{"id":"C2016A00065","name":"National Cancer Screening Register Act 2016","slug":"national-cancer-screening-register-act-2016","collection":"act","jurisdiction":"commonwealth","status":"in_force","isInForce":true,"actNumber":"65 of 2016","makingDate":null,"administeringDepartment":null,"currentVersion":{"id":54993,"registerId":"commonwealth-C2016A00065-current","compilationNumber":null,"startDate":"2026-04-02","status":"InForce","reasons":null,"registeredAt":null},"sections":[{"sectionNumber":"Part 1","sectionType":"part","heading":"Preliminary","content":"## Part 1—Preliminary","sortOrder":0},{"sectionNumber":"1","sectionType":"section","heading":"Short title","content":"#### 1 Short title\n\n This Act is the National Cancer Screening Register Act 2016.","sortOrder":1},{"sectionNumber":"2","sectionType":"section","heading":"Commencement","content":"#### 2 Commencement\n\n (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n```html\n

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1. Sections 1 to 12 and anything in this Act not elsewhere covered by this table

The day after this Act receives the Royal Assent.

21 October 2016

2. Section 13

1 May 2017.

1 May 2017

3. Sections 14 to 28

At the same time as the provisions covered by table item 1.

21 October 2016

\n```\n\n> Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.\n\n (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.","sortOrder":2},{"sectionNumber":"3","sectionType":"section","heading":"Simplified outline of this Act","content":"#### 3 Simplified outline of this Act\n\nThis Act establishes a register of information about screening associated with certain types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nThere are protections for sensitive information.","sortOrder":3},{"sectionNumber":"4","sectionType":"section","heading":"Definitions","content":"#### 4 Definitions\n\n In this Act:\n\n> approved form means a form approved under subsection 25(1).\n\n> child protection officer means an officer or employee of a State or Territory, or of a State or Territory authority, who has functions, powers or duties in relation to the care, protection or welfare of children.\n\n> civil penalty provision has the same meaning as in the Regulatory Powers Act.\n\n> claims information means information about:\n\n (a) claims for medicare benefit under Part II of the Health Insurance Act 1973; or\n (b) treatment, other than information that relates to compensation or benefits, provided under any of the following Acts:\n (i) the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006;\n (ii) the Military Rehabilitation and Compensation Act 2004;\n (iii) the Safety, Rehabilitation and Compensation Act 1988;\n (iiia) the Treatment Benefits (Special Access) Act 2019;\n (iv) the Veterans’ Entitlements Act 1986.\n\n> commercial‑in‑confidence has the meaning given by section 5.\n\n> contracted service provider has the meaning given by subsection 22A(10).\n\n> designated cancer means one of the following types of cancer:\n\n (a) bowel cancer;\n (b) cervical cancer;\n (c) lung cancer.\n\n> enforcement body has the same meaning as in the Privacy Act 1988.\n\n> entity means:\n\n (a) a person; or\n (b) a partnership; or\n (c) any other unincorporated association or body; or\n (d) a trust; or\n (e) a part of another entity (under a previous application of this definition).\n\n> healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.\n\n> healthcare provider means:\n\n (a) an individual healthcare provider; or\n (b) a healthcare provider organisation.\n\n> healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).\n\n> Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be part of an entity.\n\n> individual healthcare provider means an individual who:\n\n (a) has provided, provides, or is to provide, healthcare; or\n (b) is registered by a registration authority as a member of a particular health profession.\n\n> key information for an individual means the following:\n\n (a) the individual’s name, address, contact details, date of birth and gender;\n (b) the individual’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010) if any;\n (c) the individual’s medicare number (within the meaning of Part VII of the National Health Act 1953) if any;\n (d) the number allocated to the individual by the Veterans’ Affairs Department if any;\n (e) if applicable, the individual’s date of death;\n (f) if the register includes information relating to the individual in connection with screening associated with cervical cancer:\n (i) the individual’s sex; and\n (ii) the individual’s Human Papillomavirus vaccination status and number of doses of the vaccine administered to the individual;\n (g) the individual’s Indigenous status;\n (h) the individual’s country of origin or cultural identity;\n (i) the individual’s preferred language and whether an interpreter is required to facilitate communication with the individual;\n (j) the name and contact details of a personal representative of the individual if any;\n (k) if applicable, information on assistance required by the individual for the purposes of this Act because of a medical condition or disability;\n (l) any other information of a kind relevant to the purposes of the register and prescribed by the rules for the purposes of this definition.\n\n> nominated healthcare provider of an individual, for screening associated with a designated cancer, means the healthcare provider the individual requested be recorded for screening associated with the designated cancer in a request in effect under section 14.\n\n> parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975.\n\n> participating State or Territory means a State or Territory that has agreed with the Commonwealth to participate in the register.\n\n> personal information has the same meaning as in the Privacy Act 1988.\n\n> personal representative, of an individual, means:\n\n (a) a parent or guardian of the individual, if the individual is incapable of managing his or her health affairs; or\n (b) a trustee of an estate of the individual, if the individual is under a legal disability; or\n (c) a person who holds an enduring power of attorney granted by the individual; or\n (d) a person nominated by the individual for the purpose of managing the individual’s affairs in relation to screening associated with a designated cancer.\n\n> professional disciplinary authority means:\n\n (a) a registration authority; or\n (b) the Health Care Complaints Commission established by the Health Care Complaints Act 1993 (NSW); or\n (c) the Health Ombudsman appointed under the Health Ombudsman Act 2013 (Qld); or\n (d) any other authority that is responsible for investigating complaints about the professional conduct of individual healthcare providers.\n\n> protected information means personal information or information that is commercial‑in‑confidence, to the extent that the information is:\n\n (a) included in the register or otherwise obtained under, or in accordance with, this Act; or\n (b) derived from a record of information that was included in the register or was otherwise obtained under, or in accordance with, this Act; or\n (c) derived from a disclosure or use of information that was included in the register or was otherwise obtained under, or in accordance with, this Act.\n\n> purposes of the register means the purposes set out in section 12.\n\n> register means the National Cancer Screening Register established under section 9.\n\n> registration authority means an entity that is responsible under a law for registering members of a particular health profession.\n\n> Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.\n\n> rules means the rules made under section 28.\n\n> screening means a process in which an individual undergoes testing or procedures in order to determine whether the individual has:\n\n (a) a designated cancer or a precursor to a designated cancer; or\n (b) any indicator, including genetic markers or cell abnormalities, that may lead to a designated cancer.\n\n> screening test means a test or procedure as part of screening.\n\n> Secretary means the Secretary of the Department.\n\n> State or Territory authority has the same meaning as in the Privacy Act 1988.\n\n> Veterans’ Affairs Department means the Department administered by the Minister administering the Veterans’ Entitlements Act 1986.","sortOrder":4},{"sectionNumber":"5","sectionType":"section","heading":"Meaning of commercial‑in‑confidence","content":"#### 5 Meaning of commercial‑in‑confidence\n\n Information is commercial‑in‑confidence if a person demonstrates to the Minister that:\n (a) release of the information would cause competitive detriment to the person; and\n (b) the information is not in the public domain; and\n (c) the information is not required to be disclosed under a law of the Commonwealth, or of a State or Territory; and\n (d) the information is not readily discoverable.","sortOrder":5},{"sectionNumber":"6","sectionType":"section","heading":"Act binds the Crown","content":"#### 6 Act binds the Crown\n\n This Act binds the Crown in each of its capacities. However, it does not make the Crown liable to be prosecuted for an offence.\n\n> Note: See subsection 24(5) in relation to civil penalties.","sortOrder":6},{"sectionNumber":"7","sectionType":"section","heading":"Act extends to external Territories","content":"#### 7 Act extends to external Territories\n\n This Act extends to every external Territory.","sortOrder":7},{"sectionNumber":"Part 2","sectionType":"part","heading":"Register","content":"An Act to establish and provide for a cancer screening register, and for related purposes\n\n## Part 1—Preliminary\n\n#### 1 Short title\n\n This Act is the National Cancer Screening Register Act 2016.\n\n#### 2 Commencement\n\n (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n```html\n

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1. Sections 1 to 12 and anything in this Act not elsewhere covered by this table

The day after this Act receives the Royal Assent.

21 October 2016

2. Section 13

1 May 2017.

1 May 2017

3. Sections 14 to 28

At the same time as the provisions covered by table item 1.

21 October 2016

\n```\n\n> Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.\n\n (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.\n\n#### 3 Simplified outline of this Act\n\nThis Act establishes a register of information about screening associated with certain types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nThere are protections for sensitive information.\n\n#### 4 Definitions\n\n In this Act:\n\n> approved form means a form approved under subsection 25(1).\n\n> child protection officer means an officer or employee of a State or Territory, or of a State or Territory authority, who has functions, powers or duties in relation to the care, protection or welfare of children.\n\n> civil penalty provision has the same meaning as in the Regulatory Powers Act.\n\n> claims information means information about:\n\n (a) claims for medicare benefit under Part II of the Health Insurance Act 1973; or\n (b) treatment, other than information that relates to compensation or benefits, provided under any of the following Acts:\n (i) the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006;\n (ii) the Military Rehabilitation and Compensation Act 2004;\n (iii) the Safety, Rehabilitation and Compensation Act 1988;\n (iiia) the Treatment Benefits (Special Access) Act 2019;\n (iv) the Veterans’ Entitlements Act 1986.\n\n> commercial‑in‑confidence has the meaning given by section 5.\n\n> contracted service provider has the meaning given by subsection 22A(10).\n\n> designated cancer means one of the following types of cancer:\n\n (a) bowel cancer;\n (b) cervical cancer;\n (c) lung cancer.\n\n> enforcement body has the same meaning as in the Privacy Act 1988.\n\n> entity means:\n\n (a) a person; or\n (b) a partnership; or\n (c) any other unincorporated association or body; or\n (d) a trust; or\n (e) a part of another entity (under a previous application of this definition).\n\n> healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.\n\n> healthcare provider means:\n\n (a) an individual healthcare provider; or\n (b) a healthcare provider organisation.\n\n> healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).\n\n> Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be part of an entity.\n\n> individual healthcare provider means an individual who:\n\n (a) has provided, provides, or is to provide, healthcare; or\n (b) is registered by a registration authority as a member of a particular health profession.\n\n> key information for an individual means the following:\n\n (a) the individual’s name, address, contact details, date of birth and gender;\n (b) the individual’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010) if any;\n (c) the individual’s medicare number (within the meaning of Part VII of the National Health Act 1953) if any;\n (d) the number allocated to the individual by the Veterans’ Affairs Department if any;\n (e) if applicable, the individual’s date of death;\n (f) if the register includes information relating to the individual in connection with screening associated with cervical cancer:\n (i) the individual’s sex; and\n (ii) the individual’s Human Papillomavirus vaccination status and number of doses of the vaccine administered to the individual;\n (g) the individual’s Indigenous status;\n (h) the individual’s country of origin or cultural identity;\n (i) the individual’s preferred language and whether an interpreter is required to facilitate communication with the individual;\n (j) the name and contact details of a personal representative of the individual if any;\n (k) if applicable, information on assistance required by the individual for the purposes of this Act because of a medical condition or disability;\n (l) any other information of a kind relevant to the purposes of the register and prescribed by the rules for the purposes of this definition.\n\n> nominated healthcare provider of an individual, for screening associated with a designated cancer, means the healthcare provider the individual requested be recorded for screening associated with the designated cancer in a request in effect under section 14.\n\n> parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975.\n\n> participating State or Territory means a State or Territory that has agreed with the Commonwealth to participate in the register.\n\n> personal information has the same meaning as in the Privacy Act 1988.\n\n> personal representative, of an individual, means:\n\n (a) a parent or guardian of the individual, if the individual is incapable of managing his or her health affairs; or\n (b) a trustee of an estate of the individual, if the individual is under a legal disability; or\n (c) a person who holds an enduring power of attorney granted by the individual; or\n (d) a person nominated by the individual for the purpose of managing the individual’s affairs in relation to screening associated with a designated cancer.\n\n> professional disciplinary authority means:\n\n (a) a registration authority; or\n (b) the Health Care Complaints Commission established by the Health Care Complaints Act 1993 (NSW); or\n (c) the Health Ombudsman appointed under the Health Ombudsman Act 2013 (Qld); or\n (d) any other authority that is responsible for investigating complaints about the professional conduct of individual healthcare providers.\n\n> protected information means personal information or information that is commercial‑in‑confidence, to the extent that the information is:\n\n (a) included in the register or otherwise obtained under, or in accordance with, this Act; or\n (b) derived from a record of information that was included in the register or was otherwise obtained under, or in accordance with, this Act; or\n (c) derived from a disclosure or use of information that was included in the register or was otherwise obtained under, or in accordance with, this Act.\n\n> purposes of the register means the purposes set out in section 12.\n\n> register means the National Cancer Screening Register established under section 9.\n\n> registration authority means an entity that is responsible under a law for registering members of a particular health profession.\n\n> Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.\n\n> rules means the rules made under section 28.\n\n> screening means a process in which an individual undergoes testing or procedures in order to determine whether the individual has:\n\n (a) a designated cancer or a precursor to a designated cancer; or\n (b) any indicator, including genetic markers or cell abnormalities, that may lead to a designated cancer.\n\n> screening test means a test or procedure as part of screening.\n\n> Secretary means the Secretary of the Department.\n\n> State or Territory authority has the same meaning as in the Privacy Act 1988.\n\n> Veterans’ Affairs Department means the Department administered by the Minister administering the Veterans’ Entitlements Act 1986.\n\n#### 5 Meaning of commercial‑in‑confidence\n\n Information is commercial‑in‑confidence if a person demonstrates to the Minister that:\n (a) release of the information would cause competitive detriment to the person; and\n (b) the information is not in the public domain; and\n (c) the information is not required to be disclosed under a law of the Commonwealth, or of a State or Territory; and\n (d) the information is not readily discoverable.\n\n#### 6 Act binds the Crown\n\n This Act binds the Crown in each of its capacities. However, it does not make the Crown liable to be prosecuted for an offence.\n\n> Note: See subsection 24(5) in relation to civil penalties.\n\n#### 7 Act extends to external Territories\n\n This Act extends to every external Territory.\n\n## Part 2—Register\n\n### Division 1—Simplified outline of this Part\n\n#### 8 Simplified outline of this Part\n\nThe National Cancer Screening Register is established to keep information about cancer screening and diagnoses associated with particular types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nCertain healthcare providers are required to notify the Commonwealth Chief Medical Officer about certain types of screening test or diagnosis. In most circumstances, this information will be included on the register.\n\nIndividuals can make a number of requests in relation to the register. For example, an individual can opt out of receiving information from the register. An individual can also request that information notified by healthcare providers relating to the individual not be included in the register.\n\n### Division 2—Establishment, contents and purposes\n\n#### 9 Establishment of the register\n\n (1) The Commonwealth must establish and keep a register to be called the National Cancer Screening Register.\n (2) Parts of the register may be kept separate from each other, and be called different names.\n (3) The register is not a legislative instrument.\n\n#### 10 Coverage of the register\n\n (1) The register may include information relating to individuals in connection with screening associated with bowel cancer.\n (2) The register may include information relating to individuals in connection with screening associated with cervical cancer.\n (3) The register may include information relating to individuals in connection with screening associated with lung cancer.\n\n#### 11 Contents of the register\n\n The register may include the following for each individual:\n (a) the individual’s key information;\n (b) details of the individual’s nominated healthcare provider for screening associated with a designated cancer, if any, including the healthcare provider’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010);\n (c) information about screening tests undergone or to be undergone by the individual;\n (d) if the individual is diagnosed with a designated cancer or a precursor to a designated cancer, that diagnosis;\n (e) claims information which may indicate whether or not the individual has undergone or should undergo screening associated with a designated cancer;\n (f) details of any request or withdrawal made by the individual under section 14;\n (g) any other information relevant to the purposes of the register and prescribed by the rules.\n\n#### 12 Purposes of the register\n\n (1) The purposes of the register are to facilitate the following:\n (a) establishing and keeping an electronic database of records relating to screening and diagnoses associated with the designated cancers;\n (b) collecting, analysing and publishing statistics and other information relating to screening and diagnoses associated with the designated cancers;\n (c) monitoring the effectiveness, quality and safety of screening and diagnoses associated with the designated cancers;\n (d) providing an individual with an invitation to undergo screening;\n (e) providing an individual with a test kit for screening;\n (f) advising an individual when the individual is due to undergo a screening test or when action may need to be taken after a screening test;\n (g) advising an individual’s nominated healthcare provider for screening associated with a designated cancer (if any) when the individual is due to undergo, or when action may need to be taken after, a screening test associated with the designated cancer;\n (h) advising a participating State or Territory when action may need to be taken after a screening test for an individual residing in the State or Territory;\n (i) providing an individual access to information relating to the individual about screening and diagnoses associated with a designated cancer;\n (j) providing healthcare providers access to information about screening and diagnoses associated with a designated cancer in relation to an individual, for the purposes of providing healthcare to the individual in relation to the designated cancer;\n (k) providing a participating State or Territory with access to information relating to individuals residing in the State or Territory in connection with screening and diagnoses associated with the designated cancers;\n (l) planning, delivering and promoting healthcare and services in relation to the designated cancers;\n (m) reporting to international organisations in relation to the designated cancers;\n (n) research relating to healthcare, screening or a designated cancer.\n (2) For an individual who has a personal representative:\n (a) paragraphs (1)(d) and (e) also apply to providing the representative with an invitation or test kit for the individual; and\n (b) paragraph (1)(f) also applies to advising the representative; and\n (c) paragraph (1)(i) also applies to providing the representative access to information relating to the individual.\n\n### Division 3—Notification to the register\n\n#### 13 Requirement to notify\n\n (1) The individual healthcare provider prescribed by the rules for a type of screening test or diagnosis prescribed by the rules must notify the Commonwealth Chief Medical Officer in the approved form, by the time prescribed by the rules, of the information prescribed by the rules for the type of screening test or diagnosis.\n (2) A person is liable to a civil penalty if the person contravenes subsection (1).\n\nCivil penalty: 30 penalty units.\n\n### Division 4—Requests about the register\n\n#### 14 Requests about participation in the register\n\n (1) An individual may, in the approved form, make any of the following requests:\n (a) that a particular healthcare provider be recorded as the individual’s nominated healthcare provider for screening associated with a designated cancer;\n (b) that the individual not be given, at all or for a period of time, by (or on behalf of) the Commonwealth:\n (i) any invitation of a kind referred to in paragraph 12(1)(d) or test kit referred to in paragraph 12(1)(e) in relation to screening associated with a designated cancer; or\n (ii) any advice of a kind referred to in paragraph 12(1)(f) in relation to screening associated with a designated cancer;\n (c) that information relating to the individual that is:\n (i) about a designated cancer; and\n (ii) notified under section 13 after the date of the request;\n not be included in the register;\n (d) that a date by which the register indicates the individual is due to undergo a screening test associated with cervical cancer be changed;\n (e) that the register use a pseudonym for the individual.\n (2) An individual may, in the approved form, withdraw any request made under subsection (1).\n (3) The Commonwealth must give effect to a request or withdrawal under this section as soon as practicable.\n (4) A personal representative of the individual may make or withdraw a request under this section on behalf of the individual.\n\n### Division 5—Alternative constitutional bases\n\n#### 15 Alternative constitutional bases\n\n (1) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to matters relating to:\n (a) the provision of pharmaceutical and sickness benefits; or\n (b) the provision of medical services (without any form of civil conscription); or\n (c) census and statistics; or\n (d) postal, telegraphic, telephonic and other like services; or\n (e) external affairs, including:\n (i) giving effect to the International Covenant on Economic, Social and Cultural Rights done at New York on 16 December 1966, in particular Article 12, or to another international agreement to which Australia is a party; or\n (ii) addressing matters of international concern; or\n (f) a Territory or a Commonwealth place (within the meaning of the Commonwealth Places (Application of Laws) Act 1970); or\n (g) the implied power of the Parliament to make laws with respect to nationhood; or\n (h) the executive power of the Commonwealth; or\n (i) matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.\n\n> Note: The International Covenant on Economic, Social and Cultural Rights is in Australian Treaty Series 1976 No. 5 (\\[1976\\] ATS 5) and could in 2016 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).\n\n (2) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to acts or omissions of corporations to which paragraph 51(xx) of the Constitution applies.\n (3) A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.\n\n## Part 3—Dealing with information in the register\n\n#### 16 Simplified outline of this Part\n\nInformation can be collected for inclusion in the register.\n\nPersonal information included in the register, or derived from information included in the register, is “protected information”.\n\nSection 18 makes it an offence for a person to record, disclose or use protected information without authorisation.\n\nRecording, disclosure and use of protected information is authorised in specific circumstances, including for the purposes of the register and by healthcare providers and States and Territories.\n\nThere are also a number of exceptions to the offence.\n\n#### 17 Authorised dealings with information\n\n Uploading personal information etc. to the register\n (1) A person may collect, make a record of, disclose or otherwise use:\n (a) personal information; or\n (b) key information for an individual; or\n (c) information that is commercial‑in‑confidence;\n if the person does so for the purposes of including information in the register.\n\n> Note: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n (2) Subsection (1) does not apply to information notified under section 13 to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n Using or disclosing information in the register\n (3) A person may collect, make a record of, disclose or otherwise use protected information, or key information included in the register, if:\n (a) the person does so for the purposes of the register and is:\n (i) an officer or employee of the Commonwealth or of an authority of the Commonwealth; or\n (ii) engaged by the Commonwealth, or by an authority of the Commonwealth, to perform work relating to the purposes of the register; or\n (iii) an officer or employee of a person referred to in subparagraph (ii), or engaged by a person referred to in subparagraph (ii) to perform work relating to the purposes of the register; or\n (b) all of the following apply:\n (i) the person is a healthcare provider;\n (ii) the information is about screening or diagnosis associated with a designated cancer in relation to an individual;\n (iii) the collection, recording, disclosure or use is for the purposes of providing healthcare to the individual in relation to the designated cancer; or\n (c) the collection, recording, disclosure or use is required or permitted by the law of a participating State or Territory, and the person is:\n (i) a State or Territory authority of the participating State or Territory; or\n (ii) an officer or employee of the participating State or Territory, or of a State or Territory authority of the participating State or Territory; or\n (iii) engaged by the participating State or Territory, or by a State or Territory authority of the participating State or Territory, to perform work relating to the information; or\n (iv) an officer or employee of a person referred to in subparagraph (iii), or engaged by a person referred to in subparagraph (iii) to perform work relating to the information; or\n (d) the person does so for the purposes of performing the person’s functions, or exercising the person’s powers, under this Act; or\n (e) the person is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory; or\n (f) the information is disclosed to the person under this section and the collection, recording, disclosure or use is for the purposes for which the information was disclosed to the person; or\n (g) all of the following apply:\n (i) the person is the Secretary;\n (ii) the collection, recording, disclosure or use is for the purposes of disclosing information to a professional disciplinary authority, a child protection officer or an enforcement body;\n (iii) the person reasonably believes that the information will enable or assist the authority, officer or body to perform or exercise any of the authority’s, officer’s or body’s functions or powers; or\n (h) the person does so for the purposes of court or tribunal proceedings, or in accordance with an order of a court or tribunal; or\n (i) the person does so for the purposes of a coronial inquiry, or in accordance with an order of a coroner.\n\n> Note 1: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n> Note 2: For paragraph (c), collection, recording, disclosure or use by a listed representative of a participating State or Territory is authorised under this subsection if the law of the State or Territory does not prevent the collection, recording, disclosure or use.\n\n (4) Subsection (3) does not apply to protected information or key information to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n (5) Collection, recording, disclosure or use of personal information for the purposes of research of a kind to which guidelines approved under section 95 or 95A of the Privacy Act 1988 relate is authorised under paragraph (3)(a) or (f) only if the collection, recording, use or disclosure is in accordance with the guidelines.\n\n#### 18 Offence relating to protected information\n\n A person commits an offence if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is protected information; and\n (c) the making of the record, or the disclosure or use, is not authorised by section 17.\n\nPenalty: Imprisonment for 2 years or 120 penalty units, or both.\n\n#### 19 Exception for use in good faith\n\n Section 18 does not apply to a person to the extent that the person makes a record of, discloses or otherwise uses protected information in good faith and in purported compliance with section 17.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 20 Exception if unaware information is commercial‑in‑confidence\n\n Section 18 does not apply to a person if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is commercial‑in‑confidence; and\n (c) the person does not know that the information is commercial‑in‑confidence.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 21 Exceptions relating to the person to whom the protected information relates\n\n (1) Section 18 does not apply to a person if:\n (a) the person discloses protected information to the person to whom the information relates; or\n (b) the person is the person to whom the protected information relates; or\n (c) the making of the record, or the disclosure or use, of the protected information is in accordance with the express or implied consent of the person to whom the information relates.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).\n\n (2) Subsection (1) applies as if a reference in that subsection to the person to whom the protected information relates includes a reference to the person’s personal representative.\n\n#### 22 Exception for disclosure to person who provided the information\n\n Section 18 does not apply to a person if:\n (a) the person obtains protected information from another person; and\n (b) the person discloses that information to the other person.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 22A Data breaches\n\n Notification of contraventions and possible contraventions\n (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.\n\n> Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\n (2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify:\n (a) the Secretary; and\n (b) the Information Commissioner.\n\n> Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\nCivil penalty: 100 penalty units.\n\n (3) A notice given under subsection (1) or (2) must set out the following:\n (a) a description of the contravention that has occurred or may have occurred;\n (b) the kind or kinds of information concerned;\n (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider.\n Handling possible contraventions\n (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the possible contravention;\n (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention;\n (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register:\n (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or\n (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.\n\n Handling contraventions\n (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;\n (b) evaluate any risks that may be related to or arise out of the contravention;\n (c) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;\n (d) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;\n (e) take steps to prevent or mitigate the effects of further contraventions.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.\n\n Secretary’s duty\n (6) The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).\n No need to report or consult if already done\n (7) A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.\n (8) A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.\n (9) A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:\n (a) given notice in relation to the contravention under subsection (1) or (2); or\n (b) consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).\n Contracted service providers\n (10) In this Act:\n contracted service provider means a person who:\n (a) is engaged under an agreement referred to in section 26; and\n (b) obtains protected information in the course of performing services under the agreement.\n\n#### 22B Contravention is an interference with privacy\n\n (1) An act or practice that contravenes section 18 or subsection 22A(1), (2), (4), (5) or (6) is taken to be:\n (a) for the purposes of the Privacy Act 1988, an interference with the privacy of an individual; and\n (b) covered by section 13 of that Act.\n (2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the person who engaged in the act or practice.\n (3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the register:\n (a) to investigate an act or practice that may be an interference with the privacy of an individual under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;\n (b) to do anything incidental or conducive to the performance of those functions.\n (4) The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).\n\n> Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.\n\n#### 22C Information Commissioner may disclose details of investigations to the Secretary\n\n The Information Commissioner is authorised to disclose to the Secretary any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 22B, if the Information Commissioner is satisfied that to do so will enable the Commonwealth to monitor or improve the operation or security of the register.\n\n## Part 4—Other matters\n\n#### 23 Simplified outline of this Part\n\nThis Part deals with other matters, such as civil penalties, approved forms, agreements, delegations and rules.\n\n#### 24 Civil penalty provisions\n\n Enforceable civil penalty provisions\n (1) Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.\n\n> Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.\n\n Authorised applicant\n (2) For the purposes of Part 4 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to the civil penalty provisions of this Act:\n (a) the Secretary;\n (b) an SES employee, or an acting SES employee, in the Department.\n Relevant court\n (3) For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:\n (a) the Federal Court of Australia;\n (b) the Federal Circuit and Family Court of Australia (Division 2);\n (c) a court of a State or Territory that has jurisdiction in relation to the matter.\n Extension to external Territories\n (4) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.\n Liability of Crown\n (5) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.\n\n#### 25 Approved forms\n\n (1) The Minister may, in writing, approve a form for the purposes of a provision of this Act.\n (2) A request or withdrawal of a request required by a provision of this Act to be in the approved form must be given to the person specified in the form for that purpose.\n\n#### 26 Agreements\n\n The Minister may, on behalf of the Commonwealth, engage a person under a written agreement to perform services for or on behalf of the Commonwealth in connection with functions of the Commonwealth, the Minister or the Commonwealth Chief Medical Officer under this Act.\n\n#### 27 Delegation\n\n (1) The Minister may, in writing, delegate his or her functions or powers under:\n (a) section 5 (about commercial‑in‑confidence information); or\n (b) section 25 (about approving forms); or\n (c) section 26 (about engaging persons under agreements);\n to an SES employee, or an acting SES employee, in the Department.\n (2) The Secretary may, in writing, delegate his or her functions or powers under:\n (a) paragraph 17(3)(g) (about disclosing information); or\n (b) section 22A (about data breaches);\n to an SES employee, or an acting SES employee, in the Department.\n (3) In performing a function, or exercising a power, under a delegation, the delegate must comply with any directions of the Minister or the Secretary.\n\n#### 28 Rules\n\n (1) The Minister may, by legislative instrument, make rules prescribing matters:\n (a) required or permitted by this Act to be prescribed by the rules; or\n (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.\n (1A) Before making rules for the purposes of:\n (a) paragraph (l) of the definition of key information in section 4; or\n (b) paragraph 11(g);\n the Minister must consult the Information Commissioner in relation to matters that relate to the privacy functions (within the meaning of the Australian Information Commissioner Act 2010) and have regard to any submissions made by the Information Commissioner because of that consultation.\n (2) To avoid doubt, the rules may not do the following:\n (a) create an offence or civil penalty;\n (b) provide powers of:\n (i) arrest or detention; or\n (ii) entry, search or seizure;\n (c) impose a tax;\n (d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;\n (e) directly amend the text of this Act.","sortOrder":8},{"sectionNumber":"Division 1","sectionType":"division","heading":"Simplified outline of this Part","content":"An Act to establish and provide for a cancer screening register, and for related purposes\n\n## Part 1—Preliminary\n\n#### 1 Short title\n\n This Act is the National Cancer Screening Register Act 2016.\n\n#### 2 Commencement\n\n (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n```html\n

