Migration (Disclosure of Information to Prescribed Bodies) Instrument 2025

The instrument relies on and implements a small set of statutory concepts and procedural linkages that shape its operation.

• Prescribed body. Clause 6 formally “specifies” the listed entities as prescribed bodies for paragraph 336F(1)(d) of the Migration Act, via regulation 5.34D of the Migration Regulations. The instrument therefore defines eligible recipient entities; it does not itself define the content of the power to disclose that is in the linked provisions of the Act and Regulations.

• Delegated instrument/Naming power. The instrument is an exercise of a delegated power under regulation 5.34D (cl 3). It is a classic secondary‑legislation device: the primary law (the Migration Act and the Migration Regulations) contains or references a power that permits the Minister or authorised officer to specify recipients by regulation or instrument, and this instrument uses that power to put names on the roster.

• Schedule operation. Clause 5 creates the usual machinery for schedules: instruments identified in a Schedule are amended or repealed as stated. Schedule 2 uses that machinery to repeal IMMI 15/066 in full. Schedule 1 is a table that populates the prescribed‑body list (Schedule 1 table, items 1-107).

• Breadth and categories of recipients. The listed bodies include:

  • Commonwealth departments and agencies, including enforcement and intelligence entities (e.g. AUSTRAC, Australian Federal Police, Australian Security Intelligence Organisation, Australian Secret Intelligence Service, Australian Securities and Investments Commission, Australian Taxation Office),
  • State and territory departments (education, health, consumer affairs, transport, justice, registries of births/deaths/marriages) and law enforcement agencies,
  • Courts and prosecutors (Federal Circuit and Family Court of Australia, Commonwealth Director of Public Prosecutions, various state and territory Directors of Public Prosecutions and Offices of Public Prosecutions),
  • Overseas law enforcement and immigration agencies (for example, named agencies from Canada, New Zealand, United Kingdom, United States, Korea, Malaysia, Indonesia, Sri Lanka, Hong Kong),
  • Specialist agencies (e.g. Australian Fisheries Management Authority, Defence Science and Technology Group),
  • Regulatory and compliance bodies (Fair Work Ombudsman, Australian Financial Security Authority, consumer protection offices at state level).

• Repeal of prior instrument. Schedule 2 explicitly repeals IMMI 15/066 , the entire prior instrument , signalling that the 2025 instrument replaces the 2015 list.

• Silence on procedure, privacy and funding. The instrument does not itself set out procedural requirements for disclosure, any limits on the use or onward disclosure of information once provided, nor does it appropriate funds or set out recordkeeping or notification obligations. Those matters remain in the linked Act and regulation or in administrative policy.

In short, the main concepts are prescription of recipient bodies by Ministerial instrument under an existing regulatory power, replacement of an earlier instrument, and the expansion or re‑definition (by the specific list) of who may legitimately be treated as a recipient under the migration disclosure power referenced.

The instrument affects three broad groups directly, and a number of secondary constituencies indirectly.

Directly affected parties

1. Disclosing authority or authorities. The instrument alters the set of entities to which the disclosing authority (the entity with power under regulation 5.34D and paragraph 336F(1)(d) of the Act) can lawfully disclose migration information. While this instrument does not name the disclosing official, it operates on the disclosure power established elsewhere. Practically, the Department or agency responsible for administering those disclosure powers will be the party implementing disclosures to the newly prescribed roster (see cl 6).

2. Listed recipient bodies. Each of the 107 bodies named in Schedule 1 is directly affected, because inclusion makes that body a recipient eligible under the linked provisions. The list includes Commonwealth agencies, state and territory departments and authorities, police forces (including international police and foreign law enforcement agencies), prosecutors and courts, revenue and financial agencies, and specified overseas immigration and security agencies. Being prescribed may change the legal basis on which those bodies receive and process migration data.

