Australian Prudential Regulation Authority (confidentiality) determination No. 6 of 2015

The instrument rests on a small set of statutory and administrative concepts, each of which is central to understanding its operation.

• Determination under a delegation: The instrument is made by an APRA member acting as delegate under paragraph 57(2)(b) of the Australian Prudential Regulation Authority Act 1998. The determination therefore exercises a delegated power to classify information as non-confidential for APRA's publishing purposes. The instrument itself records the delegation point of origin.

• Reporting document: The term is defined by reference to section 13 of the Financial Sector (Collection of Data) Act 2001; the Schedule then specifies multiple reporting standards and reporting forms that fall within that definition. The practical effect is that the document types are those APRA requires from RSE licensees under APRA's reporting standards regime.

• Non-confidential information and publication: The Note following the operative clause links the determination to subsection 56(5C) of the APRA Act, stating that the effect is that the non-confidential information "may be published under subsection 56(5C)". In short, the determination removes the confidentiality protection from the listed reporting elements so that APRA may exercise its publication power under the cited subsection.

• Temporal trigger , 14-day rule: Both Part 1 and Part 2 of the Schedule make the coverage conditional on a period of at least 14 days having elapsed from the date the RSE licensee was required to provide the information specified in the relevant reporting standard. That timing rule is the operational hinge for when the non-confidentiality applies.

• Exclusion of personal information: The determination explicitly preserves the confidentiality of "personal information within the meaning of the Privacy Act 1988", so fields that are personal information remain subject to the Privacy Act rather than being declared non-confidential for APRA's publication purposes.

• Granular coverage: Part 2 enumerates specific line items and sub-fields of reporting forms (SRF 160.0, SRF 160.1, SRF 320.0, SRF 520.0, SRF 530.0, SRF 530.1, SRF 531.0, SRF 533.0, SRF 540.0, SRF 601.0). The determination therefore is not a blanket removal of confidentiality from entire reporting systems but a selective removal, either of entire reporting forms (Part 1) or of particular parts of reporting forms (Part 2).

• Current and superseded standards: The Schedule lists both current reporting standards and a set of superseded reporting standards captured in Part 1. The inclusion of superseded standards suggests a retrospective capture of data submitted under older reporting standards, subject to the 14-day rule.

Each concept is defined or applied in the text of the instrument. The instrument does not add new powers to APRA beyond those already in the APRA Act, but it exercises the authority to determine confidentiality status for the specified reporting fields and forms. The interaction between the 14-day timing rule and APRA's publication power under s 56(5C) is the operational mechanism by which data moves from being confidential to potentially publishable.

The primary directly affected parties are the RSE licensees (registrable superannuation entity trustees and their RSEs) who provide the listed reporting documents or those parts of reporting forms to APRA. The Schedule specifically references "RSE licensee" reporting forms and the 14-day lapse measured from "the date the RSE licensee was required to provide the information specified in the relevant reporting standard." Therefore trustees and RSE licensees must treat the covered items as potentially publishable non-confidential information once the 14 days have passed.

Other directly affected actors include:

• Responsible persons and officers of RSEs: SRF 520.0 items on existing and new director, executive officer and senior manager employment information are listed. That means employment details captured under those SRFs are within the set of items convertible to non-confidential information (subject to the personal-information carve-out) and therefore their status for publication is affected.

• Auditors and actuaries: SRF 520.0 items include existing and new RSE auditor and actuary information. Those professional services providers should expect that certain identification and appointment data may be treated as non-confidential.

• Service providers and counterparties: Reporting standards capture fee data (SRF 540.0), investments (SRF 530.x series), in-house assets and employer-sponsor ABNs (SRF 601.0), and investment flows (SRF 531.0). Entities that contract to provide services, that supply investments through mandates, or that are identified as employer-sponsors will be affected because line-item and identification data in APRA returns may become publishable.

• Employers sponsoring defined benefit arrangements: The Schedule contains SRF 160.0 and 160.1 defined benefit matters and member flows, including employer-sponsor counts, employer-sponsors on contribution holidays, and participation limitations. Employer-sponsors can expect certain aggregated and identified pieces of their interaction with RSEs to be captured as non-confidential.

