Options for reform

3.29 The ALRC has considered various options to achieve national consistency in the regulation of personal information handling, including the amendment of the Privacy Act to establish a single national privacy law, and the establishment of an intergovernmental cooperative scheme. These options are outlined below.

National legislation

3.30 As noted above, the Commonwealth has the power under the Australian Constitution to amend the Privacy Act so that it applies to state and territory public sectors, as well as organisations and the federal public sector.

3.31 In many respects, the preferable option would be to amend the Privacy Act to regulate all organisations and public sectors. The advantages of a single national law include guaranteed uniformity across the jurisdictions, and fewer regulatory impediments to the operation of national programs and organisations.

3.32 Another option is to extend the operation of the Privacy Act to cover certain elements of the state and territory public sectors and not others. As noted above, stakeholders have identified that inconsistent health privacy laws are a major cause of compliance burden and cost. One option would be to amend the Privacy Act so that it regulates state and territory statutory corporations and other bodies with responsibility for health services and research, such as public hospitals and universities.

3.33 A third option is to amend the Privacy Act to provide that the Act is intended to apply to the exclusion of state and territory laws that deal with the handling of personal information by organisations. A large number of submissions to the Inquiry focused on inconsistency in the regulation of personal information handling in the private sector. Under this option, state and territory legislation would continue to regulate the handling of personal information in state and territory public sectors.

Roll back provisions

3.34 National legislation could set out minimum standards for the protection of personal information in state and territory public sectors, but allow for a ‘roll back’ of those provisions once a state or territory enacts laws that conform to specified federal minimum standards.^[58]

3.35 An example of this kind of scheme is s 26(2)(b) of the Personal Information Protection and Electronic Documents Act 2000 (Canada) (PIPED Act). That section provides that the Governor-in-Council may, by order, exempt an organisation, activity or class of organisations or activities from the application of the Act if satisfied that legislation of a province that is ‘substantially similar’ to the PIPED Act applies. Few stakeholders supported this option. The ALRC did not, therefore, propose that a ‘roll back’ provision should operate generally in relation to state and territory agencies.

3.36 Section 6F of the Privacy Act provides for an extension of the Act to cover the handling of personal information by state and territory instrumentalities at the initiative of the states and territories. The Office of the Victorian Privacy Commissioner (OVPC) submitted that s 6F of the Privacy Act should be retained in its current form because it maintains control by, and independence of, the states.^[59] The ALRC agrees that s 6F is a useful mechanism to bring state and territory bodies under the operation of the Privacy Act and should be retained in the Act.

A cooperative scheme

3.37 Another option is to have the Privacy Act regulate the private sector and federal public sector, and establish a cooperative scheme to regulate state and territory public sectors. A cooperative scheme has been defined as a scheme in which each participating jurisdiction promulgates legislation to facilitate the application of a standard set of legislative provisions to regulate a matter of common concern.^[60]

3.38 In the Discussion Paper, Review of Australian Privacy Law (DP 72), the ALRC considered four types of intergovernmental cooperative schemes: referral of power to the Commonwealth; mirror legislation; complementary law regimes; and a combined scheme.^[61] These schemes may involve not only mirror or complementary legislation, but the cooperative use of Australian Government or state and territory officials.^[62]

Referral of power to the Commonwealth

3.39 Section 51(xxxvii) of the Australian Constitution gives the Commonwealth Parliament power to make laws with respect to:

matters referred to the Parliament of the Commonwealth by the Parliament or Parliaments of any State or States, but so that the law shall extend only to States by whose Parliaments the matter is referred, or which afterwards adopt the law.

3.40 The states have referred a number of matters to the Commonwealth, including corporations and counter-terrorism.^[63] While a referral of power by the states would ensure that federal privacy legislation was comprehensive in its coverage and less vulnerable to constitutional challenge, a referral of power is unnecessary to enact national privacy laws. As noted above, the Commonwealth has the power under the Australian Constitution to amend the Privacy Act so that it applies to the private sector and all public sectors in Australia.^[64]

3.41 There was very little support from stakeholders for a referral of power. The New South Wales Law Society submitted that state governments should consider referring powers to enable the Australian Parliament to enact a national privacy code.^[65] Other stakeholders emphasised, however, the need for states to be able to provide enhanced protection; the need for privacy laws to interact with state-based freedom of information, archives and human rights laws;^[66] and the importance of having a local regulator to handle complaints, and provide advice and training programs.^[67]

Mirror legislation

3.42 Mirror legislation usually refers to a system where one jurisdiction enacts a law that is then enacted in similar terms by other jurisdictions.^[68] Mirror legislation can result in inconsistency, however, both at the time the legislation is enacted and as laws are amended.^[69] One option for dealing with this is to have a central body to maintain uniformity.^[70]

3.43 An example of mirror legislation is state and territory fair trading legislation based on provisions in the Trade Practices Act 1974 (Cth). Each Australian state and territory has passed legislation that largely mirrors the consumer protection provisions of Divisions 1 and 1A of Part V of the Trade Practices Act.

