations, not inconsistent with the Act, prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed for carrying out or giving effect to the Act.
In determining the need for a Regulation under section 100 of the Act, Centrelink has consulted the Office of the Privacy Commissioner and the Attorney-General’s Department.
The Centrelink Customer Reference Number is an identifier for the purposes of NPP 7. The Privacy (Private Sector) Regulations 2001 prescribe as an exception to the prohibition in NPP 7.2, organisations permitted to use the Centrelink Customer Reference Number for the purpose of accessing the Centrelink Confirmation eServices.
Centrelink’s Confirmation eServices comprises three distinct services: Customer Confirmation; Income Confirmation; and Superannuation Confirmation. These amendment Regulations insert 27 additional organisations into the lists of prescribed organisations allowed to use and disclose the Centrelink Customer Reference Number for the purpose of making a Customer Confirmation, Income Confirmation or Superannuation Confirmation enquiry.
The release of Centrelink customers’ information through the Centrelink Confirmation eServices will only occur with the customer’s consent. In addition, the use and disclosure of the Customer Reference Number by these private sector organisations is in each case for the benefit of the individual concerned. It removes the need for customers to go into a Centrelink office to obtain written proof of their eligibility and verification will occur on-line in real time, providing up to date eligibility information.
Details of the Regulations are set out in the Attachment. The lists in the Regulations have been renumbered and the 27 additional organisations inserted at items 3, 7, 27 and 32 of Part 1 of Schedule 3, items 10, 28, 32, 38, 49, 54, 64, 71, 76, 78, 84, 85, 91, 92, 103, 110, 120 and 130 of Schedule 4, and items 1, 4, 24, 27 and 30 of Schedule 5. There have also been some minor amendments to the names of some prescribed organisations and the deletion of a prescribed organisation who no longer requires use or disclosure of a Centrelink Customer Reference Number.
The Regulations commenced on the day after they were registered.
ATTACHMENT
PRIVACY (PRIVATE SECTOR) AMENDMENT REGULATIONS 2007
(NO. 4)
Regulation 1 describes how the Regulations are to be cited.
Regulation 2 provides that the Regulations commence on the day after they are registered.
Regulation 3 provides that the Privacy (Private Sector) Regulations 2001 (the Principal Regulations) are amended in accordance with Schedule 1 to the Regulations.
Schedule 1, Item 1 substitutes the list in Part 1 of Schedule 3 to the Principal Regulations.
The substituted Part 1 of Schedule 3 renumbers the listed organisations and includes four additional organisations as prescribed organisations that may use or disclose the Centrelink Customer Reference Number for the purpose of making a Customer Confirmation enquiry at items 3, 7, 27 and 32 of Schedule 3, Part 1.
The substituted Part 1 also makes an amendment to reflect a change in name of a prescribed organisation. The previous item 13 ‘Energy Australia Pty Ltd & I Power Pty Ltd’ is changed to ‘IPOWER 2 Pty Ltd & IPOWER Pty Ltd’ and renumbered as item 18.
The substituted Part 1 also makes an amendment to delete a prescribed organisation which no longer requires use or disclosure of the Centrelink Customer Reference Number for the purpose of making a Customer Confirmation enquiry. The previous item 16 ‘Hagi Hashi, Abdirahman Abdullahi’ is deleted.
The substituted Part 1 also makes a minor amendment to the name of one of the prescribed organisations.
Schedule 1, Item 2 substitutes the list in Schedule 4 to the Principal Regulations.
The substituted Schedule 4 renumbers the listed organisations and includes 18 additional organisations as prescribed organisations that may use or disclose the Centrelink Customer Reference Number for the purpose of making an Income Confirmation enquiry at items 10, 28, 32, 38, 49, 54, 64, 71, 76, 78, 84, 85, 91, 92, 103, 110, 120 and 130 of Schedule 4.
The substituted Schedule 4 also makes a minor amendment to the name of one of the prescribed organisations.
Schedule 1, Item 3 substitutes the list in Schedule 5 to the Principal Regulations.
The substituted Schedule 5 renumbers the listed organisations and includes five additional organisations as prescribed organisations that may use or disclose the Centrelink Customer Reference Number for the purpose of making a Superannuation Confirmation enquiry at items 1, 4, 24, 27 and 30 of Schedule 5.