National Disability Insurance Scheme Amendment (Worker Screening Database) Bill 2019 [2019] AUPJCHR 84 (17 September 2019)

• National Disability Insurance Scheme Amendment (Worker Screening Database) Bill 20191
• NDIS Worker Screening Database
• Right to privacy and right to work: committee's initial analysis
• Minister's response10
• Committee comment

---

National Disability Insurance Scheme Amendment (Worker Screening Database) Bill 2019^[1]

Purpose	Establishes a national database of information relating to worker screening for the purposes of the National Disability Insurance Scheme
Portfolio	Families and Social Services
Introduced	House of Representatives, 13 February 2019
Rights	Privacy; work
Previous reports	Report 2 of 2019 and Report 3 of 2019
Status	Concluded examination

2.121 The committee first requested a response from the minister on the National Disability Insurance Scheme Amendment (Worker Screening Database) Bill 2019 in Report 2 of 2019.^[2] As that response had not been received at the time of the dissolution of the 45th Parliament, and as the bill has been reintroduced in the same terms, the committee reiterated its initial request for advice in Report 3 of 2019.^[3] The full initial human rights analysis is set out in Report 2 of 2019 at pp. 61-67.^[4]

NDIS Worker Screening Database

2.122 The bill seeks to establish a database (Worker Screening Database) to facilitate nationally consistent worker screening for the purposes of the National Disability Insurance Scheme (NDIS). The database would contain a record of decisions made under NDIS worker screening laws. Information on the database could be shared with certain persons or bodies for the purposes of the NDIS.^[5] The database would include a range of information relating to a person's application to be an NDIS worker.^[6] This could include personal information within the meaning of the Privacy Act 1988 (Privacy Act).^[7]

Right to privacy and right to work: committee's initial analysis

2.123 In its initial analysis, the committee observed that by providing for the collection, use and disclosure of information (including personal information) about persons who have made an application for an NDIS worker screening check, including any previous, current or pending decisions in relation to such applications, this measure engages and limits the right to privacy.^[8] To the extent that the collection, use and disclosure of information in the database may result in the exclusion of a person from employment, the measure also engages and limits the right to work.^[9]

2.124 The committee sought the advice of the minister as to whether the limitations on those rights are a proportionate means of achieving their stated objectives, including:

• whether the type and extent of the information on the Worker Screening Database will be appropriately circumscribed, including whether limitations on the type of information in the database will be set out in legislation (and if so, the specific provisions that apply), or will be matters of policy;

• whether access to the Worker Screening Database will be appropriately circumscribed, including whether limitations on access to the database will be set out in legislation (and if so, the specific provisions that apply), or will be matters of policy; and

• any other information that may be relevant to the proportionality of the measure.

Minister's response^[10]

