Ombudsman Regulation 1989

The regulation does not define its own core terms; rather, it relies on definitions and concepts from the Ombudsman Act 1989 and the Legislation Act 2001. Understanding the regulation requires familiarity with four key ideas from the principal Act.

Prescribed authority. Under the Ombudsman Act, the Ombudsman can investigate administrative actions of "prescribed authorities". The Act itself defines which bodies are prescribed authorities, but also allows the regulation to specify exceptions. Section 2 of this regulation provides such an exception: the auditor-general is not a prescribed authority. This exclusion is categorical and applies to any person holding or performing the duties of that office. It does not require a case-by-case assessment. The concept therefore shapes the Ombudsman's jurisdiction: the Ombudsman may investigate the auditor-general's office only if some other legislative provision grants jurisdiction, but the regulation as a source-grounded instrument denies it.

Child safety information. This term is not defined in the regulation. It comes from the Ombudsman Act, division 2.2A (Reportable conduct). That division establishes a scheme for handling allegations of reportable conduct involving children in certain contexts. The Act's section 34A(1) lists the circumstances in which the Ombudsman may disclose such information. Paragraph (j) allows disclosure to a "prescribed entity". The regulation then fills in which entities are prescribed. The concept is limited to information obtained by the Ombudsman in the course of exercising functions under division 2.2A. It does not cover all information held by the Ombudsman; only that relating to reportable conduct.

Corresponding or substantially corresponding function. Section 3 prescribes an entity that exercises a function under a law of a State or the Commonwealth that corresponds, or substantially corresponds, to a function of the Ombudsman under division 2.2A. This introduces interpretive uncertainty. The regulation does not list specific entities by name; instead it uses a functional test. The entity must be exercising a function that is analogous to the ACT Ombudsman's reportable conduct oversight role. The phrase "substantially corresponds" allows for some difference but requires a high degree of similarity. Deciding whether an entity qualifies may require analysis of the relevant state or Commonwealth law and a comparison with the ACT division 2.2A.

Reportable conduct. This concept from division 2.2A of the Ombudsman Act is the foundation for the information-sharing power. The division sets out a framework for entities to notify the Ombudsman of certain conduct involving children, and for the Ombudsman to investigate. The regulation does not restate the definition, so a practitioner must refer to the Act.

The regulation has a narrow but direct impact on specific actors and a broader indirect impact on parties affected by the Ombudsman's information-sharing powers.

Office of the auditor-general. The auditor-general is the only person or office expressly excluded from being a prescribed authority. This means that the Ombudsman cannot conduct an investigation into the auditor-general's administrative actions under the standard complaints framework of the Ombudsman Act. Persons aggrieved by a decision or action of the auditor-general therefore cannot seek recourse through the Ombudsman. They must instead rely on other accountability mechanisms, such as review by the Legislative Assembly, judicial review, or internal complaints processes within the auditor-general's office. The regulation does not explain why this exclusion exists, but it places the auditor-general outside the Ombudsman's net, similar to the way some other jurisdictions exclude their auditors from ombudsman oversight.

Interstate and Commonwealth bodies with reportable conduct functions. Section 3 prescribes entities that exercise a function under a law of a State or the Commonwealth corresponding to the Ombudsman's reportable conduct function. These entities are entitled to receive child safety information from the ACT Ombudsman. They may include ombudsman offices in other states and territories, children's commissioners, or specialised reportable conduct units. The regulation does not impose duties on these entities; it merely authorises the ACT Ombudsman to disclose information to them. Their own laws will govern how they handle that information.

The ACT Ombudsman. The regulation directly affects the Ombudsman in two ways. First, it restricts the Ombudsman's jurisdiction by removing the auditor-general from the list of investigable bodies. Second, it expands the Ombudsman's power to share child safety information by specifying additional recipients. The Ombudsman must be aware of both constraints and permissions.

Children and persons involved in reportable conduct matters. Individuals who are the subject of reportable conduct investigations, or who report such conduct, may have their information shared with interstate bodies. The regulation enables cross-border information flow, which could affect privacy and confidentiality expectations. However, the regulation does not create any new rights or protections for those individuals; those arise from the Ombudsman Act and other laws.

Private sector entities and individuals not involved in reportable conduct or Ombudsman complaints. The regulation does not directly affect private enterprise, contractors, or members of the public outside the contexts described. It is a public sector regulation that operates exclusively within the framework of government oversight.

The regulation does not impose duties directly. Its legal effect is to modify the scope of duties and rights that exist under the Ombudsman Act.

Right of the Ombudsman to disclose child safety information. The regulation confers a right on the Ombudsman to disclose child safety information to the prescribed entities. Without this regulation, the Ombudsman could not rely on section 34A(1)(j) to share information with interstate bodies; disclosure would need to be justified under another paragraph of that subsection or under a different legal authorisation. The regulation thus expands the Ombudsman's discretionary power.

