Competition and Consumer (Motor Vehicle Service and Repair Information Sharing Scheme) Rules 2021

The Rules directly affect three categories of persons. The first is data providers - usually vehicle manufacturers or their importers and distributors - who are obliged under the Act to supply scheme information to Australian repairers and scheme RTOs. Under the Rules, data providers must determine whether the requested information is safety or security information and, if so, must not supply it to an individual unless that individual is a fit and proper person. That determination imposes a compliance cost: the data provider must collect, verify and store declarations, training evidence, police checks and repairer licence details as prescribed. The second affected group is Australian repairers and their employees. A repairer enterprise is not itself required to be fit and proper, but each individual who will actually access and use the safety or security information must satisfy the criteria. This means the repairer bears the administrative burden of ensuring its staff hold current training certifications and, where security information is needed, current police checks or repairer licences. The third group is scheme RTOs and their trainers. RTOs that deliver training courses using scheme information must ensure that any individual who accesses safety or security information for that purpose meets the relevant criteria. The Rules also indirectly affect the individual technician or trainer who must personally produce declarations and evidence. They cannot merely rely on their employer’s credentials. The definition of “repairer licence” in section 4 limits the alternative pathway for security information access to licences issued or renewed under state or territory law that require both a fitness assessment and a recent national police check. This excludes many trade licences that do not mandate a police check. Finally, the Rules affect data intermediaries - third parties through whom scheme information may flow - because the note to section 9(1) clarifies that the entity seeking personal information may be a third party, not necessarily the original data provider. That third party also must comply with these Rules.

The Rules impose duties on data providers and create conditional rights for repairers and RTOs. The primary duty is on the data provider (or its agent) to verify fitness before supplying safety or security information. Section 9(1) states that personal information about an individual may be sought “only as provided for in this section”. This is a constraint on the data provider: it cannot demand more information than the Rules permit. The permissible information is: name and residential address; the individual’s relationship to the repairer or RTO (section 9(2)); safety training qualifications (section 9(3)); evidence of those qualifications if not previously provided (section 9(4)); a national police check report or evidence of a repairer licence (sections 9(5) to 9(8)); and the repairer’s name and ABN or the RTO’s name and ABN (section 10). The data provider may not seek a new police check if it already holds a report dated within two years and a written declaration of no subsequent conviction (section 9(6)). This prevents repeated demands. Conversely, the individual has the right to rely on existing evidence: if they have previously provided evidence of qualifications or a repairer licence to the same entity, the data provider must accept a written declaration and cannot demand fresh evidence (sections 9(4) and 9(8)). The individual also has the right, under section 7(5), to rely on the spent convictions regime in Part VIIC of the Crimes Act 1914 when disclosing offences. The data provider must disregard spent convictions. The individual’s duty is to provide truthful declarations and, where applicable, to complete manufacturer-provided training or obtain a police check. There is no positive right to demand access; the individual must first satisfy the criteria. The data provider has no duty to create alternative verification methods if the individual fails to meet the criteria - the individual simply cannot receive the information.

The Rules themselves do not create penalty provisions. They are made under section 57GE of the Competition and Consumer Act, and the penalty framework for the Scheme is contained in the Act. Section 57DO of the Act, for example, makes it an offence for a data provider to fail to provide scheme information in accordance with the Scheme, with a maximum penalty of 600 penalty units. Conversely, if a data provider supplies safety or security information to an individual who is not a fit and proper person as defined in the Rules, the data provider may be in breach of the Act’s general obligations to protect that information, though the precise enforcement pathway is not detailed in this instrument. The Australian Competition and Consumer Commission (ACCC) is the regulator. It can investigate breaches and seek civil penalties, injunctions, or other orders. Individuals who make false declarations to obtain access may face general criminal liability for fraud or false statements under Commonwealth law, but the Rules do not create a specific offence for that. The spent convictions provision in section 7(5) ensures that the police check criteria do not override the Crimes Act protections; an individual cannot be penalised for failing to disclose a spent conviction. The practical enforcement risk is highest for data providers: if they fail to collect the prescribed information before releasing safety or security data, they could be liable under the Act’s provisions regarding misuse of information or failure to protect security. For repairers and RTOs, the enforcement risk is indirect - if they obtain information without proper verification, they may be using information in breach of the Scheme’s terms, exposing themselves to compliance action. The Rules also create a compliance burden that may be self-enforcing: data providers have a commercial incentive to restrict access to protect themselves from liability, potentially erring on the side of demanding more evidence than the Rules strictly permit, despite the prohibition in section 9(1).

