Commonwealth Numbered Regulations - Explanatory Statements
[Index] [Search] [Download] [Related Items] [Help]
PRIVACY AMENDMENT (GOVERNMENT RELATED IDENTIFIERS) REGULATIONS 2017 (F2017L01627)
EXPLANATORY STATEMENT
Select Legislative Instrument No. , 2017
Issued by the authority of the Attorney-General
Privacy Act 1988
Privacy Amendment (Government Related Identifiers) Regulations 2017
The Privacy Act 1988 (Cth) (the Act) establishes, among other things, the Australian Privacy Principles (APPs), which regulate the collection, use, disclosure and storage of personal information by APP entities. Subsection 100(1) of the Act provides that the Governor-General may make regulations prescribing matters required or permitted by the Act to be prescribed, or necessary or convenient to be prescribed, for carrying out or giving effect to the Act.
Adoption, use or disclosure of government-related identifiers
APP 9 deals with the adoption, use or disclosure of government related identifiers by organisations. APP 9.1 provides that an organisation must not adopt a government related identifier in relation to an individual; APP 9.2 provides that an organisation must not use or disclose a government related identifier of an individual; and APP 9.3 provides that regulations may be made to permit the use of government related identifiers by organisations. APP 9.3 requires the prescription of: the government related identifier; the organisation or class of organisations that adopt, use or disclose the government related identifier and the circumstances of the adoption, use or disclosure.
Exceptions to Australian Privacy Principles 9.1 and 9.2--MedsASSIST
The purpose of the Privacy Amendment (Government Related Identifiers) Regulations 2017 (the Regulations) is to provide an exception to APP 9.1 and 9.2 by prescribing MedsASSIST in accordance with APP 9.3. MedsASSIST is a system operated by GuildLink, a wholly owned subsidiary of the Pharmacy Guild of Australia (the Guild), and used by community pharmacies in Australia for the purposes of recording and monitoring the supply of over- the-counter codeine medication to individuals. MedsASSIST involves the collection, use and disclosure by pharmacists of an individual's government related identifier. The identifier is collected from the individual with their consent, entered by the pharmacist into MedsASSIST and adopted to identify the individual (rather than a name or address).
In accordance with APP 9.3 the Regulations prescribe the adoption, use and disclosure of various government related identifiers, by GuildLink, in circumstances of its administration of MedsASSIST. The Regulations also prescribe the use and disclosure of the identifiers by pharmacies that use MedsASSIST as a clinical support tool. The Regulations refer to the relevant identifiers as MedsASSIST identifiers which include Australian passport and State or Territory driver's licence identifiers as well as the following:
* Australian Capital Territory Proof of Identity Card Customer Identifiers;
* New South Wales Photo Card Identifiers;
* Northern Territory Evidence of Age (18 Plus Card) Card Identifiers;
* Queensland Adult Proof of Age Card Identifiers;
* Queensland 18+ Card Identifiers;
* Queensland Photo Identification Card Identifiers;
* South Australia Proof of Age Card Client Identifiers;
* Tasmanian Government Personal Information Card Identifiers;
* Victoria Proof of Age Card Identifiers; and
* Western Australian Photo Card Identifiers.
MedsASSIST is due to cease operating on 1 February 2018 when the Standard Uniform Scheduling of Medicines and Poisons (the Poisons Standard) will be amended to delete the over-the-counter codeine entries from Schedule 2 (Pharmacy Medicines) and Schedule 3 (Pharmacist Only Medicines), leaving only the codeine entries in Schedule 4 (Prescription Only Medicine) and Schedule 8 (Controlled Drug).
Requirements of subsection 100(2) of the Act
Subsection 100(2) of the Act provides that before the Governor-General makes regulations for the purposes of APP 9.3 prescribing a government related identifier, an organisation or a class of organisations, and circumstances, the Attorney-General must be satisfied that:
(a) the relevant agency or State or Territory authority or, if the relevant agency or State or Territory authority has a principal executive, the principal executive:
(a) has agreed that the adoption, use or disclosure of the identifier by the organisation, or the class of organisations, in the circumstances is appropriate; and
(b) has consulted the Australian Information Commissioner (Commissioner) about that adoption, use or disclosure; and
(b) the adoption, use or disclosure of the identifier by the organisation, or the class of organisations, in the circumstances can only be for the benefit of the individual to whom the identifier relates.
