Better and Fairer Schools (Information Management) Bill 2024 - Initial Scrutiny [2024] AUSStaCSBSD 167 (21 August 2024)

1.1 The committee comments on the following bill and seeks a response or further information from the relevant minister.

	Home \| Databases \| WorldLII \| Search \| Feedback Australian Senate Standing Committee for the Scrutiny of Bills - Scrutiny Digests

Better and Fairer Schools (Information Management) Bill 2024^[1]

Purpose	This bill seeks to expand the current requirements under the Student Identifiers Act 2014 to enable the extension of the system of unique student identifiers for vocational education and training and higher education students to primary and secondary school students.
Portfolio	Education
Introduced	15 August 2024
Bill status	Before the House of Representatives

Privacy^[2]

1.2 The Student Identifiers Act 2014 (the Act) sets out a scheme establishing unique student identifiers. The student identifier scheme (the scheme) commenced from 1 January 2015 for students in national vocational education and training (VET).^[3] The purpose of the scheme was described as to allow VET students to create a single identifier to consolidate their education and training transcripts.^[4] The scheme was later extended to include all higher education students who commenced higher education from 1 January 2021.^[5] At the time the Student Identifiers Bill 2014 (the bill) was introduced, this committee raised concerns in relation to the privacy of personal information as the bill permitted authorised entities to collect, use and disclose student identifiers in specified circumstances.^[6]

1.3 The current bill seeks to expand the scheme to apply student identifiers to all primary and secondary students by 2025, with an impact on over 5 million school children (which would increase each year as new students commence their education). The committee has a range of scrutiny concerns about the privacy implications of this expansion of the scheme to all primary and secondary students in Australia.

1.4 Generally, the committee notes that the explanatory materials do not sufficiently outline how the scheme will be administered. It is unclear whether schools will, for example, provide the relevant information to the Student Identifiers Registrar (the Registrar) directly or whether each state or territory education department has a role as intermediary.^[7] In relation to state and territory level protections, the explanatory memorandum notes that the specific privacy protections of the relevant jurisdictions will apply to the administration of the scheme.^[8] It is not clear what these specific privacy protections are in each jurisdiction. The explanatory memorandum should provide a greater level of detail on the state and territory privacy protections and how they apply in this context, in order to better assist the Senate and this committee in assessing the appropriateness of the measures being implemented. It is also noted that the bill provides that the Privacy Act 1988 (Cth) (Privacy Act) is not applicable to a public body of a State or a Territory in relation to the collection, use and disclosure of student identifiers, unless the Education Minister makes a declaration in writing to apply these provisions.^[9]

1.5 The committee considers that, given the scope of infringement on individual privacy arising from the scheme, there is limited justification provided in the explanatory memorandum as to the necessity and purpose of expanding student identifiers to all school children. The purpose is described in the explanatory memorandum as to allow a student identifier to:

travel [with students] from their first year of school, throughout their schooling and into vocational education and training (VET) and higher education. The purpose of the schools identifier is to help identify and share information between schools, sectors and states and territories to support better understanding of student progress, protect student privacy and improve the national evidence base.^[10]

1.6 Further potential uses of the scheme were provided by the minister in their Second Reading speech, including tracking NAPLAN results over years and supporting jurisdictions to monitor students moving between school jurisdictions so they do not disappear from the education system.^[11] None of this detail was specified in the explanatory memorandum. In light of the significant privacy implications of the bill, the committee considers that further operational detail as to the necessity of expanding the scheme should have been set out in the explanatory memorandum to assist the Senate in assessing the necessity of the scheme.

1.7 The explanatory materials also state that this bill is consistent with the right to privacy as the bill and Act provide ‘significant safeguards to protect against arbitrary interferences with privacy’.^[12] It states that the bill doesn’t displace protections provided for personal information under the Privacy Act. However, the bill does provide that the use or disclosure of personal information by the Registrar is taken to be an authorised disclosure under the Privacy Act (and therefore permitted) if for specified purposes.^[13] The committee also notes there are already a range of exemptions from the Privacy Act set out in the Act, such as, for example, if the use or disclosure is for the purpose of the Registrar performing their functions or powers. The committee is therefore concerned that, in expanding the scheme to school aged children, the bill is permitting further exemptions from the Privacy Act. Further, as set out below, the bill provides a broad authorisation to disclose personal information obtained about school-age children for ‘research purposes’. The explanatory memorandum explains:

New subsection 25(5) provides that the Registrar is authorised for the purposes of the Privacy Act 1988 to use or disclose personal information about an individual for research purposes that relate to (directly or indirectly) to school education or that requires the use of schools identifiers, school identity management information or information about school education, and meets the requirements specified by the Education Ministerial Council. Disclosure for research purposes is necessary and justified for data driven policy development and to provide insights into the effectiveness of school funding and other government measures.^[14]

1.8 The explanatory does not indicate that the personal information about children will be de-identified when shared for these purposes, which is a threshold expectation of the committee when any personal information is being disclosed for research purposes. It is unclear whether consideration was given to requiring this information to be de-identified prior to sharing as the explanatory memorandum does not touch on this issue.