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1. Sections 1 to 12 and anything in this Act not elsewhere covered by this table

The day after this Act receives the Royal Assent.

21 October 2016

2. Section 13

1 May 2017.

1 May 2017

3. Sections 14 to 28

At the same time as the provisions covered by table item 1.

21 October 2016

\n```\n\n> Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.\n\n (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.\n\n#### 3 Simplified outline of this Act\n\nThis Act establishes a register of information about screening associated with certain types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nThere are protections for sensitive information.\n\n#### 4 Definitions\n\n In this Act:\n\n> approved form means a form approved under subsection 25(1).\n\n> child protection officer means an officer or employee of a State or Territory, or of a State or Territory authority, who has functions, powers or duties in relation to the care, protection or welfare of children.\n\n> civil penalty provision has the same meaning as in the Regulatory Powers Act.\n\n> claims information means information about:\n\n (a) claims for medicare benefit under Part II of the Health Insurance Act 1973; or\n (b) treatment, other than information that relates to compensation or benefits, provided under any of the following Acts:\n (i) the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006;\n (ii) the Military Rehabilitation and Compensation Act 2004;\n (iii) the Safety, Rehabilitation and Compensation Act 1988;\n (iiia) the Treatment Benefits (Special Access) Act 2019;\n (iv) the Veterans’ Entitlements Act 1986.\n\n> commercial‑in‑confidence has the meaning given by section 5.\n\n> contracted service provider has the meaning given by subsection 22A(10).\n\n> designated cancer means one of the following types of cancer:\n\n (a) bowel cancer;\n (b) cervical cancer;\n (c) lung cancer.\n\n> enforcement body has the same meaning as in the Privacy Act 1988.\n\n> entity means:\n\n (a) a person; or\n (b) a partnership; or\n (c) any other unincorporated association or body; or\n (d) a trust; or\n (e) a part of another entity (under a previous application of this definition).\n\n> healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.\n\n> healthcare provider means:\n\n (a) an individual healthcare provider; or\n (b) a healthcare provider organisation.\n\n> healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).\n\n> Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be part of an entity.\n\n> individual healthcare provider means an individual who:\n\n (a) has provided, provides, or is to provide, healthcare; or\n (b) is registered by a registration authority as a member of a particular health profession.\n\n> key information for an individual means the following:\n\n (a) the individual’s name, address, contact details, date of birth and gender;\n (b) the individual’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010) if any;\n (c) the individual’s medicare number (within the meaning of Part VII of the National Health Act 1953) if any;\n (d) the number allocated to the individual by the Veterans’ Affairs Department if any;\n (e) if applicable, the individual’s date of death;\n (f) if the register includes information relating to the individual in connection with screening associated with cervical cancer:\n (i) the individual’s sex; and\n (ii) the individual’s Human Papillomavirus vaccination status and number of doses of the vaccine administered to the individual;\n (g) the individual’s Indigenous status;\n (h) the individual’s country of origin or cultural identity;\n (i) the individual’s preferred language and whether an interpreter is required to facilitate communication with the individual;\n (j) the name and contact details of a personal representative of the individual if any;\n (k) if applicable, information on assistance required by the individual for the purposes of this Act because of a medical condition or disability;\n (l) any other information of a kind relevant to the purposes of the register and prescribed by the rules for the purposes of this definition.\n\n> nominated healthcare provider of an individual, for screening associated with a designated cancer, means the healthcare provider the individual requested be recorded for screening associated with the designated cancer in a request in effect under section 14.\n\n> parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975.\n\n> participating State or Territory means a State or Territory that has agreed with the Commonwealth to participate in the register.\n\n> personal information has the same meaning as in the Privacy Act 1988.\n\n> personal representative, of an individual, means:\n\n (a) a parent or guardian of the individual, if the individual is incapable of managing his or her health affairs; or\n (b) a trustee of an estate of the individual, if the individual is under a legal disability; or\n (c) a person who holds an enduring power of attorney granted by the individual; or\n (d) a person nominated by the individual for the purpose of managing the individual’s affairs in relation to screening associated with a designated cancer.\n\n> professional disciplinary authority means:\n\n (a) a registration authority; or\n (b) the Health Care Complaints Commission established by the Health Care Complaints Act 1993 (NSW); or\n (c) the Health Ombudsman appointed under the Health Ombudsman Act 2013 (Qld); or\n (d) any other authority that is responsible for investigating complaints about the professional conduct of individual healthcare providers.\n\n> protected information means personal information or information that is commercial‑in‑confidence, to the extent that the information is:\n\n (a) included in the register or otherwise obtained under, or in accordance with, this Act; or\n (b) derived from a record of information that was included in the register or was otherwise obtained under, or in accordance with, this Act; or\n (c) derived from a disclosure or use of information that was included in the register or was otherwise obtained under, or in accordance with, this Act.\n\n> purposes of the register means the purposes set out in section 12.\n\n> register means the National Cancer Screening Register established under section 9.\n\n> registration authority means an entity that is responsible under a law for registering members of a particular health profession.\n\n> Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.\n\n> rules means the rules made under section 28.\n\n> screening means a process in which an individual undergoes testing or procedures in order to determine whether the individual has:\n\n (a) a designated cancer or a precursor to a designated cancer; or\n (b) any indicator, including genetic markers or cell abnormalities, that may lead to a designated cancer.\n\n> screening test means a test or procedure as part of screening.\n\n> Secretary means the Secretary of the Department.\n\n> State or Territory authority has the same meaning as in the Privacy Act 1988.\n\n> Veterans’ Affairs Department means the Department administered by the Minister administering the Veterans’ Entitlements Act 1986.\n\n#### 5 Meaning of commercial‑in‑confidence\n\n Information is commercial‑in‑confidence if a person demonstrates to the Minister that:\n (a) release of the information would cause competitive detriment to the person; and\n (b) the information is not in the public domain; and\n (c) the information is not required to be disclosed under a law of the Commonwealth, or of a State or Territory; and\n (d) the information is not readily discoverable.\n\n#### 6 Act binds the Crown\n\n This Act binds the Crown in each of its capacities. However, it does not make the Crown liable to be prosecuted for an offence.\n\n> Note: See subsection 24(5) in relation to civil penalties.\n\n#### 7 Act extends to external Territories\n\n This Act extends to every external Territory.\n\n## Part 2—Register\n\n### Division 1—Simplified outline of this Part\n\n#### 8 Simplified outline of this Part\n\nThe National Cancer Screening Register is established to keep information about cancer screening and diagnoses associated with particular types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nCertain healthcare providers are required to notify the Commonwealth Chief Medical Officer about certain types of screening test or diagnosis. In most circumstances, this information will be included on the register.\n\nIndividuals can make a number of requests in relation to the register. For example, an individual can opt out of receiving information from the register. An individual can also request that information notified by healthcare providers relating to the individual not be included in the register.\n\n### Division 2—Establishment, contents and purposes\n\n#### 9 Establishment of the register\n\n (1) The Commonwealth must establish and keep a register to be called the National Cancer Screening Register.\n (2) Parts of the register may be kept separate from each other, and be called different names.\n (3) The register is not a legislative instrument.\n\n#### 10 Coverage of the register\n\n (1) The register may include information relating to individuals in connection with screening associated with bowel cancer.\n (2) The register may include information relating to individuals in connection with screening associated with cervical cancer.\n (3) The register may include information relating to individuals in connection with screening associated with lung cancer.\n\n#### 11 Contents of the register\n\n The register may include the following for each individual:\n (a) the individual’s key information;\n (b) details of the individual’s nominated healthcare provider for screening associated with a designated cancer, if any, including the healthcare provider’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010);\n (c) information about screening tests undergone or to be undergone by the individual;\n (d) if the individual is diagnosed with a designated cancer or a precursor to a designated cancer, that diagnosis;\n (e) claims information which may indicate whether or not the individual has undergone or should undergo screening associated with a designated cancer;\n (f) details of any request or withdrawal made by the individual under section 14;\n (g) any other information relevant to the purposes of the register and prescribed by the rules.\n\n#### 12 Purposes of the register\n\n (1) The purposes of the register are to facilitate the following:\n (a) establishing and keeping an electronic database of records relating to screening and diagnoses associated with the designated cancers;\n (b) collecting, analysing and publishing statistics and other information relating to screening and diagnoses associated with the designated cancers;\n (c) monitoring the effectiveness, quality and safety of screening and diagnoses associated with the designated cancers;\n (d) providing an individual with an invitation to undergo screening;\n (e) providing an individual with a test kit for screening;\n (f) advising an individual when the individual is due to undergo a screening test or when action may need to be taken after a screening test;\n (g) advising an individual’s nominated healthcare provider for screening associated with a designated cancer (if any) when the individual is due to undergo, or when action may need to be taken after, a screening test associated with the designated cancer;\n (h) advising a participating State or Territory when action may need to be taken after a screening test for an individual residing in the State or Territory;\n (i) providing an individual access to information relating to the individual about screening and diagnoses associated with a designated cancer;\n (j) providing healthcare providers access to information about screening and diagnoses associated with a designated cancer in relation to an individual, for the purposes of providing healthcare to the individual in relation to the designated cancer;\n (k) providing a participating State or Territory with access to information relating to individuals residing in the State or Territory in connection with screening and diagnoses associated with the designated cancers;\n (l) planning, delivering and promoting healthcare and services in relation to the designated cancers;\n (m) reporting to international organisations in relation to the designated cancers;\n (n) research relating to healthcare, screening or a designated cancer.\n (2) For an individual who has a personal representative:\n (a) paragraphs (1)(d) and (e) also apply to providing the representative with an invitation or test kit for the individual; and\n (b) paragraph (1)(f) also applies to advising the representative; and\n (c) paragraph (1)(i) also applies to providing the representative access to information relating to the individual.\n\n### Division 3—Notification to the register\n\n#### 13 Requirement to notify\n\n (1) The individual healthcare provider prescribed by the rules for a type of screening test or diagnosis prescribed by the rules must notify the Commonwealth Chief Medical Officer in the approved form, by the time prescribed by the rules, of the information prescribed by the rules for the type of screening test or diagnosis.\n (2) A person is liable to a civil penalty if the person contravenes subsection (1).\n\nCivil penalty: 30 penalty units.\n\n### Division 4—Requests about the register\n\n#### 14 Requests about participation in the register\n\n (1) An individual may, in the approved form, make any of the following requests:\n (a) that a particular healthcare provider be recorded as the individual’s nominated healthcare provider for screening associated with a designated cancer;\n (b) that the individual not be given, at all or for a period of time, by (or on behalf of) the Commonwealth:\n (i) any invitation of a kind referred to in paragraph 12(1)(d) or test kit referred to in paragraph 12(1)(e) in relation to screening associated with a designated cancer; or\n (ii) any advice of a kind referred to in paragraph 12(1)(f) in relation to screening associated with a designated cancer;\n (c) that information relating to the individual that is:\n (i) about a designated cancer; and\n (ii) notified under section 13 after the date of the request;\n not be included in the register;\n (d) that a date by which the register indicates the individual is due to undergo a screening test associated with cervical cancer be changed;\n (e) that the register use a pseudonym for the individual.\n (2) An individual may, in the approved form, withdraw any request made under subsection (1).\n (3) The Commonwealth must give effect to a request or withdrawal under this section as soon as practicable.\n (4) A personal representative of the individual may make or withdraw a request under this section on behalf of the individual.\n\n### Division 5—Alternative constitutional bases\n\n#### 15 Alternative constitutional bases\n\n (1) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to matters relating to:\n (a) the provision of pharmaceutical and sickness benefits; or\n (b) the provision of medical services (without any form of civil conscription); or\n (c) census and statistics; or\n (d) postal, telegraphic, telephonic and other like services; or\n (e) external affairs, including:\n (i) giving effect to the International Covenant on Economic, Social and Cultural Rights done at New York on 16 December 1966, in particular Article 12, or to another international agreement to which Australia is a party; or\n (ii) addressing matters of international concern; or\n (f) a Territory or a Commonwealth place (within the meaning of the Commonwealth Places (Application of Laws) Act 1970); or\n (g) the implied power of the Parliament to make laws with respect to nationhood; or\n (h) the executive power of the Commonwealth; or\n (i) matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.\n\n> Note: The International Covenant on Economic, Social and Cultural Rights is in Australian Treaty Series 1976 No. 5 (\\[1976\\] ATS 5) and could in 2016 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).\n\n (2) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to acts or omissions of corporations to which paragraph 51(xx) of the Constitution applies.\n (3) A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.\n\n## Part 3—Dealing with information in the register\n\n#### 16 Simplified outline of this Part\n\nInformation can be collected for inclusion in the register.\n\nPersonal information included in the register, or derived from information included in the register, is “protected information”.\n\nSection 18 makes it an offence for a person to record, disclose or use protected information without authorisation.\n\nRecording, disclosure and use of protected information is authorised in specific circumstances, including for the purposes of the register and by healthcare providers and States and Territories.\n\nThere are also a number of exceptions to the offence.\n\n#### 17 Authorised dealings with information\n\n Uploading personal information etc. to the register\n (1) A person may collect, make a record of, disclose or otherwise use:\n (a) personal information; or\n (b) key information for an individual; or\n (c) information that is commercial‑in‑confidence;\n if the person does so for the purposes of including information in the register.\n\n> Note: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n (2) Subsection (1) does not apply to information notified under section 13 to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n Using or disclosing information in the register\n (3) A person may collect, make a record of, disclose or otherwise use protected information, or key information included in the register, if:\n (a) the person does so for the purposes of the register and is:\n (i) an officer or employee of the Commonwealth or of an authority of the Commonwealth; or\n (ii) engaged by the Commonwealth, or by an authority of the Commonwealth, to perform work relating to the purposes of the register; or\n (iii) an officer or employee of a person referred to in subparagraph (ii), or engaged by a person referred to in subparagraph (ii) to perform work relating to the purposes of the register; or\n (b) all of the following apply:\n (i) the person is a healthcare provider;\n (ii) the information is about screening or diagnosis associated with a designated cancer in relation to an individual;\n (iii) the collection, recording, disclosure or use is for the purposes of providing healthcare to the individual in relation to the designated cancer; or\n (c) the collection, recording, disclosure or use is required or permitted by the law of a participating State or Territory, and the person is:\n (i) a State or Territory authority of the participating State or Territory; or\n (ii) an officer or employee of the participating State or Territory, or of a State or Territory authority of the participating State or Territory; or\n (iii) engaged by the participating State or Territory, or by a State or Territory authority of the participating State or Territory, to perform work relating to the information; or\n (iv) an officer or employee of a person referred to in subparagraph (iii), or engaged by a person referred to in subparagraph (iii) to perform work relating to the information; or\n (d) the person does so for the purposes of performing the person’s functions, or exercising the person’s powers, under this Act; or\n (e) the person is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory; or\n (f) the information is disclosed to the person under this section and the collection, recording, disclosure or use is for the purposes for which the information was disclosed to the person; or\n (g) all of the following apply:\n (i) the person is the Secretary;\n (ii) the collection, recording, disclosure or use is for the purposes of disclosing information to a professional disciplinary authority, a child protection officer or an enforcement body;\n (iii) the person reasonably believes that the information will enable or assist the authority, officer or body to perform or exercise any of the authority’s, officer’s or body’s functions or powers; or\n (h) the person does so for the purposes of court or tribunal proceedings, or in accordance with an order of a court or tribunal; or\n (i) the person does so for the purposes of a coronial inquiry, or in accordance with an order of a coroner.\n\n> Note 1: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n> Note 2: For paragraph (c), collection, recording, disclosure or use by a listed representative of a participating State or Territory is authorised under this subsection if the law of the State or Territory does not prevent the collection, recording, disclosure or use.\n\n (4) Subsection (3) does not apply to protected information or key information to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n (5) Collection, recording, disclosure or use of personal information for the purposes of research of a kind to which guidelines approved under section 95 or 95A of the Privacy Act 1988 relate is authorised under paragraph (3)(a) or (f) only if the collection, recording, use or disclosure is in accordance with the guidelines.\n\n#### 18 Offence relating to protected information\n\n A person commits an offence if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is protected information; and\n (c) the making of the record, or the disclosure or use, is not authorised by section 17.\n\nPenalty: Imprisonment for 2 years or 120 penalty units, or both.\n\n#### 19 Exception for use in good faith\n\n Section 18 does not apply to a person to the extent that the person makes a record of, discloses or otherwise uses protected information in good faith and in purported compliance with section 17.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 20 Exception if unaware information is commercial‑in‑confidence\n\n Section 18 does not apply to a person if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is commercial‑in‑confidence; and\n (c) the person does not know that the information is commercial‑in‑confidence.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 21 Exceptions relating to the person to whom the protected information relates\n\n (1) Section 18 does not apply to a person if:\n (a) the person discloses protected information to the person to whom the information relates; or\n (b) the person is the person to whom the protected information relates; or\n (c) the making of the record, or the disclosure or use, of the protected information is in accordance with the express or implied consent of the person to whom the information relates.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).\n\n (2) Subsection (1) applies as if a reference in that subsection to the person to whom the protected information relates includes a reference to the person’s personal representative.\n\n#### 22 Exception for disclosure to person who provided the information\n\n Section 18 does not apply to a person if:\n (a) the person obtains protected information from another person; and\n (b) the person discloses that information to the other person.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 22A Data breaches\n\n Notification of contraventions and possible contraventions\n (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.\n\n> Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\n (2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify:\n (a) the Secretary; and\n (b) the Information Commissioner.\n\n> Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\nCivil penalty: 100 penalty units.\n\n (3) A notice given under subsection (1) or (2) must set out the following:\n (a) a description of the contravention that has occurred or may have occurred;\n (b) the kind or kinds of information concerned;\n (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider.\n Handling possible contraventions\n (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the possible contravention;\n (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention;\n (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register:\n (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or\n (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.\n\n Handling contraventions\n (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;\n (b) evaluate any risks that may be related to or arise out of the contravention;\n (c) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;\n (d) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;\n (e) take steps to prevent or mitigate the effects of further contraventions.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.\n\n Secretary’s duty\n (6) The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).\n No need to report or consult if already done\n (7) A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.\n (8) A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.\n (9) A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:\n (a) given notice in relation to the contravention under subsection (1) or (2); or\n (b) consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).\n Contracted service providers\n (10) In this Act:\n contracted service provider means a person who:\n (a) is engaged under an agreement referred to in section 26; and\n (b) obtains protected information in the course of performing services under the agreement.\n\n#### 22B Contravention is an interference with privacy\n\n (1) An act or practice that contravenes section 18 or subsection 22A(1), (2), (4), (5) or (6) is taken to be:\n (a) for the purposes of the Privacy Act 1988, an interference with the privacy of an individual; and\n (b) covered by section 13 of that Act.\n (2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the person who engaged in the act or practice.\n (3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the register:\n (a) to investigate an act or practice that may be an interference with the privacy of an individual under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;\n (b) to do anything incidental or conducive to the performance of those functions.\n (4) The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).\n\n> Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.\n\n#### 22C Information Commissioner may disclose details of investigations to the Secretary\n\n The Information Commissioner is authorised to disclose to the Secretary any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 22B, if the Information Commissioner is satisfied that to do so will enable the Commonwealth to monitor or improve the operation or security of the register.\n\n## Part 4—Other matters\n\n#### 23 Simplified outline of this Part\n\nThis Part deals with other matters, such as civil penalties, approved forms, agreements, delegations and rules.\n\n#### 24 Civil penalty provisions\n\n Enforceable civil penalty provisions\n (1) Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.\n\n> Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.\n\n Authorised applicant\n (2) For the purposes of Part 4 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to the civil penalty provisions of this Act:\n (a) the Secretary;\n (b) an SES employee, or an acting SES employee, in the Department.\n Relevant court\n (3) For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:\n (a) the Federal Court of Australia;\n (b) the Federal Circuit and Family Court of Australia (Division 2);\n (c) a court of a State or Territory that has jurisdiction in relation to the matter.\n Extension to external Territories\n (4) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.\n Liability of Crown\n (5) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.\n\n#### 25 Approved forms\n\n (1) The Minister may, in writing, approve a form for the purposes of a provision of this Act.\n (2) A request or withdrawal of a request required by a provision of this Act to be in the approved form must be given to the person specified in the form for that purpose.\n\n#### 26 Agreements\n\n The Minister may, on behalf of the Commonwealth, engage a person under a written agreement to perform services for or on behalf of the Commonwealth in connection with functions of the Commonwealth, the Minister or the Commonwealth Chief Medical Officer under this Act.\n\n#### 27 Delegation\n\n (1) The Minister may, in writing, delegate his or her functions or powers under:\n (a) section 5 (about commercial‑in‑confidence information); or\n (b) section 25 (about approving forms); or\n (c) section 26 (about engaging persons under agreements);\n to an SES employee, or an acting SES employee, in the Department.\n (2) The Secretary may, in writing, delegate his or her functions or powers under:\n (a) paragraph 17(3)(g) (about disclosing information); or\n (b) section 22A (about data breaches);\n to an SES employee, or an acting SES employee, in the Department.\n (3) In performing a function, or exercising a power, under a delegation, the delegate must comply with any directions of the Minister or the Secretary.\n\n#### 28 Rules\n\n (1) The Minister may, by legislative instrument, make rules prescribing matters:\n (a) required or permitted by this Act to be prescribed by the rules; or\n (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.\n (1A) Before making rules for the purposes of:\n (a) paragraph (l) of the definition of key information in section 4; or\n (b) paragraph 11(g);\n the Minister must consult the Information Commissioner in relation to matters that relate to the privacy functions (within the meaning of the Australian Information Commissioner Act 2010) and have regard to any submissions made by the Information Commissioner because of that consultation.\n (2) To avoid doubt, the rules may not do the following:\n (a) create an offence or civil penalty;\n (b) provide powers of:\n (i) arrest or detention; or\n (ii) entry, search or seizure;\n (c) impose a tax;\n (d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;\n (e) directly amend the text of this Act.","sortOrder":9},{"sectionNumber":"8","sectionType":"section","heading":"Simplified outline of this Part","content":"#### 8 Simplified outline of this Part\n\nThe National Cancer Screening Register is established to keep information about cancer screening and diagnoses associated with particular types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nCertain healthcare providers are required to notify the Commonwealth Chief Medical Officer about certain types of screening test or diagnosis. In most circumstances, this information will be included on the register.\n\nIndividuals can make a number of requests in relation to the register. For example, an individual can opt out of receiving information from the register. An individual can also request that information notified by healthcare providers relating to the individual not be included in the register.","sortOrder":10},{"sectionNumber":"Division 2","sectionType":"division","heading":"Establishment, contents and purposes","content":"An Act to establish and provide for a cancer screening register, and for related purposes\n\n## Part 1—Preliminary\n\n#### 1 Short title\n\n This Act is the National Cancer Screening Register Act 2016.\n\n#### 2 Commencement\n\n (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n```html\n

