Privacy (Private Sector) Amendment Regulations 2009 (No. 1)

Overview

The Privacy (Private Sector) Amendment Regulations 2009 (No. 1) were enacted to amend the Privacy (Private Sector) Regulations 2001 under the authority of the Privacy Act 1988. These regulations were introduced to address the need for greater access to Centrelink records to determine if individuals are entitled to receive services or assistance. By amending the regulations, the objective was to streamline the process of verifying eligibility for services by allowing additional private sector organisations to access Centrelink records through the Centrelink Confirmation eServices with the customer’s consent. This amendment was made to facilitate real-time eligibility verification online, thereby reducing the necessity for customers to visit Centrelink offices. The regulations were developed in consultation with the Privacy Commissioner and the Department of the Prime Minister and Cabinet, with no concerns raised by the Privacy Commissioner and support from the Department. The regulations commenced on the day after they were registered.

Scope and Application

The Privacy (Private Sector) Amendment Regulations 2009 (No. 1) extends the application of the Privacy Act 1988 by amending the Privacy (Private Sector) Regulations 2001 to allow a broader range of private sector organisations to use the Centrelink Customer Reference Number for making Customer Confirmation and Income Confirmation enquiries through Centrelink’s Confirmation eServices. This amendment applies to private sector entities that are now prescribed organisations capable of using and disclosing the Centrelink Customer Reference Number, subject to the individual’s consent, for the specific purpose of accessing Centrelink records to verify eligibility. The Regulations aim to facilitate the verification process by enabling authorised organisations to access updated eligibility information online in real-time, thereby reducing the necessity for customers to visit a Centrelink office. The Regulations apply nationally and align with the National Privacy Principles, ensuring that the use of personal information remains within the bounds set by the Act, while enhancing the efficiency of eligibility verification services.

Key Provisions

The Privacy (Private Sector) Amendment Regulations 2009 (No. 1) amend the Privacy (Private Sector) Regulations 2001 to allow additional private sector organisations access to Centrelink records via the Centrelink Confirmation eServices. This access is limited to using the Centrelink Customer Reference Number for the purpose of making Customer Confirmation or Income Confirmation enquiries, as outlined in Regulation 3 of the Amendment Regulations. Specifically, Schedule 1, Item 1 of the Amendment Regulations introduces four additional organisations permitted to use the Centrelink Customer Reference Number for Customer Confirmation enquiries, while Schedule 1, Item 2 introduces 23 additional organisations for Income Confirmation enquiries. These changes are detailed in Schedule 3 and Schedule 4 of the amended Regulations, respectively. These Regulations impose specific obligations on the parties they govern. The private sector organisations listed in Schedule 3 and Schedule 4 must ensure that their use of the Centrelink Customer Reference Number complies strictly with the terms of the National Privacy Principles (NPPs), particularly NPP 7.2, which governs the use and disclosure of identifiers. These organisations must also ensure that any use or disclosure of the Centrelink Customer Reference Number is done with the customer’s consent and solely for the benefit of the individual concerned. The Regulations also mandate that all access to Centrelink records through the Centrelink Confirmation eServices is conducted electronically, eliminating the need for physical documentation and in-person verification processes. Non-compliance with these Regulations can lead to various civil and criminal consequences. Under the Privacy Act 1988, unauthorised use or disclosure of personal information may be subject to penalties. Specifically, individuals who contravene the NPPs can face penalties under section 13G of the Act, which may include fines of up to $210,000 for corporations and $42,000 for individuals. Additionally, the Privacy Commissioner can initiate legal proceedings against entities or individuals who breach the NPPs, leading to court-ordered penalties and corrective measures. Furthermore, serious breaches may result in criminal charges, with potential imprisonment terms as outlined in the Act. The Amendment Regulations also correct a minor administrative detail by updating the name of one prescribed organisation from "South West Inner Sydney Housing Cooperative Limited" to "Bridge Housing Limited," as per Schedule 1, Item 2. This change ensures that all references within the Regulations are accurate and up-to-date, thereby maintaining the clarity and effectiveness of the regulatory framework. The Regulations came into effect on the day following their registration, ensuring that the amended provisions are immediately applicable to the listed organisations.