1.9 It is also difficult to find any information in either the bill or its explanatory memorandum as to the exact personal information that is attached to a student identifier. The Office of the Unique Student Identifier currently appears to collect personal information about an individual to verify their identity in order to assign them a student identifier:

It collects individuals’ first, middle and last names, date of birth, place of birth, gender and contact details. This personal information is held indefinitely in the USI Registry System as a USI is held for life by an individual. The USI Office also uses one nominated form of identification to verify an individual’s identity (birth certificate, driver’s licence, Medicare card or passport). The USI Registry System does not hold the identity document numbers but records the type of document used for verification purposes.^[15]

1.10 Further, the committee understands that certain personal information will be used to verify and control access to a student’s unique identification number, such as their email and mobile phone number.^[16] It is not clear what legislative limits there are on the type of personal information that may be required in order to access a student identifier. The explanatory materials do not provide any information in relation to this. The committee requires further clarity on what data protections apply as to what personal information students will be required to provide in order to obtain a student identifier or to access their account, how long the information is retained for, and who is able to access these accounts. The current uncertainty is particularly concerning noting the level of personal information that appears likely to be linked to an identifier, including full names, dates of birth, places of birth, gender and contact details.^[17]

1.11 The Registrar also currently has the power to disclose authenticated VET transcripts to students and registered training organisations, VET-related bodies or other entities.^[18] However, the explanatory memorandum to the current bill does not explain the type of information or records that will be collected about school students and linked to their student identifier. Noting that primary and secondary school students are not provided with records and transcripts in the same manner as higher education students, it is difficult for the committee to understand the type of educational information that is intended to be captured, why it is necessary to do so, and the impacts of these amendments on the privacy of children.

1.12 Finally, there is no apparent option for students or their guardians to opt out of the scheme if they have concerns about the privacy and the use and disclosure of their information for these purposes. The committee’s view is that it is likely at least a proportion of school children and/or their parents and guardians may have concerns about the way in which their private information will be collected, stored and disclosed under the bill. However, again, there is no exploration of this concept in either the bill or the explanatory memorandum. At a minimum the committee expects that the explanatory memorandum should provide confirmation as to whether the extension of the scheme is mandatory for all school students. In particular, the committee is concerned that cohorts of vulnerable people, including domestic violence survivors and family members with relevant court orders or equivalent, may not want to have their personal information consolidated in this matter without the opportunity to consent. Further, the explanatory memorandum should have explored options for redress or avenues available for children and their parents/guardians who do not wish to submit to the scheme, and what impact this would have on the ability to access education.

1.13 As a final remark, the committee notes the overall poor quality of the explanatory materials in this instance which does not reflect the significant nature of the measures in the bill.

Privacy
Inappropriate delegation of legislative powers
Parliamentary oversight^[19]

1.15 Currently the Act provides that the Registrar is authorised to collect, use or disclose a student identifier for purposes specified in section 18 of the Act. These purposes include for research that directly or indirectly relates to education or training, or that requires the use of student identifiers or information about education or training and that meets the requirements specified by the Ministerial Council. ^[20]

1.16 This bill seeks to expand the nature of information the Registrar can disclose to ‘protected information’, which includes school and student identifier information.^[21] The bill also provides that Registrar would be enabled to use or disclose protected information if the use or disclosure is for the purpose of research:

1.17 As such, in order for protected information to be disclosed for the purposes of research it must meet non-legislative requirements specified by an executive body, namely the EMC. The statement of compatibility states that this will ensure appropriate limits are placed around this disclosure power.^[23] However, the committee has significant concerns with proposed safeguards and oversight having no parliamentary oversight. Where a bill leaves significant matters to be regulated without any legislative oversight, the committee expects, at a minimum, that the explanatory memorandum would address why it is appropriate to include the relevant matters outside of primary legislation and whether there is sufficient guidance on the face of the primary legislation to appropriately limit the matters that are not included. In this instance, the Registrar is able to use and disclose protected information, relating to the personal information of children in primary and secondary schools, if it meets requirements specified by the EMC, which is not captured by this bill, the Act or relevant delegated legislation. The explanatory memorandum does not provide a justification for this, rather it simply restates the operation of the provision.^[24]

1.18 While this information was not provided in the explanatory memorandum, the committee understands that the EMC is an intergovernmental body and the requirements for disclosure of protected information that will be determined by the EMC are not recorded in delegated legislation, but rather in an intergovernmental agreement.^[25] It remains unclear why any agreed position on applicable safeguards could not be introduced by way of mirror legislation in each relevant jurisdiction, which would provide for a measure of parliamentary oversight.

