Australian Prudential Regulation Authority (confidentiality) determination No. 1 of 2024

The instrument builds on a small set of statutory concepts and administrative choices. The primary statutory hooks in the instrument are section 57 of the Australian Prudential Regulation Authority Act 1998, paragraph 57(2)(b) (which permits APRA to determine that information does not contain confidential information), and subsection 56(5C) (which governs APRA’s ability to publish non-confidential information). The instrument also invokes subsection 33(3) of the Acts Interpretation Act 1901 to support delegation. Independently, the instrument incorporates statutory definitions by reference: “reporting document” has the statutory meaning in section 13 of the Financial Sector (Collection of Data) Act 2001, and “MySuper product” has the meaning in section 10(1) of the Superannuation Industry (Supervision) Act 1993.

Operationally, three conceptual elements determine the instrument’s coverage: (1) scope by reporting standard and form (Part 1 lists whole forms that are non-confidential after the 14‑day clock); (2) granular column/row-level carve-outs (Part 2 specifies which columns/rows or conditional rows are non-confidential, and which remain confidential); and (3) product-specific limitation (Part 3 limits some non-confidential treatment to data that relates to MySuper products). The instrument uses time triggers: generally a 14-day delay from the date the financial sector entity was required to provide the information under the reporting standard; in specific SRS550.1 provisions, a 12-month period applies for certain additional columns to become non-confidential.

The instrument further relies on conditional, row-level logic. For example, in SRS 332.0 (Expenses), certain cells in SRF 332.0 table 1 are non-confidential only for rows that contain specified values in one or more columns (for example, where Column 4 contains ‘Industrial Body’ or ‘Promoter’, or where a Service Provider identifier matches rows in other tables that have particular indicators). The instrument therefore treats confidentiality as a function of the content of submitted rows, not just of the reporting form as a whole. The Schedule contains several tables mapping reporting standard → reporting form → specific tables/columns → whether "All", "None" or "Conditionally" non-confidential.

Finally, the instrument is an exercise of APRA administrative discretion. By stating that the effect is that the non-confidential information may be published under s 56(5C), the determination places the data within APRA’s publication apparatus, but it does not mandate immediate publication; it enables APRA to publish in accordance with its statutory powers and policies. The legal effect is to remove statutory confidentiality protection for the parts identified in the Schedule, thereby exposing them to disclosure pathways available to APRA.

This determination affects entities that provide the specified reporting documents to APRA “by a financial sector entity” as that phrase is used in the Schedule and as governed by the Financial Sector (Collection of Data) Act 2001 reporting standards. The instrument does not create reporting obligations; it reclassifies the confidentiality of data that financial sector entities are already required to supply under existing reporting standards. The affected parties therefore are the regulated entities that submit the specified SRF/SRS forms to APRA: superannuation entities (RSEs), insurers, and other APRA-regulated firms that are obliged to file the listed reporting forms.

More concretely, the Schedule names reporting standards and forms used by RSEs and insurers: examples include SRS 251.0 Insurance (and SRF 251.0-251.3 forms), SRS 606.0 RSE Profile (SRF 606.1), SRS 611.0 Member Accounts (SRF 611.0), SRS 705.0 Components of Net Return (SRF 705.0), SRS 706.0 Fees and Costs (SRF 706.0), SRS 332.0 Expenses (SRF 332.0 tables), SRS 550.0 Asset Allocation (SRF 550.0 and related SRF 550.x tables), SRS 605.0 RSE Structure (SRF 605.0 tables) and SRS 705.1 Investment Performance and Objectives (SRF 705.1 and SRF 705.2). Part 3 specifically affects entities that provide information relating to MySuper products in SRF 705.1 and SRF 705.2 columns identified.

The instrument also affects third parties whose identifiers or commercial details appear in the reported data. For instance, the SRS 332.0 Expenses table maps service provider identifiers and types; some rows or columns that include service provider identifiers are designated non-confidential in certain circumstances (for example, where a row shows ‘Industrial Body’ or where a Related Party Indicator is ‘Yes’). That change directly affects service providers whose identities, relationship indicators or payment amounts are reported.

Who pays and who decides: regulated entities supply the data; APRA (via delegated officers) decides which parts are non-confidential by this determination. Behavioural change expected is that affected entities must assume that material covered by the Schedule will not be protected from APRA publication under s 56(5C) once the applicable time period elapses (14 days or, where specified, 12 months), and therefore anticipate public exposure of the listed datasets.

