CASA EX92/23 — DAMP Implementation (Information) Exemption 2023

The instrument relies on four defined terms, each given the meaning in subregulation 99.010(1) of CASR. DAMP refers to a drug and alcohol management plan. DAMP organisation refers to an organisation that is required to have such a plan. DAMP reporting period refers to the period in respect of which reporting would otherwise be required under Part 99 of CASR. SSAA employee refers to an employee who performs or is available to perform safety sensitive aviation activities. These cross-references mean that the instrument operates within the existing framework of Part 99 without redefining the core concepts. The exemption in section 4 applies to a DAMP organisation that has implemented a DAMP, thereby linking the relief directly to the existence of an operational plan.

The central mechanism is the conditional exemption from subregulations 99.100(1) and (2). Those subregulations would otherwise require the provision of information to CASA. Under the instrument, that obligation is suspended for the duration of the exemption provided the conditions in section 5 are met. The conditions centre on record creation rather than transmission. Section 5(1)(a) requires creation of records of the information mentioned in paragraphs 99.100(1)(a) to (l) of CASR for each DAMP reporting period or part of such a period during which the DAMP was implemented. Section 5(1)(b) adds a further obligation: if CASA requests in writing, the organisation must create records of additional information relating to the organisation’s implementation of the DAMP or to any drug or alcohol test undergone by an SSAA employee under Part 99 of CASR. Both categories of records must be anonymised in accordance with section 5(2), which prohibits inclusion of any information that might identify an SSAA employee.

Further concepts include the five-year retention period and the subsequent destruction obligation. Section 5(1)(d) requires each record to be kept in a secure location for five years after the last day of the DAMP reporting period or the part of that period. Section 5(1)(e) then requires that, within six months after the end of that five-year period, the parts of the records that relate to the results of drug or alcohol testing of an SSAA employee must be destroyed or deleted. Section 5(1)(c) requires every record to state the date it was created. These elements together establish a closed record lifecycle: creation in anonymised form, dated and secured retention, followed by partial destruction. The instrument does not define what constitutes a secure location or prescribe specific destruction methods, leaving those matters to the organisation’s internal procedures while still imposing the obligation.

The instrument directly affects DAMP organisations that have implemented a DAMP. These organisations are those that fall within the definition given by subregulation 99.010(1) of CASR and that have put a DAMP into operation. The exemption therefore applies to entities in the civil aviation sector that are subject to the drug and alcohol management requirements in Part 99 of CASR and that have taken the step of implementing the required plan. SSAA employees of such organisations are indirectly affected because the records created under the conditions must not identify them. The anonymity requirement in section 5(2) means that information about tests or implementation matters relating to individual employees cannot be recorded in a way that allows identification.

The instrument does not list specific categories of DAMP organisations. Its application depends on whether an organisation meets the criteria in the definitions cross-referenced from CASR and has implemented a DAMP. Organisations that have not yet implemented a DAMP receive no exemption and remain subject to the full requirements of subregulations 99.100(1) and (2). The three-year duration from 1 October 2023 to 30 September 2026 means that only organisations operating during that window can benefit, provided they satisfy the record-keeping conditions throughout. Compliance professionals advising aviation operators, maintenance providers, or other entities with SSAA employees must therefore assess whether their client qualifies as a DAMP organisation with an implemented DAMP before relying on the exemption.

Accountants and record-keeping specialists working with affected organisations will encounter obligations to establish systems capable of generating anonymised records of the information mentioned in paragraphs 99.100(1)(a) to (l) of CASR and any additional information requested by CASA. Journalists and researchers examining regulatory burden in aviation safety will note that the instrument shifts the locus of information from mandatory external reporting to internal retention, with a defined destruction timeline for testing results. The instrument does not create new categories of regulated persons; it provides relief to an existing class defined by reference to CASR.