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1. Sections 1 to 12 and anything in this Act not elsewhere covered by this table

The day after this Act receives the Royal Assent.

21 October 2016

2. Section 13

1 May 2017.

1 May 2017

3. Sections 14 to 28

At the same time as the provisions covered by table item 1.

21 October 2016

\n```\n\n> Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.\n\n (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.\n\n#### 3 Simplified outline of this Act\n\nThis Act establishes a register of information about screening associated with certain types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nThere are protections for sensitive information.\n\n#### 4 Definitions\n\n In this Act:\n\n> approved form means a form approved under subsection 25(1).\n\n> child protection officer means an officer or employee of a State or Territory, or of a State or Territory authority, who has functions, powers or duties in relation to the care, protection or welfare of children.\n\n> civil penalty provision has the same meaning as in the Regulatory Powers Act.\n\n> claims information means information about:\n\n (a) claims for medicare benefit under Part II of the Health Insurance Act 1973; or\n (b) treatment, other than information that relates to compensation or benefits, provided under any of the following Acts:\n (i) the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006;\n (ii) the Military Rehabilitation and Compensation Act 2004;\n (iii) the Safety, Rehabilitation and Compensation Act 1988;\n (iiia) the Treatment Benefits (Special Access) Act 2019;\n (iv) the Veterans’ Entitlements Act 1986.\n\n> commercial‑in‑confidence has the meaning given by section 5.\n\n> contracted service provider has the meaning given by subsection 22A(10).\n\n> designated cancer means one of the following types of cancer:\n\n (a) bowel cancer;\n (b) cervical cancer;\n (c) lung cancer.\n\n> enforcement body has the same meaning as in the Privacy Act 1988.\n\n> entity means:\n\n (a) a person; or\n (b) a partnership; or\n (c) any other unincorporated association or body; or\n (d) a trust; or\n (e) a part of another entity (under a previous application of this definition).\n\n> healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.\n\n> healthcare provider means:\n\n (a) an individual healthcare provider; or\n (b) a healthcare provider organisation.\n\n> healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).\n\n> Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be part of an entity.\n\n> individual healthcare provider means an individual who:\n\n (a) has provided, provides, or is to provide, healthcare; or\n (b) is registered by a registration authority as a member of a particular health profession.\n\n> key information for an individual means the following:\n\n (a) the individual’s name, address, contact details, date of birth and gender;\n (b) the individual’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010) if any;\n (c) the individual’s medicare number (within the meaning of Part VII of the National Health Act 1953) if any;\n (d) the number allocated to the individual by the Veterans’ Affairs Department if any;\n (e) if applicable, the individual’s date of death;\n (f) if the register includes information relating to the individual in connection with screening associated with cervical cancer:\n (i) the individual’s sex; and\n (ii) the individual’s Human Papillomavirus vaccination status and number of doses of the vaccine administered to the individual;\n (g) the individual’s Indigenous status;\n (h) the individual’s country of origin or cultural identity;\n (i) the individual’s preferred language and whether an interpreter is required to facilitate communication with the individual;\n (j) the name and contact details of a personal representative of the individual if any;\n (k) if applicable, information on assistance required by the individual for the purposes of this Act because of a medical condition or disability;\n (l) any other information of a kind relevant to the purposes of the register and prescribed by the rules for the purposes of this definition.\n\n> nominated healthcare provider of an individual, for screening associated with a designated cancer, means the healthcare provider the individual requested be recorded for screening associated with the designated cancer in a request in effect under section 14.\n\n> parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975.\n\n> participating State or Territory means a State or Territory that has agreed with the Commonwealth to participate in the register.\n\n> personal information has the same meaning as in the Privacy Act 1988.\n\n> personal representative, of an individual, means:\n\n (a) a parent or guardian of the individual, if the individual is incapable of managing his or her health affairs; or\n (b) a trustee of an estate of the individual, if the individual is under a legal disability; or\n (c) a person who holds an enduring power of attorney granted by the individual; or\n (d) a person nominated by the individual for the purpose of managing the individual’s affairs in relation to screening associated with a designated cancer.\n\n> professional disciplinary authority means:\n\n (a) a registration authority; or\n (b) the Health Care Complaints Commission established by the Health Care Complaints Act 1993 (NSW); or\n (c) the Health Ombudsman appointed under the Health Ombudsman Act 2013 (Qld); or\n (d) any other authority that is responsible for investigating complaints about the professional conduct of individual healthcare providers.\n\n> protected information means personal information or information that is commercial‑in‑confidence, to the extent that the information is:\n\n (a) included in the register or otherwise obtained under, or in accordance with, this Act; or\n (b) derived from a record of information that was included in the register or was otherwise obtained under, or in accordance with, this Act; or\n (c) derived from a disclosure or use of information that was included in the register or was otherwise obtained under, or in accordance with, this Act.\n\n> purposes of the register means the purposes set out in section 12.\n\n> register means the National Cancer Screening Register established under section 9.\n\n> registration authority means an entity that is responsible under a law for registering members of a particular health profession.\n\n> Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.\n\n> rules means the rules made under section 28.\n\n> screening means a process in which an individual undergoes testing or procedures in order to determine whether the individual has:\n\n (a) a designated cancer or a precursor to a designated cancer; or\n (b) any indicator, including genetic markers or cell abnormalities, that may lead to a designated cancer.\n\n> screening test means a test or procedure as part of screening.\n\n> Secretary means the Secretary of the Department.\n\n> State or Territory authority has the same meaning as in the Privacy Act 1988.\n\n> Veterans’ Affairs Department means the Department administered by the Minister administering the Veterans’ Entitlements Act 1986.\n\n#### 5 Meaning of commercial‑in‑confidence\n\n Information is commercial‑in‑confidence if a person demonstrates to the Minister that:\n (a) release of the information would cause competitive detriment to the person; and\n (b) the information is not in the public domain; and\n (c) the information is not required to be disclosed under a law of the Commonwealth, or of a State or Territory; and\n (d) the information is not readily discoverable.\n\n#### 6 Act binds the Crown\n\n This Act binds the Crown in each of its capacities. However, it does not make the Crown liable to be prosecuted for an offence.\n\n> Note: See subsection 24(5) in relation to civil penalties.\n\n#### 7 Act extends to external Territories\n\n This Act extends to every external Territory.\n\n## Part 2—Register\n\n### Division 1—Simplified outline of this Part\n\n#### 8 Simplified outline of this Part\n\nThe National Cancer Screening Register is established to keep information about cancer screening and diagnoses associated with particular types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nCertain healthcare providers are required to notify the Commonwealth Chief Medical Officer about certain types of screening test or diagnosis. In most circumstances, this information will be included on the register.\n\nIndividuals can make a number of requests in relation to the register. For example, an individual can opt out of receiving information from the register. An individual can also request that information notified by healthcare providers relating to the individual not be included in the register.\n\n### Division 2—Establishment, contents and purposes\n\n#### 9 Establishment of the register\n\n (1) The Commonwealth must establish and keep a register to be called the National Cancer Screening Register.\n (2) Parts of the register may be kept separate from each other, and be called different names.\n (3) The register is not a legislative instrument.\n\n#### 10 Coverage of the register\n\n (1) The register may include information relating to individuals in connection with screening associated with bowel cancer.\n (2) The register may include information relating to individuals in connection with screening associated with cervical cancer.\n (3) The register may include information relating to individuals in connection with screening associated with lung cancer.\n\n#### 11 Contents of the register\n\n The register may include the following for each individual:\n (a) the individual’s key information;\n (b) details of the individual’s nominated healthcare provider for screening associated with a designated cancer, if any, including the healthcare provider’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010);\n (c) information about screening tests undergone or to be undergone by the individual;\n (d) if the individual is diagnosed with a designated cancer or a precursor to a designated cancer, that diagnosis;\n (e) claims information which may indicate whether or not the individual has undergone or should undergo screening associated with a designated cancer;\n (f) details of any request or withdrawal made by the individual under section 14;\n (g) any other information relevant to the purposes of the register and prescribed by the rules.\n\n#### 12 Purposes of the register\n\n (1) The purposes of the register are to facilitate the following:\n (a) establishing and keeping an electronic database of records relating to screening and diagnoses associated with the designated cancers;\n (b) collecting, analysing and publishing statistics and other information relating to screening and diagnoses associated with the designated cancers;\n (c) monitoring the effectiveness, quality and safety of screening and diagnoses associated with the designated cancers;\n (d) providing an individual with an invitation to undergo screening;\n (e) providing an individual with a test kit for screening;\n (f) advising an individual when the individual is due to undergo a screening test or when action may need to be taken after a screening test;\n (g) advising an individual’s nominated healthcare provider for screening associated with a designated cancer (if any) when the individual is due to undergo, or when action may need to be taken after, a screening test associated with the designated cancer;\n (h) advising a participating State or Territory when action may need to be taken after a screening test for an individual residing in the State or Territory;\n (i) providing an individual access to information relating to the individual about screening and diagnoses associated with a designated cancer;\n (j) providing healthcare providers access to information about screening and diagnoses associated with a designated cancer in relation to an individual, for the purposes of providing healthcare to the individual in relation to the designated cancer;\n (k) providing a participating State or Territory with access to information relating to individuals residing in the State or Territory in connection with screening and diagnoses associated with the designated cancers;\n (l) planning, delivering and promoting healthcare and services in relation to the designated cancers;\n (m) reporting to international organisations in relation to the designated cancers;\n (n) research relating to healthcare, screening or a designated cancer.\n (2) For an individual who has a personal representative:\n (a) paragraphs (1)(d) and (e) also apply to providing the representative with an invitation or test kit for the individual; and\n (b) paragraph (1)(f) also applies to advising the representative; and\n (c) paragraph (1)(i) also applies to providing the representative access to information relating to the individual.\n\n### Division 3—Notification to the register\n\n#### 13 Requirement to notify\n\n (1) The individual healthcare provider prescribed by the rules for a type of screening test or diagnosis prescribed by the rules must notify the Commonwealth Chief Medical Officer in the approved form, by the time prescribed by the rules, of the information prescribed by the rules for the type of screening test or diagnosis.\n (2) A person is liable to a civil penalty if the person contravenes subsection (1).\n\nCivil penalty: 30 penalty units.\n\n### Division 4—Requests about the register\n\n#### 14 Requests about participation in the register\n\n (1) An individual may, in the approved form, make any of the following requests:\n (a) that a particular healthcare provider be recorded as the individual’s nominated healthcare provider for screening associated with a designated cancer;\n (b) that the individual not be given, at all or for a period of time, by (or on behalf of) the Commonwealth:\n (i) any invitation of a kind referred to in paragraph 12(1)(d) or test kit referred to in paragraph 12(1)(e) in relation to screening associated with a designated cancer; or\n (ii) any advice of a kind referred to in paragraph 12(1)(f) in relation to screening associated with a designated cancer;\n (c) that information relating to the individual that is:\n (i) about a designated cancer; and\n (ii) notified under section 13 after the date of the request;\n not be included in the register;\n (d) that a date by which the register indicates the individual is due to undergo a screening test associated with cervical cancer be changed;\n (e) that the register use a pseudonym for the individual.\n (2) An individual may, in the approved form, withdraw any request made under subsection (1).\n (3) The Commonwealth must give effect to a request or withdrawal under this section as soon as practicable.\n (4) A personal representative of the individual may make or withdraw a request under this section on behalf of the individual.\n\n### Division 5—Alternative constitutional bases\n\n#### 15 Alternative constitutional bases\n\n (1) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to matters relating to:\n (a) the provision of pharmaceutical and sickness benefits; or\n (b) the provision of medical services (without any form of civil conscription); or\n (c) census and statistics; or\n (d) postal, telegraphic, telephonic and other like services; or\n (e) external affairs, including:\n (i) giving effect to the International Covenant on Economic, Social and Cultural Rights done at New York on 16 December 1966, in particular Article 12, or to another international agreement to which Australia is a party; or\n (ii) addressing matters of international concern; or\n (f) a Territory or a Commonwealth place (within the meaning of the Commonwealth Places (Application of Laws) Act 1970); or\n (g) the implied power of the Parliament to make laws with respect to nationhood; or\n (h) the executive power of the Commonwealth; or\n (i) matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.\n\n> Note: The International Covenant on Economic, Social and Cultural Rights is in Australian Treaty Series 1976 No. 5 (\\[1976\\] ATS 5) and could in 2016 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).\n\n (2) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to acts or omissions of corporations to which paragraph 51(xx) of the Constitution applies.\n (3) A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.\n\n## Part 3—Dealing with information in the register\n\n#### 16 Simplified outline of this Part\n\nInformation can be collected for inclusion in the register.\n\nPersonal information included in the register, or derived from information included in the register, is “protected information”.\n\nSection 18 makes it an offence for a person to record, disclose or use protected information without authorisation.\n\nRecording, disclosure and use of protected information is authorised in specific circumstances, including for the purposes of the register and by healthcare providers and States and Territories.\n\nThere are also a number of exceptions to the offence.\n\n#### 17 Authorised dealings with information\n\n Uploading personal information etc. to the register\n (1) A person may collect, make a record of, disclose or otherwise use:\n (a) personal information; or\n (b) key information for an individual; or\n (c) information that is commercial‑in‑confidence;\n if the person does so for the purposes of including information in the register.\n\n> Note: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n (2) Subsection (1) does not apply to information notified under section 13 to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n Using or disclosing information in the register\n (3) A person may collect, make a record of, disclose or otherwise use protected information, or key information included in the register, if:\n (a) the person does so for the purposes of the register and is:\n (i) an officer or employee of the Commonwealth or of an authority of the Commonwealth; or\n (ii) engaged by the Commonwealth, or by an authority of the Commonwealth, to perform work relating to the purposes of the register; or\n (iii) an officer or employee of a person referred to in subparagraph (ii), or engaged by a person referred to in subparagraph (ii) to perform work relating to the purposes of the register; or\n (b) all of the following apply:\n (i) the person is a healthcare provider;\n (ii) the information is about screening or diagnosis associated with a designated cancer in relation to an individual;\n (iii) the collection, recording, disclosure or use is for the purposes of providing healthcare to the individual in relation to the designated cancer; or\n (c) the collection, recording, disclosure or use is required or permitted by the law of a participating State or Territory, and the person is:\n (i) a State or Territory authority of the participating State or Territory; or\n (ii) an officer or employee of the participating State or Territory, or of a State or Territory authority of the participating State or Territory; or\n (iii) engaged by the participating State or Territory, or by a State or Territory authority of the participating State or Territory, to perform work relating to the information; or\n (iv) an officer or employee of a person referred to in subparagraph (iii), or engaged by a person referred to in subparagraph (iii) to perform work relating to the information; or\n (d) the person does so for the purposes of performing the person’s functions, or exercising the person’s powers, under this Act; or\n (e) the person is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory; or\n (f) the information is disclosed to the person under this section and the collection, recording, disclosure or use is for the purposes for which the information was disclosed to the person; or\n (g) all of the following apply:\n (i) the person is the Secretary;\n (ii) the collection, recording, disclosure or use is for the purposes of disclosing information to a professional disciplinary authority, a child protection officer or an enforcement body;\n (iii) the person reasonably believes that the information will enable or assist the authority, officer or body to perform or exercise any of the authority’s, officer’s or body’s functions or powers; or\n (h) the person does so for the purposes of court or tribunal proceedings, or in accordance with an order of a court or tribunal; or\n (i) the person does so for the purposes of a coronial inquiry, or in accordance with an order of a coroner.\n\n> Note 1: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n> Note 2: For paragraph (c), collection, recording, disclosure or use by a listed representative of a participating State or Territory is authorised under this subsection if the law of the State or Territory does not prevent the collection, recording, disclosure or use.\n\n (4) Subsection (3) does not apply to protected information or key information to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n (5) Collection, recording, disclosure or use of personal information for the purposes of research of a kind to which guidelines approved under section 95 or 95A of the Privacy Act 1988 relate is authorised under paragraph (3)(a) or (f) only if the collection, recording, use or disclosure is in accordance with the guidelines.\n\n#### 18 Offence relating to protected information\n\n A person commits an offence if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is protected information; and\n (c) the making of the record, or the disclosure or use, is not authorised by section 17.\n\nPenalty: Imprisonment for 2 years or 120 penalty units, or both.\n\n#### 19 Exception for use in good faith\n\n Section 18 does not apply to a person to the extent that the person makes a record of, discloses or otherwise uses protected information in good faith and in purported compliance with section 17.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 20 Exception if unaware information is commercial‑in‑confidence\n\n Section 18 does not apply to a person if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is commercial‑in‑confidence; and\n (c) the person does not know that the information is commercial‑in‑confidence.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 21 Exceptions relating to the person to whom the protected information relates\n\n (1) Section 18 does not apply to a person if:\n (a) the person discloses protected information to the person to whom the information relates; or\n (b) the person is the person to whom the protected information relates; or\n (c) the making of the record, or the disclosure or use, of the protected information is in accordance with the express or implied consent of the person to whom the information relates.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).\n\n (2) Subsection (1) applies as if a reference in that subsection to the person to whom the protected information relates includes a reference to the person’s personal representative.\n\n#### 22 Exception for disclosure to person who provided the information\n\n Section 18 does not apply to a person if:\n (a) the person obtains protected information from another person; and\n (b) the person discloses that information to the other person.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 22A Data breaches\n\n Notification of contraventions and possible contraventions\n (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.\n\n> Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\n (2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify:\n (a) the Secretary; and\n (b) the Information Commissioner.\n\n> Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\nCivil penalty: 100 penalty units.\n\n (3) A notice given under subsection (1) or (2) must set out the following:\n (a) a description of the contravention that has occurred or may have occurred;\n (b) the kind or kinds of information concerned;\n (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider.\n Handling possible contraventions\n (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the possible contravention;\n (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention;\n (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register:\n (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or\n (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.\n\n Handling contraventions\n (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;\n (b) evaluate any risks that may be related to or arise out of the contravention;\n (c) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;\n (d) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;\n (e) take steps to prevent or mitigate the effects of further contraventions.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.\n\n Secretary’s duty\n (6) The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).\n No need to report or consult if already done\n (7) A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.\n (8) A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.\n (9) A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:\n (a) given notice in relation to the contravention under subsection (1) or (2); or\n (b) consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).\n Contracted service providers\n (10) In this Act:\n contracted service provider means a person who:\n (a) is engaged under an agreement referred to in section 26; and\n (b) obtains protected information in the course of performing services under the agreement.\n\n#### 22B Contravention is an interference with privacy\n\n (1) An act or practice that contravenes section 18 or subsection 22A(1), (2), (4), (5) or (6) is taken to be:\n (a) for the purposes of the Privacy Act 1988, an interference with the privacy of an individual; and\n (b) covered by section 13 of that Act.\n (2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the person who engaged in the act or practice.\n (3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the register:\n (a) to investigate an act or practice that may be an interference with the privacy of an individual under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;\n (b) to do anything incidental or conducive to the performance of those functions.\n (4) The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).\n\n> Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.\n\n#### 22C Information Commissioner may disclose details of investigations to the Secretary\n\n The Information Commissioner is authorised to disclose to the Secretary any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 22B, if the Information Commissioner is satisfied that to do so will enable the Commonwealth to monitor or improve the operation or security of the register.\n\n## Part 4—Other matters\n\n#### 23 Simplified outline of this Part\n\nThis Part deals with other matters, such as civil penalties, approved forms, agreements, delegations and rules.\n\n#### 24 Civil penalty provisions\n\n Enforceable civil penalty provisions\n (1) Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.\n\n> Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.\n\n Authorised applicant\n (2) For the purposes of Part 4 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to the civil penalty provisions of this Act:\n (a) the Secretary;\n (b) an SES employee, or an acting SES employee, in the Department.\n Relevant court\n (3) For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:\n (a) the Federal Court of Australia;\n (b) the Federal Circuit and Family Court of Australia (Division 2);\n (c) a court of a State or Territory that has jurisdiction in relation to the matter.\n Extension to external Territories\n (4) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.\n Liability of Crown\n (5) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.\n\n#### 25 Approved forms\n\n (1) The Minister may, in writing, approve a form for the purposes of a provision of this Act.\n (2) A request or withdrawal of a request required by a provision of this Act to be in the approved form must be given to the person specified in the form for that purpose.\n\n#### 26 Agreements\n\n The Minister may, on behalf of the Commonwealth, engage a person under a written agreement to perform services for or on behalf of the Commonwealth in connection with functions of the Commonwealth, the Minister or the Commonwealth Chief Medical Officer under this Act.\n\n#### 27 Delegation\n\n (1) The Minister may, in writing, delegate his or her functions or powers under:\n (a) section 5 (about commercial‑in‑confidence information); or\n (b) section 25 (about approving forms); or\n (c) section 26 (about engaging persons under agreements);\n to an SES employee, or an acting SES employee, in the Department.\n (2) The Secretary may, in writing, delegate his or her functions or powers under:\n (a) paragraph 17(3)(g) (about disclosing information); or\n (b) section 22A (about data breaches);\n to an SES employee, or an acting SES employee, in the Department.\n (3) In performing a function, or exercising a power, under a delegation, the delegate must comply with any directions of the Minister or the Secretary.\n\n#### 28 Rules\n\n (1) The Minister may, by legislative instrument, make rules prescribing matters:\n (a) required or permitted by this Act to be prescribed by the rules; or\n (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.\n (1A) Before making rules for the purposes of:\n (a) paragraph (l) of the definition of key information in section 4; or\n (b) paragraph 11(g);\n the Minister must consult the Information Commissioner in relation to matters that relate to the privacy functions (within the meaning of the Australian Information Commissioner Act 2010) and have regard to any submissions made by the Information Commissioner because of that consultation.\n (2) To avoid doubt, the rules may not do the following:\n (a) create an offence or civil penalty;\n (b) provide powers of:\n (i) arrest or detention; or\n (ii) entry, search or seizure;\n (c) impose a tax;\n (d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;\n (e) directly amend the text of this Act.","sortOrder":11},{"sectionNumber":"9","sectionType":"section","heading":"Establishment of the register","content":"#### 9 Establishment of the register\n\n (1) The Commonwealth must establish and keep a register to be called the National Cancer Screening Register.\n (2) Parts of the register may be kept separate from each other, and be called different names.\n (3) The register is not a legislative instrument.","sortOrder":12},{"sectionNumber":"10","sectionType":"section","heading":"Coverage of the register","content":"#### 10 Coverage of the register\n\n (1) The register may include information relating to individuals in connection with screening associated with bowel cancer.\n (2) The register may include information relating to individuals in connection with screening associated with cervical cancer.\n (3) The register may include information relating to individuals in connection with screening associated with lung cancer.","sortOrder":13},{"sectionNumber":"11","sectionType":"section","heading":"Contents of the register","content":"#### 11 Contents of the register\n\n The register may include the following for each individual:\n (a) the individual’s key information;\n (b) details of the individual’s nominated healthcare provider for screening associated with a designated cancer, if any, including the healthcare provider’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010);\n (c) information about screening tests undergone or to be undergone by the individual;\n (d) if the individual is diagnosed with a designated cancer or a precursor to a designated cancer, that diagnosis;\n (e) claims information which may indicate whether or not the individual has undergone or should undergo screening associated with a designated cancer;\n (f) details of any request or withdrawal made by the individual under section 14;\n (g) any other information relevant to the purposes of the register and prescribed by the rules.","sortOrder":14},{"sectionNumber":"12","sectionType":"section","heading":"Purposes of the register","content":"#### 12 Purposes of the register\n\n (1) The purposes of the register are to facilitate the following:\n (a) establishing and keeping an electronic database of records relating to screening and diagnoses associated with the designated cancers;\n (b) collecting, analysing and publishing statistics and other information relating to screening and diagnoses associated with the designated cancers;\n (c) monitoring the effectiveness, quality and safety of screening and diagnoses associated with the designated cancers;\n (d) providing an individual with an invitation to undergo screening;\n (e) providing an individual with a test kit for screening;\n (f) advising an individual when the individual is due to undergo a screening test or when action may need to be taken after a screening test;\n (g) advising an individual’s nominated healthcare provider for screening associated with a designated cancer (if any) when the individual is due to undergo, or when action may need to be taken after, a screening test associated with the designated cancer;\n (h) advising a participating State or Territory when action may need to be taken after a screening test for an individual residing in the State or Territory;\n (i) providing an individual access to information relating to the individual about screening and diagnoses associated with a designated cancer;\n (j) providing healthcare providers access to information about screening and diagnoses associated with a designated cancer in relation to an individual, for the purposes of providing healthcare to the individual in relation to the designated cancer;\n (k) providing a participating State or Territory with access to information relating to individuals residing in the State or Territory in connection with screening and diagnoses associated with the designated cancers;\n (l) planning, delivering and promoting healthcare and services in relation to the designated cancers;\n (m) reporting to international organisations in relation to the designated cancers;\n (n) research relating to healthcare, screening or a designated cancer.\n (2) For an individual who has a personal representative:\n (a) paragraphs (1)(d) and (e) also apply to providing the representative with an invitation or test kit for the individual; and\n (b) paragraph (1)(f) also applies to advising the representative; and\n (c) paragraph (1)(i) also applies to providing the representative access to information relating to the individual.","sortOrder":15},{"sectionNumber":"Division 3","sectionType":"division","heading":"Notification to the register","content":"An Act to establish and provide for a cancer screening register, and for related purposes\n\n## Part 1—Preliminary\n\n#### 1 Short title\n\n This Act is the National Cancer Screening Register Act 2016.\n\n#### 2 Commencement\n\n (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n```html\n

