Explanatory Statement
Revocation of the General Insurance Information Privacy Code
This explanatory statement relates to an instrument made under s. 18BE of the Privacy Act 1988 (Cth) (‘Privacy Act’) entitled Revocation of the General Insurance Information Privacy Code,
This explanatory statement has been drafted for the purpose of fulfilling the Office of the Privacy Commissioner’s obligations under s. 26(1) of the Legislative Instruments Act 2003 (Cth) (‘Legislative Instruments Act’).
1. Purpose
The purpose of the instrument to which this statement relates is to revoke the Privacy Commissioner’s approval under Part IIIAA of the Privacy Act of the General Insurance Information Privacy Code (the Code).
The Code commenced on 17 April 2002. According to its terms, the Code was due for an independent review of its operation by 17 April 2005. This review has been completed, and its main recommendation was that a request be made to the Privacy Commissioner for the formal revocation of the Code.
2. Approved Privacy Codes
The Privacy Amendment (Private Sector) Act 2000 (Cth) extended the operation of the Privacy Act to cover much of the private sector. A feature of the Act is the option for organisations to develop their own privacy codes which, when approved, replace compliance with the National Privacy Principles (NPPs).
The co-regulatory approach adopted in the Act was developed on the basis that the privacy concerns of consumers can best be addressed if organisations are allowed room to develop an appropriate privacy standard with their customers. This approach ensures that an effective and comprehensive data protection framework is provided for the private sector in Australia while still allowing some flexibility in its application.
The privacy rights of an individual cannot be lessened by the use of a code. For instance, the Commissioner must approve each privacy code in accordance with the Act, the prescribed standards and guidelines issued by the Commissioner. When deciding whether or not to approve a code, the Commissioner must consider whether the code incorporates all the NPPs or sets out obligations that, overall, are at least the equivalent of all the obligations set out in the NPPs.
Where an organisation consents to be bound by an approved code, the code operates in place of the NPPs until the organisation ceases to be bound by the code. Where an organisation chooses not to adopt an approved code it will be bound by the NPPs.
The Commissioner considers that periodic, independent reviews of a code and its operations are essential to the success of the co-regulatory regime. Such a requirement helps ensure that the code is meeting all the proposed objectives and remains relevant and up to date in a changing marketplace.
3. Authority for Revoking Approved Privacy Codes
Revocation of an approval of a privacy code can occur at the discretion of the Commissioner, or on request of an organisation bound by the code. The revocation of the approval of an approved privacy code is governed by section 18BE of the Privacy Act, which reads:
s. 18BE Revoking the approval of an approved privacy code
(1) The Commissioner may revoke his or her approval of an approved privacy code or a variation of an approved privacy code:
(a) on his or her own initiative; or
(b) on application by an organisation that is bound by the code.
(2) Before deciding whether to revoke the approval of a code or variation, the Commissioner must:
(a) if practicable, consult the organisation that originally sought approval of the code or variation; and
(b) consult any other person the Commissioner considers appropriate; and
(c) consider the extent to which members of the public have been given an opportunity to comment on the proposed revocation.
(3) A revocation must be in writing.
(4) A revocation comes into effect on the day specified in the revocation.
(5) The day specified must not be before the day on which the revocation is made.
The revocation of an approval by the Privacy Commissioner of an approved privacy code has the effect of varying the obligations imposed upon an organisation under the Privacy Act, thereby altering the content of the law. As a consequence, the written revocation of an privacy code under section 18BE(1) of the Privacy Act is a legislative instrument for the purposes of the Legislative Instruments Act.
4. Reasons for Revoking the Code
Clause 1.24 of the Code requires that a review of its operation be commenced within three years of its approval. In March 2005 the Insurance Council of Australia (ICA) commissioned a review of the Code which was completed on 4 July 2005.
The independent review of the Code made the following findings:
- 24 organisations had agreed to be bound by the Code
- during the three years of implementation, the Code adjudicator received five complaints, and was required to make determinations in three of these complaints
- expenditure equated to $65,330 per complaint determined under the Code and
- during the same period, the OPC reported 82 complaints about the insurance industry.
As a result of the high cost, small number of privacy complaints, and relatively low industry take-up of the Code, the Insurance Ombudsman Service Ltd (IOS) supported the recommendation by the reviewer that the Code be discontinued and that the ICA request the Privacy Commissioner to have the Code formally revoked. On the basis of the findings of the independent review, and the request by the ICA, the Privacy Commissioner has decided to revoke the Code’s approval, under section 18BE of the Privacy Act.
5. Operation and Effect
After consultation with the ICA and IOS, the Privacy Commissioner has decided the revocation of the Code will have effect on and from 30 April 2006. In order to ensure a smooth transition in complaint handling, complaints made to the Code adjudicator after 31 January 2006 are to be referred (under s 40(1B) of the Privacy Act) to the Privacy Commissioner.
The effect of the revocation is that those organisations previously bound by the Code will be required to comply directly with the NPPs and complaints of breaches of the NPPs by such organisations will be investigated by the Privacy Commissioner under Part V of the Privacy Act.
6. Consultation
The Privacy Commissioner has not been directly involved in consultation with respect to the revocation of the Code. However, under section 18 of the Legislative Instruments Act there are certain circumstances in which a rule-maker may be satisfied that consultation is unnecessary or inappropriate. Section 18(2)(e) gives the example of where appropriate consultation has already been undertaken by someone other than the rule-maker.
The independent review of the Code involved the following procedures:
- advertisements were placed in national daily media. A period of more than 6 weeks was provided for the making of submissions to the review
- ICA members were circularised with advice about the review and an invitation to comment
- relevant stakeholders were contacted in writing by the Code reviewer to advise of the review and offer an opportunity to make submissions
- interviews were conducted with a number of ICA members, including those who were signatories to the Code and those who were not
- members of the Privacy Compliance Committee were interviewed
- key personal from the IOS were interviewed
- other relevant industry associations were contacted in regard to their industry arrangements for dealing with privacy complaints. For example, the Australia Bankers Association, The Investment and Financial Services Association, Clubs Queensland, and the Australian Casino Association, and
- desk research was conducted.
As a result, the Privacy Commissioner is satisfied that an appropriate level of consultation was undertaken so as to satisfy the requirements of the Legislative Instruments Act.
The Privacy Commissioner is also satisfied that the consultation undertaken is adequate to satisfy the requirements of section 18BE(2) of the Privacy Act which requires that appropriate consultation be undertaken before deciding to revoke the approval of a privacy code.