The instrument does not, in itself, alter contractual obligations between financial sector entities and their service providers, but it creates a new public-exposure risk for contractually-sensitive information that appears in the specified reporting elements. Entities that rely on confidentiality of particular dataset cells will need to manage that exposure through commercial or operational means (for example, timing, redaction where permitted by reporting standards, or contractual renegotiation), recognising that the determination affects statutory confidentiality, not private contract rights.

Statutory duties that intersect with this determination are primarily pre-existing reporting duties under APRA reporting standards. The determination does not create new filing duties; instead, it determines the confidentiality status of specified parts of reporting documents once they have been provided to APRA under the relevant reporting standard. The instrument rests on APRA’s power in section 57 of the APRA Act to make confidentiality determinations, and it uses the Acts Interpretation Act 1901 to support delegation. Key rights and duties flow from these legal relationships.

APRA’s duty and right: APRA, through the delegate, has exercised the entitlement to determine that specified information is not confidential. That determination enables APRA to publish the identified data under subsection 56(5C) of the Act. The instrument therefore gives APRA a legal basis to disclose the non-confidential parts of the reporting documents. This is an affirmative administrative power to reclassify information already held by APRA, and it is constrained by the Schedule and the statutory disclosure framework in the Act.

Financial sector entities’ duties and limitations: reporting entities remain obliged to supply the reporting documents as required by each reporting standard; the instrument does not alter submission requirements or timing. What it changes is the treatment of those submissions after provision: once the relevant period (generally 14 days) from the date the entity was required to provide the information has elapsed, the specified parts are no longer treated as confidential for APRA’s purposes. For columns subject to a 12‑month delay (some SRS 550.1 columns), confidentiality lapses after a longer period as specified in the Schedule.

Entities also have a limited ongoing right to confidentiality for elements of the reporting forms that the Schedule expressly leaves out. The Schedule is explicit about columns/tables where the determination does not apply (for example, SRF 550.0 table 2 columns listed under “Classifications not covered” and SRF 605.0 table 4 column 6 is explicitly “None covered, All not covered” meaning that column remains confidential). Those parts remain subject to the pre-existing confidentiality protections in the Act (and any other applicable statutory rules).

Third-party considerations: service providers or other third parties named in reporting forms may have contractual or reputational interests implicated by a loss of statutory confidentiality. The determination limits the ability of a reporting entity to invoke APRA statutory confidentiality to shield those items listed in the Schedule once the time threshold passes. Entities retain whatever private-law remedies they have under contract, but those remedies do not restore statutory confidentiality with respect to APRA’s disclosure power conferred by s 56(5C).

Discretion and timing: the instrument does not compel APRA to publish, it determines non-confidentiality, and the Schedule relies on objective conditions (form, table, column, row values, and time elapsed) to determine when statutory confidentiality is removed. Entities should treat the dates on which they are required to provide data as the trigger points for the 14-day or 12-month clocks specified in the Schedule.

The determination is an administrative characterisation and does not itself create new penal consequences. It revokes a prior APRA confidentiality determination and replaces it with the current mapping of what APRA treats as non-confidential. The instrument does not set fines, sanctions or criminal penalties, nor does it purport to change the underlying statutory penalties that may be associated with breaches of reporting obligations under separate legislation or reporting standards. It simply determines that certain information does not contain confidential information for the purpose of APRA Act disclosure rules.

Enforcement of the determination is procedural rather than penal. The practical enforcement mechanism is APRA’s ability to disclose material that has been designated non-confidential under the instrument. Once a dataset or specified parts are classified as non-confidential, APRA may publish them in accordance with s 56(5C) of the APRA Act; the risk to regulated entities is reputational, commercial, or consequential (for example, third-party contractual claims), not a direct new statutory penalty arising from this instrument.

The instrument relies on APRA’s existing powers to obtain and publish data, and those powers are themselves governed by the Act and by the reporting standards under the Financial Sector (Collection of Data) Act 2001. Any enforcement action for failure to submit reporting documents or for submitting false or misleading information would be taken under the reporting standards and the statutory framework that created the reporting obligations, not under this determination. The instrument does, however, change the enforcement landscape in a practical sense: because specified data may be published, regulated entities face increased exposure for any non-compliance or reporting errors in the affected fields.

