Privacy (Private Sector) Amendment Regulations 2009 (No. 2)

Overview

The Privacy (Private Sector) Amendment Regulations 2009 (No. 2) were enacted to amend the Privacy (Private Sector) Regulations 2001, under the authority of the Privacy Act 1988. The primary objective of these regulations is to expand the list of prescribed organisations that can access Centrelink records to verify an individual's eligibility for services or assistance, while ensuring compliance with the National Privacy Principles (NPPs). The problem these regulations address is the need for efficient and accurate verification of eligibility without requiring customers to visit Centrelink offices, thereby improving service delivery and customer convenience. The regulations were issued following consultations with the Privacy Commissioner and the Department of the Prime Minister and Cabinet, with no objections raised. The Privacy Commissioner and the Department support the amendments, which allow 16 additional organisations to use Centrelink Customer Reference Numbers for Customer Confirmation and Income Confirmation enquiries, provided the customer consents to the disclosure.

Scope and Application

The Privacy (Private Sector) Amendment Regulations 2009 (No. 2) amends the Privacy (Private Sector) Regulations 2001 to enhance the accessibility of Centrelink records, specifically by expanding the list of organisations that can use Centrelink Customer Reference Numbers for eligibility verification purposes. These regulations apply to private sector organisations, with the primary focus on those that can use or disclose identifiers assigned by Commonwealth agencies, as outlined in the National Privacy Principles (NPPs). The NPPs govern the handling of personal information by private sector entities, including restrictions on the use and disclosure of identifiers such as the Centrelink Customer Reference Number, unless specified exceptions apply. These regulations extend to any organisation that wishes to utilise Centrelink’s Confirmation eServices for customer confirmations or income confirmations, provided they obtain consent from the customer. The amendment allows 16 additional organisations to use the Centrelink Customer Reference Number for making customer and income confirmation enquiries, thereby facilitating real-time verification and reducing the need for customers to visit Centrelink offices. The regulations are applicable nationally across Australia and were made under the authority of the Privacy Act 1988, ensuring they do not conflict with the overarching privacy framework established by the Act.

Key Provisions

The Privacy (Private Sector) Amendment Regulations 2009 (No. 2) (the Regulations) amend the Privacy (Private Sector) Regulations 2001 (the Principal Regulations) to allow more organisations to use and disclose the Centrelink Customer Reference Number for specific purposes under the National Privacy Principles (NPPs). Under section 100(1) of the Privacy Act 1988, the Governor-General may make regulations prescribing matters required or permitted by the Act, which the Regulations do by inserting additional organisations into the lists of those permitted to use Centrelink Customer Reference Numbers for Customer Confirmation and Income Confirmation enquiries (Regulation 3, Schedule 1, Item 1 and Item 2). The Regulations came into effect on the day after they were registered (Regulation 2). The Regulations impose obligations on private sector organisations by specifying that they must not use or disclose the Centrelink Customer Reference Number except under the conditions set out in the NPPs. In particular, NPP 7.2 (as referenced in the Explanatory Statement) restricts the use or disclosure of identifiers assigned by Commonwealth agencies, with exceptions for prescribed organisations and circumstances. The Regulations clarify and expand the list of prescribed organisations that can use the Centrelink Customer Reference Number for Customer Confirmation and Income Confirmation enquiries, ensuring these organisations can access necessary information to determine a person's eligibility for services or assistance, provided the customer consents to the disclosure. Failure to comply with the requirements of the Privacy Act 1988 and the amended Regulations could result in civil or criminal penalties. For instance, unauthorised use or disclosure of personal information can lead to substantial penalties. Specifically, under the Privacy Act, an organisation that contravenes an NPP can be liable to pay a pecuniary penalty of up to $2.1 million for a corporation and up to $420,000 for an individual, as stipulated in section 13G of the Act. Additionally, the Act provides for criminal penalties, including fines of up to $210,000 for individuals and $1.05 million for bodies corporate, and possible imprisonment terms for serious breaches. These penalties underscore the importance of compliance with privacy regulations and the potential consequences of non-compliance.