• Market participants and researchers: Because the determination makes specified data potentially publishable under the APRA Act, journalists, researchers, competitors, and other market participants are indirectly affected in that they may gain public access to this previously confidential regulatory data once APRA exercises its publication power.

• APRA itself and its administrative processes: APRA gains clarity on which reporting items are non-confidential and therefore may be published. APRA staff implementing data publication, data management teams and legal/compliance functions will need to reflect the determination in internal handling and redaction regimes, particularly with respect to the personal-information carve-out.

• Members and beneficiaries: Some of the covered items , membership profile standards SRS 610.x and items within SRF 320.0 (net assets available for members’ benefits, defined benefit members’ benefits, unallocated contributions) , concern aggregated member outcomes and balances. While personal information is excluded from the determination, aggregated member-related metrics may be published, which affects members’ access to fund-level information.

Who pays and who decides: RSE licensees "pay" in operational and reputational terms because they are required by the reporting standards to provide the data that becomes potentially publishable. APRA decides whether and how to publish under subsection 56(5C) of the APRA Act once the statutory non-confidentiality is in place. The instrument does not change the underlying statutory reporting obligation; it changes the confidentiality status of specified data for purposes of APRA's publication power.

This determination modifies the confidentiality status of identified reporting information; it does not itself create new reporting duties nor remove the statutory duty to provide data to APRA under the Financial Sector (Collection of Data) Act 2001 and APRA’s reporting standards. The principal duties and rights implicated by the instrument are as follows, grounded in the text:

• Duty to provide reporting documents: The determination applies to "reporting forms given to APRA pursuant to the current and superseded reporting standards listed" and uses the phrase "the date the RSE licensee was required to provide the information specified in the relevant reporting standard." That presupposes an existing duty,that duty remains in force and is not varied by the determination.

• Duty to treat certain information as non-confidential for publication: Once the 14-day period has elapsed from the date the RSE licensee was required to provide the data, the specified documents or parts "do not contain confidential information" for the purpose of APRA's publication ability. The phrase in the operative clause is direct: the reporting document or the specified parts "do not contain confidential information."

• Right of APRA to publish non-confidential data under s 56(5C): The Note states the effect is that non-confidential information (other than personal information) may be published under subsection 56(5C) of the APRA Act. The determination therefore creates a legal condition enabling APRA to exercise its existing statutory publication right.

• Right to privacy for personal information: The instrument preserves the confidentiality of personal information as defined in the Privacy Act 1988. That is an explicit carve-out: the determination does not render personal information non-confidential for publication.

• Delegated decision-making: The determination records the delegate and the statutory delegation head (paragraph 57(2)(b)), confirming the administrative right of the APRA delegate to make such determinations.

• Applicability to current and superseded standards: The Schedule gives a right to APRA to treat data submitted under both current and superseded reporting standards as non-confidential once the 14-day window passes. That changes retention/handling expectations for historical data submitted under older standards.

What the instrument does not do, in terms of duties or rights:

• It does not impose civil or criminal penalties in the text. It simply declares a confidentiality status change. The instrument does not, on its face, create an obligation on APRA to publish, nor does it set out any mechanism for the RSE licensee to contest publication. The instrument does not provide redaction rules other than excluding personal information under the Privacy Act definition.

Practical duties implied for affected entities:

• RSE licensees must be aware of the 14-day trigger and prepare for the listed items to be treated as potentially publishable after that period. That implies an internal duty to identify whether submitted fields include personal information and to prevent the submission of personal information in fields intended to be publishable.

• Service providers that supply data must expect that certain data elements may no longer be treated as confidential once submitted by an RSE licensee and the 14-day delay has passed.

Rights of affected parties to challenge publication or seek confidentiality exemptions are not addressed in this instrument; the instrument simply declares non-confidentiality for the listed items and identifies the statutory route for publication.

The determination itself contains no penalty clauses, fines, or enforcement procedures. It is a confidentiality determination that changes the status of certain APRA reporting data to non-confidential for the purposes of the APRA Act's publication power. The instrument does not specify any sanction for non-compliance nor does it create enforcement mechanisms distinct from those already present in APRA's statutory framework.