The instrument does not address review mechanisms, merits review or judicial review of a confidentiality determination. It is made by a delegate under s 57 and the Acts Interpretation Act 1901; challenges to APRA determinations in general would proceed by judicial review principles applicable to administrative decisions, but the instrument itself contains no procedural guidance for review or appeal. The determination revokes the earlier No. 3 of 2023 instrument; it therefore alters the administrative rule that governed confidentiality of these reporting documents previously. If affected entities consider APRA’s exercise of discretion was legally flawed, their rights to challenge would be determined by general administrative law principles rather than by this instrument’s text.

The determination explicitly cross-references a small set of statutes and statutory definitions. It is made under section 57 of the Australian Prudential Regulation Authority Act 1998 and uses subsection 33(3) of the Acts Interpretation Act 1901 in relation to delegation. It relies on the statutory definition of "reporting document" in section 13 of the Financial Sector (Collection of Data) Act 2001 and on the SIS Act definition of “MySuper product” at section 10(1) to limit part of its scope. The instrument notes that its effect is to permit publication under subsection 56(5C) of the APRA Act. These cross-references are the explicit legal intersections the instrument itself identifies.

The determination therefore sits inside three connected statutory frameworks:

• APRA’s confidentiality and disclosure regime under the APRA Act (ss 56 and 57), which governs APRA’s power to protect or publish information it receives; the instrument directly modifies which parts of reports APRA will treat as non-confidential for disclosure purposes.

• Reporting obligations created under the Financial Sector (Collection of Data) Act 2001 , the reporting standards that require regulated entities to provide the listed SRF/SRS documents are the upstream source of the actual data that the determination covers; the instrument does not alter those reporting standards, but it changes how that reported material is classified by APRA.

• The Superannuation Industry (Supervision) Act 1993, through the definition of MySuper product used in Part 3, which limits the non-confidential treatment for certain SRF 705.1/705.2 cells to information that relates to MySuper products.

The instrument does not itself reference the Privacy Act 1988, general corporations law, competition law or securities law. That does not mean there is no practical interface, but the instrument’s text leaves those intersections outside its explicit scope. Entities should note that publication by APRA of non-confidential data may engage other legal regimes (for example, privacy obligations or contractual confidentiality arrangements), but those interactions are not altered by this instrument beyond the fact the instrument removes APRA’s statutory confidentiality protection for the specified data. Any tension between APRA’s disclosure and other statutory obligations would arise in the practical application of multiple legal regimes and would require entity-specific legal assessment.

The instrument also interacts administratively with APRA’s prior confidentiality determination because it revokes the earlier instrument (No. 3 of 2023). Revocation removes the previous mapping of confidential/non-confidential fields and replaces it with the current Schedule. The instrument therefore alters the administrative baseline for entities that had relied on the confidentiality settings in the 2023 determination.

This instrument is Australian Prudential Regulation Authority (confidentiality) determination No. 1 of 2024 and is dated 7 June 2024. The instrument expressly revokes Australian Prudential Regulation Authority (confidentiality) determination No. 3 of 2023. It is made by delegate (Andrew Robertson) under section 57 of the APRA Act and subsection 33(3) of the Acts Interpretation Act 1901. The instrument states its commencement is the start of the day after it is registered on the Federal Register of Legislation.

Beyond the single revocation noted in the instrument, no other amendments, historical versions or iterative changes are recorded in the text provided. The Schedule sets the current confidentiality mapping as of this instrument and supersedes the mapping in the revoked instrument No. 3 of 2023. The instrument contains date, signatory and commencement details; it does not contain a transitional schedule beyond the time triggers specified for particular dataset cells (for example, the 14-day or 12-month periods from the date the reporting entity was required to provide the information).

If entities had previously relied on the No. 3 of 2023 determination to treat particular datasets as confidential from APRA’s statutory perspective, that reliance will be affected as soon as this instrument commences. The instrument does not itself amend reporting standards, but it changes the confidentiality framework applying to data that is produced under those reporting standards. Any future amendments to the confidentiality mapping would, in turn, need to be made by a further APRA determination under section 57 and would presumably be published and registered on the Federal Register of Legislation.

