Information Privacy Regulation 2014

“Public sector agency” is a central concept under the Act, defined in section 9, and the regulation expands that definition by prescribing the Asbestos Response Taskforce as a public sector agency under section 9(h). The dictionary defines the taskforce by reference to the ACT government body established in June 2014. This means the taskforce must comply with all IPPs unless an exemption applies. “Corresponding privacy law” is defined in section 21(4) of the Act, and the regulation prescribes the NSW and Victorian laws as such. This allows an ACT agency to transfer personal information to an entity in those states if that entity is bound by a law that is substantially similar to the Act; the transfer is then treated as if the recipient were subject to the Act. “Loose-fill asbestos insulation” is defined in the dictionary by cross-reference to the Dangerous Substances Act 2004, section 47I. This is a specific type of asbestos (not bonded or sheet asbestos) that was used in ACT homes and is subject to a government buyback and eradication scheme. “Residential premises” is defined as premises that are a class 1, class 2, or class 10 building under the Building Act 2004. Class 10 includes non-habitable structures like sheds and garages, which broadens the exemption’s reach beyond dwellings. “Building work” is also defined via the Building Act 2004, section 6. The “case management system project” is defined in section 7(3) as the development, testing, installation, ongoing maintenance, and upgrading of an information management system for cases heard by ACT courts. This includes both new systems and future upgrades, making the exemption ongoing. The dictionary includes signpost definitions that import terms from the Building Act and Dangerous Substances Act, creating a web of interlocking definitions across ACT legislation. The concept of “prescribed” is fundamental: the regulation functions entirely by specifying items, agencies, or matters that are prescribed, thereby toggling the Act’s application. Because the regulation uses the mechanism of prescribing under the Act, it can be amended without amending the primary Act, giving the executive flexibility to expand or contract exemptions and designations.

The regulation directly affects four categories of entities and persons. First, the Asbestos Response Taskforce and the administrative unit that administers it (currently likely the Environment, Planning and Sustainable Development Directorate) are affected because they are now subject to the Act as public sector agencies. However, they also receive the benefit of the exemption for disclosing asbestos information. This means they can freely disclose information about the presence of loose-fill asbestos to owners, occupiers, and builders without complying with the IPPs on disclosure (IPP 11), as long as they do not disclose an individual’s identity. Without the exemption, such disclosures might breach the Act. Second, individuals who own or occupy residential premises, or who carry out building work on those premises, are affected because they can receive information about asbestos from the taskforce without the taskforce having to meet privacy obligations. For those individuals, this is beneficial: they get information quickly without having to jump through privacy hurdles. However, their own personal information (beyond the asbestos information) is not exempt. Third, the ACT administrative unit responsible for courts (likely the Justice and Community Safety Directorate) is affected because it is prescribed as an agency that can disclose and use personal information for the case management system project without complying with the Act. This includes sharing personal information with the Western Australian Department of the Attorney General. That department is also affected because it can receive and presumably use that information. Fourth, individuals whose personal information is included in the case management system are affected because their privacy rights under the Act are overridden for the purposes of that project. The exemption allows the courts administrative unit to use and disclose information that would otherwise be restricted by IPPs. For example, sensitive information such as criminal records or health information could be used for system testing without the individual’s consent. The regulation also indirectly affects any ACT agency that wishes to transfer personal information to NSW or Victoria: those agencies now have a clear lawful basis to do so under the corresponding privacy law provisions. Conversely, agencies dealing with other states or territories cannot rely on this regulation and must find another basis for cross-border transfers. Private individuals and businesses are not directly regulated, but they may be information recipients under the asbestos exemption.