The instrument confers a right to exemption from subregulations 99.100(1) and (2) of CASR for any DAMP organisation that has implemented a DAMP and that complies with the conditions in section 5. This right is conditional. Section 4(2) expressly states that the exemption is subject to those conditions. The primary duty is set out in section 5(1)(a): the DAMP organisation must create records of the information mentioned in paragraphs 99.100(1)(a) to (l) of CASR in relation to each DAMP reporting period or part of a DAMP reporting period during which the DAMP was implemented. This duty applies automatically once the exemption is relied upon.

A further duty arises under section 5(1)(b) when CASA makes a written request. In that event, the organisation must create records of information not mentioned in paragraph (a) that relates to the organisation’s implementation of the DAMP or to a drug or alcohol test undergone by an SSAA employee under Part 99 of CASR. Both duties are qualified by the anonymity requirement in section 5(2), which prohibits any information that might identify an SSAA employee. Section 5(1)(c) imposes a duty to ensure each record states the date it was created. Section 5(1)(d) requires that each record be kept in a secure location for five years after the last day of the relevant DAMP reporting period or part of that period. Section 5(1)(e) requires destruction or deletion, within six months after the end of that five-year period, of the parts of the records that relate to the results of drug or alcohol testing of an SSAA employee.

The instrument does not confer any right to withhold information from CASA if a written request is made under section 5(1)(b). It also does not create any right to retain testing results beyond the destruction timeline. Organisations therefore have a right to the exemption only while they perform the record-creation, dating, retention and destruction duties. Failure to perform any of these duties means the exemption ceases to apply, returning the organisation to the requirements of subregulations 99.100(1) and (2). The duties are framed as positive obligations to create and manage records rather than as negative obligations to refrain from particular conduct.

The instrument itself does not prescribe penalties for non-compliance with its conditions. Section 4 provides that the exemption is subject to the conditions in section 5, but it does not state consequences for breach of those conditions. Enforcement therefore occurs through the operation of the underlying Civil Aviation Safety Regulations 1998. If an organisation fails to meet the conditions, the exemption does not apply and the organisation remains subject to subregulations 99.100(1) and (2). Non-compliance with those subregulations would then be addressed under the penalty provisions of CASR and the Civil Aviation Act 1988.

CASA retains the power to request additional records under section 5(1)(b). An organisation that does not respond to such a request by creating the required anonymised records would lose the benefit of the exemption. The instrument does not specify any particular enforcement mechanism beyond the conditional nature of the exemption. Related exemption provisions in other legislation, such as section 37 of the Foreign Acquisitions and Takeovers Act 1975, which allows regulations to provide that the Act does not apply in prescribed circumstances, and section 111AT of the Corporations Act 2001, which empowers ASIC to exempt persons from disclosing entity provisions, illustrate that Australian regulators commonly structure exemptions as conditional relief rather than absolute immunity. In each case, failure to satisfy conditions removes the protection.

The five-year retention and subsequent destruction requirements in section 5(1)(d) and (e) create a further compliance point. An organisation that retains testing results beyond the six-month destruction window after the five-year period, or that fails to keep records in a secure location, risks losing the exemption. Because the records must be anonymised, enforcement attention is likely to focus on whether identification has been avoided and whether the destruction timeline has been observed. The instrument contains no provision for extensions of the retention period or for alternative destruction methods.

The instrument operates as a specific exemption within the Civil Aviation Safety Regulations 1998 framework. It is made under regulations 11.160 and 11.205 of CASR and directly modifies the application of subregulations 99.100(1) and (2) for the stated period. It therefore interacts with Part 99 of CASR, which establishes the drug and alcohol management regime, by suspending the reporting obligations in section 99.100 while preserving the underlying requirement to have and implement a DAMP. The definitions in section 3 of the instrument cross-reference subregulation 99.010(1) of CASR, ensuring that DAMP, DAMP organisation, DAMP reporting period and SSAA employee carry the same meaning as in the principal regulations.

