Privacy Regulations 2006

Overview

The Privacy Regulations 2006, issued under the authority of the Attorney-General, were enacted to refine the framework established by the Privacy Act 1988, specifically addressing the management of personal information during emergencies and disasters. This legislation aims to ensure that necessary information exchange during such critical situations is legally permissible, overriding general secrecy provisions in Commonwealth laws unless they are designated as such. By designating certain secrecy provisions under the Census and Statistics Act 1905 as exceptions, these regulations aim to safeguard the integrity and exclusive use of data collected by the Australian Bureau of Statistics for statistical purposes. The regulations were made in consultation with the ABS and do not significantly impact business or individuals, as they pertain narrowly to the ABS and its data usage protocols. The enacting body for these regulations is the Parliament of Australia, with the policy objective being to balance the need for information dissemination in emergencies with the protection of sensitive statistical data. These regulations are designed to provide clarity and certainty in the legal basis for information exchange in disaster scenarios while ensuring that data collected for statistical purposes remains protected and used only for those purposes.

Scope and Application

The Privacy Regulations 2006, which are a legislative instrument under the Legislative Instruments Act 2003, specifically address the collection, use and disclosure of personal information in emergency and disaster situations as outlined in Part VIA of the Privacy Act 1988. This legislative framework is designed to override secrecy provisions in Commonwealth legislation unless they are classified as designated secrecy provisions, thereby ensuring a clear and certain legal basis for information exchange during emergencies and disasters. Notably, the Regulations prescribe certain secrecy provisions of the Australian Bureau of Statistics (ABS) as designated secrecy provisions, specifically sections 19 and 19A of the Census and Statistics Act 1905, to ensure that data collected by the ABS for statistical purposes remains strictly for those purposes. These Regulations apply exclusively to the ABS, and as such, were made in consultation with the ABS without the necessity for broader consultation. The Regulations do not significantly impact businesses, individuals, or the economy, and they came into effect the day after their registration on the Federal Register of Legislative Instruments.

Key Provisions

The Privacy Regulations 2006, made under the Privacy Act 1988, specifically address the collection, use and disclosure of personal information during emergencies and disasters as outlined in Part VIA of the Act (sections 80P(7)(d) and 80P(7)(d)). These provisions are designed to ensure that, in the event of an emergency or disaster, there is a clear legal framework permitting the necessary exchange of personal information, unless such information is protected by a designated secrecy provision. The term ‘designated secrecy provision’ is defined in the Act, and includes provisions prescribed by the Regulations. The Regulations themselves serve to designate certain secrecy provisions in the Census and Statistics Act 1905, specifically sections 19 and 19A, as those which must be respected even in emergency situations. This designation ensures that data collected by the Australian Bureau of Statistics (ABS) for statistical purposes remains restricted to those purposes, thereby maintaining the integrity of the ABS's data collection and analysis activities. Under the Privacy Regulations 2006, entities that collect, use or disclose personal information in an emergency or disaster must comply with the overarching requirements of the Privacy Act 1988, while also respecting the designated secrecy provisions as prescribed. This means that while the Act facilitates the necessary exchange of personal information during emergencies, it simultaneously mandates that such information is used strictly for the purpose of addressing the emergency and not for any other unrelated purposes. The designated secrecy provisions ensure that sensitive statistical data collected by the ABS is not inadvertently misused or disclosed outside of its intended statistical use. Entities must therefore balance the urgent need to share information during an emergency with the requirement to protect certain types of sensitive information, ensuring that their actions are both legally compliant and ethically sound. Breaching the provisions of the Privacy Act 1988 or the Privacy Regulations 2006 can result in both civil and criminal consequences. Civil penalties for non-compliance can include fines up to $210,000 for corporations and $42,000 for individuals, as stipulated in section 13H of the Act. Additionally, the Act provides for corrective action orders, which can compel entities to rectify their non-compliant practices. Criminal penalties may also apply, particularly if the breach involves the misuse of personal information in a way that constitutes a serious and wilful disregard for the privacy rights of individuals. Such offences can lead to imprisonment, with the maximum penalties varying depending on the specific circumstances of the breach. It is crucial for entities to adhere to the requirements set forth in the Privacy Act 1988 and the Privacy Regulations 2006 to avoid these significant legal repercussions.