The regulation does not impose any new duties or confer any new rights. Instead, it modifies existing duties and rights under the Information Privacy Act 2014. For the asbestos exemption, a key duty on the taskforce and its administrative unit is a negative duty: they must not disclose the identity of any individual when providing information about asbestos in premises. The exemption only covers disclosure of information about whether premises contain or have contained loose-fill asbestos and “relevant related information” (examples given include a clearance certificate and demolition date). The identity of an individual is expressly excluded. This acts as a limited right for individuals: their identity cannot be disclosed even if the rest of the information can be. However, the regulation does not give individuals a right to receive the disclosure; it merely allows the agency to make it. For the courts exemption, the relevant duty is that the exemption applies only to the case management system project. The disclosure and use of personal information must be for that project, and only to the WA Attorney General’s Department. There is no right for individuals to opt out or to be notified, and no condition that the information be de-identified. This is a significant curtailment of the rights individuals would otherwise have under IPPs 10 and 11. For the corresponding privacy law prescription, the effect is that an ACT agency may transfer personal information to an entity in NSW or Victoria if that entity is subject to the prescribed law and the transfer is otherwise permitted. This does not confer a right on the recipient, but it does create a right for the ACT agency to make the transfer without breaching the Act. The regulation does not provide any right of review or appeal for individuals affected by the exemptions. They cannot complain to the Privacy Commissioner about a disclosure that falls within the exemption because the Act does not apply. However, they can still complain about disclosures outside the exemption, such as disclosure of identity in the asbestos context. The regulation also preserves the Act’s definition of “sensitive information”, which includes health information, political opinions, and criminal records. The courts exemption explicitly notes that personal information includes sensitive information, so even sensitive data can be used and disclosed under the exemption. This is a notable loss of protection.

The regulation itself creates no offences and sets no penalty units. Penalties and enforcement mechanisms are located in the Information Privacy Act 2014. However, the regulation’s exemptions directly affect the enforceability of those penalties. Because the regulation exempts certain disclosures and uses from the Act, conduct that would otherwise be a breach of an IPP and potentially subject to a civil penalty or a complaint to the Privacy Commissioner becomes lawful. For example, an unauthorised disclosure of personal information by a public sector agency can lead to a maximum penalty of 50 penalty units for an individual and 250 penalty units for a corporation under section 77 of the Act. But if the disclosure falls within the courts exemption, it is authorised and no penalty applies. Similarly, a person whose identity is disclosed in contravention of the asbestos exemption’s limitation could still pursue enforcement. The regulation’s limits become crucial: any disclosure that goes beyond the exemption (e.g., disclosing an individual’s name along with asbestos information, or using courts project information for a different purpose) is not exempt and remains subject to the Act’s enforcement regime. The ACT Privacy Commissioner handles complaints about interferences with privacy and can investigate, make determinations, and seek civil penalties from the ACAT. The regulation does not affect the Commissioner’s powers, but it limits the scope of what constitutes an interference. The penalty unit value at the republication date is $160 for an individual and $810 for a corporation, which applies to offences under the Act. The regulation’s exemption removes that monetary risk for the specific activities covered. For the corresponding privacy law prescription, enforcement falls partly on the interstate law: if a NSW agency receives personal information under this provision and mishandles it, enforcement would be under the NSW Act, not the ACT Act. This creates a reliance on the adequacy of enforcement in other jurisdictions. Practitioners should note that while the regulation reduces enforcement risk for certain agency actions, it also reduces recourse for affected individuals. There is no right to seek compensation or correction under the Act for information handled under the exemptions. The only enforcement route for an individual would be if the agency steps outside the exemption, or if the disclosure is otherwise unlawful (e.g., a breach of confidentiality or tort of privacy, which may exist at common law in the ACT).

The regulation operates solely within the framework of the Information Privacy Act 2014, but it interacts with several other statutes. The asbestos exemption cross-references the Dangerous Substances Act 2004 for the definition of loose-fill asbestos insulation, and the Building Act 2004 for the definitions of “class” and “building work”. This means that any change to those definitions in the primary Acts will automatically affect the scope of the exemption without amending this regulation. For example, if the Building Act were to redefine class 10 buildings, the exemption’s reach would change. The courts exemption involves interaction with Western Australian law, specifically the Western Australian Department of the Attorney General. That department is subject to the Western Australian privacy regime (the Freedom of Information Act 1992 (WA) and any applicable codes). However, the regulation does not require WA law to be equivalent to the ACT Act; it merely permits the disclosure. This creates a gap: once information leaves the ACT, its protection depends on WA law, which may be weaker. The corresponding privacy law prescription for NSW and Victorian laws means that transfers to those states are treated as intra-ACT transfers for privacy purposes. This aligns with the Act’s aim of facilitating information sharing between jurisdictions with similar protections, but it does not apply to any other state or territory, such as Queensland or South Australia. Transfers to other jurisdictions still require a separate legal basis (e.g., consent, or another exemption). The regulation also interacts with the Legislation Act 2001, which defines “prescribed” and sets penalty unit values. The dictionary at the end of the regulation imports definitions from that Act. Additionally, the regulation must be read together with the Act’s sections 9, 21, and 25, which are the enabling provisions. Because the regulation provides exemptions under section 25(1)(h), it effectively overrides the IPPs that would otherwise apply. This means the regulation interacts with each IPP separately: for courts, IPP 10 (use) and IPP 11 (disclosure) are suspended for the project; for asbestos, IPP 11 is suspended for disclosure of the specified information. The regulation does not exempt collection or storage, so agencies must still comply with the Act for those aspects. For example, the taskforce must still collect asbestos information in accordance with IPP 1 (open and transparent management) and IPP 3 (collection only for lawful purpose). This narrow scope of the exemption is critical to understand.