Similar exemption mechanisms appear in other Commonwealth legislation. Section 37 of the Foreign Acquisitions and Takeovers Act 1975 empowers regulations to provide that the Act, or specified provisions, do not apply in relation to acquisitions, interests, businesses or foreign persons of prescribed kinds or in prescribed circumstances. Section 111AT of the Corporations Act 2001 allows ASIC to exempt specified persons from all or specified disclosing entity provisions, either generally or subject to conditions. The present instrument follows the same pattern of targeted, conditional relief granted by a regulator or delegate. In contrast, provisions such as section 39N of the Snowy Mountains Engineering Corporation Act 1970 and section 67AS of the Australian National Railways Commission Sale Act 1997 provide exemptions from tax liabilities in respect of exempt matters. Those provisions address fiscal consequences rather than ongoing regulatory reporting obligations.

The record-keeping and destruction requirements in section 5 may intersect with general obligations under the Privacy Act 1988 and the Archives Act 1983, although the instrument itself does not address those intersections. The requirement to destroy parts of records relating to drug or alcohol test results after five years plus six months creates a finite retention period that organisations must reconcile with any broader record-retention policies. The anonymity requirement in section 5(2) reduces the risk of personal information being included in the records, but organisations must still ensure that the information mentioned in paragraphs 99.100(1)(a) to (l) of CASR can be recorded without identification. The instrument does not override any other law; it simply provides that, for the duration of the exemption and while conditions are met, the reporting obligations in subregulations 99.100(1) and (2) do not apply.

The instrument itself constitutes the recent change. It was made on 26 September 2023 and took effect on 1 October 2023. Section 2(b) provides that it is repealed at the end of 30 September 2026, establishing a fixed three-year period of operation. No prior version of this specific exemption appears in the text of the instrument. The change introduces a conditional suspension of the reporting requirements in subregulations 99.100(1) and (2) for DAMP organisations that have implemented a DAMP, coupled with mandatory internal record creation, dating, five-year retention and partial destruction.

The text does not state the reasons for the introduction of the exemption or for the choice of a three-year duration. Section 5 sets out the precise conditions that must be satisfied, including the creation of records of the information mentioned in paragraphs 99.100(1)(a) to (l) of CASR and any additional information requested by CASA, all without identifying SSAA employees. The repeal date in section 2(b) means that after 30 September 2026 the exemption will no longer be available unless a further instrument is made. Organisations that have relied on the exemption during the three-year period will need to prepare for the resumption of the reporting obligations under subregulations 99.100(1) and (2) unless further relief is granted.

The structure of the instrument, with its commencement, repeal and detailed conditions, follows the pattern seen in other exemption instruments such as those made under section 37 of the Foreign Acquisitions and Takeovers Act 1975 and section 111AT of the Corporations Act 2001. In each case the regulator or delegate specifies the scope of relief and the conditions that must be observed. Here the conditions focus on anonymised internal records rather than on external notification or payment of fees. The three-year window allows DAMP organisations to adjust their compliance systems to the record-keeping regime before the exemption ends.

The source text of the instrument and the related retrieval context do not identify any court challenges or controversies relating to CASA EX92/23. No cases are named in the instrument or in the surrounding materials. The instrument contains no reference to judicial review, disallowance proceedings or disputes concerning its validity or application. Section 4 simply states the exemption and its conditions. Section 5 details the record-keeping obligations without any provision addressing enforcement disputes or review rights.

As a legislative instrument made by a delegate under regulations 11.160 and 11.205 of CASR, the instrument is subject to the general framework for legislative instruments under the Legislation Act 2003. That framework includes provisions for registration, tabling and potential disallowance, but the instrument text itself does not mention these processes. Organisations seeking to challenge the exemption or its conditions would need to pursue remedies outside the four corners of the instrument. The related retrieval context shows that other exemption provisions, such as those in the Foreign Acquisitions and Takeovers Act 1975 and the Corporations Act 2001, have been used without recorded challenges in the materials provided. No controversies are documented in the text concerning the anonymity requirement, the five-year retention period or the destruction obligation.

Compliance professionals should therefore treat the instrument as currently unchallenged on the basis of the available text. Any future proceedings would be assessed against the specific wording of sections 4 and 5, particularly the requirement that records must not include information that might identify an SSAA employee and the strict timeline for destruction of testing results. The absence of named cases in the source text means that analysis of judicial interpretation must await any actual litigation.