Operational enforcement and consequences must therefore be inferred from the statutory architecture cited in the instrument:

• Publication authority under the APRA Act: The Note links the determination to subsection 56(5C) of the Australian Prudential Regulation Authority Act 1998, indicating that once the determination applies, APRA may publish the listed non-confidential material under that subsection. The instrument does not provide the text or scope of subsection 56(5C); the immediate consequence of the determination is the removal of confidentiality status so that publication under the APRA Act becomes legally available to APRA.

• Compliance consequences for RSE licensees: The determination does not create new reporting obligations, but it changes the confidentiality regime of existing reports. The practical enforcement consequence is reputational and commercial: data submitted that falls within the listed fields may be published, and RSE licensees cannot rely on a confidentiality shield in respect of those fields once the 14-day window has passed. If an RSE licensee mistakenly includes personal information within a non-confidential field, the instrument clarifies personal information remains confidential under the Privacy Act but does not specify penalties for inclusion; potential ramifications would depend on breach of privacy obligations under the Privacy Act rather than this determination.

• No change to statutory duties to supply data: The legal duties to provide reporting documents under the Financial Sector (Collection of Data) Act 2001 and reporting standards remain; this instrument does not alter penalties for failing to supply reports. Any enforcement action relating to failure to report or to provide false or misleading information would be governed by the underlying statutes and standards, not by this determination.

• Administrative discretion and lack of appeal mechanics in the instrument: The instrument does not include administrative processes for parties to request retention of confidentiality for particular items, nor does it state appeal routes against a decision by APRA to publish. If a party wishes to resist publication, any remedy or dispute would need to be sought under the general statutory scheme (for example through merits review or judicial review depending on available statutory mechanisms and the nature of the decision), but the instrument itself is silent on enforcement pathways.

In short, the determination is a device to change confidentiality status; it does not introduce standalone penalties or specific enforcement processes. The immediate "enforcement" effect is that APRA may lawfully publish the specified information under its publication power; the practical consequences for regulated entities are reputational, commercial and privacy-risk related, and any punitive measures for other regulatory failures remain governed by other statutory provisions.

The instrument expressly references and interacts with multiple components of the federal regulatory architecture. The cross-references in the text are the primary statutory touchpoints and determine the instrument's legal frame.

• Australian Prudential Regulation Authority Act 1998: The determination is made under paragraph 57(2)(b) of the APRA Act, which permits delegation of APRA’s functions to a member, and it links the effect of the instrument to subsection 56(5C) as the statutory route under which APRA may publish non-confidential information. The instrument therefore operates as an exercise of delegated authority under the APRA Act and as a gateway for use of APRA’s publication power under s 56(5C). The instrument does not reproduce the text of either cited provision, it only invokes them as the legal basis for delegation and publication.

• Financial Sector (Collection of Data) Act 2001: The determination uses the term "reporting document" and points readers to section 13 of the Financial Sector (Collection of Data) Act 2001 for its meaning. That Act and section define the ambit of APRA’s data collection powers and the set of documents that constitute APRA reporting returns. Because the Schedule refers to "reporting forms given to APRA pursuant to the current and superseded reporting standards", the determination operates within the data collection regime established by that Act and by APRA’s reporting standards made under it.

• Privacy Act 1988: The determination explicitly preserves the confidentiality of personal information "within the meaning of the Privacy Act 1988". This interaction means that where a reporting form field contains personal information, that personal information remains outside the set of data APRA may treat as non-confidential for publication. The practical effect is to require APRA and RSE licensees to consider the Privacy Act when preparing for publication outcomes under this determination.

• APRA reporting standards and specific forms: The instrument does not change the content of the reporting standards themselves but identifies specific standards and fields (for example SRS 320.1; SRS 330.0/330.1/330.2; SRS 600.0; SRS 610.x; SRF 320.0; SRF 530.x; SRF 540.0; SRF 520.0; SRF 601.0; SRF 160.x). The determination interacts operationally with those standards, altering the confidentiality status of submission fields required by those standards after the 14-day period. The inclusion of superseded reporting standards indicates interaction with historical data flows and suggests APRA intends these older-format submissions to be equally treated for publication purposes where they fall within the listed superseded standards.

• No direct interaction with Freedom of Information or other disclosure statutes is stated: The instrument does not reference FOI legislation or other federal disclosure regimes. The text confines itself to APRA’s publication power under the APRA Act and the Privacy Act carve-out. Any interaction with FOI or other legislative disclosure obligations would need specific statutory cross-reference and is not present in this determination.

