Commonwealth Numbered Regulations - Explanatory Statements

[Index] [Search] [Download] [Related Items] [Help]

PRIVACY AMENDMENT (PROTECTION OF AUSTRALIAN FARMS) REGULATIONS 2019 (F2019L00531)

Privacy Amendment (protection of australian farms) Regulations 2019

EXPLANATORY STATEMENT

Issued by authority of the Attorney-General

In compliance with section 15J of the Legislation Act 2003

Purpose and operation of the Instrument

The Privacy Act 1988 (Cth) (Privacy Act) establishes, among other things, the Australian Privacy Principles (APPs), which regulate the collection, use, disclosure and storage of personal information by APP entities.

The Privacy Act does not apply to organisations that are classed as 'small business operators'. Most entities with annual turnover of less than $3 million fall within the definition of a small business operator. However, subsection 6E(1) of the Privacy Act provides that the Privacy Act applies in relation to a prescribed small business operator (with prescribed modifications, if any).

Subsection 100(1) of the Privacy Act provides that the Governor-General may make Regulations prescribing matters required or permitted by the Privacy Act to be prescribed, or necessary or convenient to be prescribed, for carrying out or giving effect to the Privacy Act.

Prescribing Aussie Farms Inc as an organisation for the purposes of the Privacy Act

Aussie Farms Inc (ABN: 17 356 117 654) (Aussie Farms) is an Australian animal welfare organisation which registered with the Australian Securities and Investments Commission on 26 November 2013 and registered as a charity with the Australian Charities and Not-for-profits Commission as of 1 January 2018.

On 21 January 2019, Aussie Farms published an online map on their website containing information about certain Australian farms and agricultural operators. This information included personal contact details, locations, images and other specifics about these farms and agricultural producers.

Publication of the personal information has caused deep concern within Australia's agricultural community due to fears that farmers' property or families may be inappropriately targeted and subject to activity that threatens their livelihood. Since publication of the map, there have been two reported instances of trespass on farms by protesters in Western Australia and Queensland.

The Office of the Australian Information Commissioner (OAIC) is able to investigate complaints about the handling of personal information in relation to government agencies and other entities prescribed by the Privacy Act. The OAIC was unable to investigate these circumstances further on the basis that Aussie Farms was not required to comply with the Privacy Act as it fell below the financial threshold of $3 million per year and was therefore considered a small business operator and not subject to the jurisdiction of the OAIC.

This Regulation requires that Aussie Farms collect, use and disclose personal information in the manner required by the APPs. This ensures that Aussie Farms actions relating to personal information are consistent with the expectations of the Australian community. Prescribing Aussie Farms under this instrument allows the OAIC to have oversight of the practices of Aussie Farms to the extent that those practices relate to the collection, use or disclosure of personal information and gives confidence to the Australian agricultural community that their personal information is not being misused in a manner that threatens their home, family or business.

 Consultation

The Australian Information Commissioner has been consulted on the contents of this instrument relating to the desirability of regulating Aussie Farms under the Privacy Act.

Regulation Impact Statement

This instrument has a negligible regulatory impact as it applies to limited entities with no anticipated on-flow effects.

STATEMENT OF COMPATIBILITY WITH HUMAN RIGHTS

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Privacy Amendment (Protection of Australian Farms) Regulations 2019

1.                This instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the instrument

2.                This instrument amends the Privacy Regulation 2013, pursuant to the regulation-making powers contained in subsections 6E(1) and 100(1) of the Privacy Act 1988 (Privacy Act).

3.                The requirements in the Privacy Act apply to an 'organisation'. An 'organisation' is defined, in part, to exclude 'small business operators, defined as businesses with a turnover of less than $3 million per year.

4.                Subsection 6E(1) provides that the Privacy Act applies to  a prescribed small business operator as if that operator were an 'organisation'. The prescription of a small business operator is made under the regulation-making power in subsection 100(1).

5.                This instrument adds a new subsection 7(1A) to the Privacy Regulation, prescribing Aussie Farms Inc for the purposes of subsection 6E(1) of the Privacy Act.

6.                This prescription is necessary to ensure that the publication of personal information (such as the addresses of individuals involved in a particular category of business operations), which could lead to violations of human rights perpetrated against individuals involved in those business operations, is subject to the protective legislative framework provided by the Privacy Act.

Human rights implications

7.                By prescribing a small business operator for the purposes of subsection 6E(1) of the Privacy Act, the instrument engages the right to privacy and the right to freedom of expression.

8.                Australia's human rights obligations accrue to individuals, not to legal entities such as corporations. Therefore, to the extent that the instrument imposes legislative requirements on business, it does not have an impact on Australia's human rights obligations.