The responsible agencies and authorities have agreed: that the adoption, use or disclosure of the identifiers is appropriate in the circumstances; and to having the Attorney-General's Department consult with the Commissioner on their behalf given the number of identifiers involved. The Commissioner has been consulted and has agreed that the Regulations are appropriate. The adoption, use and disclosure of the identifiers can only be for the benefit of the individuals to whom they relate as MedsASSIST helps pharmacists identify patients at risk of codeine dependence or poorly managed chronic pain. Pharmacists are then able to facilitate access to suitable referral pathways to support patients better manage their pain and enhance health outcomes.
Details of the Regulations are set out in Attachment A.
A Statement of Compatibility with Human Rights is set out in Attachment B prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny Act) 2011.
Consistent with the requirements of the Legislation Act 2003, consultation on the Regulations was undertaken with the Office of the Australian Information Commissioner. The Department of Health, the Guild, and the responsible agencies and authorities of the identifiers were also consulted and support the Regulations.
The Office of Best Practice Regulation was consulted on the Regulations and advised that no Regulation Impact Statement was required.
The Regulations are a legislative instrument for the purposes of the Legislation Act 2003.
The Regulations commence the day after registration.
ATTACHMENT A
Privacy Amendment (Government Related Identifiers) Regulations 2017
Preliminary
Section 1 - Name of Regulation
This section provides that the title of the Regulations is the Privacy Amendment (Government Related Identifiers) Regulations 2017.
Section 2 - Commencement
This section provides that the Regulations commence on the day after registration.
Section 3 - Authority
This section provides that the proposed Regulations are made under the Privacy Act 1988 (Privacy Act).
Section 4 - Schedule(s)
This section provides that amendments or repeals have effect according to the terms set out in the Schedule(s).
Schedule 1 - Amendments
Section 19 - Exceptions to Australian Privacy Principles 9.1 and 9.2--MedsASSIST
Subsection 19(1) provides that subclause 9.3 of the Australian Privacy Principles applies in relation to the adoption, use or disclosure by GuildLink of a MedsASSIST identifier of an individual in the course of the operation or administration of MedsASSIST by GuildLink.
Subsection 19(2) provides that subclause 9.3 of the Australian Privacy Principles applies in relation to the use or disclosure, by an organisation that operates a pharmacy, of a MedsASSIST identifier of an individual in the course of using or contributing to MedsASSIST as a clinical decision support tool.
Subsection 19(3) defines GuildLink, MedsASSIST and MedsASSIST identifier for the purposes of subsections 19(1) and (2).
Subsection 19(4) provides that section 19 is repealed at the start of 1 February 2018.
ATTACHMENT B
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Privacy Regulation 2013
This Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Legislative Instrument
The Privacy Amendment (Government Related Identifiers) Regulations 2017 (the Regulations) amend the Privacy Regulation 2013 to prescribe the adoption, use and disclosure of various government related identifiers, including State and Territory driver licence, proof of age card, and passport identifiers, by GuildLink, in circumstances of its administration of MedsASSIST. The Regulations also prescribe the use and disclosure of the identifiers by pharmacies that use MedsASSIST as a clinical support tool. MedsASSIST is a system operated by GuildLink, a wholly owned subsidiary of the Pharmacy Guild of Australia (the Guild), and used by community pharmacies in Australia for the purposes of recording and monitoring the dispensing of over-the-counter codeine medication to individuals.
Human rights implications
This Legislative Instrument engages the right to the protection against arbitrary interference with privacy, protected in Article 17 of the International Covenant on Civil and Political Rights (ICCPR). The right to privacy in Article 17 of the ICCPR prohibits unlawful or arbitrary interferences with a person's privacy, family, home and correspondence. In order for an interference with a right not to be 'arbitrary', the interference must be for a reason consistent with the relevant Convention and reasonable in the particular circumstances.
The Regulation prescribes the use and disclosure of government related identifiers by GuildLink and pharmacies that use MedsASSIST. MedsASSIST helps pharmacists identify patients at risk of codeine dependence or poorly managed chronic pain and facilitate access to suitable referral pathways to support patients to better manage their pain and enhance health outcomes. MedsASSIST will cease to operate on 1 February 2018 when relevant codeine medication is up-scheduled to Schedule 4 Prescription Only Medicine. The measures are time limited, reasonable, necessary and proportionate as they ensure that a discrete subset of personal information is used only for the benefit of the individual to whom the personal information relates. These are legitimate objectives consistent with the Privacy Act.
Conclusion
This Legislative Instrument engages with the right to privacy, through the use and disclosure of personal information. To the extent that the Legislative Instrument may limit the right to privacy, those limitations are reasonable, necessary and proportionate to achieve the legitimate aims of the Legislative Instrument.