Commonwealth Numbered Regulations - Explanatory Statements
[Index] [Search] [Download] [Related Items] [Help]
PRIVACY AMENDMENT (NT HOME OWNERSHIP) REGULATIONS 2023 (F2023L01420)
EXPLANATORY STATEMENT
Issued by Authority of the Attorney-General
Privacy Act 1988
Privacy Amendment (NT Home Ownership) Regulations 2023
Legislative Authority
The Privacy Act 1988 (Privacy Act) provides for the protection of the privacy of individuals. One of the objects of the Privacy Act is to facilitate an efficient credit reporting system while ensuring the privacy of individuals is respected.
Section 100 of the Privacy Act provides that the Governor-General may make regulations, not inconsistent with the Act, prescribing matters required or permitted by the Act to be prescribed or necessary or convenient to be prescribed for carrying out or giving effect to the Act.
Paragraph 6G(1)(d) of the Privacy Act provides that a credit provider is an agency, organisation or small business operator that carries on a business or undertaking that involves providing credit and that is prescribed by the Regulations.
Subsection 6F(1) of the Privacy Act provides that the Privacy Act applies in relation to a prescribed State or Territory authority as if the authority were an organisation. Before the Governor-General makes regulations prescribing a State or Territory authority for the purposes of subsection 6F(1) of the Privacy Act, the Minister must be satisfied that the relevant State or Territory has requested that the authority be prescribed for those purposes and consult the Australian Information Commissioner about the desirability of regulating under the Privacy Act the collection, holding, use, correction and disclosure of personal information by the authority.
Paragraph 20E(4)(a) of the Privacy Act provides that if credit reporting information is, or was derived from, repayment history information or financial hardship information about the individual, the credit reporting body must not disclose the information as a permitted use or disclosure unless the recipient of the information is a credit provider who is a licensee or is prescribed by the regulations or a mortgage insurer.
Subparagraph 21D(2)(a)(i) of the Privacy Act provides that the disclosure of credit information about the individual is a permitted disclosure if the credit provider is prescribed by the regulations and knows, or believes on reasonable grounds, that the individual is at least 18 years old, and the credit reporting body is an agency or an organisation that has an Australian link, and the information meets the requirements of subsection 21D(3) of the Privacy Act, including that the credit provider is prescribed by the regulations if the information is repayment history information or financial hardship information about the individual.
Purpose
The purpose of the Privacy Amendment (NT Home Ownership) Regulations 2023 (the Regulations) is to amend the Privacy Regulation 2013 (Privacy Regulation) to ensure NT Home Ownership is a credit provider permitted to manage credit information about an individual under the Privacy Act. It does so by:
* prescribing NT Home Ownership as a Territory authority as if it was an organisation;
* prescribing NT Home Ownership as a credit provider under the Privacy Act;
* permitting credit reporting bodies (CRBs) to disclose credit reporting information, including repayment history information, to NT Home Ownership;
* permitting NT Home Ownership to disclose credit information about an individual to a CRB.
Background
NT Home Ownership is operated by the NT Department to assist lower income residents of the NT to participate in home ownership through loans, including home loan products.
The NT Department provides subsidised loans through contracting with a credit provider for the delivery of services in managing its loan portfolio and through loans fully funded by the NT Department.
To ensure the NT Department can support its work in assisting vulnerable and lower income NT residents with housing, it is necessary for NT Home Ownership to be prescribed as a credit provider by the Privacy Regulation. Currently, Indigenous Business Australia, Export Finance and Insurance Corporation, and the Regional Investment Corporation are prescribed as credit providers under the Privacy Regulation. The Regulations add NT Home Ownership to this group.
Impact and effect
The effect of the Regulations is to impose obligations on NT Home Ownership to protect an individual's credit information, including credit eligibility information and CRB derived information under the Privacy Act. It does so by prescribing NT Home Ownership as a credit provider and, in doing so, requires NT Home Ownership to handle information in accordance with the following legislation and legislative instrument:
* Part IIIA of the Privacy Act, which deals with the privacy of information relating to credit reporting (as supported by the Privacy Regulation)
* The Privacy (Credit Reporting) Code 2014 (the Code).
Part IIIA of the Privacy Act regulates the handling of personal information about an individual's activities in relation to consumer credit. Division 3 of Part IIIA of the Privacy Act outlines:
* the types of credit information credit providers like NT Home Ownership can disclose to a CRB to be included in an individual's credit report
* the permitted purposes for which credit providers like NT Home Ownership can use credit eligibility information about an individual.