The Rules operate within a broader legislative framework. The primary interaction is with Part 3 of Schedule 2 to the Competition and Consumer Act 2010, which establishes the overall obligations to share scheme information. The Rules only regulate the subset of that information that is safety or security information. For ordinary scheme information - such as diagnostic trouble codes, service schedules, or non-security wiring diagrams - the Rules impose no additional gatekeeping. The Privacy Act 1988 governs the collection, use, storage, and disclosure of the personal information that data providers gather under sections 9 and 10. The note to section 9(1) explicitly states that compliance with the Privacy Act is required in addition to the Rules. The collection of police check reports and licence details is sensitive information under the Privacy Act, so data providers must have a lawful basis and comply with the Australian Privacy Principles. Section 7(5) preserves the operation of Part VIIC of the Crimes Act 1914, which prohibits requiring the disclosure of spent convictions in certain circumstances. This means that a person with a spent conviction for a relevant theft or dishonesty offence cannot be excluded from access on that basis, provided the conviction is spent. The definition of “national police check” in section 4 cross-references the Australian Federal Police and the Australian Criminal Intelligence Commission. The definition of “repairer licence” ties into state and territory licensing regimes, but only those that require a fitness assessment based on a recent police check. This excludes lighter licensing schemes. The Rules do not interact directly with intellectual property law, but the underlying Scheme information may be subject to copyright or trade secrets. Nothing in the Rules overrides those protections; the information sharing obligation is a separate statutory regime. There is no interaction with the Motor Vehicle Standards Act 1989 or the Australian Design Rules, because the Scheme relates to service and repair information, not vehicle certification. The Rules are also subordinate to the Act: if any conflict arises between the Rules and the Act, the Act prevails.

The instrument was made on 25 October 2021 by the Assistant Treasurer and commenced on 1 July 2022. The commencement table in section 2 sets out that the whole instrument started on that date. There are no subsequent amendments recorded in the instrument text. The explanatory statement that would accompany such instruments is not provided in the source material, but the instrument itself shows no amending provisions, no schedule of amendments, and no noting of later changes. The Act that authorises the Rules, the Competition and Consumer Amendment (Motor Vehicle Service and Repair Information Sharing Scheme) Act 2021, commenced on 1 July 2022 as well. The Rules have remained static since their commencement. Any future amendment would need to be made by the responsible minister, currently the Assistant Treasurer or delegate, under the same rule-making power. Possible areas for future amendment include expanding the list of prescribed systems for safety information beyond hydrogen, high voltage, and electric propulsion, or adjusting the police check renewal period from two years to a different interval. There is no sunset clause in the instrument, so it continues indefinitely unless repealed or replaced.

The source text does not cite any litigation. There are no references to court cases, administrative review decisions, or tribunal rulings within the instrument or the accompanying notes. As a relatively recent instrument - commenced only in July 2022 - and as subordinate legislation that does not itself create rights of action, it is unlikely to have generated significant case law. Any disputes about the meaning of “system connected to” in section 5, or about what constitutes “limited period of time” for security information in section 6, would likely be resolved by the ACCC through guidance or ultimately by the Federal Court under the general provisions of the Competition and Consumer Act. The absence of litigation history does not mean the Rules are uncontroversial. Automotive service and repair industry groups have raised concerns about delayed access to security information and the cost of police checks for small operators, but those disputes have not crystallised into litigation as of the instrument’s current state. The instrument also interacts with potential private rights of action under the Act for failure to provide scheme information, but again no cases are cited.