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1. Sections 1 to 12 and anything in this Act not elsewhere covered by this table

The day after this Act receives the Royal Assent.

21 October 2016

2. Section 13

1 May 2017.

1 May 2017

3. Sections 14 to 28

At the same time as the provisions covered by table item 1.

21 October 2016

\n```\n\n> Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.\n\n (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.\n\n#### 3 Simplified outline of this Act\n\nThis Act establishes a register of information about screening associated with certain types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nThere are protections for sensitive information.\n\n#### 4 Definitions\n\n In this Act:\n\n> approved form means a form approved under subsection 25(1).\n\n> child protection officer means an officer or employee of a State or Territory, or of a State or Territory authority, who has functions, powers or duties in relation to the care, protection or welfare of children.\n\n> civil penalty provision has the same meaning as in the Regulatory Powers Act.\n\n> claims information means information about:\n\n (a) claims for medicare benefit under Part II of the Health Insurance Act 1973; or\n (b) treatment, other than information that relates to compensation or benefits, provided under any of the following Acts:\n (i) the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006;\n (ii) the Military Rehabilitation and Compensation Act 2004;\n (iii) the Safety, Rehabilitation and Compensation Act 1988;\n (iiia) the Treatment Benefits (Special Access) Act 2019;\n (iv) the Veterans’ Entitlements Act 1986.\n\n> commercial‑in‑confidence has the meaning given by section 5.\n\n> contracted service provider has the meaning given by subsection 22A(10).\n\n> designated cancer means one of the following types of cancer:\n\n (a) bowel cancer;\n (b) cervical cancer;\n (c) lung cancer.\n\n> enforcement body has the same meaning as in the Privacy Act 1988.\n\n> entity means:\n\n (a) a person; or\n (b) a partnership; or\n (c) any other unincorporated association or body; or\n (d) a trust; or\n (e) a part of another entity (under a previous application of this definition).\n\n> healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.\n\n> healthcare provider means:\n\n (a) an individual healthcare provider; or\n (b) a healthcare provider organisation.\n\n> healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).\n\n> Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be part of an entity.\n\n> individual healthcare provider means an individual who:\n\n (a) has provided, provides, or is to provide, healthcare; or\n (b) is registered by a registration authority as a member of a particular health profession.\n\n> key information for an individual means the following:\n\n (a) the individual’s name, address, contact details, date of birth and gender;\n (b) the individual’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010) if any;\n (c) the individual’s medicare number (within the meaning of Part VII of the National Health Act 1953) if any;\n (d) the number allocated to the individual by the Veterans’ Affairs Department if any;\n (e) if applicable, the individual’s date of death;\n (f) if the register includes information relating to the individual in connection with screening associated with cervical cancer:\n (i) the individual’s sex; and\n (ii) the individual’s Human Papillomavirus vaccination status and number of doses of the vaccine administered to the individual;\n (g) the individual’s Indigenous status;\n (h) the individual’s country of origin or cultural identity;\n (i) the individual’s preferred language and whether an interpreter is required to facilitate communication with the individual;\n (j) the name and contact details of a personal representative of the individual if any;\n (k) if applicable, information on assistance required by the individual for the purposes of this Act because of a medical condition or disability;\n (l) any other information of a kind relevant to the purposes of the register and prescribed by the rules for the purposes of this definition.\n\n> nominated healthcare provider of an individual, for screening associated with a designated cancer, means the healthcare provider the individual requested be recorded for screening associated with the designated cancer in a request in effect under section 14.\n\n> parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975.\n\n> participating State or Territory means a State or Territory that has agreed with the Commonwealth to participate in the register.\n\n> personal information has the same meaning as in the Privacy Act 1988.\n\n> personal representative, of an individual, means:\n\n (a) a parent or guardian of the individual, if the individual is incapable of managing his or her health affairs; or\n (b) a trustee of an estate of the individual, if the individual is under a legal disability; or\n (c) a person who holds an enduring power of attorney granted by the individual; or\n (d) a person nominated by the individual for the purpose of managing the individual’s affairs in relation to screening associated with a designated cancer.\n\n> professional disciplinary authority means:\n\n (a) a registration authority; or\n (b) the Health Care Complaints Commission established by the Health Care Complaints Act 1993 (NSW); or\n (c) the Health Ombudsman appointed under the Health Ombudsman Act 2013 (Qld); or\n (d) any other authority that is responsible for investigating complaints about the professional conduct of individual healthcare providers.\n\n> protected information means personal information or information that is commercial‑in‑confidence, to the extent that the information is:\n\n (a) included in the register or otherwise obtained under, or in accordance with, this Act; or\n (b) derived from a record of information that was included in the register or was otherwise obtained under, or in accordance with, this Act; or\n (c) derived from a disclosure or use of information that was included in the register or was otherwise obtained under, or in accordance with, this Act.\n\n> purposes of the register means the purposes set out in section 12.\n\n> register means the National Cancer Screening Register established under section 9.\n\n> registration authority means an entity that is responsible under a law for registering members of a particular health profession.\n\n> Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.\n\n> rules means the rules made under section 28.\n\n> screening means a process in which an individual undergoes testing or procedures in order to determine whether the individual has:\n\n (a) a designated cancer or a precursor to a designated cancer; or\n (b) any indicator, including genetic markers or cell abnormalities, that may lead to a designated cancer.\n\n> screening test means a test or procedure as part of screening.\n\n> Secretary means the Secretary of the Department.\n\n> State or Territory authority has the same meaning as in the Privacy Act 1988.\n\n> Veterans’ Affairs Department means the Department administered by the Minister administering the Veterans’ Entitlements Act 1986.\n\n#### 5 Meaning of commercial‑in‑confidence\n\n Information is commercial‑in‑confidence if a person demonstrates to the Minister that:\n (a) release of the information would cause competitive detriment to the person; and\n (b) the information is not in the public domain; and\n (c) the information is not required to be disclosed under a law of the Commonwealth, or of a State or Territory; and\n (d) the information is not readily discoverable.\n\n#### 6 Act binds the Crown\n\n This Act binds the Crown in each of its capacities. However, it does not make the Crown liable to be prosecuted for an offence.\n\n> Note: See subsection 24(5) in relation to civil penalties.\n\n#### 7 Act extends to external Territories\n\n This Act extends to every external Territory.\n\n## Part 2—Register\n\n### Division 1—Simplified outline of this Part\n\n#### 8 Simplified outline of this Part\n\nThe National Cancer Screening Register is established to keep information about cancer screening and diagnoses associated with particular types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nCertain healthcare providers are required to notify the Commonwealth Chief Medical Officer about certain types of screening test or diagnosis. In most circumstances, this information will be included on the register.\n\nIndividuals can make a number of requests in relation to the register. For example, an individual can opt out of receiving information from the register. An individual can also request that information notified by healthcare providers relating to the individual not be included in the register.\n\n### Division 2—Establishment, contents and purposes\n\n#### 9 Establishment of the register\n\n (1) The Commonwealth must establish and keep a register to be called the National Cancer Screening Register.\n (2) Parts of the register may be kept separate from each other, and be called different names.\n (3) The register is not a legislative instrument.\n\n#### 10 Coverage of the register\n\n (1) The register may include information relating to individuals in connection with screening associated with bowel cancer.\n (2) The register may include information relating to individuals in connection with screening associated with cervical cancer.\n (3) The register may include information relating to individuals in connection with screening associated with lung cancer.\n\n#### 11 Contents of the register\n\n The register may include the following for each individual:\n (a) the individual’s key information;\n (b) details of the individual’s nominated healthcare provider for screening associated with a designated cancer, if any, including the healthcare provider’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010);\n (c) information about screening tests undergone or to be undergone by the individual;\n (d) if the individual is diagnosed with a designated cancer or a precursor to a designated cancer, that diagnosis;\n (e) claims information which may indicate whether or not the individual has undergone or should undergo screening associated with a designated cancer;\n (f) details of any request or withdrawal made by the individual under section 14;\n (g) any other information relevant to the purposes of the register and prescribed by the rules.\n\n#### 12 Purposes of the register\n\n (1) The purposes of the register are to facilitate the following:\n (a) establishing and keeping an electronic database of records relating to screening and diagnoses associated with the designated cancers;\n (b) collecting, analysing and publishing statistics and other information relating to screening and diagnoses associated with the designated cancers;\n (c) monitoring the effectiveness, quality and safety of screening and diagnoses associated with the designated cancers;\n (d) providing an individual with an invitation to undergo screening;\n (e) providing an individual with a test kit for screening;\n (f) advising an individual when the individual is due to undergo a screening test or when action may need to be taken after a screening test;\n (g) advising an individual’s nominated healthcare provider for screening associated with a designated cancer (if any) when the individual is due to undergo, or when action may need to be taken after, a screening test associated with the designated cancer;\n (h) advising a participating State or Territory when action may need to be taken after a screening test for an individual residing in the State or Territory;\n (i) providing an individual access to information relating to the individual about screening and diagnoses associated with a designated cancer;\n (j) providing healthcare providers access to information about screening and diagnoses associated with a designated cancer in relation to an individual, for the purposes of providing healthcare to the individual in relation to the designated cancer;\n (k) providing a participating State or Territory with access to information relating to individuals residing in the State or Territory in connection with screening and diagnoses associated with the designated cancers;\n (l) planning, delivering and promoting healthcare and services in relation to the designated cancers;\n (m) reporting to international organisations in relation to the designated cancers;\n (n) research relating to healthcare, screening or a designated cancer.\n (2) For an individual who has a personal representative:\n (a) paragraphs (1)(d) and (e) also apply to providing the representative with an invitation or test kit for the individual; and\n (b) paragraph (1)(f) also applies to advising the representative; and\n (c) paragraph (1)(i) also applies to providing the representative access to information relating to the individual.\n\n### Division 3—Notification to the register\n\n#### 13 Requirement to notify\n\n (1) The individual healthcare provider prescribed by the rules for a type of screening test or diagnosis prescribed by the rules must notify the Commonwealth Chief Medical Officer in the approved form, by the time prescribed by the rules, of the information prescribed by the rules for the type of screening test or diagnosis.\n (2) A person is liable to a civil penalty if the person contravenes subsection (1).\n\nCivil penalty: 30 penalty units.\n\n### Division 4—Requests about the register\n\n#### 14 Requests about participation in the register\n\n (1) An individual may, in the approved form, make any of the following requests:\n (a) that a particular healthcare provider be recorded as the individual’s nominated healthcare provider for screening associated with a designated cancer;\n (b) that the individual not be given, at all or for a period of time, by (or on behalf of) the Commonwealth:\n (i) any invitation of a kind referred to in paragraph 12(1)(d) or test kit referred to in paragraph 12(1)(e) in relation to screening associated with a designated cancer; or\n (ii) any advice of a kind referred to in paragraph 12(1)(f) in relation to screening associated with a designated cancer;\n (c) that information relating to the individual that is:\n (i) about a designated cancer; and\n (ii) notified under section 13 after the date of the request;\n not be included in the register;\n (d) that a date by which the register indicates the individual is due to undergo a screening test associated with cervical cancer be changed;\n (e) that the register use a pseudonym for the individual.\n (2) An individual may, in the approved form, withdraw any request made under subsection (1).\n (3) The Commonwealth must give effect to a request or withdrawal under this section as soon as practicable.\n (4) A personal representative of the individual may make or withdraw a request under this section on behalf of the individual.\n\n### Division 5—Alternative constitutional bases\n\n#### 15 Alternative constitutional bases\n\n (1) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to matters relating to:\n (a) the provision of pharmaceutical and sickness benefits; or\n (b) the provision of medical services (without any form of civil conscription); or\n (c) census and statistics; or\n (d) postal, telegraphic, telephonic and other like services; or\n (e) external affairs, including:\n (i) giving effect to the International Covenant on Economic, Social and Cultural Rights done at New York on 16 December 1966, in particular Article 12, or to another international agreement to which Australia is a party; or\n (ii) addressing matters of international concern; or\n (f) a Territory or a Commonwealth place (within the meaning of the Commonwealth Places (Application of Laws) Act 1970); or\n (g) the implied power of the Parliament to make laws with respect to nationhood; or\n (h) the executive power of the Commonwealth; or\n (i) matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.\n\n> Note: The International Covenant on Economic, Social and Cultural Rights is in Australian Treaty Series 1976 No. 5 (\\[1976\\] ATS 5) and could in 2016 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).\n\n (2) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to acts or omissions of corporations to which paragraph 51(xx) of the Constitution applies.\n (3) A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.\n\n## Part 3—Dealing with information in the register\n\n#### 16 Simplified outline of this Part\n\nInformation can be collected for inclusion in the register.\n\nPersonal information included in the register, or derived from information included in the register, is “protected information”.\n\nSection 18 makes it an offence for a person to record, disclose or use protected information without authorisation.\n\nRecording, disclosure and use of protected information is authorised in specific circumstances, including for the purposes of the register and by healthcare providers and States and Territories.\n\nThere are also a number of exceptions to the offence.\n\n#### 17 Authorised dealings with information\n\n Uploading personal information etc. to the register\n (1) A person may collect, make a record of, disclose or otherwise use:\n (a) personal information; or\n (b) key information for an individual; or\n (c) information that is commercial‑in‑confidence;\n if the person does so for the purposes of including information in the register.\n\n> Note: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n (2) Subsection (1) does not apply to information notified under section 13 to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n Using or disclosing information in the register\n (3) A person may collect, make a record of, disclose or otherwise use protected information, or key information included in the register, if:\n (a) the person does so for the purposes of the register and is:\n (i) an officer or employee of the Commonwealth or of an authority of the Commonwealth; or\n (ii) engaged by the Commonwealth, or by an authority of the Commonwealth, to perform work relating to the purposes of the register; or\n (iii) an officer or employee of a person referred to in subparagraph (ii), or engaged by a person referred to in subparagraph (ii) to perform work relating to the purposes of the register; or\n (b) all of the following apply:\n (i) the person is a healthcare provider;\n (ii) the information is about screening or diagnosis associated with a designated cancer in relation to an individual;\n (iii) the collection, recording, disclosure or use is for the purposes of providing healthcare to the individual in relation to the designated cancer; or\n (c) the collection, recording, disclosure or use is required or permitted by the law of a participating State or Territory, and the person is:\n (i) a State or Territory authority of the participating State or Territory; or\n (ii) an officer or employee of the participating State or Territory, or of a State or Territory authority of the participating State or Territory; or\n (iii) engaged by the participating State or Territory, or by a State or Territory authority of the participating State or Territory, to perform work relating to the information; or\n (iv) an officer or employee of a person referred to in subparagraph (iii), or engaged by a person referred to in subparagraph (iii) to perform work relating to the information; or\n (d) the person does so for the purposes of performing the person’s functions, or exercising the person’s powers, under this Act; or\n (e) the person is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory; or\n (f) the information is disclosed to the person under this section and the collection, recording, disclosure or use is for the purposes for which the information was disclosed to the person; or\n (g) all of the following apply:\n (i) the person is the Secretary;\n (ii) the collection, recording, disclosure or use is for the purposes of disclosing information to a professional disciplinary authority, a child protection officer or an enforcement body;\n (iii) the person reasonably believes that the information will enable or assist the authority, officer or body to perform or exercise any of the authority’s, officer’s or body’s functions or powers; or\n (h) the person does so for the purposes of court or tribunal proceedings, or in accordance with an order of a court or tribunal; or\n (i) the person does so for the purposes of a coronial inquiry, or in accordance with an order of a coroner.\n\n> Note 1: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n> Note 2: For paragraph (c), collection, recording, disclosure or use by a listed representative of a participating State or Territory is authorised under this subsection if the law of the State or Territory does not prevent the collection, recording, disclosure or use.\n\n (4) Subsection (3) does not apply to protected information or key information to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n (5) Collection, recording, disclosure or use of personal information for the purposes of research of a kind to which guidelines approved under section 95 or 95A of the Privacy Act 1988 relate is authorised under paragraph (3)(a) or (f) only if the collection, recording, use or disclosure is in accordance with the guidelines.\n\n#### 18 Offence relating to protected information\n\n A person commits an offence if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is protected information; and\n (c) the making of the record, or the disclosure or use, is not authorised by section 17.\n\nPenalty: Imprisonment for 2 years or 120 penalty units, or both.\n\n#### 19 Exception for use in good faith\n\n Section 18 does not apply to a person to the extent that the person makes a record of, discloses or otherwise uses protected information in good faith and in purported compliance with section 17.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 20 Exception if unaware information is commercial‑in‑confidence\n\n Section 18 does not apply to a person if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is commercial‑in‑confidence; and\n (c) the person does not know that the information is commercial‑in‑confidence.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 21 Exceptions relating to the person to whom the protected information relates\n\n (1) Section 18 does not apply to a person if:\n (a) the person discloses protected information to the person to whom the information relates; or\n (b) the person is the person to whom the protected information relates; or\n (c) the making of the record, or the disclosure or use, of the protected information is in accordance with the express or implied consent of the person to whom the information relates.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).\n\n (2) Subsection (1) applies as if a reference in that subsection to the person to whom the protected information relates includes a reference to the person’s personal representative.\n\n#### 22 Exception for disclosure to person who provided the information\n\n Section 18 does not apply to a person if:\n (a) the person obtains protected information from another person; and\n (b) the person discloses that information to the other person.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 22A Data breaches\n\n Notification of contraventions and possible contraventions\n (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.\n\n> Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\n (2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify:\n (a) the Secretary; and\n (b) the Information Commissioner.\n\n> Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\nCivil penalty: 100 penalty units.\n\n (3) A notice given under subsection (1) or (2) must set out the following:\n (a) a description of the contravention that has occurred or may have occurred;\n (b) the kind or kinds of information concerned;\n (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider.\n Handling possible contraventions\n (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the possible contravention;\n (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention;\n (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register:\n (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or\n (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.\n\n Handling contraventions\n (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;\n (b) evaluate any risks that may be related to or arise out of the contravention;\n (c) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;\n (d) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;\n (e) take steps to prevent or mitigate the effects of further contraventions.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.\n\n Secretary’s duty\n (6) The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).\n No need to report or consult if already done\n (7) A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.\n (8) A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.\n (9) A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:\n (a) given notice in relation to the contravention under subsection (1) or (2); or\n (b) consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).\n Contracted service providers\n (10) In this Act:\n contracted service provider means a person who:\n (a) is engaged under an agreement referred to in section 26; and\n (b) obtains protected information in the course of performing services under the agreement.\n\n#### 22B Contravention is an interference with privacy\n\n (1) An act or practice that contravenes section 18 or subsection 22A(1), (2), (4), (5) or (6) is taken to be:\n (a) for the purposes of the Privacy Act 1988, an interference with the privacy of an individual; and\n (b) covered by section 13 of that Act.\n (2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the person who engaged in the act or practice.\n (3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the register:\n (a) to investigate an act or practice that may be an interference with the privacy of an individual under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;\n (b) to do anything incidental or conducive to the performance of those functions.\n (4) The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).\n\n> Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.\n\n#### 22C Information Commissioner may disclose details of investigations to the Secretary\n\n The Information Commissioner is authorised to disclose to the Secretary any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 22B, if the Information Commissioner is satisfied that to do so will enable the Commonwealth to monitor or improve the operation or security of the register.\n\n## Part 4—Other matters\n\n#### 23 Simplified outline of this Part\n\nThis Part deals with other matters, such as civil penalties, approved forms, agreements, delegations and rules.\n\n#### 24 Civil penalty provisions\n\n Enforceable civil penalty provisions\n (1) Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.\n\n> Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.\n\n Authorised applicant\n (2) For the purposes of Part 4 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to the civil penalty provisions of this Act:\n (a) the Secretary;\n (b) an SES employee, or an acting SES employee, in the Department.\n Relevant court\n (3) For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:\n (a) the Federal Court of Australia;\n (b) the Federal Circuit and Family Court of Australia (Division 2);\n (c) a court of a State or Territory that has jurisdiction in relation to the matter.\n Extension to external Territories\n (4) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.\n Liability of Crown\n (5) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.\n\n#### 25 Approved forms\n\n (1) The Minister may, in writing, approve a form for the purposes of a provision of this Act.\n (2) A request or withdrawal of a request required by a provision of this Act to be in the approved form must be given to the person specified in the form for that purpose.\n\n#### 26 Agreements\n\n The Minister may, on behalf of the Commonwealth, engage a person under a written agreement to perform services for or on behalf of the Commonwealth in connection with functions of the Commonwealth, the Minister or the Commonwealth Chief Medical Officer under this Act.\n\n#### 27 Delegation\n\n (1) The Minister may, in writing, delegate his or her functions or powers under:\n (a) section 5 (about commercial‑in‑confidence information); or\n (b) section 25 (about approving forms); or\n (c) section 26 (about engaging persons under agreements);\n to an SES employee, or an acting SES employee, in the Department.\n (2) The Secretary may, in writing, delegate his or her functions or powers under:\n (a) paragraph 17(3)(g) (about disclosing information); or\n (b) section 22A (about data breaches);\n to an SES employee, or an acting SES employee, in the Department.\n (3) In performing a function, or exercising a power, under a delegation, the delegate must comply with any directions of the Minister or the Secretary.\n\n#### 28 Rules\n\n (1) The Minister may, by legislative instrument, make rules prescribing matters:\n (a) required or permitted by this Act to be prescribed by the rules; or\n (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.\n (1A) Before making rules for the purposes of:\n (a) paragraph (l) of the definition of key information in section 4; or\n (b) paragraph 11(g);\n the Minister must consult the Information Commissioner in relation to matters that relate to the privacy functions (within the meaning of the Australian Information Commissioner Act 2010) and have regard to any submissions made by the Information Commissioner because of that consultation.\n (2) To avoid doubt, the rules may not do the following:\n (a) create an offence or civil penalty;\n (b) provide powers of:\n (i) arrest or detention; or\n (ii) entry, search or seizure;\n (c) impose a tax;\n (d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;\n (e) directly amend the text of this Act.","sortOrder":16},{"sectionNumber":"13","sectionType":"section","heading":"Requirement to notify","content":"#### 13 Requirement to notify\n\n (1) The individual healthcare provider prescribed by the rules for a type of screening test or diagnosis prescribed by the rules must notify the Commonwealth Chief Medical Officer in the approved form, by the time prescribed by the rules, of the information prescribed by the rules for the type of screening test or diagnosis.\n (2) A person is liable to a civil penalty if the person contravenes subsection (1).\n\nCivil penalty: 30 penalty units.","sortOrder":17},{"sectionNumber":"Division 4","sectionType":"division","heading":"Requests about the register","content":"An Act to establish and provide for a cancer screening register, and for related purposes\n\n## Part 1—Preliminary\n\n#### 1 Short title\n\n This Act is the National Cancer Screening Register Act 2016.\n\n#### 2 Commencement\n\n (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n```html\n