Several practical difficulties arise from the precise wording of the conditions. The anonymity requirement in section 5(2) applies to all records created under section 5(1)(a) or (b). This means that even where the information mentioned in paragraphs 99.100(1)(a) to (l) of CASR would normally include employee-specific data, the organisation must ensure that the records contain no information that might identify any SSAA employee. Aggregation or redaction techniques must be applied consistently. Failure to achieve true anonymity would place the organisation outside the protection of the exemption.

The destruction obligation in section 5(1)(e) is narrowly framed. It requires destruction or deletion only of the parts of the records that relate to the results of drug or alcohol testing of an SSAA employee. Other parts of the records, such as those relating to the organisation’s implementation of the DAMP, may remain after the six-month window following the five-year retention period. Organisations must therefore implement systems capable of segregating testing results from other information so that only the required parts are destroyed. The six-month period begins at the end of the five-year retention period, which itself runs from the last day of the DAMP reporting period or part of that period. Any delay in calculating these dates could result in either premature destruction or retention beyond the permitted period.

The requirement in section 5(1)(c) that each record must state the date it was created creates an audit trail obligation. Records created in response to a CASA request under section 5(1)(b) must also be dated. The instrument does not specify the form of the date or the medium of the record, leaving organisations to determine suitable methods while ensuring the date is stated. The secure location requirement in section 5(1)(d) is not further defined, so organisations must satisfy themselves that their chosen storage meets the standard of security expected in the aviation regulatory context.

A further point arises from the conditional nature of the exemption. If CASA makes a written request for additional records and the organisation does not create them in anonymised form, the exemption ceases to apply. The instrument provides no grace period or opportunity to remedy non-compliance before the exemption is lost. Organisations must therefore maintain readiness to generate the required records promptly upon receipt of a written request. The three-year duration of the instrument means that these obligations apply only until 30 September 2026, after which the reporting requirements in subregulations 99.100(1) and (2) resume unless further relief is granted.

Compliance begins with confirmation that the organisation is a DAMP organisation that has implemented a DAMP as defined by reference to subregulation 99.010(1) of CASR. Only then does the exemption from subregulations 99.100(1) and (2) become available. The organisation must then establish procedures to create records of the information mentioned in paragraphs 99.100(1)(a) to (l) of CASR for each DAMP reporting period or part of such a period during which the DAMP operates. These records must be anonymised so that no information might identify an SSAA employee, and each record must state the date it was created.

If CASA issues a written request under section 5(1)(b), the organisation must create additional records of information relating to the implementation of the DAMP or to any drug or alcohol test undergone by an SSAA employee under Part 99 of CASR. These additional records must also be anonymised and dated. All records, whether created under section 5(1)(a) or (b), must be kept in a secure location for five years after the last day of the relevant DAMP reporting period or part of that period. Organisations should implement a calendar system to track the end of each five-year period and the subsequent six-month window for destruction.

Within six months after the end of each five-year retention period, the parts of the records that relate to the results of drug or alcohol testing of an SSAA employee must be destroyed or deleted. Other parts of the records may be retained or disposed of according to the organisation’s general policies, provided the testing results portions are removed on time. Records should be stored in a manner that allows segregation of testing results for efficient destruction. Legal advisers should review the organisation’s record-keeping policies to ensure they accommodate the anonymity, dating, retention and destruction requirements without creating identifying information.

Accountants and compliance officers should document the processes used to generate anonymised records and to calculate the five-year and six-month periods. Training for staff responsible for record creation should emphasise that no SSAA employee may be identified in any record. If a written request from CASA is received, the response must be prepared and the records created without delay. Because the instrument is repealed at the end of 30 September 2026, organisations should plan for the resumption of reporting under subregulations 99.100(1) and (2) after that date. Regular internal audits of the record system will help confirm that the conditions in section 5 continue to be met throughout the exemption period.