3. Individuals whose information is the subject of disclosure. Persons subject to migration records or other information held under the Migration Act or the Regulations are indirectly affected by the increased or updated set of potential recipients. The instrument widens (or at least specifies) the circle of bodies that could lawfully receive data under the statutory disclosure power referenced.

Indirectly affected parties

• Legal, compliance and privacy advisers in both disclosing and recipient agencies will be affected because they must reconcile the prescribed list with confidentiality, secrecy and privacy obligations that apply to their organisations. The instrument itself is silent on those obligations, so operational integration will fall to the agencies.

• Third parties that receive information from prescribed bodies. The instrument does not address onward disclosure, but by colouring who can be a primary recipient, it affects the downstream data ecosystem through which migration information may flow.

• Visa applicants, migrants, dependants and sponsors. The inclusion of a broad set of law enforcement, revenue, health, education and state registry agencies could have consequences for how immigration status, compliance and identity issues are investigated or acted upon by those recipient organisations.

Who pays and who decides

• The instrument does not allocate funding. Administrative costs for retrieving, preparing and disclosing information will fall on the disclosing authority; recipients will incur costs for receiving, storing and processing data. Those cost allocations are implicit because the instrument prescribes recipients but does not provide resourcing.

• Decision‑making about whether to disclose in any particular case is governed by the statutory and regulatory provisions referenced (reg 5.34D and paragraph 336F(1)(d)) and internal procedures of the disclosing authority. This instrument does not set or alter those decision rules.

Temporal effect and operational timing

• The instrument comes into force the day after registration (cl 2). That imposes an immediate administrative need to update recipient rosters, memoranda of understanding, data‑sharing agreements and staff guidance once it is registered.

In aggregate, the instrument reshapes the perimeter of authorised recipients under the migration disclosure power. That change in perimeter triggers practical compliance, governance and operational responsibilities across the disclosing authority and all named recipients, and affects individuals whose data may be shared.

This instrument primarily confers a status (prescribed body) and therefore changes the legal relationship between the migration disclosure power and the listed entities. The instrument itself is minimal on duties and rights; key operative points are as follows.

Conferred status (right to receive under the linked provisions)

• Clause 6 specifies that each body in Schedule 1 is a prescribed body “for paragraph 336F(1)(d) of the Act” (cl 6). That specification is the instrument’s core legal effect. It confers, through the linkage to the statute and regulation, an entitlement to be treated as an authorised recipient when the conditions in the Act and regulation are met. The instrument does not itself create a standalone entitlement; the right arises only where the Act/regulation permit disclosure.

Duties left to other texts or administrative practice

• The instrument does not itself impose duties on recipients, such as obligations to protect information, restrict use, notify subjects, or refrain from onward disclosure. Any such duties must arise from the Act, the Migration Regulations, or from other statutory or administrative instruments or agreements.

• The instrument also does not impose procedural duties on the disclosing authority (for example, recordkeeping, notification to individuals, or consultation with recipients). Those procedures must be sourced in the statutory disclosure rules or in administrative policy.

Implicit operational responsibilities

• Because the instrument expands the catalogue of eligible recipients, disclosing agencies will have the practical duty to operationalise that change. That includes updating internal lists, training authorised officers, reviewing and, where necessary, renegotiating data‑sharing agreements or memoranda of understanding, and ensuring any internal authorisation workflows reflect the new list. The instrument itself imposes none of those tasks in statutory text, but they are necessary to give effect to the instrument.

Limits and scope

• The instrument is bounded by its wording. It applies expressly “for the purposes of regulation 5.34D of the Regulations” and specifies bodies “for paragraph 336F(1)(d) of the Act” (cl 6). Therefore any rights to receive information depend on the scope of those provisions. The instrument does not in isolation broaden the type of information that may be disclosed beyond what the Act and regulation permit.

Interaction with prior instruments

• Schedule 2 repeals IMMI 15/066 in full. For recipients or disclosers that were governed by the 2015 instrument, their duties and rights under the earlier instrument are displaced by the repeal; the 2025 instrument is the instrument that now sets the prescribed list (Schedule 2).