Several features of the Rules create traps for the unwary. First, the definition of “safety information” is not self-limiting. Section 5(1)(d) sweeps in any system “connected to” a hydrogen, high voltage, or electric propulsion system. In modern electric and hybrid vehicles, the high voltage battery connects to the inverter, which connects to the motor, which connects to the gearbox, which connects to the cooling system, and so on. A clever data provider could argue that almost any powered system in an electric vehicle is connected, directly or indirectly, to the high voltage system, thereby classifying all scheme information for that vehicle as safety information subject to training requirements. The note about hybrid systems not connected to high voltage is the only boundary illustration; for pure battery electric vehicles, there may be no escape. Second, the security information definition in section 6 requires that the information be both related to the security system and “unique to the vehicle” or “only usable for a limited period of time”. Data providers may argue that VIN-specific key codes are unique, but a generic immobiliser reset procedure that works across many models is not unique. This creates a classification dispute without clear guidance. Third, the fit and proper person test for security information in section 7(3) has a trap: the alternative pathway using a repairer licence requires that the licence was issued or renewed no earlier than two years before the request, and that the national police check report taken into account when that licence was issued is still current. But if the individual held a repairer licence renewed four years ago, and the police check was done at that time, the licence itself may be current but the police check is over two years old. That individual cannot use the licence pathway unless the underlying police check is also within two years. They would need to obtain a fresh police check to satisfy paragraph (a) instead. Fourth, the requirement in section 9(6) that a new police check cannot be sought if the entity already holds a report dated within two years and a declaration of no subsequent conviction - but this only applies if the entity is the same one that received the earlier report. If the repairer switches to a different data provider or data intermediary, that new entity may demand a fresh police check because it has not previously been given the report. This multiplies the administrative burden for a technician working across multiple brands. Fifth, the Rules do not address remote access. If an individual in Western Australia requests security information from a data provider based in Germany via a cloud portal, the data provider’s agent in Australia might collect the declaration, but the personal information may be stored offshore. The interaction with the Privacy Act’s cross-border disclosure rules is not mentioned. Sixth, the reference to “spent convictions” in section 7(5) means that a data provider cannot reject an applicant based on a conviction that is spent under the Crimes Act, but the data provider must first know whether a conviction is spent. The individual may not disclose it. If the data provider receives a police check report that shows a spent conviction, it must disregard it, but there is no guidance on how to handle accidental knowledge. Seventh, the Rules place no obligation on the data provider to accept digital evidence or remote verification. A small repairer in a rural area could be required to produce original training certificates in person or by post, creating delay.

Compliance requires a structured process for any entity that supplies safety or security information - typically a vehicle manufacturer, importer, or their authorised third party. The data provider must first classify each piece of requested scheme information. If the information relates to a hydrogen, high voltage, or electric propulsion system (or a system connected to one), it is safety information. If it relates to the mechanical and electrical security system and is unique or time-limited, it is security information. It may be both. The data provider must then determine the identity of the individual who will actually access and use the information, not just the repairer business or RTO. For safety information, the data provider must collect from that individual a written declaration stating their name, residential address, and relationship to the repairer or RTO (section 9(2)). If the information involves hydrogen, high voltage, or electric propulsion systems (or connected systems), the data provider must also obtain a written declaration from the individual that they have successfully completed the manufacturer- or RTO-provided training required by section 7(2). If evidence of that training has not previously been provided to the same entity, the data provider may ask for evidence (section 9(4)). For security information, the data provider must check whether the individual holds a national police check report dated within two years that shows no relevant conviction (as defined in section 7(4)), and obtain a written declaration of no subsequent conviction. Alternatively, if the individual holds a qualifying repairer licence issued or renewed within two years, and that licence was assessed against a recent police check, the data provider may accept a written declaration of no subsequent conviction instead of a fresh police check (section 7(3)(b)). The data provider must document the date of the police check report or licence renewal. It cannot demand a fresh police check if it already has a qualifying report within two years and the declaration (section 9(6)). The data provider should also collect the name and ABN of the repairer or RTO on each request (section 10). All collected personal information must be handled in accordance with the Privacy Act 1988. The data provider should implement a records system that tracks when a particular individual last provided training evidence or a police check, to avoid re-requesting it unnecessarily. For repairers and RTOs, compliance means ensuring that each employee who will access safety or security information has the required declarations ready. The repairer should facilitate the employee obtaining manufacturer training for safety systems and a national police check for security systems. The repairer should also ensure that the employee’s repairer licence (if used) has a recent underlying police check. The employer cannot substitute its own compliance for the individual’s; each person must personally satisfy the criteria. The safest approach is for the repairer to maintain a central register of each employee’s training certificates, police check reports, and declarations, and to provide copies to each data provider from which the employee will request information. If a data provider refuses access because the individual does not meet the criteria, the repairer should first check whether the refusal is based on a permissible ground under the Rules. If the data provider demands more information than the Rules allow, the repairer or individual may lodge a complaint with the ACCC.