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1. Sections 1 to 12 and anything in this Act not elsewhere covered by this table

The day after this Act receives the Royal Assent.

21 October 2016

2. Section 13

1 May 2017.

1 May 2017

3. Sections 14 to 28

At the same time as the provisions covered by table item 1.

21 October 2016

\n```\n\n> Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.\n\n (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.\n\n#### 3 Simplified outline of this Act\n\nThis Act establishes a register of information about screening associated with certain types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nThere are protections for sensitive information.\n\n#### 4 Definitions\n\n In this Act:\n\n> approved form means a form approved under subsection 25(1).\n\n> child protection officer means an officer or employee of a State or Territory, or of a State or Territory authority, who has functions, powers or duties in relation to the care, protection or welfare of children.\n\n> civil penalty provision has the same meaning as in the Regulatory Powers Act.\n\n> claims information means information about:\n\n (a) claims for medicare benefit under Part II of the Health Insurance Act 1973; or\n (b) treatment, other than information that relates to compensation or benefits, provided under any of the following Acts:\n (i) the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006;\n (ii) the Military Rehabilitation and Compensation Act 2004;\n (iii) the Safety, Rehabilitation and Compensation Act 1988;\n (iiia) the Treatment Benefits (Special Access) Act 2019;\n (iv) the Veterans’ Entitlements Act 1986.\n\n> commercial‑in‑confidence has the meaning given by section 5.\n\n> contracted service provider has the meaning given by subsection 22A(10).\n\n> designated cancer means one of the following types of cancer:\n\n (a) bowel cancer;\n (b) cervical cancer;\n (c) lung cancer.\n\n> enforcement body has the same meaning as in the Privacy Act 1988.\n\n> entity means:\n\n (a) a person; or\n (b) a partnership; or\n (c) any other unincorporated association or body; or\n (d) a trust; or\n (e) a part of another entity (under a previous application of this definition).\n\n> healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.\n\n> healthcare provider means:\n\n (a) an individual healthcare provider; or\n (b) a healthcare provider organisation.\n\n> healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).\n\n> Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be part of an entity.\n\n> individual healthcare provider means an individual who:\n\n (a) has provided, provides, or is to provide, healthcare; or\n (b) is registered by a registration authority as a member of a particular health profession.\n\n> key information for an individual means the following:\n\n (a) the individual’s name, address, contact details, date of birth and gender;\n (b) the individual’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010) if any;\n (c) the individual’s medicare number (within the meaning of Part VII of the National Health Act 1953) if any;\n (d) the number allocated to the individual by the Veterans’ Affairs Department if any;\n (e) if applicable, the individual’s date of death;\n (f) if the register includes information relating to the individual in connection with screening associated with cervical cancer:\n (i) the individual’s sex; and\n (ii) the individual’s Human Papillomavirus vaccination status and number of doses of the vaccine administered to the individual;\n (g) the individual’s Indigenous status;\n (h) the individual’s country of origin or cultural identity;\n (i) the individual’s preferred language and whether an interpreter is required to facilitate communication with the individual;\n (j) the name and contact details of a personal representative of the individual if any;\n (k) if applicable, information on assistance required by the individual for the purposes of this Act because of a medical condition or disability;\n (l) any other information of a kind relevant to the purposes of the register and prescribed by the rules for the purposes of this definition.\n\n> nominated healthcare provider of an individual, for screening associated with a designated cancer, means the healthcare provider the individual requested be recorded for screening associated with the designated cancer in a request in effect under section 14.\n\n> parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975.\n\n> participating State or Territory means a State or Territory that has agreed with the Commonwealth to participate in the register.\n\n> personal information has the same meaning as in the Privacy Act 1988.\n\n> personal representative, of an individual, means:\n\n (a) a parent or guardian of the individual, if the individual is incapable of managing his or her health affairs; or\n (b) a trustee of an estate of the individual, if the individual is under a legal disability; or\n (c) a person who holds an enduring power of attorney granted by the individual; or\n (d) a person nominated by the individual for the purpose of managing the individual’s affairs in relation to screening associated with a designated cancer.\n\n> professional disciplinary authority means:\n\n (a) a registration authority; or\n (b) the Health Care Complaints Commission established by the Health Care Complaints Act 1993 (NSW); or\n (c) the Health Ombudsman appointed under the Health Ombudsman Act 2013 (Qld); or\n (d) any other authority that is responsible for investigating complaints about the professional conduct of individual healthcare providers.\n\n> protected information means personal information or information that is commercial‑in‑confidence, to the extent that the information is:\n\n (a) included in the register or otherwise obtained under, or in accordance with, this Act; or\n (b) derived from a record of information that was included in the register or was otherwise obtained under, or in accordance with, this Act; or\n (c) derived from a disclosure or use of information that was included in the register or was otherwise obtained under, or in accordance with, this Act.\n\n> purposes of the register means the purposes set out in section 12.\n\n> register means the National Cancer Screening Register established under section 9.\n\n> registration authority means an entity that is responsible under a law for registering members of a particular health profession.\n\n> Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.\n\n> rules means the rules made under section 28.\n\n> screening means a process in which an individual undergoes testing or procedures in order to determine whether the individual has:\n\n (a) a designated cancer or a precursor to a designated cancer; or\n (b) any indicator, including genetic markers or cell abnormalities, that may lead to a designated cancer.\n\n> screening test means a test or procedure as part of screening.\n\n> Secretary means the Secretary of the Department.\n\n> State or Territory authority has the same meaning as in the Privacy Act 1988.\n\n> Veterans’ Affairs Department means the Department administered by the Minister administering the Veterans’ Entitlements Act 1986.\n\n#### 5 Meaning of commercial‑in‑confidence\n\n Information is commercial‑in‑confidence if a person demonstrates to the Minister that:\n (a) release of the information would cause competitive detriment to the person; and\n (b) the information is not in the public domain; and\n (c) the information is not required to be disclosed under a law of the Commonwealth, or of a State or Territory; and\n (d) the information is not readily discoverable.\n\n#### 6 Act binds the Crown\n\n This Act binds the Crown in each of its capacities. However, it does not make the Crown liable to be prosecuted for an offence.\n\n> Note: See subsection 24(5) in relation to civil penalties.\n\n#### 7 Act extends to external Territories\n\n This Act extends to every external Territory.\n\n## Part 2—Register\n\n### Division 1—Simplified outline of this Part\n\n#### 8 Simplified outline of this Part\n\nThe National Cancer Screening Register is established to keep information about cancer screening and diagnoses associated with particular types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nCertain healthcare providers are required to notify the Commonwealth Chief Medical Officer about certain types of screening test or diagnosis. In most circumstances, this information will be included on the register.\n\nIndividuals can make a number of requests in relation to the register. For example, an individual can opt out of receiving information from the register. An individual can also request that information notified by healthcare providers relating to the individual not be included in the register.\n\n### Division 2—Establishment, contents and purposes\n\n#### 9 Establishment of the register\n\n (1) The Commonwealth must establish and keep a register to be called the National Cancer Screening Register.\n (2) Parts of the register may be kept separate from each other, and be called different names.\n (3) The register is not a legislative instrument.\n\n#### 10 Coverage of the register\n\n (1) The register may include information relating to individuals in connection with screening associated with bowel cancer.\n (2) The register may include information relating to individuals in connection with screening associated with cervical cancer.\n (3) The register may include information relating to individuals in connection with screening associated with lung cancer.\n\n#### 11 Contents of the register\n\n The register may include the following for each individual:\n (a) the individual’s key information;\n (b) details of the individual’s nominated healthcare provider for screening associated with a designated cancer, if any, including the healthcare provider’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010);\n (c) information about screening tests undergone or to be undergone by the individual;\n (d) if the individual is diagnosed with a designated cancer or a precursor to a designated cancer, that diagnosis;\n (e) claims information which may indicate whether or not the individual has undergone or should undergo screening associated with a designated cancer;\n (f) details of any request or withdrawal made by the individual under section 14;\n (g) any other information relevant to the purposes of the register and prescribed by the rules.\n\n#### 12 Purposes of the register\n\n (1) The purposes of the register are to facilitate the following:\n (a) establishing and keeping an electronic database of records relating to screening and diagnoses associated with the designated cancers;\n (b) collecting, analysing and publishing statistics and other information relating to screening and diagnoses associated with the designated cancers;\n (c) monitoring the effectiveness, quality and safety of screening and diagnoses associated with the designated cancers;\n (d) providing an individual with an invitation to undergo screening;\n (e) providing an individual with a test kit for screening;\n (f) advising an individual when the individual is due to undergo a screening test or when action may need to be taken after a screening test;\n (g) advising an individual’s nominated healthcare provider for screening associated with a designated cancer (if any) when the individual is due to undergo, or when action may need to be taken after, a screening test associated with the designated cancer;\n (h) advising a participating State or Territory when action may need to be taken after a screening test for an individual residing in the State or Territory;\n (i) providing an individual access to information relating to the individual about screening and diagnoses associated with a designated cancer;\n (j) providing healthcare providers access to information about screening and diagnoses associated with a designated cancer in relation to an individual, for the purposes of providing healthcare to the individual in relation to the designated cancer;\n (k) providing a participating State or Territory with access to information relating to individuals residing in the State or Territory in connection with screening and diagnoses associated with the designated cancers;\n (l) planning, delivering and promoting healthcare and services in relation to the designated cancers;\n (m) reporting to international organisations in relation to the designated cancers;\n (n) research relating to healthcare, screening or a designated cancer.\n (2) For an individual who has a personal representative:\n (a) paragraphs (1)(d) and (e) also apply to providing the representative with an invitation or test kit for the individual; and\n (b) paragraph (1)(f) also applies to advising the representative; and\n (c) paragraph (1)(i) also applies to providing the representative access to information relating to the individual.\n\n### Division 3—Notification to the register\n\n#### 13 Requirement to notify\n\n (1) The individual healthcare provider prescribed by the rules for a type of screening test or diagnosis prescribed by the rules must notify the Commonwealth Chief Medical Officer in the approved form, by the time prescribed by the rules, of the information prescribed by the rules for the type of screening test or diagnosis.\n (2) A person is liable to a civil penalty if the person contravenes subsection (1).\n\nCivil penalty: 30 penalty units.\n\n### Division 4—Requests about the register\n\n#### 14 Requests about participation in the register\n\n (1) An individual may, in the approved form, make any of the following requests:\n (a) that a particular healthcare provider be recorded as the individual’s nominated healthcare provider for screening associated with a designated cancer;\n (b) that the individual not be given, at all or for a period of time, by (or on behalf of) the Commonwealth:\n (i) any invitation of a kind referred to in paragraph 12(1)(d) or test kit referred to in paragraph 12(1)(e) in relation to screening associated with a designated cancer; or\n (ii) any advice of a kind referred to in paragraph 12(1)(f) in relation to screening associated with a designated cancer;\n (c) that information relating to the individual that is:\n (i) about a designated cancer; and\n (ii) notified under section 13 after the date of the request;\n not be included in the register;\n (d) that a date by which the register indicates the individual is due to undergo a screening test associated with cervical cancer be changed;\n (e) that the register use a pseudonym for the individual.\n (2) An individual may, in the approved form, withdraw any request made under subsection (1).\n (3) The Commonwealth must give effect to a request or withdrawal under this section as soon as practicable.\n (4) A personal representative of the individual may make or withdraw a request under this section on behalf of the individual.\n\n### Division 5—Alternative constitutional bases\n\n#### 15 Alternative constitutional bases\n\n (1) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to matters relating to:\n (a) the provision of pharmaceutical and sickness benefits; or\n (b) the provision of medical services (without any form of civil conscription); or\n (c) census and statistics; or\n (d) postal, telegraphic, telephonic and other like services; or\n (e) external affairs, including:\n (i) giving effect to the International Covenant on Economic, Social and Cultural Rights done at New York on 16 December 1966, in particular Article 12, or to another international agreement to which Australia is a party; or\n (ii) addressing matters of international concern; or\n (f) a Territory or a Commonwealth place (within the meaning of the Commonwealth Places (Application of Laws) Act 1970); or\n (g) the implied power of the Parliament to make laws with respect to nationhood; or\n (h) the executive power of the Commonwealth; or\n (i) matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.\n\n> Note: The International Covenant on Economic, Social and Cultural Rights is in Australian Treaty Series 1976 No. 5 (\\[1976\\] ATS 5) and could in 2016 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).\n\n (2) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to acts or omissions of corporations to which paragraph 51(xx) of the Constitution applies.\n (3) A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.\n\n## Part 3—Dealing with information in the register\n\n#### 16 Simplified outline of this Part\n\nInformation can be collected for inclusion in the register.\n\nPersonal information included in the register, or derived from information included in the register, is “protected information”.\n\nSection 18 makes it an offence for a person to record, disclose or use protected information without authorisation.\n\nRecording, disclosure and use of protected information is authorised in specific circumstances, including for the purposes of the register and by healthcare providers and States and Territories.\n\nThere are also a number of exceptions to the offence.\n\n#### 17 Authorised dealings with information\n\n Uploading personal information etc. to the register\n (1) A person may collect, make a record of, disclose or otherwise use:\n (a) personal information; or\n (b) key information for an individual; or\n (c) information that is commercial‑in‑confidence;\n if the person does so for the purposes of including information in the register.\n\n> Note: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n (2) Subsection (1) does not apply to information notified under section 13 to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n Using or disclosing information in the register\n (3) A person may collect, make a record of, disclose or otherwise use protected information, or key information included in the register, if:\n (a) the person does so for the purposes of the register and is:\n (i) an officer or employee of the Commonwealth or of an authority of the Commonwealth; or\n (ii) engaged by the Commonwealth, or by an authority of the Commonwealth, to perform work relating to the purposes of the register; or\n (iii) an officer or employee of a person referred to in subparagraph (ii), or engaged by a person referred to in subparagraph (ii) to perform work relating to the purposes of the register; or\n (b) all of the following apply:\n (i) the person is a healthcare provider;\n (ii) the information is about screening or diagnosis associated with a designated cancer in relation to an individual;\n (iii) the collection, recording, disclosure or use is for the purposes of providing healthcare to the individual in relation to the designated cancer; or\n (c) the collection, recording, disclosure or use is required or permitted by the law of a participating State or Territory, and the person is:\n (i) a State or Territory authority of the participating State or Territory; or\n (ii) an officer or employee of the participating State or Territory, or of a State or Territory authority of the participating State or Territory; or\n (iii) engaged by the participating State or Territory, or by a State or Territory authority of the participating State or Territory, to perform work relating to the information; or\n (iv) an officer or employee of a person referred to in subparagraph (iii), or engaged by a person referred to in subparagraph (iii) to perform work relating to the information; or\n (d) the person does so for the purposes of performing the person’s functions, or exercising the person’s powers, under this Act; or\n (e) the person is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory; or\n (f) the information is disclosed to the person under this section and the collection, recording, disclosure or use is for the purposes for which the information was disclosed to the person; or\n (g) all of the following apply:\n (i) the person is the Secretary;\n (ii) the collection, recording, disclosure or use is for the purposes of disclosing information to a professional disciplinary authority, a child protection officer or an enforcement body;\n (iii) the person reasonably believes that the information will enable or assist the authority, officer or body to perform or exercise any of the authority’s, officer’s or body’s functions or powers; or\n (h) the person does so for the purposes of court or tribunal proceedings, or in accordance with an order of a court or tribunal; or\n (i) the person does so for the purposes of a coronial inquiry, or in accordance with an order of a coroner.\n\n> Note 1: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n> Note 2: For paragraph (c), collection, recording, disclosure or use by a listed representative of a participating State or Territory is authorised under this subsection if the law of the State or Territory does not prevent the collection, recording, disclosure or use.\n\n (4) Subsection (3) does not apply to protected information or key information to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n (5) Collection, recording, disclosure or use of personal information for the purposes of research of a kind to which guidelines approved under section 95 or 95A of the Privacy Act 1988 relate is authorised under paragraph (3)(a) or (f) only if the collection, recording, use or disclosure is in accordance with the guidelines.\n\n#### 18 Offence relating to protected information\n\n A person commits an offence if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is protected information; and\n (c) the making of the record, or the disclosure or use, is not authorised by section 17.\n\nPenalty: Imprisonment for 2 years or 120 penalty units, or both.\n\n#### 19 Exception for use in good faith\n\n Section 18 does not apply to a person to the extent that the person makes a record of, discloses or otherwise uses protected information in good faith and in purported compliance with section 17.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 20 Exception if unaware information is commercial‑in‑confidence\n\n Section 18 does not apply to a person if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is commercial‑in‑confidence; and\n (c) the person does not know that the information is commercial‑in‑confidence.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 21 Exceptions relating to the person to whom the protected information relates\n\n (1) Section 18 does not apply to a person if:\n (a) the person discloses protected information to the person to whom the information relates; or\n (b) the person is the person to whom the protected information relates; or\n (c) the making of the record, or the disclosure or use, of the protected information is in accordance with the express or implied consent of the person to whom the information relates.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).\n\n (2) Subsection (1) applies as if a reference in that subsection to the person to whom the protected information relates includes a reference to the person’s personal representative.\n\n#### 22 Exception for disclosure to person who provided the information\n\n Section 18 does not apply to a person if:\n (a) the person obtains protected information from another person; and\n (b) the person discloses that information to the other person.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 22A Data breaches\n\n Notification of contraventions and possible contraventions\n (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.\n\n> Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\n (2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify:\n (a) the Secretary; and\n (b) the Information Commissioner.\n\n> Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\nCivil penalty: 100 penalty units.\n\n (3) A notice given under subsection (1) or (2) must set out the following:\n (a) a description of the contravention that has occurred or may have occurred;\n (b) the kind or kinds of information concerned;\n (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider.\n Handling possible contraventions\n (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the possible contravention;\n (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention;\n (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register:\n (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or\n (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.\n\n Handling contraventions\n (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;\n (b) evaluate any risks that may be related to or arise out of the contravention;\n (c) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;\n (d) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;\n (e) take steps to prevent or mitigate the effects of further contraventions.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.\n\n Secretary’s duty\n (6) The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).\n No need to report or consult if already done\n (7) A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.\n (8) A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.\n (9) A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:\n (a) given notice in relation to the contravention under subsection (1) or (2); or\n (b) consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).\n Contracted service providers\n (10) In this Act:\n contracted service provider means a person who:\n (a) is engaged under an agreement referred to in section 26; and\n (b) obtains protected information in the course of performing services under the agreement.\n\n#### 22B Contravention is an interference with privacy\n\n (1) An act or practice that contravenes section 18 or subsection 22A(1), (2), (4), (5) or (6) is taken to be:\n (a) for the purposes of the Privacy Act 1988, an interference with the privacy of an individual; and\n (b) covered by section 13 of that Act.\n (2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the person who engaged in the act or practice.\n (3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the register:\n (a) to investigate an act or practice that may be an interference with the privacy of an individual under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;\n (b) to do anything incidental or conducive to the performance of those functions.\n (4) The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).\n\n> Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.\n\n#### 22C Information Commissioner may disclose details of investigations to the Secretary\n\n The Information Commissioner is authorised to disclose to the Secretary any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 22B, if the Information Commissioner is satisfied that to do so will enable the Commonwealth to monitor or improve the operation or security of the register.\n\n## Part 4—Other matters\n\n#### 23 Simplified outline of this Part\n\nThis Part deals with other matters, such as civil penalties, approved forms, agreements, delegations and rules.\n\n#### 24 Civil penalty provisions\n\n Enforceable civil penalty provisions\n (1) Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.\n\n> Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.\n\n Authorised applicant\n (2) For the purposes of Part 4 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to the civil penalty provisions of this Act:\n (a) the Secretary;\n (b) an SES employee, or an acting SES employee, in the Department.\n Relevant court\n (3) For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:\n (a) the Federal Court of Australia;\n (b) the Federal Circuit and Family Court of Australia (Division 2);\n (c) a court of a State or Territory that has jurisdiction in relation to the matter.\n Extension to external Territories\n (4) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.\n Liability of Crown\n (5) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.\n\n#### 25 Approved forms\n\n (1) The Minister may, in writing, approve a form for the purposes of a provision of this Act.\n (2) A request or withdrawal of a request required by a provision of this Act to be in the approved form must be given to the person specified in the form for that purpose.\n\n#### 26 Agreements\n\n The Minister may, on behalf of the Commonwealth, engage a person under a written agreement to perform services for or on behalf of the Commonwealth in connection with functions of the Commonwealth, the Minister or the Commonwealth Chief Medical Officer under this Act.\n\n#### 27 Delegation\n\n (1) The Minister may, in writing, delegate his or her functions or powers under:\n (a) section 5 (about commercial‑in‑confidence information); or\n (b) section 25 (about approving forms); or\n (c) section 26 (about engaging persons under agreements);\n to an SES employee, or an acting SES employee, in the Department.\n (2) The Secretary may, in writing, delegate his or her functions or powers under:\n (a) paragraph 17(3)(g) (about disclosing information); or\n (b) section 22A (about data breaches);\n to an SES employee, or an acting SES employee, in the Department.\n (3) In performing a function, or exercising a power, under a delegation, the delegate must comply with any directions of the Minister or the Secretary.\n\n#### 28 Rules\n\n (1) The Minister may, by legislative instrument, make rules prescribing matters:\n (a) required or permitted by this Act to be prescribed by the rules; or\n (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.\n (1A) Before making rules for the purposes of:\n (a) paragraph (l) of the definition of key information in section 4; or\n (b) paragraph 11(g);\n the Minister must consult the Information Commissioner in relation to matters that relate to the privacy functions (within the meaning of the Australian Information Commissioner Act 2010) and have regard to any submissions made by the Information Commissioner because of that consultation.\n (2) To avoid doubt, the rules may not do the following:\n (a) create an offence or civil penalty;\n (b) provide powers of:\n (i) arrest or detention; or\n (ii) entry, search or seizure;\n (c) impose a tax;\n (d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;\n (e) directly amend the text of this Act.","sortOrder":18},{"sectionNumber":"14","sectionType":"section","heading":"Requests about participation in the register","content":"#### 14 Requests about participation in the register\n\n (1) An individual may, in the approved form, make any of the following requests:\n (a) that a particular healthcare provider be recorded as the individual’s nominated healthcare provider for screening associated with a designated cancer;\n (b) that the individual not be given, at all or for a period of time, by (or on behalf of) the Commonwealth:\n (i) any invitation of a kind referred to in paragraph 12(1)(d) or test kit referred to in paragraph 12(1)(e) in relation to screening associated with a designated cancer; or\n (ii) any advice of a kind referred to in paragraph 12(1)(f) in relation to screening associated with a designated cancer;\n (c) that information relating to the individual that is:\n (i) about a designated cancer; and\n (ii) notified under section 13 after the date of the request;\n not be included in the register;\n (d) that a date by which the register indicates the individual is due to undergo a screening test associated with cervical cancer be changed;\n (e) that the register use a pseudonym for the individual.\n (2) An individual may, in the approved form, withdraw any request made under subsection (1).\n (3) The Commonwealth must give effect to a request or withdrawal under this section as soon as practicable.\n (4) A personal representative of the individual may make or withdraw a request under this section on behalf of the individual.","sortOrder":19},{"sectionNumber":"Division 5","sectionType":"division","heading":"Alternative constitutional bases","content":"An Act to establish and provide for a cancer screening register, and for related purposes\n\n## Part 1—Preliminary\n\n#### 1 Short title\n\n This Act is the National Cancer Screening Register Act 2016.\n\n#### 2 Commencement\n\n (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.\n\n```html\n