In summary, the instrument confers a status enabling receipt of migration‑related information where the Act and regulation allow, but it does not itself set out duties on recipients or procedural protections. Those are matters for the Migration Act, the Migration Regulations, and any inter‑agency arrangements or statutory privacy/confidentiality regimes that apply.

The instrument is silent about penalties and enforcement mechanisms. It neither creates offences nor prescribes sanctions. Its enforcement implications are therefore indirect and flow from the statutory provisions it references and from existing administrative arrangements.

Silence on offences

• There are no penalty provisions in this instrument. It contains no criminal or civil sanctions for misuse, unlawful disclosure, or non‑compliance by either the disclosing authority or the prescribed bodies. The instrument’s clauses (1-6) and Schedules 1-2 are descriptive and prescriptive in terms of naming, but they do not impose punishments.

Enforcement depends on the Act and Regulations

• Any enforcement remedy for misuse of information, unauthorised disclosure, or contravention of the conditions attached to disclosure must be sought in the Migration Act 1958, the Migration Regulations 1994 (particularly reg 5.34D and the provisions that authorise disclosure, such as paragraph 336F(1)(d)), or in other relevant statutes or administrative frameworks. This instrument merely populates the roster of permissible recipients under that statutory framework (cl 6).

Administrative and contractual remedies

• In practice, enforcement and compliance supervision will likely be carried out through:

  • internal disciplinary and administrative mechanisms in the disclosing agency and within prescribed bodies;
  • contractual or memorandum‑based arrangements between agencies that may include compliance and audit provisions; and
  • statutory sanctions present in the primary legal instruments (not in this instrument).

• The instrument does not specify any such contractual terms, audit regimes or oversight mechanisms. Those elements would have to be implemented separately by the agencies concerned.

Practical enforcement implications

• Because the instrument broadens or clarifies recipients, a wider set of organisations may need to adopt or apply their own internal compliance mechanisms to manage receipt and use of information. In the absence of instrument‑level sanctions, recipient agencies’ internal policies, or obligations arising under other statutes, will govern remedial steps for misuse.

• If a prescribed body misuses disclosed information and that misuse violates other statutory secrecy or privacy obligations, the relevant enforcement route would be under those other laws or under the primary migration disclosure provisions; this instrument does not alter those enforcement pathways.

In short, enforcement of appropriate disclosure and use is not implemented or amended by this instrument; enforcement responsibilities and sanctions remain located in the primary legal framework and in agency governance arrangements outside this instrument’s text.

The instrument expressly operates by reference to other legal instruments and is otherwise silent on how it interfaces with broader legal regimes. Key interactions and legal cross‑references from the instrument text are as follows.

Direct statutory cross‑references

• Regulation 5.34D of the Migration Regulations 1994: Clause 3 states the instrument is made under regulation 5.34D. Clause 6 makes the prescription “for the purposes of regulation 5.34D of the Regulations” and connects that prescription to paragraph 336F(1)(d) of the Migration Act. Therefore the instrument is functionally and legally subordinate to reg 5.34D; the operational scope of what may be disclosed remains defined by that regulation.

• Paragraph 336F(1)(d) of the Migration Act 1958: Clause 6 specifies that the listed bodies are prescribed “for paragraph 336F(1)(d) of the Act.” The instrument does not reproduce paragraph 336F(1)(d). To understand the legal effect in any given case, one must consult paragraph 336F(1)(d) and the surrounding provisions of the Act to identify the permitted content and the tests for disclosure.

Interaction with prior secondary legislation

• Schedule 2 repeals IMMI 15/066 - Disclosure of Information to Prescribed Bodies 2015 in full. That repeal replaces the earlier instrument with the current list as of the date of commencement. To assess changes in legal effect over time, one must compare the two instruments; the 2025 instrument is now operative (Schedule 2).