The Code particularises the credit reporting obligations imposed on NT Home Ownership by Part IIIA of the Privacy Act and the Regulations. It covers notification requirements, credit enquiries, financial hardship information, default information and publicly available information, credit bans, access and complaints, among other things.
Consultation
The Office of Impact Analysis was consulted in relation to the Regulations and advised that a Regulatory Impact Statement is not required (OBPR21-01269).
Details/Operation
The Regulations are a legislative instrument for the purposes of the Legislation Act 2003.
The Regulations commence on the day after the instrument is registered on the Federal Register of Legislation.
Details of the Regulations are set out in Attachment A.
Other
The Regulations are compatible with the human rights and freedoms recognised or declared under section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011. A statement of compatibility with human rights for the Regulations is at Attachment B.
ATTACHMENT A
Details of the Privacy Amendment (NT Home Ownership) Regulations 2023
Section 1 - Name
This section provides that the name of the instrument is the Privacy Amendment (NT Home Ownership) Regulations 2023 (the Regulations).
Section 2 - Commencement
This section provides that the instrument commences on the day after the day the instrument is registered on the Federal Register of Legislation.
Section 3 - Authority
This section provides that the Regulations are made under the Privacy Act 1988 (the Privacy Act).
Section 4 - Schedules
This section is the formal enabling provision for the Schedule to the Regulations. This section enables the Privacy Regulation 2013 (Privacy Regulation) to be amended.
Schedule 1 - Amendments
Privacy Regulation 2013
Item [1] - Section 5
This item adds a new definition in section 5 to provide that NT Home Ownership means NT Home Ownership, ABN 85 169 745 141, and includes an agent acting on behalf of NT Home Ownership.
Item [2] - At the end of section 8
This item inserts a new heading for 'Northern Territory'. Under the Northern Territory heading, new subsection 8(7) specifies that for the purposes of subsection 6F(1) of the Privacy Act, NT Home Ownership is prescribed, and the Act applies in relation to NT Home Ownership as if the Act were modified as set out in the following new subsection (8).
Item [3] - At the end of subsection 10(1)
This item adds new paragraph (d) to subsection 10(1) of the Privacy Regulation to provide that NT Home Ownership, as an agency, is prescribed as a credit provider under section 6G of the Privacy Act.
The effect of this amendment is that a CRB would be permitted to disclose credit reporting information to NT Home Ownership as a credit provider under paragraph 20E(3)(a) of the Privacy Act.
Prescribing NT Home Ownership as a credit provider under section 6G of the Privacy Act has resulted in a range of additional privacy obligations applying to NT Home Ownership (specifically, the obligations contained in Part IIIA of the Privacy Act and the Code). These relate to the transparency of information, additional notification requirements, the use and disclosure of information, ensuring the integrity and security of information, facilitating access to, and correction of, information and dealing with complaints regarding the handling of information.
Transparency of information
Obligations regarding the transparency of information require NT Home Ownership to:
* prepare a specific policy about its management of credit information and credit eligibility information, making this publicly available and taking reasonable steps to provide a copy of this policy free of charge on request (section 21B of the Privacy Act)
* implement practices, procedures and systems to ensure that NT Home Ownership meets its obligations under Part IIIA of the Privacy Act and the Code and enable NT Home Ownership to deal with inquiries or complaints from individuals about its compliance, including through staff training (section 21B of the Privacy Act).
As a credit provider, NT Home Ownership's notification obligations under Australian Privacy Principle (APP) 5 of the Privacy Act have been expanded to cover a range of additional matters specified in Part IIIA of the Privacy Act and the Code. In particular, additional notification requirements have been imposed on NT Home Ownership where it collects personal information about an individual that is likely to be disclosed to a CRB (section 21C of the Privacy Act). Individuals are able to be informed of these additional matters through NT Home Ownership's website. However, NT Home Ownership also makes this information available in other forms (to cover people who may not be able to access the information through the website).
Use and disclosure of credit related information
Generally speaking, a credit provider must not disclose credit information about an individual to a CRB (subsection 21D(1) of the Privacy Act). However, this prohibition on disclosure does not apply in the particular circumstances set out in subsection 21D(2). As NT Home Ownership has been prescribed as a credit provider and prescribed for the purposes of subparagraphs 21D(2)(a)(i) and 21D(3)(c)(i), the requirements in subsection 21D(2) are met and the prohibition in subsection 21D(1) does not apply provided NT Home Ownership handles credit information consistent with other requirements under section 21D.