Commencement information

Column 1

Column 2

Column 3

Provisions

Commencement

Date/Details

1. Sections 1 to 12 and anything in this Act not elsewhere covered by this table

The day after this Act receives the Royal Assent.

21 October 2016

2. Section 13

1 May 2017.

1 May 2017

3. Sections 14 to 28

At the same time as the provisions covered by table item 1.

21 October 2016

\n```\n\n> Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.\n\n (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.\n\n#### 3 Simplified outline of this Act\n\nThis Act establishes a register of information about screening associated with certain types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nThere are protections for sensitive information.\n\n#### 4 Definitions\n\n In this Act:\n\n> approved form means a form approved under subsection 25(1).\n\n> child protection officer means an officer or employee of a State or Territory, or of a State or Territory authority, who has functions, powers or duties in relation to the care, protection or welfare of children.\n\n> civil penalty provision has the same meaning as in the Regulatory Powers Act.\n\n> claims information means information about:\n\n (a) claims for medicare benefit under Part II of the Health Insurance Act 1973; or\n (b) treatment, other than information that relates to compensation or benefits, provided under any of the following Acts:\n (i) the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006;\n (ii) the Military Rehabilitation and Compensation Act 2004;\n (iii) the Safety, Rehabilitation and Compensation Act 1988;\n (iiia) the Treatment Benefits (Special Access) Act 2019;\n (iv) the Veterans’ Entitlements Act 1986.\n\n> commercial‑in‑confidence has the meaning given by section 5.\n\n> contracted service provider has the meaning given by subsection 22A(10).\n\n> designated cancer means one of the following types of cancer:\n\n (a) bowel cancer;\n (b) cervical cancer;\n (c) lung cancer.\n\n> enforcement body has the same meaning as in the Privacy Act 1988.\n\n> entity means:\n\n (a) a person; or\n (b) a partnership; or\n (c) any other unincorporated association or body; or\n (d) a trust; or\n (e) a part of another entity (under a previous application of this definition).\n\n> healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988.\n\n> healthcare provider means:\n\n (a) an individual healthcare provider; or\n (b) a healthcare provider organisation.\n\n> healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge).\n\n> Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be part of an entity.\n\n> individual healthcare provider means an individual who:\n\n (a) has provided, provides, or is to provide, healthcare; or\n (b) is registered by a registration authority as a member of a particular health profession.\n\n> key information for an individual means the following:\n\n (a) the individual’s name, address, contact details, date of birth and gender;\n (b) the individual’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010) if any;\n (c) the individual’s medicare number (within the meaning of Part VII of the National Health Act 1953) if any;\n (d) the number allocated to the individual by the Veterans’ Affairs Department if any;\n (e) if applicable, the individual’s date of death;\n (f) if the register includes information relating to the individual in connection with screening associated with cervical cancer:\n (i) the individual’s sex; and\n (ii) the individual’s Human Papillomavirus vaccination status and number of doses of the vaccine administered to the individual;\n (g) the individual’s Indigenous status;\n (h) the individual’s country of origin or cultural identity;\n (i) the individual’s preferred language and whether an interpreter is required to facilitate communication with the individual;\n (j) the name and contact details of a personal representative of the individual if any;\n (k) if applicable, information on assistance required by the individual for the purposes of this Act because of a medical condition or disability;\n (l) any other information of a kind relevant to the purposes of the register and prescribed by the rules for the purposes of this definition.\n\n> nominated healthcare provider of an individual, for screening associated with a designated cancer, means the healthcare provider the individual requested be recorded for screening associated with the designated cancer in a request in effect under section 14.\n\n> parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975.\n\n> participating State or Territory means a State or Territory that has agreed with the Commonwealth to participate in the register.\n\n> personal information has the same meaning as in the Privacy Act 1988.\n\n> personal representative, of an individual, means:\n\n (a) a parent or guardian of the individual, if the individual is incapable of managing his or her health affairs; or\n (b) a trustee of an estate of the individual, if the individual is under a legal disability; or\n (c) a person who holds an enduring power of attorney granted by the individual; or\n (d) a person nominated by the individual for the purpose of managing the individual’s affairs in relation to screening associated with a designated cancer.\n\n> professional disciplinary authority means:\n\n (a) a registration authority; or\n (b) the Health Care Complaints Commission established by the Health Care Complaints Act 1993 (NSW); or\n (c) the Health Ombudsman appointed under the Health Ombudsman Act 2013 (Qld); or\n (d) any other authority that is responsible for investigating complaints about the professional conduct of individual healthcare providers.\n\n> protected information means personal information or information that is commercial‑in‑confidence, to the extent that the information is:\n\n (a) included in the register or otherwise obtained under, or in accordance with, this Act; or\n (b) derived from a record of information that was included in the register or was otherwise obtained under, or in accordance with, this Act; or\n (c) derived from a disclosure or use of information that was included in the register or was otherwise obtained under, or in accordance with, this Act.\n\n> purposes of the register means the purposes set out in section 12.\n\n> register means the National Cancer Screening Register established under section 9.\n\n> registration authority means an entity that is responsible under a law for registering members of a particular health profession.\n\n> Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014.\n\n> rules means the rules made under section 28.\n\n> screening means a process in which an individual undergoes testing or procedures in order to determine whether the individual has:\n\n (a) a designated cancer or a precursor to a designated cancer; or\n (b) any indicator, including genetic markers or cell abnormalities, that may lead to a designated cancer.\n\n> screening test means a test or procedure as part of screening.\n\n> Secretary means the Secretary of the Department.\n\n> State or Territory authority has the same meaning as in the Privacy Act 1988.\n\n> Veterans’ Affairs Department means the Department administered by the Minister administering the Veterans’ Entitlements Act 1986.\n\n#### 5 Meaning of commercial‑in‑confidence\n\n Information is commercial‑in‑confidence if a person demonstrates to the Minister that:\n (a) release of the information would cause competitive detriment to the person; and\n (b) the information is not in the public domain; and\n (c) the information is not required to be disclosed under a law of the Commonwealth, or of a State or Territory; and\n (d) the information is not readily discoverable.\n\n#### 6 Act binds the Crown\n\n This Act binds the Crown in each of its capacities. However, it does not make the Crown liable to be prosecuted for an offence.\n\n> Note: See subsection 24(5) in relation to civil penalties.\n\n#### 7 Act extends to external Territories\n\n This Act extends to every external Territory.\n\n## Part 2—Register\n\n### Division 1—Simplified outline of this Part\n\n#### 8 Simplified outline of this Part\n\nThe National Cancer Screening Register is established to keep information about cancer screening and diagnoses associated with particular types of cancer.\n\nThe purposes of the register relate to:\n\n(a) supporting cancer screening programs; and\n\n(b) providing access to information about cancer screening and diagnoses; and\n\n(c) cancer screening matters more broadly.\n\nCertain healthcare providers are required to notify the Commonwealth Chief Medical Officer about certain types of screening test or diagnosis. In most circumstances, this information will be included on the register.\n\nIndividuals can make a number of requests in relation to the register. For example, an individual can opt out of receiving information from the register. An individual can also request that information notified by healthcare providers relating to the individual not be included in the register.\n\n### Division 2—Establishment, contents and purposes\n\n#### 9 Establishment of the register\n\n (1) The Commonwealth must establish and keep a register to be called the National Cancer Screening Register.\n (2) Parts of the register may be kept separate from each other, and be called different names.\n (3) The register is not a legislative instrument.\n\n#### 10 Coverage of the register\n\n (1) The register may include information relating to individuals in connection with screening associated with bowel cancer.\n (2) The register may include information relating to individuals in connection with screening associated with cervical cancer.\n (3) The register may include information relating to individuals in connection with screening associated with lung cancer.\n\n#### 11 Contents of the register\n\n The register may include the following for each individual:\n (a) the individual’s key information;\n (b) details of the individual’s nominated healthcare provider for screening associated with a designated cancer, if any, including the healthcare provider’s healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010);\n (c) information about screening tests undergone or to be undergone by the individual;\n (d) if the individual is diagnosed with a designated cancer or a precursor to a designated cancer, that diagnosis;\n (e) claims information which may indicate whether or not the individual has undergone or should undergo screening associated with a designated cancer;\n (f) details of any request or withdrawal made by the individual under section 14;\n (g) any other information relevant to the purposes of the register and prescribed by the rules.\n\n#### 12 Purposes of the register\n\n (1) The purposes of the register are to facilitate the following:\n (a) establishing and keeping an electronic database of records relating to screening and diagnoses associated with the designated cancers;\n (b) collecting, analysing and publishing statistics and other information relating to screening and diagnoses associated with the designated cancers;\n (c) monitoring the effectiveness, quality and safety of screening and diagnoses associated with the designated cancers;\n (d) providing an individual with an invitation to undergo screening;\n (e) providing an individual with a test kit for screening;\n (f) advising an individual when the individual is due to undergo a screening test or when action may need to be taken after a screening test;\n (g) advising an individual’s nominated healthcare provider for screening associated with a designated cancer (if any) when the individual is due to undergo, or when action may need to be taken after, a screening test associated with the designated cancer;\n (h) advising a participating State or Territory when action may need to be taken after a screening test for an individual residing in the State or Territory;\n (i) providing an individual access to information relating to the individual about screening and diagnoses associated with a designated cancer;\n (j) providing healthcare providers access to information about screening and diagnoses associated with a designated cancer in relation to an individual, for the purposes of providing healthcare to the individual in relation to the designated cancer;\n (k) providing a participating State or Territory with access to information relating to individuals residing in the State or Territory in connection with screening and diagnoses associated with the designated cancers;\n (l) planning, delivering and promoting healthcare and services in relation to the designated cancers;\n (m) reporting to international organisations in relation to the designated cancers;\n (n) research relating to healthcare, screening or a designated cancer.\n (2) For an individual who has a personal representative:\n (a) paragraphs (1)(d) and (e) also apply to providing the representative with an invitation or test kit for the individual; and\n (b) paragraph (1)(f) also applies to advising the representative; and\n (c) paragraph (1)(i) also applies to providing the representative access to information relating to the individual.\n\n### Division 3—Notification to the register\n\n#### 13 Requirement to notify\n\n (1) The individual healthcare provider prescribed by the rules for a type of screening test or diagnosis prescribed by the rules must notify the Commonwealth Chief Medical Officer in the approved form, by the time prescribed by the rules, of the information prescribed by the rules for the type of screening test or diagnosis.\n (2) A person is liable to a civil penalty if the person contravenes subsection (1).\n\nCivil penalty: 30 penalty units.\n\n### Division 4—Requests about the register\n\n#### 14 Requests about participation in the register\n\n (1) An individual may, in the approved form, make any of the following requests:\n (a) that a particular healthcare provider be recorded as the individual’s nominated healthcare provider for screening associated with a designated cancer;\n (b) that the individual not be given, at all or for a period of time, by (or on behalf of) the Commonwealth:\n (i) any invitation of a kind referred to in paragraph 12(1)(d) or test kit referred to in paragraph 12(1)(e) in relation to screening associated with a designated cancer; or\n (ii) any advice of a kind referred to in paragraph 12(1)(f) in relation to screening associated with a designated cancer;\n (c) that information relating to the individual that is:\n (i) about a designated cancer; and\n (ii) notified under section 13 after the date of the request;\n not be included in the register;\n (d) that a date by which the register indicates the individual is due to undergo a screening test associated with cervical cancer be changed;\n (e) that the register use a pseudonym for the individual.\n (2) An individual may, in the approved form, withdraw any request made under subsection (1).\n (3) The Commonwealth must give effect to a request or withdrawal under this section as soon as practicable.\n (4) A personal representative of the individual may make or withdraw a request under this section on behalf of the individual.\n\n### Division 5—Alternative constitutional bases\n\n#### 15 Alternative constitutional bases\n\n (1) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to matters relating to:\n (a) the provision of pharmaceutical and sickness benefits; or\n (b) the provision of medical services (without any form of civil conscription); or\n (c) census and statistics; or\n (d) postal, telegraphic, telephonic and other like services; or\n (e) external affairs, including:\n (i) giving effect to the International Covenant on Economic, Social and Cultural Rights done at New York on 16 December 1966, in particular Article 12, or to another international agreement to which Australia is a party; or\n (ii) addressing matters of international concern; or\n (f) a Territory or a Commonwealth place (within the meaning of the Commonwealth Places (Application of Laws) Act 1970); or\n (g) the implied power of the Parliament to make laws with respect to nationhood; or\n (h) the executive power of the Commonwealth; or\n (i) matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.\n\n> Note: The International Covenant on Economic, Social and Cultural Rights is in Australian Treaty Series 1976 No. 5 (\\[1976\\] ATS 5) and could in 2016 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).\n\n (2) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to acts or omissions of corporations to which paragraph 51(xx) of the Constitution applies.\n (3) A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.\n\n## Part 3—Dealing with information in the register\n\n#### 16 Simplified outline of this Part\n\nInformation can be collected for inclusion in the register.\n\nPersonal information included in the register, or derived from information included in the register, is “protected information”.\n\nSection 18 makes it an offence for a person to record, disclose or use protected information without authorisation.\n\nRecording, disclosure and use of protected information is authorised in specific circumstances, including for the purposes of the register and by healthcare providers and States and Territories.\n\nThere are also a number of exceptions to the offence.\n\n#### 17 Authorised dealings with information\n\n Uploading personal information etc. to the register\n (1) A person may collect, make a record of, disclose or otherwise use:\n (a) personal information; or\n (b) key information for an individual; or\n (c) information that is commercial‑in‑confidence;\n if the person does so for the purposes of including information in the register.\n\n> Note: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n (2) Subsection (1) does not apply to information notified under section 13 to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n Using or disclosing information in the register\n (3) A person may collect, make a record of, disclose or otherwise use protected information, or key information included in the register, if:\n (a) the person does so for the purposes of the register and is:\n (i) an officer or employee of the Commonwealth or of an authority of the Commonwealth; or\n (ii) engaged by the Commonwealth, or by an authority of the Commonwealth, to perform work relating to the purposes of the register; or\n (iii) an officer or employee of a person referred to in subparagraph (ii), or engaged by a person referred to in subparagraph (ii) to perform work relating to the purposes of the register; or\n (b) all of the following apply:\n (i) the person is a healthcare provider;\n (ii) the information is about screening or diagnosis associated with a designated cancer in relation to an individual;\n (iii) the collection, recording, disclosure or use is for the purposes of providing healthcare to the individual in relation to the designated cancer; or\n (c) the collection, recording, disclosure or use is required or permitted by the law of a participating State or Territory, and the person is:\n (i) a State or Territory authority of the participating State or Territory; or\n (ii) an officer or employee of the participating State or Territory, or of a State or Territory authority of the participating State or Territory; or\n (iii) engaged by the participating State or Territory, or by a State or Territory authority of the participating State or Territory, to perform work relating to the information; or\n (iv) an officer or employee of a person referred to in subparagraph (iii), or engaged by a person referred to in subparagraph (iii) to perform work relating to the information; or\n (d) the person does so for the purposes of performing the person’s functions, or exercising the person’s powers, under this Act; or\n (e) the person is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory; or\n (f) the information is disclosed to the person under this section and the collection, recording, disclosure or use is for the purposes for which the information was disclosed to the person; or\n (g) all of the following apply:\n (i) the person is the Secretary;\n (ii) the collection, recording, disclosure or use is for the purposes of disclosing information to a professional disciplinary authority, a child protection officer or an enforcement body;\n (iii) the person reasonably believes that the information will enable or assist the authority, officer or body to perform or exercise any of the authority’s, officer’s or body’s functions or powers; or\n (h) the person does so for the purposes of court or tribunal proceedings, or in accordance with an order of a court or tribunal; or\n (i) the person does so for the purposes of a coronial inquiry, or in accordance with an order of a coroner.\n\n> Note 1: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n> Note 2: For paragraph (c), collection, recording, disclosure or use by a listed representative of a participating State or Territory is authorised under this subsection if the law of the State or Territory does not prevent the collection, recording, disclosure or use.\n\n (4) Subsection (3) does not apply to protected information or key information to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n (5) Collection, recording, disclosure or use of personal information for the purposes of research of a kind to which guidelines approved under section 95 or 95A of the Privacy Act 1988 relate is authorised under paragraph (3)(a) or (f) only if the collection, recording, use or disclosure is in accordance with the guidelines.\n\n#### 18 Offence relating to protected information\n\n A person commits an offence if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is protected information; and\n (c) the making of the record, or the disclosure or use, is not authorised by section 17.\n\nPenalty: Imprisonment for 2 years or 120 penalty units, or both.\n\n#### 19 Exception for use in good faith\n\n Section 18 does not apply to a person to the extent that the person makes a record of, discloses or otherwise uses protected information in good faith and in purported compliance with section 17.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 20 Exception if unaware information is commercial‑in‑confidence\n\n Section 18 does not apply to a person if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is commercial‑in‑confidence; and\n (c) the person does not know that the information is commercial‑in‑confidence.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 21 Exceptions relating to the person to whom the protected information relates\n\n (1) Section 18 does not apply to a person if:\n (a) the person discloses protected information to the person to whom the information relates; or\n (b) the person is the person to whom the protected information relates; or\n (c) the making of the record, or the disclosure or use, of the protected information is in accordance with the express or implied consent of the person to whom the information relates.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).\n\n (2) Subsection (1) applies as if a reference in that subsection to the person to whom the protected information relates includes a reference to the person’s personal representative.\n\n#### 22 Exception for disclosure to person who provided the information\n\n Section 18 does not apply to a person if:\n (a) the person obtains protected information from another person; and\n (b) the person discloses that information to the other person.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).\n\n#### 22A Data breaches\n\n Notification of contraventions and possible contraventions\n (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.\n\n> Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\n (2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify:\n (a) the Secretary; and\n (b) the Information Commissioner.\n\n> Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\nCivil penalty: 100 penalty units.\n\n (3) A notice given under subsection (1) or (2) must set out the following:\n (a) a description of the contravention that has occurred or may have occurred;\n (b) the kind or kinds of information concerned;\n (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider.\n Handling possible contraventions\n (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the possible contravention;\n (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention;\n (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register:\n (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or\n (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.\n\n Handling contraventions\n (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;\n (b) evaluate any risks that may be related to or arise out of the contravention;\n (c) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;\n (d) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;\n (e) take steps to prevent or mitigate the effects of further contraventions.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.\n\n Secretary’s duty\n (6) The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).\n No need to report or consult if already done\n (7) A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.\n (8) A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.\n (9) A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:\n (a) given notice in relation to the contravention under subsection (1) or (2); or\n (b) consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).\n Contracted service providers\n (10) In this Act:\n contracted service provider means a person who:\n (a) is engaged under an agreement referred to in section 26; and\n (b) obtains protected information in the course of performing services under the agreement.\n\n#### 22B Contravention is an interference with privacy\n\n (1) An act or practice that contravenes section 18 or subsection 22A(1), (2), (4), (5) or (6) is taken to be:\n (a) for the purposes of the Privacy Act 1988, an interference with the privacy of an individual; and\n (b) covered by section 13 of that Act.\n (2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the person who engaged in the act or practice.\n (3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the register:\n (a) to investigate an act or practice that may be an interference with the privacy of an individual under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;\n (b) to do anything incidental or conducive to the performance of those functions.\n (4) The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).\n\n> Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.\n\n#### 22C Information Commissioner may disclose details of investigations to the Secretary\n\n The Information Commissioner is authorised to disclose to the Secretary any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 22B, if the Information Commissioner is satisfied that to do so will enable the Commonwealth to monitor or improve the operation or security of the register.\n\n## Part 4—Other matters\n\n#### 23 Simplified outline of this Part\n\nThis Part deals with other matters, such as civil penalties, approved forms, agreements, delegations and rules.\n\n#### 24 Civil penalty provisions\n\n Enforceable civil penalty provisions\n (1) Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.