• Contractual confidentiality and private law obligations: The determination operates regardless of private contractual confidentiality provisions between RSE licensees and third-party counterparties, insofar as APRA’s statutory power to publish is concerned. The instrument does not alter private contract rights directly, but by making identified fields "non-confidential information", it creates a statutory overlay that may conflict with private confidentiality expectations. The instrument does not purport to resolve such conflicts; it simply changes APRA’s treatment of the data. Parties relying on contractual confidentiality should therefore consider the potential mismatch between contractual promises and APRA’s rights to publish once the 14-day period expires.

• Administrative law and review: The instrument is a statutory instrument; any legal challenge to APRA's exercise of its powers or to a specific publication would require consideration of administrative law remedies. The determination itself does not specify internal review rights or merits review pathways for publication decisions.

In sum, the determination sits at the intersection of APRA’s data collection powers (Financial Sector (Collection of Data) Act 2001), APRA’s publication powers (APRA Act s 56(5C)), privacy protection obligations (Privacy Act 1988), and the reporting standards regime. It does not purport to pre-empt or amend those laws, but instead sets out how specified APRA reporting items will be treated for confidentiality and publication purposes within that legal architecture.

The instrument itself is dated 15 May 2015 and states it commences upon registration on the Federal Register of Legislative Instruments. The text of the instrument does not include any express amendments, amending provisions, or schedules showing earlier versions of the same determination. The Schedule lists both current reporting standards and a specific set of superseded reporting standards whose submissions are captured. That indicates the determination’s scope includes data submitted under older reporting standards, but the instrument does not identify any prior APRA determinations replacing or amending this one.

Because the instrument is a singular determination, the edition presented contains the operative text and Schedule. There is no in-text record of prior amendments to this particular instrument, and the instrument does not purport to amend other instruments. The instrument itself would be recorded on the Federal Register of Legislative Instruments where its registration date, instrument number, and any subsequent amendments or repeals would be tracked administratively. The instrument as provided contains:

• Commencement statement: "This determination commences upon registration on the Federal Register of Legislative Instruments." This indicates the instrument takes effect from that administrative event.

• No sunset clause, no explicit amendment or repeal provisions: The instrument does not establish a termination date, does not state that it supersedes a prior determination, nor does it include a provision authorising the making of later amendments. Any later change to the confidentiality status of the listed reporting items would require a further determination or legislative change.

• References to current and superseded reporting standards: The Schedule lists both current reporting standards and five superseded reporting standards (SRS 100.0 Statement of Financial Performance (2005); SRS 110.0 Statement of Financial Position (2005); SRS 110.1 Selected Disclosure of Investments (2005); SRS 210.1 Selected Disclosure of Investments (2005); SRS 260.0 Trustee Statement (2005)). Their inclusion suggests the determination was drafted in an environment where reporting standards had been updated and APRA intended consistency across versions. That is an internal policy decision reflected in the Schedule, rather than an amendment history.

To identify whether this determination has been amended or repealed since registration, a user would need to consult the Federal Register of Legislative Instruments, APRA’s legislative instruments register, or subsequent APRA determinations. The instrument as supplied contains no record of later amendments or prior incarnations. The absence of an amendment record within the instrument means the operational status and historical sequence must be established from external administrative registries.

The determination text contains no references to litigation, court decisions, tribunal determinations, or legal challenges. It names no cases and cites no authorities other than statutory provisions and reporting standards. The instrument therefore contains no internal litigation history.

Given the limited scope of the instrument,declaring specified fields and reporting documents non-confidential,the text itself does not report judicial consideration of the determination. If any third parties had sought judicial review of APRA’s determinations in relation to publication or confidentiality rights, those proceedings and outcomes are not referenced in this instrument. As the instrument does not provide a litigation history, readers seeking case law addressing APRA’s use of s 56(5C) publication powers, the adequacy of delegate determinations under s 57(2)(b), or conflicts between statutory publication and contractual confidentiality would need to consult external case law databases or administrative decisions; none are supplied in the instrument.