Implications for statutory privacy, secrecy and administrative law regimes

• The instrument does not mention privacy, secrecy, or information‑handling statutes. However, because the instrument determines to whom migration information may be disclosed under the migration statutory scheme, it necessarily intersects with any other statutory regimes that impose limits on disclosure, obligations to protect personal data, or constraints on use of information. The instrument itself does not resolve conflicts or priorities between the migration disclosure power and other statutes.

• Where other laws impose prohibitions or obligations on either the disclosing agency or on recipient bodies, those laws will constrain practical operation. The instrument does not displace these other legal duties.

Inter‑agency agreements and contractual terms

• Because inclusion on the prescribed list will in practice require data sharing, agencies may rely on memoranda of understanding, data‑sharing agreements, contractual terms, or administrative protocols to operationalise disclosures and to define rights, duties, and dispute resolution processes. The instrument neither compels nor precludes such instruments; it simply identifies the authorised recipients under the migration disclosure provision.

International cooperation and foreign laws

• The list includes multiple named foreign agencies (for example, agencies from Canada, New Zealand, United Kingdom, United States, Korea, Malaysia, Indonesia, Sri Lanka, Hong Kong). Any disclosure to or cooperation with these bodies will engage international legal and practical constraints, including (but not limited to) the foreign body’s domestic legal limits on use, onward disclosure, and data protection. The instrument does not address choice of law, mutual legal assistance, or transfer safeguards; those matters must be addressed in other instruments or agreements.

Administrative law and review

• The instrument does not address merits review, judicial review, or other administrative law remedies relating to decisions to disclose information or decisions by recipients to act on disclosed information. Any rights to review decisions to disclose, or legal remedies in relation to misuse, will need to be sought in the Migration Act, Migration Regulations, or other applicable laws.

In sum, this instrument functions as a cross‑reference node: it narrows or specifies recipient categories under one statutory disclosure power but leaves substantive interplay with privacy statutes, administrative law, international law and contractual governance to be resolved elsewhere.

The instrument includes very limited delegated legislative history within its text; the key amendment history points that appear in the instrument are:

• Repeal of earlier instrument IMMI 15/066 - Disclosure of Information to Prescribed Bodies 2015. Schedule 2 states, item 1: “The whole of the instrument. Repeal the instrument.” That is the sole amendment action recorded in this instrument. The repeal is absolute and replaces the prior instrument in full (Schedule 2).

• Clause 5 sets the general schedule operation: “Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.” That standard clause governs how Schedule 2’s repeal operates and confirms that schedules have operative force.

• The instrument itself is dated 30 September 2025 and the instrument’s commencement clause (cl 2) states it “commences on the day after registration.” The instrument therefore enters the subordinate‑legislation record at registration and replaces the 2015 instrument from that point forward.

No other amendments to existing regulations or Acts are made by this text. The instrument does not amend the Migration Regulations themselves; it relies on the regulatory power in regulation 5.34D rather than altering regulatory text. It does not create transitional provisions, savings clauses, or retrospective effects , it is silent on those matters. The replacement of the 2015 instrument is straightforward: repeal and substitution by listing the new prescribed bodies in Schedule 1.

To understand the full change in legal practice or list composition over time, a reader must compare the 2015 instrument (now repealed) with this 2025 instrument. The instrument does not provide a narrative or explanatory memorandum within its text describing the reasons for additions, deletions, or any policy review that led to the changes; it is purely an operational replacement instrument.

The instrument’s text does not recount any litigation history. There are no references to court proceedings, tribunal decisions, or past challenges to either the prior instrument (IMMI 15/066) or to the practice of disclosing migration information to named bodies. The instrument is a subordinate legislative instrument that replaces the 2015 instrument; it contains no retroactive legal determinations, no declaratory provisions about past actions, and no statutory responses to judicial findings.

For practitioners seeking litigation history relevant to disclosure powers under the Migration Act or Migration Regulations, this instrument does not provide that record. Any litigation concerning disclosure powers, the interpretation of regulation 5.34D or paragraph 336F(1)(d) of the Act, or disputes about the legality of particular disclosures would be found in case law or tribunal decisions outside this instrument. Such material is not reproduced or summarised here.