2.125 The minister advised:

Personal information in the NDIS Worker Screening Database
The information to be included in the database is circumscribed by new subsection 181Y(5) of the National Disability Insurance Scheme Act 2013 (NDIS Act) to be inserted by the Bill. New subsection 181Y(5) does not provide for the database to hold information about a person’s criminal history, including convictions and charges and any other information relied on to support a decision that is made under a NDIS worker screening law in a state or territory, or information about a person’s sexual identity or preferences. Such information would not be necessary for the Commission’s worker screening database function, which is outlined in new subsection 181Y(1) and informed by the purposes of the database in new subsection 181Y(3). This is supported by the division of responsibilities for worker screening in Part 3 of the Intergovernmental Agreement on Nationally Consistent NDIS Worker Screening (IGA), under which states and territories are responsible for operating NDIS Worker Screening Units. In addition, the collection, use and disclosure of criminal history information (which is generally very sensitive) is governed by Schedule A to the IGA and arrangements between the Australian Criminal Intelligence Commission (ACIC) and states and territories. These arrangements closely limit the use and disclosure of such information.
New subsection 181Y(8) enables the Minister to determine additional purposes of the database and information to be contained within the database by way of legislative instrument. An example of additional determined content of the database may be a new type of decision contemplated by NDIS worker screening law not already covered by subsection 181Y(5). Flexibility in this area will benefit the overall database as states and territories are yet to implement their NDIS worker screening laws. Additional content to be determined is necessarily limited by the NDIS Commissioner’s functions and the provisions relating to the collection, use and disclosure of information under the NDIS Act. In developing any future legislative instruments for this purpose, the Minister will be required to produce a Statement of Compatibility with Human Rights. This will require the Minister to have regard to the proportionality of the additional determined purpose or information in pursing the legitimate objective. Such instrument will also be subject to disallowance.
Information on the database may be used for policy development, evaluation and research purposes. Personal information used for this purpose will be de-identified in accordance with the requirements of the Office of the Australian Information Commissioner and used for the Commission’s core functions. These requirements will be addressed through standard operating procedures.
Access to the NDIS Worker Screening Database
The National Worker Screening database maintains a register of cleared and excluded applicants and workers from all jurisdictions. The database gives effect to the agreement of governments in clause 94 of the IGA, to national portability of NDIS Worker Screening Check outcomes.
The information to be held in the database is provided by Worker Screening Units in each state and territory. Those Units undertake risk assessments and clearance status of NDIS Worker Screening Check applicants. Worker Screening Units in each state and territory will be required to secure consent from the applicant to have the NDIS worker screening check outcome included in the national database and to the disclosure of their NDIS Worker Screening outcome to current and prospective employers, to the Commission, to NDIS Worker Screening Units and to third party government entities providing the screening information. Consent will also be sought to ongoing monitoring of their eligibility to maintain the clearance for the duration of the clearance, and consent to share information from law enforcement agencies and the Commission for the purposes of working with vulnerable persons screening processes. These requirements are set out in Part 5 – Application Process of IGA.
Staff in ‘risk-assessed roles’ (those with more than incidental contact, key personnel, or roles prescribed by the NDIS Commissioner) must hold an NDIS Worker Screening Check clearance as a condition of provider registration (see the National Disability Insurance Scheme (Practice Standards – Worker Screening) Rules 2018 (Worker Screening Rules)). Registered providers will have access to the database in order to comply with this condition. In order to comply with this condition they must be able to access the database to establish a link to a worker and check the clearance status of an employee, or potential employee. They are also required to de-link from an individual if that worker has left their employ.
For both registered and non-registered providers (including self-managed participants), the worker must provide their worker screening ID or their application ID to the provider to allow them to be able to search for the worker to establish their clearance status. Providers cannot randomly view workers. Providers will be able to access the following information: name, date of birth, worker screening ID, clearance status, eligibility to work, and expiry of clearance. As the information accessed by providers remains protected Commission information, providers are also subject to the requirements of sections 67A in subsequent use and disclosure of that information. Providers are also subject to the penalties in sections 67B, C and D.
Additional information regarding the proportionality of the measure
Under the IGA, a key principle is that worker screening requirements are proportional insofar as worker screening is only mandatory for workers whose role poses a significant opportunity for harm. This requirement is implemented through the Worker Screening Rules, which only require screening of workers in ‘risk- assessed roles’.
In addition, the Commission, Worker Screening Units and providers are subject to the Privacy Act and equivalent state and territory requirements.

Committee comment

2.126 The committee thanks the minister for this response and notes the minister's advice that the type and extent of information that may be included in the database is circumscribed by the provisions of proposed new subsection 181Y(5), which does not provide for the database to hold information about a person's criminal history or about a person's sexual identity or preferences. The committee also notes the minister's advice that the collection, use and disclosure of criminal history information is governed by arrangements between the Australian Criminal Intelligence Commission and states and territories, which limit the use and disclosure of such information. The committee also notes the advice that information used for policy development, evaluation and research purposes will be de-identified.

