Privacy Amendment (Energy and Water Utilities) Regulations 2017 [F2017L00170]-Concluded matters [2017] AUSStaCSDLM 169 (5 October 2017)

---

Instrument	Privacy Amendment (Energy and Water Utilities) Regulations 2017 [F2017L00170]
Purpose	Amends the Privacy Regulation 2013 to extend permission for energy and water utilities in the Australian Capital Territory and the Northern Territory to disclose credit information
Authorising legislation	Privacy Act 1988
Department	Attorney-General's
Disallowance	15 sitting days after tabling (tabled Senate 20 March 2017) Notice of motion to disallow must be given by 19 June 2017
Scrutiny principle	Standing Order 23(3)(a)
Previously reported in	Delegated legislation monitor 4 of 2017

The committee previously commented as follows:

Background

Privacy Amendment (Australian Government Solicitor and Energy and Water Utilities) Regulation 2016 [F2016L01913] (the 2016 regulations) intended to amend the Privacy Regulation 2013 (the privacy regulation) to extend permission for energy and water utilities in the Australian Capital Territory (ACT) and the Northern Territory (NT) to disclose credit information until 1 January 2018. This permission would enable those utilities to continue to access the credit reporting system. However, as a result of a drafting error in the commencement provision in the 2016 regulations, the relevant provision in the privacy regulation was repealed on 1 January 2017.

Drafting

Privacy Amendment (Energy and Water Utilities) Regulations 2017 [F2017L00170] (the 2017 regulations) amend the privacy regulation to permit energy and water utilities in the ACT and the NT to disclose credit information until 1 January 2018.

However, the committee notes that as the 2017 regulations commenced on 29 February 2017 it appears that there was no law in operation to support any disclosures of credit information by utilities in the ACT and the NT during the period between the repeal of the 2016 regulations and the commencement of the 2017 regulations.

The committee is concerned about the effect, if any, on the legality of any disclosures that may have occurred during the period between the repeal of the 2016 regulations on 1 January 2017 and the commencement of the 2017 regulations on 29 February 2017. The ES does not provide any information about the effect,

if any, of the drafting error in the commencement provision of the 2016 regulations.

The committee requests the advice of the minister in relation to the above.

Minister's response

The Attorney-General advised:

Consultation with the ACT and Northern Territory governments indicates that credit information was disclosed by a small number of utilities that were not members of a recognised EDR scheme or prescribed in regulations between 1 January and 1 March 2017. It appears likely that these disclosures would not have been in compliance with subparagraph 21D(2)(a)(i) of the Privacy Act 1988 (the Privacy Act), which prohibits the disclosure of credit information by credit providers unless they are a member of an EDR scheme recognised by the Australian Information Commissioner or prescribed in regulations.
Notwithstanding the fact that these utilities are not members of a recognised EDR scheme, I am advised that customers of the utilities have dispute resolution options. The utilities have internal complaints processes in place that customers can access. In addition, customers are able to complain to the Australian lnformation Commissioner if they have any concerns over the collection, use, disclosure and storage of their credit information.
Given that our consultation suggests some disclosures of credit information by energy and water utilities may not have complied with subparagraph 21D(2)(a)(i) of the Privacy Act between 1 January and
1 March 2017, my Department will prepare an amendment to the Privacy Regulation 2013 with appropriate retrospective application to ensure
that disclosures of credit information between 1 January 2017 and
1 March 2017 by energy and water utilities in the ACT and the Northern Territory are permitted for the purposes of the Privacy Act.
It is my hope that this intention to amend the Privacy Regulation 2013 in this way will resolve the Committee's scrutiny issues and that the 2017 Regulation will not be subject to a motion of disallowance. Should such a motion be given and be passed, or be taken to be passed, there would be a significant impact on the progress towards simpler complaints processes in the ACT and the Northern Territory as disallowance would mean that, amongst other things, the EDR exemption for ACT and Northern Territory utilities could not be made for six months after the day of disallowance. Such an impact on progress towards simpler complaints processes would be a poor outcome for the utilities and their customers.

Committee's response

The committee thanks the Attorney-General for his response and has concluded its examination of the instrument.

The committee notes the Attorney-General's undertaking to register an amendment to the Privacy Regulation 2013 with appropriate retrospective application to ensure that disclosures of credit information between 1 January 2017 and 1 March 2017 by energy and water utilities in the ACT and the NT are permitted for the purposes of the Privacy Act 1988.