NT Home Ownership is also subject to specific obligations in relation to credit eligibility information disclosed to it by a CRB. Subsection 21G(1) of the Privacy Act prohibits a credit provider from using or disclosing the credit eligibility information that it holds. However, the prohibitions on use and disclosure do not apply in the circumstances set out in subsections 21G(2)-(3). Where NT Home Ownership uses or discloses credit eligibility information in those circumstances, NT Home Ownership will make a written note of that use or disclosure (subsection 21G(6) of the Privacy Act).
There are also several requirements in paragraph 5.3 of the Code that a credit provider needs to address as part of its disclosure practices, procedures and systems. To meet these obligations, NT Home Ownership will make an assessment as to the content and level of detail that should reasonably be included in its practices, procedures and systems to cover its various obligations under the Privacy Act and the Code.
Ensuring the integrity and security of credit related information
As a credit provider, NT Home Ownership must ensure the integrity and security of credit related information. In particular:
* NT Home Ownership must take reasonable steps to ensure the credit eligibility information it collects, uses and discloses is accurate, up-to-date and complete (section 21Q of the Privacy Act). APP 10 does not apply to NT Home Ownership in relation to its handling of credit eligibility information but does apply in relation to credit information generally (that is, information collected from the individual directly).
* NT Home Ownership must not disclose credit information or use/disclose credit eligibility information that is false or misleading in a material particular (section 21R of the Privacy Act).
* NT Home Ownership must take reasonable steps to protect credit eligibility information from misuse, interference, loss, unauthorised access, modification or disclosure (section 21S of the Privacy Act). These provisions also include requirements for NT Home Ownership to destroy or de-identify certain information that it holds in its records where it no longer needs this information for relevant purposes. APP 11 will apply to NT Home Ownership in relation to credit information generally (that is, information collected from an individual directly).
The Code also imposes various record keeping obligations on credit providers in relation to their use or disclosure of credit information.
Access to, and correction of, credit related information
There are specific provisions in Part IIIA of the Privacy Act relating to the capacity of an individual to request access to their own credit eligibility information (section 21T of the Privacy Act) and to request correction of their own credit information (section 21V).
Specific obligations are also being imposed on NT Home Ownership where it identifies that credit information or credit eligibility information it holds is inaccurate, out of date, incomplete, irrelevant or misleading on its own motion (section 21U). There is no capacity for NT Home Ownership to charge for providing such access or making such correction.
These specific provisions alter the operation of the APPs with respect to credit-related information held by NT Home Ownership.
Complaints regarding the handling of credit related information
There is a specific complaints-handling regime in Division 5 of Part IIIA of the Privacy Act that applies to certain complaints made to NT Home Ownership about its acts or practices that may be a breach of Part IIIA of the Privacy Act or the Code.
In accordance with this regime, NT Home Ownership will provide written acknowledgement of the complaint and how it will be handled, investigate the complaint, consult other parties as necessary and make a decision within 30 days unless the individual agrees to a longer period (section 23B of the Privacy Act).
Item [4] - section 13AA
This item adds new paragraph (c) to include that NT Home Ownership, as a credit provider, is prescribed for the purposes of paragraph 20E(4)(a) of the Privacy Act. The effect of this amendment would be to permit a CRB to disclose repayment history information and credit reporting information about an individual to NT Home Ownership, as well as maintaining CRBs' current ability to disclose to Indigenous Business Australia.
Item [5] - At the end of subsection 14(1) and (2)
This item adds new paragraph (c) to subsection 14(1) to include that NT Home Ownership, as a credit provider, is prescribed for the purposes of subparagraph 21D(2)(a)(i) of the Act and new paragraph (c) to subsection 14(2) for the purposes of subparagraph 21D(3)(c)(i) of the Act.
The effect of this amendment would be to permit NT Home Ownership to disclose repayment history information or financial hardship information about an individual to a CRB, provided the other requirements of subsection 21D(3) are met. These include the requirements in:
* subparagraph 21D(3)(c)(ii) (that the consumer credit to which the information relates is consumer credit in relation to which the provider also discloses, or a credit provider has previously disclosed, consumer credit liability information about the individual to the credit reporting body)
* subparagraph 21D(3)(c)(iii) (that the provider needs to comply with any requirements relating to the disclosure of the information that are prescribed in the regulations). No requirements are currently prescribed in the regulation for the purposes of that provision.
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Privacy Amendment (NT Home Ownership) Regulations 2023
The instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the instrument
NT Home Ownership is a Northern Territory (NT) agency for the purposes of the Financial Management Act 1995 (NT) that sits within the NT's Department of Territory Families, Housing and Communities (the NT Department).
NT Home Ownership is operated by the NT Department to assist lower income residents of the NT to participate in home ownership through loans, including home loan products.