The regulation was originally notified on 16 October 2014 as SL2014-25 and commenced the following day. Since then, it has been amended by five subsequent instruments. The first amendment, SL2015-6 (Information Privacy Amendment Regulation 2015 (No 1)), commenced 27 February 2015. It substituted the heading of section 6 and amended its text to refine the asbestos exemption, and inserted section 7 creating the courts case management system exemption. This was a major expansion of the regulation’s scope. Later in 2015, the Dangerous Substances (Loose-fill Asbestos Eradication) Legislation Amendment Act 2015 (A2015-6) amended the dictionary definition of “loose-fill asbestos insulation” by substituting a cross-reference to the Dangerous Substances Act 2004, section 47I. This was necessary because that Act had been amended. The next amendment, SL2017-4 (Information Privacy Amendment Regulation 2017 (No 1)), inserted section 5A prescribing the NSW and Victorian privacy laws as corresponding privacy laws. This gave effect to a policy decision to align with the most populous neighbouring states. In 2020, the Loose-fill Asbestos Legislation Amendment Act 2020 (A2020-20) made a minor amendment to the dictionary, likely updating the definition of loose-fill asbestos insulation again to reflect changes in the Dangerous Substances Act. The most recent amendment, A2023-57 (Justice and Community Safety Legislation Amendment Act 2023 (No 3)), amended section 6 in relation to the asbestos exemption. The exact change is not detailed in the amendment history, but it is the last amendment before the republication. The amendment history also shows that section 2 (commencement) was omitted as redundant under the Legislation Act. The regulation has been republished six times, with R6 being the current version effective 12 December 2023. Notable is that the regulation has been regularly amended, reflecting the evolving policy on asbestos information disclosure and the ongoing case management system project. The frequent amendments suggest the regulation is a live instrument that the government uses to adjust privacy boundaries quickly without amending the primary Act. Practitioners should ensure they refer to the latest republication, as uncommenced amendments may be pending (none are indicated here).

There is no reported or known case law that specifically deals with the Information Privacy Regulation 2014. The regulation is a subordinate instrument and has likely been the subject of administrative decisions rather than court proceedings. The asbestos exemption may have been applied in the context of the ACT government’s loose-fill asbestos eradication scheme, which involved many property owners and created potential for disputes. However, any litigation would more likely have challenged the underlying Act or the government’s conduct rather than the regulation itself. The courts exemption could be relevant in proceedings concerning the case management system project, but again, no reported decisions are evident. The corresponding privacy law provision (section 5A) may have been used in practice but has not been judicially considered. Because the regulation is limited in scope, it is unlikely to generate standalone litigation. Challenges would typically be as part of broader judicial review or privacy complaints. For example, if the taskforce disclosed an individual’s identity in breach of the exemption, a complaint could be made to the Privacy Commissioner, who would then interpret the regulation. A decision by the Commissioner can be appealed to the ACT Civil and Administrative Tribunal (ACAT) and then to the Supreme Court on a question of law. Such appeals could produce case law on the regulation’s meaning. As of the republication date, no such case law is cited in the source. The endnotes do not list any case annotations. The absence of litigation history does not mean the regulation is unused; rather, it may indicate that its provisions are clear enough not to provoke dispute, or that affected individuals have not challenged the exemptions. For the courts project, the lack of litigation may be because the project is still ongoing or because individuals are unaware of the privacy implications. Practitioners should note that the regulation’s interpretation is not yet settled by judicial authority. If a dispute arises, the ACAT and Supreme Court will apply standard principles of statutory interpretation, including reading exemptions narrowly as they derogate from rights. The regulation’s dictionary and cross-references will be key.