2.127 The bill also enables the minister to determine additional purposes of the database and information to be contained by way of legislative instrument. The committee notes the minister's advice that this power would be circumscribed by the NDIS Commissioner's functions,^[11] and the 'provisions relating to the collection, use and disclosure of information under the NDIS Act'. The committee also notes the minister's advice that any such addition to the purposes would be by way of a legislative instrument, and so would require the production of a statement of compatibility, and be subject to disallowance. The committee notes that should a legislative instrument be made which expands the purposes of the database, the committee would, as part of its regular scrutiny, examine it for compatibility with human rights.

2.128 In relation to access to information within the database, the committee notes the minister's advice that the information is provided by Worker Screening Units that are required to get applicants' consent to have the screening check outcome included in the database and disclosed to relevant persons. The committee also notes the minister's advice that employment providers cannot 'randomly' view workers within the database, the data can only be viewed to establish a worker's clearance status, and providers can access limited personal information. These are important safeguards against disproportionate limitations on the right to privacy and right to work. However, the committee notes that these limitations are not reflected in the provisions of the proposed legislation. As the minister's response notes, the National Disability Insurance Scheme (Practice Standards – Worker Screening) Rules 2018 inform the type of information to which NDIS providers will need access in order to fulfil their registration conditions.^[12] However, the rules do not explicitly circumscribe the type of information providers can access. As such, it appears that the limitations on access to information within the database by NDIS providers would operate only as matters of policy and practice. The committee notes the limitations on access to information in the database, including restrictions on the type of information which service providers could access, may be more appropriately included in legislation, rather than left to policy.

2.129 The committee thanks the minister for this response. In light of the information provided, the committee considers the legislative limitations on the type and extent of information that may be included in the NDIS Worker Screening Database provide important safeguards against any disproportionate limit on the right to privacy and to work.

2.130 In relation to access to the database, the committee considers there appears to be restrictions that may, in practice, sufficiently safeguard against disproportionate limitations on the right to privacy. However, the committee notes that these safeguards appear to be matters of policy, rather than law. As such, the committee considers it may be appropriate that restrictions on access to the database be set out in legislation.

2.131 The committee draws this matter to the attention of the minister and the Parliament.

---

[1] This entry can be cited as: Parliamentary Joint Committee on Human rights, National Disability Insurance Scheme Amendment (Worker Screening Database) Bill 2019, Report 5 of 2019; [2019] AUPJCHR 84.

[2] Parliamentary Joint Committee on Human Rights, Report 2 of 2019 (2 April 2019) pp. 61-67.

[3] Parliamentary Joint Committee on Human Rights, Report 3 of 2019 (30 July 2019) p. 2.

[4] Parliamentary Joint Committee on Human Rights, Report 2 of 2019 (2 April 2019) pp. 61-67

[5] Proposed section 181Y(3). 'NDIS worker screening law' is defined in proposed section 9 as a law of a state or territory determined by the minister by legislative instrument.

[6] Proposed section 181Y(5). Proposed section 181Y(8) would allow the minister, by legislative instrument, to determine additional purposes for the Worker Screening Database, and to determine additional information that may be included in the database.

[7] Proposed section 181Y(7).

[8] Parliamentary Joint Committee on Human Rights, Report 2 of 2019 (2 April 2019) p. 63.

[9] Parliamentary Joint Committee on Human Rights, Report 2 of 2019 (2 April 2019) p. 64.

[10] The minister's response to the committee's inquiries was received on 20 August 2019. The response is available in full on the committee's website at: https://www.aph.gov.au/Parliamentary_Business/Committees/Joint/Human_Rights/Scrutiny_reports.

[11] The NDIS Commissioner's functions are set out in Part 2 of the National Disability Insurance Scheme Act 2013.

[12] Section 18 of the National Disability Insurance Scheme (Practice Standards – Worker Screening Rules) 2018 requires NDIS providers to keep a written list of all workers who engage in risk assessed roles. This list must include the full name, date of birth and address of the person, the worker's NDIS worker screening check application number, NDIS worker screening check number, worker screening check outcome expiry date, and whether the worker's clearance is subject to any decision that has the effect that the provider may not allow the worker to engage in a risk assessed role. Section 21 states that NDIS providers must keep these records for seven years from the date the record is made.