9.                However, the creation of those requirements may impact on the human rights of individuals interacting with a business, or the rights of individuals involved in that business. The analysis below considers how the re-application of the Act's legislative scheme to a small business operator may impact on the rights of individuals related to that business.

The right to privacy

10.            Article 17 of the International Covenant on Civil and Political Rights (ICCPR) provides that 'no-one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence', and that 'everyone has the right to protection of the law against such interference or attacks'.

11.            The instrument promotes the right to privacy, through ensuring that the use of personal information must be in accordance with the Act, which provides the protection of law required by Article 17.

12.            The Privacy Act creates a framework for the collection, use and disclosure of personal information which is generally applicable. However, the framework of the Act provides an exemption for business operations with an annual turnover of less than $3 million.

13.            The small business exemption is designed to lessen regulatory burden on small business, on the basis that smaller businesses have a smaller impact on privacy, and therefore the risk of violations of privacy by such businesses is commensurately smaller.

14.            However, where the particular nature of operations of a business mean that its use of personal information is uncharacteristically large for a business of its size, the application of the Act is necessary to ensure appropriate protection of the right to privacy of the individuals whose personal information is being used.

15.            Therefore, this instrument promotes the human right to privacy, by requiring that Aussie Farms Inc, a small business operator with an impact on privacy that is uncharacteristically large with the potential for serious misuse of that information for its size, complies with appropriate privacy requirements. This ensures that, consistent with Article 17, individuals are protected by law against arbitrary or unlawful interference with their privacy.

The right to freedom of expression

16.            Article 19 of the ICCPR specifies that 'everyone shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds'.

17.            At the outset, it is important to note that the Privacy Act's regulatory scheme already applies to charities and political interest groups with a turnover larger than $3 million. On that basis, this extension of the Act to Aussie Farms Inc is consistent with the way other political interest and protest entities engage with the Act.

18.            The requirements imposed by the Privacy Act, including that organisations have a privacy policy and are transparent with individuals around the collection and use of personal information, do not prevent freedom of expression, and in particular, they do not prevent Aussie Farms from using personal information.

19.            Rather, they impose safeguards to ensure that any expression that involves personal information has appropriate regard to the human right to privacy.

20.            Article 19(3) of the ICCPR states that the right to freedom of expression may be subject to certain restrictions, including for respect of the rights and reputations of others.

21.            To the extent that this instrument limits the human right to freedom of expression, it is a justified limitation, for the following reasons.

22.            The limitation is prescribed by law, because it is in a piece of publicly available delegated legislation. This ensures that the public have an adequate indication of the impact of the instrument.

23.            The limitation pursues the legitimate objective of ensuring that a small business operator with a particularly large use of personal information has respect for the human right to privacy.

24.            The limitation is rationally connected to its objective, through specifying a particular small business operator with a large impact on privacy, and requiring reasonable safeguards on their engagement with personal information.

25.            The limitation is proportionate to that objective by requiring the same safeguards that are required for organisations with a similar impact on the human right to privacy, and in particular, political interest and protest organisations similar to Aussie Farms Inc.

26.            For these reasons, whilst it is highly unlikely that the instrument will limit the human right to freedom of expression, to the extent that it does, that limitation is justified in the schema of Article 19 of the ICCPR.

Conclusion

27.            This instrument is compatible with human rights because it advances the protection of human rights, in particular the right to privacy. To the extent that it may limit the right to freedom of expression, that limitation is prescribed by law, in pursuit of a legitimate objective, rationally connected to the objective, and are a proportionate way of achieving that objective.

Attachment A

NOTES ON SECTIONS

Section 1 - Name

Section 1 provides that the title of the instrument is the Privacy Amendment (Protection of Australian Farms) Regulations 2019.

Section 2 - Commencement

This section provides that the instrument commences on the day after the Instrument is registered.

Section 3 - Authority

This section provides that the instrument is made under the Privacy Act 1988.

Section 4 - Schedules

This section provides that amendments or repeals have effect according to the terms set out in the Schedule.

SCHEDULE 1 - Amendments

Item 1 - Before subsection 7(1)

Subsection 7(1A)

Subsection 7(1A) prescribes Aussie Farms Inc (ABN: 17 356 117 654) as a small business operator that is be treated as an organisation for the purposes of the Privacy Act 1988.

After commencement of this instrument, Aussie Farms must comply with all obligations placed on organisations under the Privacy Act 1988 including restrictions on the collection, use and disclosure of personal information.

Item 2 - At the end of Part 5

Section 23

Section 23 states that subsection 7(1A) of the instrument applies to acts done, or practices engaged in, after the commencement of this instrument irrespective of whether personal information was collected before or after the commencement of this instrument.

Section 23 ensures that personal information held by Aussie Farms prior to the commencement of this instrument is afforded equal protection under the Privacy Act 1988 with information collected after commencement.