{"id":"F2024L00463","name":"Guidelines issued under Section 95(1) of the Privacy Act 1988 (Cth)","slug":"guidelines-issued-under-section-95-1-of-the-privacy-act-1988-cth","collection":"legislative_instrument","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":null,"makingDate":null,"administeringDepartment":null,"currentVersion":{"id":105201,"registerId":"commonwealth-F2024L00463-current","compilationNumber":null,"startDate":"2026-04-03","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"1","sectionType":"section","heading":"Guidelines issued under Section 95(1) of the Privacy Act 1988 (Cth)","content":"---\nmeta-content-style-type: text/css\nmeta-content-type: application/xhtml+xml; charset=utf-8\n---\n\n![NHMRC logo in header](image.001.jpeg)\n\n \n\nCOMMONWEALTH OF AUSTRALIA\n\nGuidelines issued under Section 95(1) of the Privacy Act 1988 (Cth)\n\n \n\nI, PRUE ALISON TORRANCE, Chief Executive Officer (A/g) of the National Health and Medical Research Council, with responsibility for issuing guidelines under the Privacy Act 1988 (Cth) for the protection of privacy by agencies in the conduct of medical research, under section 95(1) of that Act, HEREBY;\n\n- revoke the Guidelines under Section 95(1) of the Privacy Act 1988 (Cth), 2014\n\n\nand\n\n- issue the Guidelines under Section 95(1) of the Privacy Act 1988 (Cth), 2014 (updated 2024)\n\n\n \n\nThese guidelines take effect on the date of this instrument.  \n\n \n\nDated this 21st day of March 2024.\n\n \n\n[signed]\n\n \n\nPrue Torrance  Chief Executive Officer (A/g)\n","sortOrder":0}],"analysis":{"flash_summary":{"complexity_score":2,"scope_assessment":{"changed":true,"description":"This instrument explicitly revokes the earlier Guidelines under Section 95(1) of the Privacy Act 1988 (Cth), 2014 and issues a new document described as the Guidelines (2014, updated 2024), so the authoritative guidance document for agencies has changed as of 21 March 2024 (instrument text). The instrument does not set out the substantive differences between the old and new texts, so the precise nature and extent of the scope change must be determined by comparing the revoked 2014 Guidelines and the issued updated 2024 Guidelines themselves."},"complexity_factors":["Limited substantive content in the instrument — it performs a revocation and reissue without reproducing the updated Guidelines.","Reference to external statutory power (section 95(1) of the Privacy Act 1988 (Cth)) which provides legal authority but no detail in this instrument.","Immediate effective date (21 March 2024) with no transitional arrangements specified.","Centralised administrative discretion (NHMRC Chief Executive Officer) exercised, requiring affected agencies to interpret and implement the updated Guidelines themselves.","Potential need for agencies to compare prior and updated Guidelines to determine practical changes — the instrument does not provide those comparisons."],"plain_english_summary":"What this instrument does (mechanically)\n\n- The Chief Executive Officer (Acting) of the National Health and Medical Research Council (NHMRC) has used a power under section 95(1) of the Privacy Act 1988 (Cth) to replace the NHMRC’s existing Guidelines under that section (the 2014 Guidelines) with a new, updated document described as the Guidelines under Section 95(1) of the Privacy Act 1988 (Cth), 2014 (updated 2024).\n- The instrument expressly revokes the previous Guidelines under Section 95(1) of the Privacy Act 1988 (Cth), 2014, and issues the updated Guidelines in their place.\n- The new Guidelines take effect on the date of the instrument: 21 March 2024 (the instrument’s execution date).\n\nWho is affected\n\n- Agencies that conduct medical research and that are the intended subjects of Guidelines issued under s95(1) of the Privacy Act. The instrument identifies the target as agencies \"in the conduct of medical research\" (instrument text).\n- Individual researchers, administrators and possibly third parties whose handling of personal information is governed by those agencies will be affected to the extent the new Guidelines change practical requirements or expectations.\n\nWhy it matters (official purpose and practical consequences)\n\n- Officially, the instrument is issued “for the protection of privacy by agencies in the conduct of medical research” (instrument text). Mechanically, replacing the 2014 Guidelines with an updated 2024 version means the applicable guidance that agencies should follow has changed as of 21 March 2024.\n\nPractical effects, incentives and costs\n\n- Who decides: the NHMRC Chief Executive Officer (A/g) exercised the statutory authority to revoke and reissue the Guidelines under s95(1) (instrument text). The instrument centralises the decision to update and set the effective date in that office.\n- Who pays / direct financial impact: the instrument itself does not impose new monetary charges or specify funding. Any compliance costs (staff time, training, policy updates, system changes) will fall on the agencies required to follow the updated Guidelines.