3.44 A number of stakeholders supported mirror legislation.^[71] For example, the Queensland Government submitted that a consistent set of privacy principles binding both public and private sectors should be adopted by each jurisdiction by way of mirror legislation. Each jurisdiction would then be responsible for administering the relevant legislation, for establishing and maintaining complaint resolution mechanisms, undertaking advocacy, education and awareness activities and monitoring the operation of the scheme.^[72]

Complementary law scheme

3.45 A complementary applied law scheme involves one jurisdiction (which need not be the Commonwealth) enacting a law on a topic, which is then applied by other jurisdictions.^[73] Where the Australian Parliament enacts a law that applies to specified matters within Commonwealth constitutional power, the law will apply in the states as a Commonwealth law to the extent possible. State legislation will apply to the extent that its application is consistent with the application of the Commonwealth law.^[74]

In the perfect applied law regime where a law is promulgated by one jurisdiction and is picked up by other jurisdictions as in force from time to time, there are effective limits (which may be non-legislative) on modification and there is central administration and enforcement of that law, which can be expected to provide a substantial degree of uniformity.^[75]

3.46 Uniformity can be reduced, however, if an applied law regime does not involve centralised control over amendments to the legislation. Further, any capacity for the applying state to have control over the text of the legislation can also lead to inconsistency.^[76]

3.47 An example of a complementary applied law scheme is the agricultural and veterinary chemicals legislation under the Agricultural and Veterinary Chemicals Code Act 1994 (Cth). The Australian Parliament enacted the Agricultural and Veterinary Chemicals Code to apply to ‘participating territories’ and with provisions to enable the states to apply the text of the Code as a law of the state. All states and territories have adopted the Code in relevant legislation.

3.48 The Agricultural and Veterinary Chemicals Code Act confers regulatory functions on the National Registration Authority for Agricultural and Veterinary Chemicals, establishing it as the national authority responsible for the evaluation, registration and review of agricultural and veterinary chemicals and their control up to their point of sale. The states and territories retain responsibility for control-of-use activities, such as licensing of pest control, operators and aerial spraying. Some states have also enacted legislation relating to the enforcement of the Code. For example, the Agricultural and Veterinary Chemicals (Control of Use) Act 1995 (Tas) establishes the Agricultural, Silvicultural and Veterinary Chemical Council. The Competition Code under the Trade Practices Act 1974 (Cth) is another example of a complementary applied law scheme.^[77]

3.49 A complementary (non-applied) law scheme has been adopted in relation to the classification of films, publications and computer games. Films, publications and computer games are classified under the Classification (Publications, Films and Computer Games) Act 1995 (Cth) while the controls and penalties are imposed under state and territory legislation.^[78]

3.50 In an information privacy context, the governments of Victoria and South Australia supported a complementary cooperative scheme, where the Commonwealth has responsibility for the private sector and the Australian Government, and the states and territories have responsibility for state and territory public sectors.^[79] Other stakeholders were opposed to a complementary non-applied scheme, arguing that this model enables a single jurisdiction to prevent changes to the legislation, notwithstanding overwhelming support for change from the public and other jurisdictions’ governments.^[80]

Combined scheme

3.51 Another model is a scheme that combines mirror legislation and applied law approaches. In this model, some states could enact their own law mirroring federal laws that regulate personal information and other states could apply the Commonwealth law as a law of the state. Examples of this approach include the therapeutic goods and gene technology regulatory schemes.

3.52 The Gene Technology Act 2000 (Cth) extends to matters within the Commonwealth’s power, leaving the states with the option of either applying the federal Act or enacting their own legislation. Both options have been adopted by different states. For example, NSW has opted for the applied law model while Victoria has adopted mirror legislation.^[81] Section 26 of the Gene Technology Act 2000 (Cth) establishes the independent position of the Gene Technology Regulator. The Regulator oversees the accreditation of research facilities and licenses experimental and commercial dealings.^[82]