1.19 Effectively, the EMC would be able to determine the operation of proposed subsection 18(5) of the bill, rather than being bound by circumstances detailed in the bill. The committee considers this likely to be an inappropriate delegation of legislative power. The requirements specified by the EMC would also not be subject to the ordinary parliamentary processes and scrutiny that a bill would be subject to.

1.20 The committee’s concerns are heightened in this instance as the EMC may also include a body prescribed by the regulations, if there is no body of ministers responsible for school and higher education. It is unclear what sort of body may be prescribed for this purpose and the committee finds the possibility that a body comprised of non-elected representatives may be able to determine the requirements that must be met before protected information may be used or disclosed particularly alarming.

1.21 The other circumstance that must be satisfied in order for the Registrar to use or disclose protected information is if the use or disclosure is for the purpose of research that directly or indirectly relates to school education. The general privacy impacts of this specific measure are set out above. Neither the bill nor the explanatory memorandum provides any guidance as to how the term ‘school education’ should be understood. The committee considers some examples of what purposes may be understood as being directly or indirectly related to school education could be provided in order to provide transparency and certainty as to when protected information may be used or disclosed.

1.22 In light of the above, the committee requests the minister’s advice as to:

Privacy
Significant matters in delegated legislation^[26]

1.23 Further to the above matters, this bill also seeks to amend the Act to provide that an ‘entity prescribed by the regulations’ is authorised to collect, use or disclose protected information of an individual if the collection, use or disclosure is for a purpose or circumstances relating to school education and prescribed by the regulations. As set out above, the collection, use or disclosure of protected personal information raises significant privacy concerns and the entity that is authorised to do this is a significant issue over which Parliament should exercise control.

1.24 Where a bill includes significant matters in delegated legislation, the committee expects the explanatory memorandum to the bill to address why it is appropriate to include the relevant matters in delegated legislation and whether there is sufficient guidance on the face of the primary legislation to appropriately limit the matters that are being left to delegated legislation. A legislative instrument made by the executive is not subject to the full range of parliamentary scrutiny inherent in bringing forward proposed legislation in the form of a bill.

1.25 In this instance, the explanatory memorandum only restates what the provision does and does not explain who such a likely entity will be, why it is necessary to have this power or provide any justification for the inclusion of a significant matter in the regulations.^[27]

1.26 It is not clear to the committee why it is necessary and appropriate for any entity, other than the Registrar, to be able to collect, use or disclose protected information, and why it is necessary and appropriate for these entities to be prescribed by delegated legislation. The committee understands that there may be a large volume of information to process as part of providing school or student identifiers, but queries why it is not possible for the Registrar’s powers to be delegated in primary legislation to specified categories of persons who may be able to collect, use and disclose protected information for specified purposes, as this would ensure an appropriate level of parliamentary oversight.

1.27 Further, it is not clear to the committee why it is necessary and appropriate for the circumstances when collection, use or disclosure is authorised to be prescribed by regulations. Given the potential significant amount of personal information of children that falls within the category of protected information that is collected as part of this scheme, the committee considers that there should be appropriate parliamentary oversight of when this information may be collected, used and disclosed. At a minimum, the committee considers that some guidance as to what circumstances the regulations may prescribe for the collection, use and disclosure of protected information should be provided either on the face of the bill or the explanatory memorandum.

1.28 In light of the above, the committee requests the minister’s advice as to:

Exemption from disallowance
Exemption from sunsetting^[28]

1.29 The bill seeks to provide that provisions of the Act^[29] relating to the protection of records of student identifiers, the collection, use and disclosure of student identifiers and the interactions with the Privacy Act are not applicable to a public body of a state or a territory unless the Education Minister makes a declaration in writing to apply these provisions.^[30] The Education Minister may do so on the request of the responsible State or Territory minister.^[31] This declaration or a declaration revoking the application of these provisions would be a legislative instrument that is exempt from disallowance and sunsetting.^[32]

1.30 In relation to the exemptions from disallowance and sunsetting, the explanatory memorandum provides the following justification:

A declaration made under the new subsection 55A(4) is not subject to disallowance or sunsetting. A declaration made under section 55A will formalise an agreement between the Commonwealth and States and Territories. Enabling the Minister to make non-disallowable instruments in support of the schools USI regulatory framework strikes a balance between the principles of accountability and the practical imperative of maintaining the integrity and facilitative capabilities of national schemes requiring the co-operation of multiple governments. Without these exemptions, disallowance by the Commonwealth Parliament or through sunsetting could be in conflict with multilateral agreements reached by states and territories. This would, in turn, undermine confidence in the agreed intergovernmental arrangements and may discourage ongoing state and territory cooperative support. Disallowance or sunsetting of a declaration would undermine this agreement and could cause significant uncertainty as to the application of sections 16, 17 and 24.^[33]

1.31 While acknowledging the legislative basis for the exemption as outlined in the explanatory memorandum, the committee considers that disallowance is the primary means by which the Parliament exercises control over the legislative power that it has delegated to the Executive. Exempting an instrument from disallowance therefore has significant implications for parliamentary scrutiny. In June 2021, the Senate acknowledged these implications and resolved that delegated legislation should be subject to disallowance unless exceptional circumstances can be shown which would justify an exemption.^[34] In addition, the Senate resolved that any claim that circumstances justify such an exemption will be subject to rigorous scrutiny, with the expectation that the claim will only be justified in rare cases.

1.32 The Senate’s resolution is consistent with concerns about the inappropriate exemption of delegated legislation from disallowance expressed by this committee in its recent review of the Biosecurity Act 2015^[35], and by the Senate Standing Committee for the Scrutiny of Delegated Legislation in its inquiry into the exemption of delegated legislation from parliamentary oversight.^[36]

1.33 Further, sunsetting plays a key role in ensuring legislative instruments are regularly reviewed to determine whether they are still fit for purpose. Once they have sunsetted, instruments must be remade and tabled in the Parliament, which promotes parliamentary oversight and scrutiny through debate and discussion.

1.34 The committee does not consider the fact that an instrument is made to facilitate the operation of an intergovernmental scheme is reason, in itself, for exempting an instrument from the usual disallowance or sunsetting processes. Moreover, the committee does not consider the fact that a number of executive governments have reached agreement in relation to a particular matter precludes the need for parliamentary oversight of the laws resulting from such agreement. It is not apparent here how subjecting an instrument made this provision to the ordinary parliamentary oversight processes would cause uncertainty, undermine confidence or be in conflict with multilateral agreements reached by states and territories.

1.35 The committee draws its scrutiny concerns to the attention of senators and leaves to the Senate as a whole the appropriateness of instruments made under proposed subsections 55A(1) and 55A(3) of the bill being exempt from sunsetting and disallowance.

1.36 The committee also draws this matter to the attention of the Senate Standing Committee for the Scrutiny of Delegated Legislation.

^[2] The concerns relate to the bill as a whole. The committee draws senators’ attention to the bill pursuant to Senate standing order 24(1)(a)(i).

^[6] See Senate Standing Committee for the Scrutiny of Bills, Ninth Report of 2014 (16 July 2014) pp. 368–372.

^[7] Note Schedule 1, item 25, proposed subsection 13A(1) provides that the approved authority for a school may apply for a schools identifier to be assigned to a student as well as a prescribed public body of the relevant State or Territory (along with an entity prescribed by the regulations). The explanatory memorandum provides no detail about who these bodies might be (see p. 15).

^[11] The Hon Mr Clare MP, Minister for Education, House of Representatives Hansard, Thursday 15 August 2024, p. 10.

^[19] Schedule 1, item 46, proposed subsection 18(5). The committee draws senators’ attention to this provision pursuant to Senate standing orders 24(1)(a)(i), (iv) and (v).

^[21] Schedule 1, item 4, proposed subsection 4(1), definition of ‘protected information’.

^[22] Schedule 1, item 4, proposed subsection 4(1) , definition of ‘Education Ministerial Council’.

^[25] Council of Australian Governments, National School Reform Agreement, September 2021, p. 9.

^[26] Schedule 1, item 47, proposed section 18D. The committee draws senators’ attention to this provision pursuant to Senate standing orders 24(1)(a)(i) and (iv).

^[28] Schedule 1, item 78, proposed section 55A. The committee draws senators’ attention to this provision pursuant to Senate standing order 24(1)(a)(v).

^[32] Schedule 1, item 78, proposed subsection 55A(4). It would be exempt from disallowance and sunsetting by force of subsections 44(1) and 54(1) of the Legislation Act 2003.

Australian Senate Standing Committee for the Scrutiny of Bills - Scrutiny Digests