\n- Behavioural changes: agencies must review and, if necessary, change their policies and operational practices to align with the updated Guidelines once they take effect. The instrument provides the legal change (revocation and reissue) but does not, in itself, set operational detail — that detail will be in the updated Guidelines text.\n- Compliance burden and implementation risk: because the instrument revokes the prior Guidelines and replaces them immediately, agencies may face transitional work to compare the old and new texts and put changes into effect. The instrument does not state any transitional arrangements, timelines, or enforcement mechanisms, so agencies must consult the updated Guidelines (not contained in this instrument) to assess specific obligations.\n- Bureaucratic discretion: the power exercised is that vested in the NHMRC CEO under s95(1) (instrument text). The instrument shows that the NHMRC holds discretion to issue and revoke Guidelines under that statutory head of power.\n\nWhat is and is not contained in the instrument\n\n- Contained: the formal revocation of the 2014 Guidelines and the formal issuance of the updated 2024 Guidelines, the identity of the issuer, and the effective date (21 March 2024).\n- Not contained: the substantive content of the updated Guidelines, any transitional or enforcement provisions, and any specific compliance duties or penalties. To understand operational requirements and legal effect beyond the change in which document is authoritative, readers must consult the updated Guidelines themselves and the Privacy Act.\n\nNet summary statement\n\n- This instrument replaces the NHMRC’s 2014 privacy Guidelines for medical research with an updated 2024 version and makes that replacement effective immediately (21 March 2024). The issuer is the NHMRC Chief Executive Officer (A/g) acting under s95(1) of the Privacy Act 1988 (Cth). Agencies that conduct medical research are the parties that must read and follow the new Guidelines; any compliance costs stem from aligning internal processes to the updated guidance. The instrument sets the legal change but does not itself contain the operational prescriptions or transitional rules — those will be found in the updated Guidelines."},"kimi_summary":{"content_quality":"rejected","complexity_score":2,"rejection_reason":"This is a formal instrument of making/revocation (a 'notice of issue') rather than the substantive guidelines themselves. It contains only procedural information about the replacement of the 2014 guidelines with the 2024 updated version, plus administrative details (date, signature, logo). The actual content of the Guidelines under Section 95(1) — the rules, requirements, and substantive provisions that agencies must follow — is not included in this text. Analysis of this fragment would not provide meaningful insight into the regulatory framework for privacy in medical research.","scope_assessment":{"changed":false,"description":"This is purely an instrument of revocation and re-issue. It does not alter the scope of the underlying guidelines or the statutory framework. The scope remains limited to privacy protection in medical research conducted by agencies under the Privacy Act 1988."},"complexity_factors":["Very short instrument (approximately 200 words)","No defined terms within the instrument itself","No cross-references to other legislative provisions beyond the enabling section (s 95(1) Privacy Act)","Simple binary structure: revoke old guidelines, issue new guidelines","No conditional logic or exceptions","Essentially a formal 'notice of making' document rather than substantive regulatory content"],"plain_english_summary":"These are official rules issued by the National Health and Medical Research Council (NHMRC) that tell Australian government agencies how to protect people's privacy when conducting medical research. They replace the 2014 version of the same guidelines with an updated 2024 version. The guidelines operate under the Privacy Act 1988, which is Australia's main privacy law. Essentially, they set the ground rules for how government bodies can use and handle personal health information for research purposes while keeping that information safe and respecting people's privacy rights."}},"importantCases":[],"_links":{"self":"/api/acts/guidelines-issued-under-section-95-1-of-the-privacy-act-1988-cth","history":"/api/acts/guidelines-issued-under-section-95-1-of-the-privacy-act-1988-cth/history","analysis":"/api/acts/guidelines-issued-under-section-95-1-of-the-privacy-act-1988-cth/analysis","conflicts":"/api/acts/guidelines-issued-under-section-95-1-of-the-privacy-act-1988-cth/conflicts","importantCases":"/api/acts/guidelines-issued-under-section-95-1-of-the-privacy-act-1988-cth/important-cases","documents":"/api/acts/guidelines-issued-under-section-95-1-of-the-privacy-act-1988-cth/documents"}}