Consequently, there is no litigation narrative to derive from the instrument itself: the text is a manifest of named bodies and a repeal of an earlier instrument, without attendant judicial history or litigation‑related amendments included in the instrument.

This instrument is compact but contains a number of practical and legal “watch points” that advisers, compliance officers and operational teams should note when operationalising or advising on its effects.

1. The instrument prescribes recipients, but not the basis for disclosure. Clause 6 ties the list to regulation 5.34D and paragraph 336F(1)(d) of the Act. To determine what may lawfully be disclosed, and under what tests, you must consult those primary sources. The instrument alone does not say whether disclosure is discretionary or mandatory in particular circumstances, nor does it set thresholds or safeguards.

2. Broad, cross‑jurisdictional list. Schedule 1 names a wide range of bodies including foreign law enforcement and immigration agencies (items 17, 29, 30, 31, 33, 65, 66, 78, 87-90, 45, 35). Disclosure to overseas agencies raises immediate questions about reciprocal use, onward disclosure, data protection standards, and foreign legal constraints. The instrument does not address international data transfer safeguards.

3. Inclusion of registry and service agencies with non‑law enforcement functions. The list includes births/deaths/marriages registries, education and health departments, consumer affairs and motor vehicle agencies, and services agencies (for example, items relating to state registries, departments of education and health, and Services Australia at item 67). The inclusion of these service providers means migration‑related information could reach agencies whose primary functions are administrative or regulatory rather than criminal investigation. The instrument does not limit use to particular purposes.

4. Repeal creates immediate operational change. Schedule 2 repeals the 2015 instrument in full. Because the commencement is the day after registration (cl 2), agencies must be ready to implement the new list immediately; legacy lists or MOUs tied to the 2015 instrument may no longer be an accurate basis for disclosure.

5. No funding or operational guidance. The instrument does not provide funding, procedural rules, minimum protective measures, or recordkeeping obligations. Agencies implementing disclosure must design (or update) their own administrative controls and data‑sharing agreements. Those operational gaps create risk if not addressed promptly.

6. No express limits on onward disclosure or retention. The instrument neither restricts onward disclosure by recipient agencies nor prescribes retention periods. If a prescribed body retains or shares data, the instrument does not itself constrain that behaviour; other laws and policies must be relied upon.

7. Potential for different interpretations. Because the instrument uses a statutory cross‑reference rather than reproducing the enabling text, there is scope for disagreement about whether particular categories of information fall within the disclosure power. Operational officers and legal advisers must consider the wording of reg 5.34D and paragraph 336F(1)(d) to avoid over‑sharing.

8. Diverse recipient capabilities. The listed recipients range from intelligence agencies with specialised data protections to smaller state consumer affairs offices and registries that may have different technical and legal capabilities to handle sensitive information. The instrument does not account for capability mismatches.

9. No specific notification to subjects. The instrument contains no duty to notify individuals when their information is disclosed. That absence creates both legal and reputational risks for agencies and recipients, depending on the applicable legal obligations elsewhere.

10. Administrative resourcing burden. Practical implementation,reviewing MOUs, updating internal systems to reflect the new roster, training staff,will consume agency resources. Those costs are not provided for in the instrument.

Each of these points is grounded in what the instrument does and does not say. They outline operational gaps and legal vectors that need to be addressed by reference to the Migration Act, the Migration Regulations, and inter‑agency governance instruments.

Compliance with this instrument requires coordination between the disclosing authority, legal and policy teams, and the recipient bodies. The instrument’s text is sparse, so practical compliance steps are necessarily procedural and evidence‑based, keyed to the legal cross‑references (regulation 5.34D and paragraph 336F(1)(d) of the Act) and the Schedule 1 list.