The instrument’s textual record provides the minimal legislative history required for administrative transparency: instrument number, date (7 June 2024), delegate name and title, statutory bases for the determination and the Schedule listing specific reporting standards, forms and columns/tables. There is no explicit transitional carve-out or grandfathering clause in the text beyond the time delays specified for certain data fields; the instrument’s revocation clause means the 2023 determination is no longer operative once this instrument commences.

The instrument itself does not mention any litigation. It neither cites court decisions nor records any judicial or administrative proceedings related to this determination. The text revokes a prior APRA confidentiality determination (No. 3 of 2022023) but contains no reference to litigation arising from that prior instrument. Therefore the instrument, as drafted, records no litigation history or legal challenges in its text.

Absent citations in the instrument to particular court or tribunal decisions, this determination should be treated as an administrative exercise by APRA under the relevant statutory powers. If parties wish to assess whether any previous confidentiality determinations have been subject to judicial review or other litigation, they would need to search case law and administrative law databases; that inquiry is outside the instrument’s text.

Because the instrument affects statutory confidentiality (and thus the possibility of APRA publication under s 56(5C)), it is possible in principle that affected parties could seek judicial review of APRA’s decision-making process in appropriate circumstances. The instrument does not provide internal review rights or appeal mechanisms; any challenge to the lawfulness of the determination would proceed under general administrative law principles. The instrument itself, however, contains no litigation record and identifies no judicial precedent as relevant to its exercise of discretion.

There are several practical and legal nuances embedded in the Schedule that create specific implementation risks and potential surprises for reporting entities and their commercial partners.

Timing triggers: the general rule is a 14-day delay from the date the entity was required to provide the information under the reporting standard; in several SRS 550.1 entries the Schedule states that where a period of at least 12 months has elapsed, additional classifications become non-confidential. Entities may assume a uniform 14-day rule; instead they must calculate the applicable clock for each reporting field and be alert to the longer 12-month trigger where specified.

Row-level conditionality: for SRS 332.0 (Expenses), whether a particular value in a column is non-confidential may depend on the presence of specific values in other columns or on matching service provider identifiers across tables. For example, SRF 332.0 table 1 columns 1-3 and 5-9 will be non-confidential for rows containing particular values in Column 4 or where the Service Provider identifier matches rows in other tables with particular indicators. That requires entities to implement logic to identify which rows will lose confidentiality and when. A failure to correctly map the conditional rules may lead an entity to under- or over-estimate public exposure.

Partial coverage and exclusions: some tables or columns are explicitly not covered. For example, SRF 332.0 table 2 columns 7-10 are marked “None” covered and therefore remain confidential, while SRF 332.0 table 4 (all columns) are covered and become non-confidential. In SRS 605.0, SRF 605.0 table 4 column 6 is listed as “None covered , All not covered”, meaning that column remains confidential. These selective coverings mean that even within a single form an entity must treat some cells as publishable and others as confidential.

Service provider identifiers: the mapping may expose service provider identifiers in certain circumstances. For example, SRF 332.0 table 2 column 1 is non-confidential when the row contains ‘Marketing’ in Expense Type, or when Related Party Indicator is ‘Yes’, or where the identifier matches certain rows in other tables. Exposed identifiers may have contractual or reputational effects for service providers or may trigger third-party disputes.

MySuper limitation: for SRF 705.2 table 1 and table 2 columns 5-6, coverage in Part 3 applies only where the information relates to a MySuper product (as defined in s 10(1) SIS Act). Entities that operate both MySuper and non-MySuper offerings must tag the relevant dataset rows precisely; mis-tagging could lead to unintended disclosure or an erroneous confidentiality assertion.

APRA publication is discretionary: the instrument states the effect is that non-confidential information may be published under s 56(5C). “May” is permissive, not mandatory. Being classified non-confidential exposes data to the risk of publication, but it is not an automatic publication trigger. Entities must therefore prepare for possible publication but cannot assume publication will occur.

Revocation of prior instrument: entities that had relied on the earlier No. 3 of 2023 determination for confidentiality assurances need to re-evaluate which datasets remain confidential. The timing of the revocation (commencement day after registration) is material for transitional planning.

No new reporting standards changed: the determination does not modify the reporting standards themselves. If a reporting standard forbids redaction of a field, the entity cannot avoid APRA receiving that data; the determination affects only APRA’s handling of it after receipt.