\n\n> Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.\n\n Authorised applicant\n (2) For the purposes of Part 4 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to the civil penalty provisions of this Act:\n (a) the Secretary;\n (b) an SES employee, or an acting SES employee, in the Department.\n Relevant court\n (3) For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:\n (a) the Federal Court of Australia;\n (b) the Federal Circuit and Family Court of Australia (Division 2);\n (c) a court of a State or Territory that has jurisdiction in relation to the matter.\n Extension to external Territories\n (4) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.\n Liability of Crown\n (5) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.\n\n#### 25 Approved forms\n\n (1) The Minister may, in writing, approve a form for the purposes of a provision of this Act.\n (2) A request or withdrawal of a request required by a provision of this Act to be in the approved form must be given to the person specified in the form for that purpose.\n\n#### 26 Agreements\n\n The Minister may, on behalf of the Commonwealth, engage a person under a written agreement to perform services for or on behalf of the Commonwealth in connection with functions of the Commonwealth, the Minister or the Commonwealth Chief Medical Officer under this Act.\n\n#### 27 Delegation\n\n (1) The Minister may, in writing, delegate his or her functions or powers under:\n (a) section 5 (about commercial‑in‑confidence information); or\n (b) section 25 (about approving forms); or\n (c) section 26 (about engaging persons under agreements);\n to an SES employee, or an acting SES employee, in the Department.\n (2) The Secretary may, in writing, delegate his or her functions or powers under:\n (a) paragraph 17(3)(g) (about disclosing information); or\n (b) section 22A (about data breaches);\n to an SES employee, or an acting SES employee, in the Department.\n (3) In performing a function, or exercising a power, under a delegation, the delegate must comply with any directions of the Minister or the Secretary.\n\n#### 28 Rules\n\n (1) The Minister may, by legislative instrument, make rules prescribing matters:\n (a) required or permitted by this Act to be prescribed by the rules; or\n (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.\n (1A) Before making rules for the purposes of:\n (a) paragraph (l) of the definition of key information in section 4; or\n (b) paragraph 11(g);\n the Minister must consult the Information Commissioner in relation to matters that relate to the privacy functions (within the meaning of the Australian Information Commissioner Act 2010) and have regard to any submissions made by the Information Commissioner because of that consultation.\n (2) To avoid doubt, the rules may not do the following:\n (a) create an offence or civil penalty;\n (b) provide powers of:\n (i) arrest or detention; or\n (ii) entry, search or seizure;\n (c) impose a tax;\n (d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;\n (e) directly amend the text of this Act.","sortOrder":20},{"sectionNumber":"15","sectionType":"section","heading":"Alternative constitutional bases","content":"#### 15 Alternative constitutional bases\n\n (1) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to matters relating to:\n (a) the provision of pharmaceutical and sickness benefits; or\n (b) the provision of medical services (without any form of civil conscription); or\n (c) census and statistics; or\n (d) postal, telegraphic, telephonic and other like services; or\n (e) external affairs, including:\n (i) giving effect to the International Covenant on Economic, Social and Cultural Rights done at New York on 16 December 1966, in particular Article 12, or to another international agreement to which Australia is a party; or\n (ii) addressing matters of international concern; or\n (f) a Territory or a Commonwealth place (within the meaning of the Commonwealth Places (Application of Laws) Act 1970); or\n (g) the implied power of the Parliament to make laws with respect to nationhood; or\n (h) the executive power of the Commonwealth; or\n (i) matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth.\n\n> Note: The International Covenant on Economic, Social and Cultural Rights is in Australian Treaty Series 1976 No. 5 (\\[1976\\] ATS 5) and could in 2016 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au).\n\n (2) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to acts or omissions of corporations to which paragraph 51(xx) of the Constitution applies.\n (3) A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution.","sortOrder":21},{"sectionNumber":"Part 3","sectionType":"part","heading":"Dealing with information in the register","content":"## Part 3—Dealing with information in the register","sortOrder":22},{"sectionNumber":"16","sectionType":"section","heading":"Simplified outline of this Part","content":"#### 16 Simplified outline of this Part\n\nInformation can be collected for inclusion in the register.\n\nPersonal information included in the register, or derived from information included in the register, is “protected information”.\n\nSection 18 makes it an offence for a person to record, disclose or use protected information without authorisation.\n\nRecording, disclosure and use of protected information is authorised in specific circumstances, including for the purposes of the register and by healthcare providers and States and Territories.\n\nThere are also a number of exceptions to the offence.","sortOrder":23},{"sectionNumber":"17","sectionType":"section","heading":"Authorised dealings with information","content":"#### 17 Authorised dealings with information\n\n Uploading personal information etc. to the register\n (1) A person may collect, make a record of, disclose or otherwise use:\n (a) personal information; or\n (b) key information for an individual; or\n (c) information that is commercial‑in‑confidence;\n if the person does so for the purposes of including information in the register.\n\n> Note: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n (2) Subsection (1) does not apply to information notified under section 13 to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n Using or disclosing information in the register\n (3) A person may collect, make a record of, disclose or otherwise use protected information, or key information included in the register, if:\n (a) the person does so for the purposes of the register and is:\n (i) an officer or employee of the Commonwealth or of an authority of the Commonwealth; or\n (ii) engaged by the Commonwealth, or by an authority of the Commonwealth, to perform work relating to the purposes of the register; or\n (iii) an officer or employee of a person referred to in subparagraph (ii), or engaged by a person referred to in subparagraph (ii) to perform work relating to the purposes of the register; or\n (b) all of the following apply:\n (i) the person is a healthcare provider;\n (ii) the information is about screening or diagnosis associated with a designated cancer in relation to an individual;\n (iii) the collection, recording, disclosure or use is for the purposes of providing healthcare to the individual in relation to the designated cancer; or\n (c) the collection, recording, disclosure or use is required or permitted by the law of a participating State or Territory, and the person is:\n (i) a State or Territory authority of the participating State or Territory; or\n (ii) an officer or employee of the participating State or Territory, or of a State or Territory authority of the participating State or Territory; or\n (iii) engaged by the participating State or Territory, or by a State or Territory authority of the participating State or Territory, to perform work relating to the information; or\n (iv) an officer or employee of a person referred to in subparagraph (iii), or engaged by a person referred to in subparagraph (iii) to perform work relating to the information; or\n (d) the person does so for the purposes of performing the person’s functions, or exercising the person’s powers, under this Act; or\n (e) the person is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory; or\n (f) the information is disclosed to the person under this section and the collection, recording, disclosure or use is for the purposes for which the information was disclosed to the person; or\n (g) all of the following apply:\n (i) the person is the Secretary;\n (ii) the collection, recording, disclosure or use is for the purposes of disclosing information to a professional disciplinary authority, a child protection officer or an enforcement body;\n (iii) the person reasonably believes that the information will enable or assist the authority, officer or body to perform or exercise any of the authority’s, officer’s or body’s functions or powers; or\n (h) the person does so for the purposes of court or tribunal proceedings, or in accordance with an order of a court or tribunal; or\n (i) the person does so for the purposes of a coronial inquiry, or in accordance with an order of a coroner.\n\n> Note 1: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles.\n\n> Note 2: For paragraph (c), collection, recording, disclosure or use by a listed representative of a participating State or Territory is authorised under this subsection if the law of the State or Territory does not prevent the collection, recording, disclosure or use.\n\n (4) Subsection (3) does not apply to protected information or key information to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14.\n (5) Collection, recording, disclosure or use of personal information for the purposes of research of a kind to which guidelines approved under section 95 or 95A of the Privacy Act 1988 relate is authorised under paragraph (3)(a) or (f) only if the collection, recording, use or disclosure is in accordance with the guidelines.","sortOrder":24},{"sectionNumber":"18","sectionType":"section","heading":"Offence relating to protected information","content":"#### 18 Offence relating to protected information\n\n A person commits an offence if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is protected information; and\n (c) the making of the record, or the disclosure or use, is not authorised by section 17.\n\nPenalty: Imprisonment for 2 years or 120 penalty units, or both.","sortOrder":25},{"sectionNumber":"19","sectionType":"section","heading":"Exception for use in good faith","content":"#### 19 Exception for use in good faith\n\n Section 18 does not apply to a person to the extent that the person makes a record of, discloses or otherwise uses protected information in good faith and in purported compliance with section 17.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).","sortOrder":26},{"sectionNumber":"20","sectionType":"section","heading":"Exception if unaware information is commercial‑in‑confidence","content":"#### 20 Exception if unaware information is commercial‑in‑confidence\n\n Section 18 does not apply to a person if:\n (a) the person makes a record of, discloses or otherwise uses information; and\n (b) the information is commercial‑in‑confidence; and\n (c) the person does not know that the information is commercial‑in‑confidence.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).","sortOrder":27},{"sectionNumber":"21","sectionType":"section","heading":"Exceptions relating to the person to whom the protected information relates","content":"#### 21 Exceptions relating to the person to whom the protected information relates\n\n (1) Section 18 does not apply to a person if:\n (a) the person discloses protected information to the person to whom the information relates; or\n (b) the person is the person to whom the protected information relates; or\n (c) the making of the record, or the disclosure or use, of the protected information is in accordance with the express or implied consent of the person to whom the information relates.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code).\n\n (2) Subsection (1) applies as if a reference in that subsection to the person to whom the protected information relates includes a reference to the person’s personal representative.","sortOrder":28},{"sectionNumber":"22","sectionType":"section","heading":"Exception for disclosure to person who provided the information","content":"#### 22 Exception for disclosure to person who provided the information\n\n Section 18 does not apply to a person if:\n (a) the person obtains protected information from another person; and\n (b) the person discloses that information to the other person.\n\n> Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code).","sortOrder":29},{"sectionNumber":"22A","sectionType":"section","heading":"Data breaches","content":"#### 22A Data breaches\n\n Notification of contraventions and possible contraventions\n (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner.\n\n> Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\n (2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify:\n (a) the Secretary; and\n (b) the Information Commissioner.\n\n> Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing.\n\nCivil penalty: 100 penalty units.\n\n (3) A notice given under subsection (1) or (2) must set out the following:\n (a) a description of the contravention that has occurred or may have occurred;\n (b) the kind or kinds of information concerned;\n (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider.\n Handling possible contraventions\n (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the possible contravention;\n (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention;\n (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register:\n (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or\n (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing.\n\n Handling contraventions\n (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following:\n (a) so far as is reasonably practicable, contain the contravention and undertake a preliminary assessment of the causes;\n (b) evaluate any risks that may be related to or arise out of the contravention;\n (c) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected;\n (d) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected;\n (e) take steps to prevent or mitigate the effects of further contraventions.\n\n> Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the contravention, regardless of when it occurred or whether it is ongoing.\n\n Secretary’s duty\n (6) The Secretary must comply with a request under subparagraph (4)(c)(ii) or paragraph (5)(d).\n No need to report or consult if already done\n (7) A person is not required to comply with subsection (1) or (2) in relation to a contravention that has occurred if the person has already given notice under that subsection that the contravention may have occurred.\n (8) A person is not required to comply with paragraph (5)(c) or (d) in relation to a contravention if the person has already consulted, or asked the Secretary to consult, the Information Commissioner under paragraph (4)(c) in relation to the contravention.\n (9) A contracted service provider or former contracted service provider is not required to comply with subsection (2), subparagraph (4)(c)(ii) or paragraph (5)(d) in relation to a contravention that has, or may have, occurred if another person has already:\n (a) given notice in relation to the contravention under subsection (1) or (2); or\n (b) consulted, or asked the Secretary to consult, the Information Commissioner in relation to the contravention under paragraph (4)(c) or (5)(c) or (d).\n Contracted service providers\n (10) In this Act:\n contracted service provider means a person who:\n (a) is engaged under an agreement referred to in section 26; and\n (b) obtains protected information in the course of performing services under the agreement.","sortOrder":30},{"sectionNumber":"22B","sectionType":"section","heading":"Contravention is an interference with privacy","content":"#### 22B Contravention is an interference with privacy\n\n (1) An act or practice that contravenes section 18 or subsection 22A(1), (2), (4), (5) or (6) is taken to be:\n (a) for the purposes of the Privacy Act 1988, an interference with the privacy of an individual; and\n (b) covered by section 13 of that Act.\n (2) The respondent to a complaint under the Privacy Act 1988 about an act or practice, other than an act or practice of an agency or organisation, is the person who engaged in the act or practice.\n (3) In addition to the Information Commissioner’s functions under the Privacy Act 1988, the Information Commissioner has the following functions in relation to the register:\n (a) to investigate an act or practice that may be an interference with the privacy of an individual under subsection (1) and, if the Information Commissioner considers it appropriate to do so, to attempt by conciliation to effect a settlement of the matters that gave rise to the investigation;\n (b) to do anything incidental or conducive to the performance of those functions.\n (4) The Information Commissioner has power to do all things that are necessary or convenient to be done for or in connection with the performance of his or her functions under subsection (3).\n\n> Note: An act or practice that is an interference with privacy may be the subject of a complaint under section 36 of the Privacy Act 1988.","sortOrder":31},{"sectionNumber":"22C","sectionType":"section","heading":"Information Commissioner may disclose details of investigations to the Secretary","content":"#### 22C Information Commissioner may disclose details of investigations to the Secretary\n\n The Information Commissioner is authorised to disclose to the Secretary any information or documents that relate to an investigation the Information Commissioner conducts because of the operation of section 22B, if the Information Commissioner is satisfied that to do so will enable the Commonwealth to monitor or improve the operation or security of the register.","sortOrder":32},{"sectionNumber":"Part 4","sectionType":"part","heading":"Other matters","content":"## Part 4—Other matters","sortOrder":33},{"sectionNumber":"23","sectionType":"section","heading":"Simplified outline of this Part","content":"#### 23 Simplified outline of this Part\n\nThis Part deals with other matters, such as civil penalties, approved forms, agreements, delegations and rules.","sortOrder":34},{"sectionNumber":"24","sectionType":"section","heading":"Civil penalty provisions","content":"#### 24 Civil penalty provisions\n\n Enforceable civil penalty provisions\n (1) Each civil penalty provision of this Act is enforceable under Part 4 of the Regulatory Powers Act.\n\n> Note: Part 4 of the Regulatory Powers Act allows a civil penalty provision to be enforced by obtaining an order for a person to pay a pecuniary penalty for the contravention of the provision.\n\n Authorised applicant\n (2) For the purposes of Part 4 of the Regulatory Powers Act, each of the following persons is an authorised applicant in relation to the civil penalty provisions of this Act:\n (a) the Secretary;\n (b) an SES employee, or an acting SES employee, in the Department.\n Relevant court\n (3) For the purposes of Part 4 of the Regulatory Powers Act, each of the following courts is a relevant court in relation to the civil penalty provisions of this Act:\n (a) the Federal Court of Australia;\n (b) the Federal Circuit and Family Court of Australia (Division 2);\n (c) a court of a State or Territory that has jurisdiction in relation to the matter.\n Extension to external Territories\n (4) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, extends to every external Territory.\n Liability of Crown\n (5) Part 4 of the Regulatory Powers Act, as that Part applies in relation to the civil penalty provisions of this Act, does not make the Crown liable to a pecuniary penalty.","sortOrder":35},{"sectionNumber":"25","sectionType":"section","heading":"Approved forms","content":"#### 25 Approved forms\n\n (1) The Minister may, in writing, approve a form for the purposes of a provision of this Act.\n (2) A request or withdrawal of a request required by a provision of this Act to be in the approved form must be given to the person specified in the form for that purpose.","sortOrder":36},{"sectionNumber":"26","sectionType":"section","heading":"Agreements","content":"#### 26 Agreements\n\n The Minister may, on behalf of the Commonwealth, engage a person under a written agreement to perform services for or on behalf of the Commonwealth in connection with functions of the Commonwealth, the Minister or the Commonwealth Chief Medical Officer under this Act.","sortOrder":37},{"sectionNumber":"27","sectionType":"section","heading":"Delegation","content":"#### 27 Delegation\n\n (1) The Minister may, in writing, delegate his or her functions or powers under:\n (a) section 5 (about commercial‑in‑confidence information); or\n (b) section 25 (about approving forms); or\n (c) section 26 (about engaging persons under agreements);\n to an SES employee, or an acting SES employee, in the Department.\n (2) The Secretary may, in writing, delegate his or her functions or powers under:\n (a) paragraph 17(3)(g) (about disclosing information); or\n (b) section 22A (about data breaches);\n to an SES employee, or an acting SES employee, in the Department.\n (3) In performing a function, or exercising a power, under a delegation, the delegate must comply with any directions of the Minister or the Secretary.","sortOrder":38},{"sectionNumber":"28","sectionType":"section","heading":"Rules","content":"#### 28 Rules\n\n (1) The Minister may, by legislative instrument, make rules prescribing matters:\n (a) required or permitted by this Act to be prescribed by the rules; or\n (b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.\n (1A) Before making rules for the purposes of:\n (a) paragraph (l) of the definition of key information in section 4; or\n (b) paragraph 11(g);\n the Minister must consult the Information Commissioner in relation to matters that relate to the privacy functions (within the meaning of the Australian Information Commissioner Act 2010) and have regard to any submissions made by the Information Commissioner because of that consultation.\n (2) To avoid doubt, the rules may not do the following:\n (a) create an offence or civil penalty;\n (b) provide powers of:\n (i) arrest or detention; or\n (ii) entry, search or seizure;\n (c) impose a tax;\n (d) set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;\n (e) directly amend the text of this Act.","sortOrder":39}],"analysis":{"kimi_summary":{"_metrics":{"completionTokens":640},"content_quality":"ok","complexity_score":7,"scope_assessment":{"changed":false,"description":"The legislation remains focused on its original purpose of establishing a cancer screening register. While the 2019 amendment added 'Treatment Benefits (Special Access) Act 2019' to the definition of 'claims information' and made minor technical updates, the core scope has not expanded beyond cancer screening registration, notification, and privacy protection."},"complexity_factors":["28 defined terms in section 4, including recursive definitions (e.g., 'entity' includes 'part of another entity')","9 separate authorisation pathways for using protected information in section 17(3)","6 exceptions to the offence in sections 19-22, with evidential burdens on defendants","Nested conditions in section 22A: data breach notification duties with multiple triggering conditions and overlapping obligations","Cross-references to 6 other Acts (Privacy Act 1988, Healthcare Identifiers Act 2010, Regulatory Powers Act, etc.)","Alternative constitutional bases in section 15 with 9 separate heads of power","Sub-delegation chains: Minister → SES employee, and Secretary → SES employee, with directional compliance requirements"],"plain_english_summary":"This Act creates a **National Cancer Screening Register** — a central database that tracks cancer screening and diagnoses for Australians.\n\n**What it does:**\n- Establishes an electronic register to store information about screening for **bowel, cervical and lung cancer**\n- Records who has been screened, when they're due for screening, and any diagnoses\n- Sends invitations and test kits to people when they're due for screening\n- Allows healthcare providers to access relevant information to help treat patients\n\n**Who it affects:**\n- **Everyone eligible for cancer screening** — your personal details, Medicare number, screening history and results can be recorded\n- **Healthcare providers** — must notify the register about certain screening tests and diagnoses (with penalties for failing to do so)\n- **States and territories** — can access information about residents who participate\n\n**Your rights:**\n- You can **opt out** of receiving screening invitations and reminders\n- You can request that **new information not be added** to your record\n- You can nominate a preferred healthcare provider\n- You can ask the register to use a **pseudonym** (fake name) instead of your real name\n- A personal representative (parent, guardian, or someone with power of attorney) can make requests on your behalf\n\n**Privacy protections:**\n- Information in the register is \"protected information\" — it's a **criminal offence** (up to 2 years prison) to disclose or misuse it without authorisation\n- There are strict rules about who can access the data and when\n- Data breach notification requirements apply — the Secretary and contractors must report breaches to the Information Commissioner\n- The Information Commissioner can investigate privacy breaches\n\n**Why it matters:**\nThe register aims to improve cancer detection by ensuring people don't miss screening appointments, tracking program effectiveness, and supporting medical research — but with significant privacy safeguards given the sensitive health data involved."},"flash_summary_failed":{"failed":true,"reason":"A positive credit balance is required for all requests, including BYOK, so fallback providers remain available. Add credits at https://vercel.com/d?to=%2F%5Bteam%5D%2F%7E%2Fai%3Fmodal%3Dtop-up to continue.","source":"analysis-cron"},"flash_summary":{"complexity_score":6,"scope_assessment":{"changed":false,"description":"This version does not materially change the Act’s original scope. The instrument as presented sticks to the original design: establish a Commonwealth register for screening associated with bowel, cervical and lung cancer (s9–s12); require notifications by specified healthcare providers (s13); provide individual opt‑out/control mechanisms (s14); and protect register data with authorised uses, exceptions and breach reporting (s17–s22A). The text includes delegated‑rule powers (s28) that allow the Minister to prescribe operational detail and to add certain classes of information (s11(g)), which means the register’s content and the set of notifying providers can be expanded within the framework of the Act. Those delegated powers create potential for future scope growth by regulation, but the primary statutory scope set out in the Act itself (designated cancers and the high‑level purposes in s12) is unchanged."