In practical terms, the absence of litigation references in the instrument means the legal status of the determination as a regulatory instrument stands unannotated within the text. Any legal contestation of APRA’s publication of items covered by this determination would have to be located in the public record outside the instrument. The instrument does not provide internal dispute-resolution mechanisms or examples of prior contested publications. It simply states the determination and its effect.

Several concrete operational and legal "gotchas" arise from the instrument’s drafting and scope. These are practical traps or points of uncertainty that regulated entities, advisers and other stakeholders should note and plan for.

• The 14-day timing hinge: The instrument applies only where "a period of at least 14 days has elapsed from the date the RSE licensee was required to provide the information specified in the relevant reporting standard." The instrument does not define how that "date required to provide" is to be determined in particular circumstances (for example, whether it is the statutory due date, an APRA-specified deadline, or the date the RSE licensee actually submitted the form if early or late). That ambiguity can create uncertainty about when the confidentiality status flips. Entities must therefore carefully document the dates when information was required and when it was supplied.

• Covering both current and superseded reporting standards: The Schedule explicitly lists superseded standards. If an RSE submitted data under an older standard format, the instrument still treats that data as within scope once the 14 days have passed. Funds and advisers who assumed older-format submissions would be treated differently should not rely on such an assumption.

• Granularity and partial-field treatment: Part 2 lists very specific fields and sub-lines. In practice, reports often carry free-text fields, attachments or contextual information alongside these line items. The instrument does not offer guidance on how to treat contextual material, narrative explanations, or attachments that accompany the listed line items. Regulated entities should not assume narrative or supporting material is outside the determination simply because a numeric line item is listed.

• Personal information carve-out: The instrument excludes "personal information within the meaning of the Privacy Act 1988", but does not define how APRA will separate personal information from aggregated or quasi-identifying information in practice. Some fields (for example, "Standard employer-sponsor details column 1 Name and column 2 ABN" in SRF 601.0) identify employers directly, while others (membership profiles) may identify small cohorts. The instrument does not provide guidance on what constitutes personal information across the listed fields (e.g., whether small numbers of members in a category might render an otherwise aggregated field identifying). Entities must engage privacy counsel and document design/aggregation to avoid inadvertent personal-information publication.

• Interaction with contractual confidentiality: The instrument does not address private contractual confidentiality clauses between RSE licensees and investment managers, custodians, or data providers. If a contract promises confidentiality but the reporting field becomes non-confidential under this determination, there is a mismatch between statutory publication rights and private promises. The instrument contains no transitional or compensation mechanism for affected counterparties.

• No procedural or appeal pathway set out: The instrument provides no mechanism for an RSE to contest APRA publication of a particular item once it becomes non-confidential, nor does it set out internal APRA procedures for notice or consultation before publication. If APRA intends to publish, the instrument is silent on consultation; regulated entities must assume APRA can publish without prior agreement.

• Potential commercial and market-sensitivity implications: Some listed fields are market-sensitive (investment holdings, flows, fees, borrowings, in-house assets, employer ABNs). The instrument does not address whether APRA will publish in aggregated or disaggregated form or whether it will delay publication to avoid market disruption. Entities should assume APRA has discretion under s 56(5C) and that publication may include potentially commercially sensitive metrics.

• Absence of explicit retroactivity or limitation: The instrument covers reporting forms "given to APRA pursuant to the current and superseded reporting standards," but it ties application to the 14-day rule. It does not expressly state whether the determination applies to historic reports already held by APRA beyond the 14-day period prior to the instrument’s commencement. Practical effect may be ambiguous for historical datasets.

• Delegation provenance and administrative durability: The instrument is signed by an APRA delegate under paragraph 57(2)(b); parties should verify the scope and limits of that delegation in APRA’s delegation instrument to ensure the determination was made within proper delegated authority. The instrument does not include details on the limits or terms of the delegation beyond citing the paragraph.

These points are not legal conclusions about validity; they are operational items the text itself leaves unclear or unaddressed. They represent real-world friction points that require administrative clarification or cautious operational responses by RSE licensees and their advisers.

The instrument changes the confidentiality landscape for a defined set of APRA reporting items. Compliance for RSE licensees and related parties will therefore involve process, contractual and privacy steps to manage publication risk. The following practical steps map to the instrument’s text and operational effects.