The NT Department provides subsidised loans through contracting with a credit provider for the delivery of services in managing its loan portfolio and through loans fully funded by the NT Department.
The restrictions in the Privacy Act on the collection, use and disclosure of consumer credit information to and by credit reporting bodies (CRBs) and credit providers make it difficult for NT Home Ownership or its contracting agent to request or receive credit information from CRBs, including default information and repayment history information.
To ensure the NT Department can support its work in assisting vulnerable and lower income NT residents with housing, it is necessary for NT Home Ownership to be prescribed as a credit provider by the Privacy Regulation. Currently, Indigenous Business Australia, Export Finance and Insurance Corporation, and the Regional Investment Corporation are prescribed as credit providers under the Privacy Regulations. The Regulations add to NT Home Ownership to this group.
To administer an individual's application for such loans, NT Home Ownership needs to manage information about that individual, including information relating to 'credit reporting'. This includes personal information about an individual's identity, consumer credit liability, default information and personal insolvency.
The purpose of the Privacy Amendment (NT Home Ownership) Regulations 2023 (the Regulations) is to ensure NT Home Ownership is a credit provider permitted to manage credit information about an individual consistent with the Privacy Act. It does so by:
* prescribing NT Home Ownership as a Territory authority treated as an organisation, and as a credit provider under the Privacy Act
* permitting credit reporting bodies (CRBs) to disclose credit reporting information, including repayment history information, to NT Home Ownership, and
* permitting NT Home Ownership to disclose credit information about an individual to a CRB.
Human rights implications
The Regulations engage the prohibition on interference with a person's privacy, family and home in Article 17 of the International Covenant on Civil and Political Rights (ICCPR).
Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with their privacy, family, home or correspondence, nor to unlawful attacks on their honour and reputation. Article 17 of the ICCPR also provides that everyone has the right to the protection of the law against such interference or attacks.
Article 17 of the ICCPR also protects unwarranted and unreasonable intrusions into activities which society recognises as falling within the sphere of individual autonomy. Such intrusions can include:
* the collection, storage, security, use, disclosure, or publication of information
* the regulation of information held on a public register (for example, a legislative requirement to maintain a public register of biosecurity)
* creating an identification system
* providing for sharing of information across or within agencies, and
* authorising powers of entry to premises or search of persons or premises.
The prohibitions in Article 17 have been given effect by the Privacy Act.
The Privacy Act
The Privacy Act provides for the protection of personal information collected and held by Australian Government agencies and certain private sector organisations. It sets out Australian Privacy Principles (APPs) which deal with all stages of the information lifecycle setting out standards for the collection, storage, security, use, disclosure, and quality of personal information. They also create obligations on agencies and organisations regarding access to, and correction of, an individual's own personal information.
One of the objects of the Privacy Act is to facilitate an efficient credit reporting system while ensuring that the privacy of individuals is respected. The laws about credit reporting are intended to balance an individual's right to protect their personal information with the need to ensure credit providers:
* have sufficient information available to assist them to decide whether to provide an individual with credit
* can comply with their responsible lending obligations under the National Consumer Credit Protection Act 2009 administered by the Australian Securities and Investment Commission (ASIC).
To promote an individual's right to privacy, Part IIIA of the Privacy Act regulates the handling of personal information about individuals' activities in relation to consumer credit. Division 3 of Part IIIA outlines:
* the types of credit information that credit providers like NT Home Ownership can disclose to a CRB, for the purpose of that information being included in an individual's credit report
* the permitted purposes for which credit providers like NT Home Ownership can use credit eligibility information about an individual.
The Australian Information Commissioner, through the OAIC, is responsible for monitoring and enforcing compliance with the Privacy Act and can investigate complaints.
An individual's right to privacy when dealing with NT Home Ownership is already promoted by the Privacy Act.
The Regulations
The Regulations further promote an individual's right to privacy because prescribing NT Home Ownership as a credit provider under section 6G of the Privacy Act has resulted in a range of additional privacy obligations applying to NT Home Ownership. These obligations are contained in Part IIIA of the Privacy Act and the Privacy (Credit Reporting) Code 2014 (Code). The obligations relate to the transparency of information, additional notification requirements, the use and disclosure of information, ensuring the integrity and security of information, facilitating access to, and correction of, information and dealing with complaints regarding the handling of information.
Transparency of information
Obligations regarding the transparency of information require NT Home Ownership to:
* prepare a specific policy about its management of credit information and credit eligibility information, making this publicly available and taking reasonable steps to provide a copy of this policy on request (section 21B of the Privacy Act), and
* implement practices, procedures and systems to ensure that NT Home Ownership meets its obligations under Part IIIA of the Privacy Act and the Code and enable NT Home Ownership to deal with inquiries or complaints from individuals about its compliance, including through staff training (section 21B of the Privacy Act).