Several aspects of this regulation can trap unwary practitioners. First, the asbestos exemption only covers disclosure to owners, occupiers, and people carrying out building work. It does not cover disclosure to other parties, such as neighbours, real estate agents, or future purchasers. If the taskforce discloses asbestos information to a broader group, it must comply with the Act. Also, the exemption is limited to information about whether premises contain or have contained loose-fill asbestos and “relevant related information”. The examples given (clearance certificate, demolition date) are illustrative, not exhaustive. There is no definition of “relevant related information”, creating uncertainty. A cautious agency should limit disclosures to those examples. Second, the asbestos exemption explicitly excludes the identity of an individual. This means that if the taskforce discloses a report that includes the owner’s name along with asbestos information, it breaches the Act. The taskforce must redact names. But note that “identity” is not defined; it could include the name, address, phone number, or any data that identifies the person. Practitioners should adopt a broad interpretation to avoid risk. Third, the courts exemption applies only to the ACT courts administrative unit. Other agencies that might be involved in the case management system project (e.g., IT contractors, other government departments) are not exempt. If personal information flows beyond the administrative unit and the WA Department, it may be an unauthorised disclosure. The definition of “case management system project” includes ongoing maintenance and upgrading, so the exemption is indefinite. However, it does not cover all uses of court information; only those for the project. Using the same information for another purpose (e.g., research, staffing decisions) would be a breach. Fourth, the corresponding privacy law prescription covers only NSW and Victoria. Transfers to any other jurisdiction (including other Australian states, territories, or overseas) are not covered. A common mistake is to assume that any state law is sufficient. Fifth, the dictionary definition of “residential premises” includes class 10 buildings, which are non-habitable structures. If an agency discloses asbestos info about a garden shed, it is still within the exemption. But the term “premises” is not otherwise defined; it likely includes the whole property. Sixth, the regulation’s notes are explanatory and not part of the law (section 4). They cannot be relied upon to expand or limit the provisions. Seventh, the regulation does not provide a sunset clause for the courts exemption. It continues until the regulation is amended or repealed. This creates a permanent carve-out that may not have been intended as permanent when inserted in 2015. Eighth, changes to the dangerous substances and building definitions automatically affect the exemption’s scope without any further regulation. Practitioners must monitor those primary Acts. Finally, the regulation is silent on record-keeping or reporting requirements. Agencies should keep records of disclosures made under exemptions to demonstrate compliance with the limits.

For agencies relying on the exemption for the Asbestos Response Taskforce, compliance requires strict adherence to the exemption’s boundaries. First, confirm that the agency is either the taskforce or the administrative unit that administers it. Second, ensure that the information disclosed is only about whether residential premises contain or have contained loose-fill asbestos and “relevant related information”. When in doubt, disclose only the fact of presence or absence and any clearance certificate or demolition date. Third, never disclose the identity of any individual. This means redacting names, addresses (if they identify an individual), and any other personal details from documents before release. The agency should implement a policy of checking all disclosures against this requirement. Fourth, only disclose to the categories of persons listed: an owner, an occupier (past or present), or someone who has carried out, is carrying out, or intends to carry out building work on the premises. Verifying that the recipient falls into one of these categories may require a declaration or evidence. For occupiers, note that “occupier” likely includes tenants. For anyone intending to carry out building work, the agency should get some confirmation (e.g., a building permit application). Fifth, do not use the exemption to disclose information to any other party, such as a journalist or neighbour. For the courts case management project, the complying agency is the administrative unit responsible for the administration of ACT courts. Compliance steps: ensure that the disclosure or use of personal information is only for the case management system project. The project definition includes development, testing, installation, maintenance, and upgrading of the system. Any use outside this scope (e.g., for research, data analytics, or administrative efficiency not directly related to the project) would not be exempt. Also, the only permitted recipient of disclosure is the Department of the Attorney General of Western Australia. The regulation does not permit disclosure to any other entity, including subcontractors. The administrative unit should have a data sharing agreement with the WA department that limits the use of the information to the project and requires compliance with WA law at least. Since the regulation does not impose conditions on the recipient, the administrative unit should impose its own contractual protections to minimise risk. For both exemptions, agencies should document the basis for each disclosure or use, including the date, the type of information, the recipient, and the exemption provision relied upon. This helps demonstrate compliance if challenged. For agencies transferring personal information to NSW or Victoria under the corresponding privacy law prescription, they must first determine that the recipient is subject to the prescribed law. They should also check that the transfer meets any other requirements under the Act, such as that the recipient is not subject to a foreign law that would require disclosure (see Act s 21). While the regulation facilitates the transfer, it does not override other Act requirements. Finally, any agency that is not covered by an exemption must comply fully with the Act. The fact that exemptions exist for others does not mean your agency is exempt. Always start with the assumption that the Act applies, and rely on the regulation only when you are certain the specific conditions are met and documented.