1. Identify covered reports and fields against internal reporting maps

   • Compare your internal APRA reporting templates and submission history against the Schedule’s Part 1 and Part 2 lists. The Schedule names specific reporting standards (for example SRS 320.1; SRS 530.0; SRS 540.0; SRF 320.0; SRF 530.1; SRF 540.0; SRF 601.0; SRF 160.0; SRF 160.1; SRF 520.0) and enumerates detailed line items. Map each listed field to your data sources and owners. This mapping is the first compliance control.

2. Determine the 14-day trigger dates and document them

   • The instrument applies only after "a period of at least 14 days has elapsed from the date the RSE licensee was required to provide the information specified in the relevant reporting standard." Establish the authoritative methodology within your compliance team for identifying the "date required to provide" (e.g. the reporting due date in APRA guidance or the formal statutory due date). Retain contemporaneous evidence of the due date and the submission date to prove whether the 14-day period has expired.

3. Segregate personal information and apply Privacy Act controls

   • The instrument expressly excludes "personal information within the meaning of the Privacy Act 1988." Review the covered fields to identify any personal data inadvertently included. For any fields that might be quasi-identifying or where counts are small, apply data minimisation, aggregation and suppression as necessary before submission to avoid mixing personal information with publishable fields. Consult privacy counsel if a field might identify an individual or small cohort.

4. Review contracts with service providers and counterparties

   • Contracts that promise confidentiality to investment managers, custodians or employer-sponsors may be inconsistent with APRA’s ability to publish certain fields once the 14 days pass. Review confidentiality clauses and consider whether contractual amendments or notifications to counterparties are required. If contract changes are impracticable, document the legal basis for APRA publication and the residual contractual risk.

5. Update internal data governance and publication risk registers

   • Add the listed fields to your regulator-publication risk register. Assign data custodians for each field and implement controls for submission, archiving and redaction where necessary. Ensure audit trails exist showing when the reporting data was finalised and submitted to APRA.

6. Prepare communications and escalation protocols

   • Decide how the organisation will respond if APRA publishes specific items. This includes communications to stakeholders (trustees, responsible persons, employer-sponsors, affected service providers), and escalation paths for legal and market communications teams if publication would cause reputational or commercial harm.

7. Test disclosures and scenario plan for market-sensitive items

   • For potentially market-sensitive fields (investment holdings/flows SRF 530.x/531.0/533.0; fees SRF 540.0; borrowings SRF 320.0; employer ABNs SRF 601.0), run scenario tests to see what public disclosure could mean for counterparties and tendering processes. Consider whether pre-emptive disclosures to clients or counterparties might mitigate surprise.

8. Ensure consistency with Privacy Act obligations and record-keeping

   • Even where fields are non-confidential for APRA publication, obligations under the Privacy Act remain. Ensure that any personal data handling complies with Australia’s privacy principles, including notices to individuals where required and remedies for accidental disclosure.

9. Maintain a register of APRA publications and related decisions

   • Track what APRA actually publishes under subsection 56(5C). Record the date APRA exercises its publication power and which fields were published. This archive will support any future legal or regulatory queries and will also feed back into contractual and market-risk assessments.

10. Seek legal and compliance advice on ambiguous items

• Where the line between personal information and publishable aggregate data is unclear or where contextual attachments accompany listed line items, obtain advice from privacy and regulatory counsel. The instrument does not resolve these contextual ambiguities.

11. Consider redesigning internal reports to limit gratuitous exposure

• Where practicable, avoid including unnecessary narrative or identifying information in fields that are listed as non-confidential. If background text is essential, consider whether it can be provided in a form that does not become APRA-publishable (bearing in mind the Schedule’s granular lists and absence of clear rules on attachments).

12. Monitor APRA guidance and the Federal Register for changes

• The instrument commences on registration. APRA may issue subsequent guidance on how it will publish (aggregated tables, delay policies, redaction practices). Monitor APRA’s website and the Federal Register of Legislative Instruments for updates, further determinations, or clarifying materials.

Each of these steps follows from the instrument’s mechanics: the Schedule’s list of standards and fields, the 14-day timing rule, the linkage to s 56(5C) publication power, and the explicit Privacy Act carve-out. Implementing these controls will not eliminate the risk of publication, but will align internal processes with the changed confidentiality status and reduce accidental exposure of personal or contractually-sensitive data.