},"complexity_factors":["30+ defined terms in the interpretation section (s4) including multi‑part definitions (e.g. \"key information\" with subparagraphs a–l).","Multiple cross‑references to other statutes (Privacy Act 1988, Regulatory Powers Act, Healthcare Identifiers Act 2010, National Health Act, various veterans/compensation Acts).","Layered authorisations and exceptions: authorised collection/use (s17), criminal offence for unauthorised use (s18), and several defences/exceptions (s19–s22).","Two enforcement tracks: criminal offence (s18) and civil penalties (s13, s22A) enforced under the Regulatory Powers Act (s24).","Delegation and contracting regime allowing outsourced processing (s26, s27) combined with specific breach notification duties for contractors (s22A) and civil penalties for non‑reporting.","Rule‑making power with specific consultation obligations (s28 and s28(1A)) and express limits on rule content (s28(2)), creating significant delegated‑legislation complexity.","Alternative constitutional bases clause (s15) that broadens interpretive options for operation and enforcement.","Conditional logic where individual's requests limit otherwise authorised collection/use (s14 contrasted with s17/s13) — timing and retrospective effect create interpretive complexity."],"plain_english_summary":"**What this law does (in plain English)**\n\n- Establishes a Commonwealth-run database called the National Cancer Screening Register to hold information about screening and diagnoses for specified cancers (s9, s10, s11). The Act expressly lists bowel, cervical and lung cancer as the \"designated cancers\" the register may cover (s4, s10).\n\n- Sets out why the register exists: to run an electronic database, analyse and publish statistics, monitor screening quality and safety, send invitations and test kits, remind people and their nominated healthcare providers about screening, give access to information for individuals, healthcare providers and participating States/Territories, and support planning, reporting and research (s12).\n\n- Creates rules about who must notify the register and what must be notified: healthcare providers specified in rules must notify the Commonwealth Chief Medical Officer in an approved form and by times set out in the rules (s13). Failure to notify attracts a civil penalty (30 penalty units) (s13(2)).\n\n- Allows individuals to make requests about their participation: nominate a healthcare provider, opt out of invitations/test kits/advice, stop future notifications about them being included after a date, change due dates for cervical screening, or request a pseudonym (s14). The Commonwealth must give effect to those requests \"as soon as practicable\" (s14(3)). Personal representatives can act for individuals (s14(4)).\n\n- Protects sensitive data: personal information and commercial‑in‑confidence material included in or derived from the register is \"protected information\" (s4). There is a criminal offence for unauthorised recording, use or disclosure of protected information (s18) with penalties up to 2 years imprisonment or 120 penalty units. The Act lists specific authorised uses and multiple exceptions (s17–s22).\n\n- Adds operational and governance mechanics: the Minister may make rules by legislative instrument (s28); the Minister may engage contractors to perform services (s26); the Secretary and Minister may delegate certain powers (s27); and contractors (and the Secretary) have reporting duties for data breaches (s22A) with a civil penalty for contractor non‑reporting (100 penalty units) (s22A(2)).\n\n\n**Who it affects**\n\n- Individuals who undergo or are eligible for screening for bowel, cervical or lung cancer — their personal and screening data can be recorded (s10, s11).\n- Individual healthcare providers and healthcare provider organisations who perform screening tests or make diagnoses (they may be required to notify under rules) (s13, s4 definitions).\n- Contracted service providers who process register data on behalf of the Commonwealth (s26, s22A(10)).\n- The Commonwealth (Minister, Secretary, Chief Medical Officer) and participating States/Territories that receive or use register information (s12, s17(3)(c)).\n- The Information Commissioner, who is given investigation and disclosure functions in relation to privacy breaches of the register (s22B, s22C).\n\n\n**Why it matters (claimed purposes and how the Act implements them)**\n\n- The Act claims the register will support screening programs, individual access to screening information, monitoring and research (s3, s8, s12). Mechanically, it implements those claims by: requiring notifications from specified healthcare providers (s13); permitting the collection and authorised use of personal and key information for register purposes (s17); and enabling the Minister to make rules to fill in operational detail (s28).\n\n\n**Testing the claimed purposes against practical trade‑offs, incentives and costs**\n\n- Compliance costs for providers: the Act makes notification mandatory for providers described in the rules (s13). Providers will incur administrative and IT costs to comply (time, recordkeeping, submitting approved forms). Non‑compliance risks civil penalties (s13(2)).\n\n- Privacy and enforcement trade‑offs: the Act creates a high‑value criminal offence for unauthorised use/disclosure of register data (s18). At the same time it authorises broad uses for Commonwealth purposes, healthcare, participating States/Territories and research (s17). That combination concentrates decision power in the Secretary/Minister and in rules about who can access data — placing emphasis on secure contracting, governance and enforcement (s26, s27, s22A). The Act adds an explicit duty to report breaches to the Information Commissioner (s22A) and treats contraventions as interferences with privacy under the Privacy Act (s22B), which strengthens external oversight but also increases procedural complexity.\n\n- Outsourcing and private sector involvement: the Minister may engage private contractors under agreements (s26). Contractors can obtain protected information in the course of performing services (s22A(10)). That creates a commercial market for register services (data processing, mail‑outs, analytics) but imports operational risk: contractors are under a civil duty to notify breaches (s22A(2)) and the Commonwealth must rely on contractual controls and the rules/regulatory settings made by the Minister (s26, s28).\n\n- Effects on individual choice and autonomy: the Act provides individuals (or their personal representatives) with explicit opt‑out and control requests (s14). Requests can stop invitations/test kits/advice, prevent future notifications from being included after the request date, change due dates for cervical screening, or apply a pseudonym (s14(1)). These provisions preserve an element of individual control over participation, but they do not remove already‑recorded data (s14(1)(c) applies only to information notified under s13 after the request date). The Commonwealth must process requests \"as soon as practicable\" (s14(3)), which leaves some administrative discretion on timing.\n\n- Impact on competition, prices and productivity: the register itself is a government database. It does not directly set prices or provide services in competition with private actors, but contractors engaged under s26 could supply services that private firms might compete for. The Act protects commercial‑in‑confidence information from disclosure (s5, s17(1)(c)), which can preserve competitive positions for firms involved in program delivery. Compliance burdens on clinicians and pathology providers could shift resources from clinical activity to administration, with potential productivity costs.\n\n- Research and statistical use: the Act explicitly allows research and publication of statistics (s12(1)(b), (n)), but it limits researcher access in practice through the authorised use rules (s17(3)(a), s17(5)) and by cross‑reference to Privacy Act guidelines for certain kinds of research (s17(5)). That creates potential for regulated but available access for legitimate research while retaining privacy controls.\n\n\n**Who pays, who decides, and what behaviour changes**\n\n- Who pays: the Commonwealth funds establishment and operation of the register (s9). Healthcare providers bear compliance costs in notifying under the rules (s13). Contracted service providers are paid under agreements (s26) but bear notification/reporting obligations and potential civil penalties for non‑reporting (s22A).\n\n- Who decides: the Minister sets the operational rules and may approve forms (s25, s28). The Secretary (or delegated SES officers) executes day‑to‑day operational decisions including disclosures to disciplinary authorities and breach handling (s17(3)(g), s22A, s27). The Information Commissioner exercises oversight functions in relation to privacy interferences (s22B, s22C).\n\n- Behaviour changes expected: specified healthcare providers will put in place procedures to notify the register (s13); individuals may opt out or nominate a healthcare provider (s14); Commonwealth agencies and participating States/Territories will access register data for program delivery and monitoring (s12, s17); private contractors will be used to operate or support the register under contract (s26), which may increase demand for data processing services.\n\n\n**Key legal guardrails and limits**\n\n- The Minister may make detailed rules but the rules cannot create offences or penalties, impose taxes, or directly amend the Act (s28(2)). The Minister must consult the Information Commissioner before prescribing certain key items of information (s28(1A)).\n\n- The Act provides multiple exceptions and authorisations for data handling (s17–s22) and cross‑references the Privacy Act protections and the Information Commissioner’s investigatory powers (s22B). The Act also sets reporting obligations and penalties for data breach notification involving contractors (s22A).\n\n\n**Quick section map for practical reference**\n\n- Establishment and coverage: s9–s11\n- Purposes: s12\n- Notification duty (providers): s13\n- Individual participation controls (opt‑out etc.): s14\n- Authorised uses and exceptions: s17–s22\n- Data breach reporting: s22A\n- Rules, contracting and delegation: s25–s28\n\n(References in parentheses are to sections of the Act.)"},"issue_detection":{"absurdities":[{"type":"impossible_compliance","section":"s 5 (commercial-in-confidence definition)","severity":"high","reasoning":"Protected information includes commercial-in-confidence information, and criminal offences under s 18 turn on whether information is 'protected information'. But the precondition for information being commercial-in-confidence — a demonstration to the Minister — has no procedural scaffolding. A person who discloses information believing it is not commercial-in-confidence (because no one has demonstrated it to the Minister) may be wrong, yet the Act provides no mechanism to check. This creates impossible compliance conditions for third parties who cannot know the status of any given piece of information.","confidence":0.82,"description":"The definition of 'commercial-in-confidence' requires a person to 'demonstrate to the Minister' that the information meets four criteria. However, the Act provides no mechanism, procedure, forum, or timeline by which a person can make such a demonstration. There is no process by which the Minister adjudicates, decides, records or communicates the determination. The status of information as commercial-in-confidence is therefore practically indeterminate and cannot be reliably established for the purposes of the Act."},{"type":"retroactive_impossibility","section":"s 14(1)(c) and s 13(1)","severity":"low","reasoning":"While not strictly retroactive, a gap in commencement dates means s 14(1)(c) requests referenced a mechanism (s 13 notifications) that did not yet legally exist. This is a structural incoherence rather than an operational impossibility, as the requests would become operative once s 13 commenced, but it creates an oddity where the opt-out right preceded the thing being opted out from.","confidence":0.72,"description":"Section 14(1)(c) allows an individual to request that information 'notified under section 13 after the date of the request' not be included in the register. However, section 13 did not commence until 1 May 2017 (per the commencement table), while ss 14–28 commenced on 21 October 2016. This means individuals could make opt-out requests under s 14(1)(c) for a period of approximately 6 months before any notification obligation under s 13 existed, resulting in opt-out requests that had no practical subject matter to operate on at the time they were made."},{"type":"circular_definition","section":"s 4 (definition of 'entity', para (e))","severity":"low","reasoning":"Paragraph (e) only makes sense if 'entity' has already been defined, yet it forms part of the definition itself. The phrase 'previous application' implies iterative application of the same definition. While this drafting technique is used in other Commonwealth legislation and courts have generally accepted it, it is logically circular and creates genuine interpretive uncertainty about where the recursion stops.","confidence":0.65,"description":"The definition of 'entity' includes at paragraph (e) 'a part of another entity (under a previous application of this definition)'. This is a self-referential recursive definition: an entity includes a part of an entity, which is itself defined as a thing that includes a part of an entity, and so on infinitely. The parenthetical '(under a previous application of this definition)' attempts to arrest infinite regress but is logically circular — the definition defines itself by reference to itself."},{"type":"self_contradicting","section":"s 9(1) and s 10","severity":"medium","reasoning":"The mandatory establishment of a register whose contents are entirely discretionary ('may include') creates a hollow obligation. Section 11 similarly uses 'may include' for all content. A register that must exist but need not contain anything is a logical absurdity that undermines the entire legislative purpose stated in s 3.","confidence":0.78,"description":"Section 9(1) imposes a mandatory obligation ('must establish and keep a register'), but section 10 states the register 'may include' information about each of the three designated cancers. The combination means the Commonwealth is obliged to maintain a register that is not required to contain any information about any cancer type. The register could lawfully be empty and the Commonwealth would still be compliant with its establishment obligation."},{"type":"other","section":"s 22A(2) and s 22A(10) (definition of contracted service provider)","severity":"low","reasoning":"The Act treats former contracted service providers as having ongoing obligations (ss 22A(2), (4), (5), (9)) but the definitional basis for 'contracted service provider' in s 22A(10) is present-tense ('is engaged under an agreement'). A 'former' contracted service provider by definition no longer satisfies paragraph (a) of the definition. The Act applies obligations to a class of persons who no longer meet the definition used to impose those obligations.","confidence":0.7,"description":"The definition of 'contracted service provider' in s 22A(10) requires the person to 'obtain protected information in the course of performing services under the agreement'. The civil penalty in s 22A(2) also applies to 'former contracted service providers'. However, once a person ceases to be a contracted service provider, the agreement under which they obtained protected information has ended. It is logically problematic to impose ongoing obligations under a definition that references a current agreement when the person's status is defined by the cessation of that agreement."},{"type":"other","section":"s 12(2) — cross-references to s 12(1)(d), (e), (f), (i)","severity":"low","reasoning":"Sending a bowel cancer test kit to a personal representative rather than the individual raises practical and clinical absurdities — the representative would need to physically deliver it, and the individual's consent to screening is obscured. The provision does not address whether the individual must also receive the kit or whether the representative's receipt substitutes entirely.","confidence":0.55,"description":"Section 12(2) extends paragraphs 12(1)(d), (e), (f) and (i) to personal representatives. However, paragraphs (d) and (e) concern providing invitations and test kits to 'an individual', and s 12(2)(a) says those paragraphs 'also apply to providing the representative with an invitation or test kit for the individual'. This conflates the individual receiving screening-related communications with a representative receiving them on the individual's behalf — but an invitation or test kit sent to a representative is functionally sent to the wrong person for clinical purposes, potentially undermining informed consent and clinical governance."},{"type":"impossible_compliance","section":"s 14(1)(e)","severity":"medium","reasoning":"If the register uses a pseudonym, how does the Commonwealth Chief Medical Officer receive notifications under s 13 that match to the pseudonymous record? How does the individual's nominated healthcare provider receive advice under s 12(1)(g)? How does a participating State or Territory identify the individual under s 12(1)(k)? The pseudonym right appears practically impossible to implement without defeating the register's core purposes, yet the Commonwealth is obliged under s 14(3) to give effect to such a request 'as soon as practicable'.","confidence":0.75,"description":"Section 14(1)(e) allows an individual to request 'that the register use a pseudonym for the individual'. However, the register's core function — including sending screening invitations, test kits, and coordinating with nominated healthcare providers and States and Territories — requires identification of the individual. Using a pseudonym would make the register unable to fulfil its statutory purposes under s 12 in relation to that individual. The Act provides no mechanism to reconcile pseudonymity with operational functionality."}],"contradictions":[{"severity":"medium","section_a":"s 6 (Crown not liable to prosecution for offences)","section_b":"s 22B(1) (contraventions of s 18 are interferences with privacy)","confidence":0.65,"description":"Section 6 provides that the Act does not make the Crown liable to be prosecuted for an offence. Section 18 creates a criminal offence for unauthorised use of protected information. Commonwealth officers acting in an official capacity who commit offences under s 18 would fall within Crown immunity. However, s 22B deems contraventions of s 18 to be interferences with privacy under the Privacy Act 1988, which carries its own enforcement mechanisms. The Crown immunity from prosecution (s 6) could be circumvented via the s 22B pathway, creating an inconsistency in the enforcement regime."},{"severity":"medium","section_a":"s 17(3)(e) (authorised use if required or authorised by any law)","section_b":"s 18 (offence for unauthorised use of protected information)","confidence":0.7,"description":"Section 17(3)(e) authorises collection, recording, disclosure or use of protected information if the person 'is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory'. This is an extremely broad carve-out that could encompass almost any exercise of statutory power by any government official under any Commonwealth or State law. Combined with s 17(3)(c) (State/Territory authority permissions), the authorisation exceptions are so broad they could render the s 18 offence practically unenforceable against government actors, contradicting the Act's stated purpose of protecting sensitive information."},{"severity":"high","section_a":"s 14(1)(c) (individual may request information not be included in register)","section_b":"s 13(1) (healthcare provider must notify Commonwealth Chief Medical Officer)","confidence":0.85,"description":"Section 13(1) imposes a mandatory obligation on prescribed healthcare providers to notify the Commonwealth Chief Medical Officer of specified information. Section 14(1)(c) allows an individual to request that information notified under s 13 not be included in the register. However, s 17(2) only prevents inclusion of information in the register contrary to a s 14 request — it does not prevent the notification obligation under s 13. The result is that healthcare providers are compelled to notify information that the Commonwealth is then prohibited from including in the register, creating a mandatory reporting obligation that produces information that cannot lawfully be used for its primary purpose."},{"severity":"low","section_a":"s 9(1) (Commonwealth must establish and keep the register)","section_b":"s 14(1)(c) (individual may request exclusion of information from register)","confidence":0.55,"description":"The Commonwealth has a mandatory duty to establish and maintain the register (s 9(1)), and must give effect to individual requests under s 14(3) 'as soon as practicable'. If a sufficient number of individuals exercise their right under s 14(1)(c) to exclude their information from the register, the Commonwealth remains obliged to maintain an effectively empty register. There is no provision allowing the Commonwealth to wind down or modify the register in response to widespread opt-outs, creating an absurd ongoing administrative obligation."},{"severity":"medium","section_a":"s 22A(1) (Secretary must notify Information Commissioner of possible contraventions)","section_b":"s 22C (Information Commissioner may disclose investigation details back to Secretary)","confidence":0.75,"description":"Section 22A(1) requires the Secretary to notify the Information Commissioner of possible contraventions. Section 22C then authorises the Information Commissioner to disclose details of the resulting investigation back to the Secretary. This creates a circular information flow: the Secretary notifies the Commissioner of a possible breach involving the Secretary's own department, and the Commissioner then reports back to the Secretary about the investigation of that breach. The Secretary is simultaneously the notifier, a potential subject of investigation, and the recipient of investigation intelligence — undermining the independence of the oversight mechanism."},{"severity":"medium","section_a":"s 4 definition of 'personal representative' para (a) (parent or guardian if individual incapable of managing health affairs)","section_b":"s 4 definition of 'personal representative' para (d) (person nominated by the individual)","confidence":0.78,"description":"The definition of personal representative creates an internal tension: paragraph (a) applies where an individual is 'incapable of managing his or her health affairs', while paragraph (d) applies to a person 'nominated by the individual'. An individual who is incapable of managing their health affairs may also be incapable of making a valid nomination under paragraph (d). Both categories could simultaneously apply to the same individual in borderline capacity cases, with different persons potentially qualifying as personal representative under different paragraphs, with no priority rule or conflict resolution mechanism provided."},{"severity":"high","section_a":"s 4 definition of 'key information' para (a) (records 'gender')","section_b":"s 4 definition of 'key information' para (f)(i) (records 'sex' for cervical cancer screening)","confidence":0.82,"description":"The definition of key information records 'gender' as a general identifier (para (a)) but separately records 'sex' specifically for cervical cancer screening (para (f)(i)). The Act does not define either 'gender' or 'sex', nor does it explain the distinction between the two for operational purposes. For cervical cancer screening, which is clinically relevant to biological sex rather than gender identity, the separation creates ambiguity about which field governs eligibility for screening invitations and whether a mismatch between recorded gender and sex would trigger or suppress screening invitations."}]},"summary":{"complexity_score":7,"scope_assessment":{"changed":true,"description":"The original Act covered bowel and cervical cancer screening only. Lung cancer has since been added as a 'designated cancer' (along with references to the Treatment Benefits (Special Access) Act 2019 in the claims information definition), indicating the scope has expanded beyond the original two cancer types. The data breach provisions (section 22A) and related privacy enforcement mechanisms also appear to have been added after the original enactment, reflecting a significant expansion of the regulatory framework beyond the register's core establishment purpose."},"complexity_factors":["Multiple interlocking definitions that cross-reference each other and other Acts (Privacy Act 1988, Healthcare Identifiers Act 2010, Health Insurance Act 1973, etc.)","Extensive cross-referencing to at least 10 other pieces of Commonwealth and State/Territory legislation","Layered authorisation framework for information use — a long list of permitted/prohibited circumstances that interact with individual opt-out requests","Dual penalty regime mixing criminal offences (imprisonment) and civil penalties (pecuniary fines), with multiple exceptions and evidential burden rules","Complex data breach response obligations with multiple duty-holders (Secretary, contracted service providers, former contracted service providers) and tiered notification requirements","Alternative constitutional bases provision (section 15) invoking multiple heads of Commonwealth legislative power — uncommon and legally technical","Significant detail delegated to subordinate 'rules' made by the Minister, meaning the full legal picture requires reading separate legislative instruments","Interaction between federal register obligations and participating State/Territory laws creates a cooperative federalism layer","Special provisions for sensitive sub-populations (personal representatives, children, people with disabilities, veterans, Indigenous Australians)","Repeated content in the document (the Act text appears duplicated multiple times in the source material, adding navigational complexity)"],"plain_english_summary":"This law creates a government-run National Cancer Screening Register that records bowel, cervical and lung screening tests and diagnoses. It affects Australians who’ve had those tests, requires certain healthcare providers to report results, and lets individuals control participation (opt out, block entries, use a pseudonym, nominate a doctor or delegate decisions). The register includes strict privacy protections, breach-reporting rules, and penalties for unlawful use or failing to report breaches."}},"importantCases":[],"_links":{"self":"/api/acts/national-cancer-screening-register-act-2016","history":"/api/acts/national-cancer-screening-register-act-2016/history","analysis":"/api/acts/national-cancer-screening-register-act-2016/analysis","conflicts":"/api/acts/national-cancer-screening-register-act-2016/conflicts","importantCases":"/api/acts/national-cancer-screening-register-act-2016/important-cases","documents":"/api/acts/national-cancer-screening-register-act-2016/documents"}}