Administrative and technical burden: complying with the row/column conditionality, tracking precise submission dates to compute the 14‑day or 12‑month periods, and auditing service-provider matches across tables will require data governance effort. Entities should expect to invest in mapping, quality assurance and possibly contract renegotiation with service providers.

Compliance with the practical effect of this determination is a mix of legal, data-governance and commercial measures. Because the instrument reclassifies specified reporting elements as non-confidential after defined time periods, affected entities should take the following actions to manage legal exposure and operational risk. These steps are concrete and flow from the instrument’s Schedule and timing rules.

1. Map obligations to the Schedule

   • Create a crosswalk between the reporting standards/forms your entity submits and the Schedule’s entries (e.g. SRS 251.0 → SRF 251.0-251.3; SRS 332.0 → SRF 332.0 tables 1-4; SRS 550.0/550.1 → SRF 550.x; SRS 605/606/611/705/706 as listed).
   • Identify which tables/columns are marked “All”, “None” or conditionally non-confidential. Treat conditional rows as a separate class requiring row-level logic.

2. Track trigger dates

   • Record the date on which the entity was required to provide each reporting document under the relevant reporting standard; that date is the trigger for the 14-day clock in most cases.
   • For SRS 550.1 entries where the Schedule specifies a 12-month delay before additional columns become non-confidential, record those dates and automate reminders.

3. Implement row-level logic and QA

   • For SRS 332.0 conditional rules, implement deterministic logic that checks the relevant column values (for example, Column 4 values such as ‘Industrial Body’ or ‘Promoter’; Related Party Indicator flags; Expense Type = ‘Marketing’) and service-provider identifier matches across tables to determine whether a row is non-confidential.
   • Ensure quality assurance controls to prevent misclassification of rows and ensure accuracy of service-provider identifiers.

4. Review contracts and commercial arrangements

   • Identify third parties (service providers, related parties) whose identifiers or payment data may be exposed under the Schedule.
   • Consider whether contractual confidentiality clauses anticipate statutory publication by a regulator and whether commercial arrangements need adjustment (subject to the reporting standard requirements). Private contracts cannot reinstate statutory confidentiality but may provide remedies or set expectations with service providers.

5. Data minimisation and redaction (only where permitted)

   • Review reporting standards to confirm whether any selective redaction is permitted. The determination does not change reporting accuracy obligations and does not permit withholding data required by the reporting standards.
   • If redaction is permitted by the reporting standard (rare), assess whether redaction would achieve business objectives, noting that the Schedule addresses what APRA will treat as non-confidential once provided.

6. Governance, privacy and disclosure policies

   • Update data governance policies to reflect that certain reporting fields will not be treated as confidential by APRA after the trigger period.
   • Coordinate with privacy and legal teams to assess downstream privacy implications of APRA publication, recognising the instrument does not itself engage the Privacy Act but publication may nonetheless disclose personal or commercial information.

7. Prepare for potential publication

   • Assume APRA could publish the non-confidential data under s 56(5C). Establish process owners who can respond to APRA publications (for example, investor relations, communications, legal).
   • Develop a plan to address reputational or commercial fallouts if specific line items are published (for example, service provider arrangements, fee components, related-party transactions).

8. Seek clarity from APRA where necessary

   • For edge cases (e.g. borderline MySuper tagging in SRF 705.1/705.2 rows), consider engaging APRA through established channels to confirm interpretation. The instrument’s text is specific but operational questions about implementation could benefit from APRA guidance.

9. Audit trail and record-keeping

   • Maintain an auditable record of submission dates, the dataset versions submitted, and the logic used to determine whether rows are non-confidential. This will assist in responding to any discrepancies or challenges arising from publication.

10. Legal review and risk assessment

    • Obtain legal advice focused on: (a) the instrument’s immediate effect on statutory confidentiality for specified fields, (b) interplay with contractual confidentiality and potential remedies, and (c) any privacy law, competition or market disclosure consequences specific to the entity’s business model.

These compliance steps follow the instrument’s operational logic: the determination changes APRA’s statutory confidentiality treatment for listed datasets once specified time triggers have passed. Entities cannot alter APRA’s statutory power by private contract, but they can manage the operational, contractual and reputational consequences by the measures above.