Immediate administrative steps

1. Legal check of scope. Consult regulation 5.34D of the Migration Regulations and paragraph 336F(1)(d) of the Migration Act to establish the conditions, limits and lawful purpose of any disclosure. The instrument (cl 6) prescribes recipients only; the operational legal test sits in the referenced provisions.

2. Update recipient rosters and internal guidance. Replace any reliance on IMMI 15/066 with the Schedule 1 list (Schedule 2 repeals IMMI 15/066). Update internal authorised recipient lists, guidance notes for authorised officers, and system rosters to reflect the 107 named bodies.

3. Review and refresh inter‑agency agreements. Where data sharing is operationalised through MOUs or data exchange agreements, agencies should:

   • confirm current agreements remain appropriate given the new list;
   • renegotiate terms where necessary to incorporate conditions on use, retention, security and audit rights;
   • ensure agreements address cross‑border transfer safeguards when foreign bodies are involved.

4. Revise operational protocols and training. Train staff authorised to disclose under the migration disclosure power on:

   • the updated list of prescribed bodies (Schedule 1);
   • the legal tests for disclosure under reg 5.34D and paragraph 336F(1)(d);
   • documentation and recordkeeping steps for each disclosure decision.

Privacy, security and recordkeeping

5. Apply existing secrecy and privacy obligations. Identify the statutory secrecy and privacy obligations applicable to the disclosing authority and to each recipient. While this instrument does not itself impose data‑protection duties, those obligations will constrain disclosure and use. Where necessary, conduct privacy impact assessments before initiating new categories of disclosure.

6. Ensure secure transfer mechanisms. For disclosures, especially to overseas recipients, confirm secure channels, encryption, and retention limits are in place. Document technical standards required for transfer, storage and access.

7. Maintain disclosure records. Keep contemporaneous records of the legal basis for disclosure, the specific data disclosed, the recipient body, the purpose of disclosure, and any agreements that regulate use and retention. Those records support internal audit and legal compliance reviews.

Cross‑jurisdictional and foreign disclosure precautions

8. For disclosures to foreign law enforcement and immigration agencies, obtain legal and policy clearance that addresses:
   • whether the recipient’s domestic law allows the recipient to use or forward information in ways compatible with Australian policy or legal expectations;
   • whether mutual legal assistance or other formal mechanisms are required or advisable;
   • whether diplomatic channels or ministerial approvals are relevant for sensitive transfers.

Organisational governance and oversight

9. Governance oversight. Allocate responsibility within the disclosing agency for:

   • approving disclosure policies and risk assessments;
   • maintaining and publishing, where required, a list of recipients and the legal basis for disclosure;
   • conducting periodic audits of disclosures to ensure conformity with reg 5.34D and paragraph 336F(1)(d).

10. Incident and complaints handling. Put in place procedures to handle complaints from affected individuals and incidents of unauthorised disclosure, including notification processes, remedial steps, and internal disciplinary measures.

Timing and urgency

11. Implement before the commencement date. Because the instrument commences the day after registration (cl 2), agencies must act quickly to update procedures, staff training and agreements immediately on registration to avoid unauthorised or ad hoc practices based on out‑of‑date recipient lists.

Practical checklist for recipients

12. Recipient bodies listed in Schedule 1 should:

• confirm whether they wish to receive disclosures under the migration scheme;
• ensure internal policies on use, retention and onward disclosure are compatible with receiving migration‑related data;
• set up secure receipt and access controls and log access for audit purposes;
• consider whether formal agreements with the disclosing agency are necessary to define obligations.

Concluding compliance note

Because the instrument specifies recipients but leaves substantive disclosure procedures and constraints to the enabling statute and regulation, a compliance programme must be built around those primary legal texts. The instrument provides a clear administrative trigger,the new roster in Schedule 1 and the repeal of the 2015 instrument (Schedule 2),but it does not provide operational detail. Effective compliance therefore rests on integrating legal analysis of reg 5.34D and paragraph 336F(1)(d) and on implementing robust administrative, technical and contractual controls for information handling.