As a credit provider, NT Home Ownership's notification obligations under Australian Privacy Principle (APP) 5 of the Privacy Act have been expanded to cover a range of additional matters specified in Part IIIA of the Privacy Act and the Code. In particular, additional notification requirements have been imposed on NT Home Ownership where it collects personal information about an individual that is likely to be disclosed to a CRB (section 21C of the Privacy Act). Individuals are able to be informed of these additional matters through NT Home Ownership website. However, NT Home Ownership also makes this information available in other forms (to cover people who may not be able to access the information through the website).
Use and disclosure of credit related information
Generally speaking, a credit provider must not disclose credit information about an individual to a CRB (subsection 21D(1) of the Privacy Act). However, this prohibition on disclosure does not apply in the particular circumstances set out in subsection 21D(2). As NT Home Ownership has been prescribed as a credit provider, the requirements in subsection 21D(2) are met and the prohibition in subsection 21D(1) does not apply provided NT Home Ownership handles credit information consistent with other requirements under section 21D.
NT Home Ownership is also subject to specific obligations in relation to credit eligibility information disclosed to it by a CRB. Subsection 21G(1) of the Privacy Act prohibits a credit provider from using or disclosing the credit eligibility information that it holds. However, the prohibitions on use and disclosure do not apply in the circumstances set out in subsections 21G(2)-(3). Where NT Home Ownership uses or discloses credit eligibility information in those circumstances, NT Home Ownership will make a written note of that use or disclosure (subsection 21G(6) of the Privacy Act).
There are also several requirements in paragraph 5.3 of the Code that a credit provider needs to address as part of its disclosure practices, procedures and systems. To meet these obligations, NT Home Ownership will make an assessment as to the content and level of detail that should reasonably be included in its practices, procedures and systems to cover its various obligations under the Privacy Act and the Code.
Ensuring the integrity and security of credit related information
As a credit provider, NT Home Ownership must ensure the integrity and security of credit related information. In particular:
* NT Home Ownership must take reasonable steps to ensure the credit eligibility information it collects, uses and discloses is accurate, up-to-date and complete (section 21Q of the Privacy Act). APP 10 does not apply to NT Home Ownership in relation to its handling of credit eligibility information but does apply in relation to credit information generally (that is, information collected from the individual directly)
* NT Home Ownership must not disclose credit information or use/disclose credit eligibility information that is false or misleading in a material particular (section 21R of the Privacy Act)
* NT Home Ownership must take reasonable steps to protect credit eligibility information from misuse, interference, loss, unauthorised access, modification or disclosure (section 21S of the Privacy Act). These provisions also include requirements for NT Home Ownership to destroy or de-identify certain information that it holds in its records where it no longer needs this information for relevant purposes. APP 11 will apply to NT Home Ownership in relation to credit information generally (that is, information collected from an individual directly).
The Code also imposes various record keeping obligations on credit providers in relation to their use or disclosure of credit information.
Access to, and correction of, credit related information
There are specific provisions in Part IIIA of the Privacy Act relating to the capacity of an individual to request access to their own credit eligibility information (section 21T of the Privacy Act) and to request correction of their own credit information (section 21V).
Specific obligations are also imposed on NT Home Ownership where it identifies that credit information or credit eligibility information it holds is inaccurate, out of date, incomplete, irrelevant or misleading on its own motion (section 21U). There is no capacity for NT Home Ownership to charge for providing such access or making such correction.
These specific provisions alter the operation of the APPs with respect to credit-related information held by NT Home Ownership.
Complaints regarding the handling of credit related information
There is a specific complaints-handling regime in Division 5 of Part IIIA of the Privacy Act that applies to certain complaints made to NT Home Ownership about its acts or practices that may be a breach of Part IIIA of the Privacy Act or the Code.
In accordance with this regime, NT Home Ownership will provide written acknowledgement of the request and how it will be handled, investigate the complaint, consult other parties as necessary and make a decision within 30 days unless the individual agrees to a longer period (section 23B of the Privacy Act).
By prescribing NT Home Ownership as a credit provider under section 6G of the Privacy Act and imposing obligations under Part IIIA of the Privacy Act and the Code on NT Home Ownership, the Regulations further promote an individual's right to privacy when applying for a loan from NT Home Ownership.
Conclusion
The instrument is compatible with human rights because it promotes the protection of human rights.
The Hon Mark Dreyfus KC MP
Attorney-General