Duty of the Ombudsman not to treat the auditor-general as a prescribed authority. By excluding the auditor-general from the definition, the regulation imposes a negative duty on the Ombudsman: that office is not subject to investigation under the Act. If the Ombudsman receives a complaint about the auditor-general, the proper response is to decline to investigate on jurisdictional grounds. The regulation does not set out what the Ombudsman must do with such a complaint, but the Ombudsman Act likely requires the Ombudsman to notify the complainant of the inability to investigate.

No duty on prescribed entities to receive information. The regulation does not impose an obligation on the interstate or Commonwealth bodies to accept or act on information disclosed to them. Whether they have a duty to receive information or to use it in a particular way depends on their own enabling legislation. The regulation merely creates the legal pathway for the ACT Ombudsman to send information.

No new rights for individuals. Persons whose information is disclosed do not gain any new rights from this regulation. Their rights to privacy, to access information, or to seek review of disclosure are governed by the Ombudsman Act, privacy legislation, and other applicable laws. The regulation itself is silent on procedural protections, such as notice before disclosure or the right to object.

No duties on the auditor-general. The regulation does not impose any duties on the auditor-general. It simply removes that office from the Ombudsman's jurisdiction. The auditor-general remains subject to other oversight mechanisms, including the Legislative Assembly and the Audit Act 1996.

The Ombudsman Regulation 1989 does not create any offences or penalties. It is a purely enabling and limiting instrument. Enforcement of the broader Ombudsman Act regime is handled by the Act itself, which contains penalties for conduct such as obstructing the Ombudsman, failing to provide information, or retaliating against complainants. Those penalties are not affected by this regulation.

The regulation's provisions are self-executing in the sense that they require no active enforcement by a regulatory body. The exclusion of the auditor-general from being a prescribed authority operates automatically: the Ombudsman is simply without jurisdiction. If the Ombudsman purports to investigate the auditor-general, the auditor-general may raise the regulation as a jurisdictional bar. Any dispute about whether the auditor-general is a prescribed authority could be resolved by a court or tribunal in proceedings for judicial review of the Ombudsman's action, but the regulation itself does not specify an enforcement mechanism.

Similarly, the power to disclose child safety information to prescribed entities is discretionary. The Ombudsman is not required to disclose; the regulation merely permits it. Breach of any secrecy or privacy obligations if the Ombudsman discloses information outside the authorised pathways would be a matter under the Ombudsman Act or other laws, not under the regulation.

The penalty unit values are noted on the front page of the republication: $160 for an individual and $810 for a corporation as at the republication date. However, these values are set by the Legislation Act 2001, not by this regulation. They would apply to any offence under the Ombudsman Act that attracts a penalty expressed in penalty units. The regulation itself contains no offence provisions, so the penalty unit information is purely informational for the reader.

The practical enforcement of the information-sharing provision depends on the recipient entity's compliance with its own laws. If the ACT Ombudsman discloses information to an entity that does not in fact exercise a function under a corresponding law, the disclosure might be unauthorised. The Ombudsman bears the risk of making that determination. The regulation provides a safe harbour only if the entity truly meets the functional test.

The regulation is expressly made under the Ombudsman Act 1989 (ACT) and must be read as part of that Act. It is a subordinate law, so it cannot override the Act; it only fills in details left by the Act. Its interaction with other legislation is limited but important.

Ombudsman Act 1989. This is the primary law. The regulation gives effect to section 34A(1)(j) (prescribed entities for child safety information disclosure) and to the definition of "prescribed authority" by specifying an exclusion. The regulation's section 2 uses the phrase "not a prescribed authority for the Act", confirming that the Ombudsman Act's definition of that term is modified. The regulation does not define "child safety information" or "reportable conduct"; those terms come from the Act.

Auditor-General Act 1996 (ACT). The regulation does not refer to this Act, but the exclusion of the auditor-general from Ombudsman jurisdiction complements the auditor-general's own accountability framework. The Auditor-General Act establishes the office and its functions, including performance audits and financial audits. The regulation's effect is to prevent dual oversight in which the Ombudsman could investigate the auditor-general's administrative actions, which could create conflicts or duplication. The trade-off is that there is no external Ombudsman review available for persons aggrieved by the auditor-general.

Legislation Act 2001. This Act governs the making, republication, and interpretation of subordinate laws in the ACT. The regulation's republication includes the standard note about penalty units taken from the Legislation Act. The regulation is also subject to the Legislation Act's provisions on regulation-making power and disallowance. The amendment history shows that some changes were made under the Legislation Act, part 11.3 (editorial changes).

State and Commonwealth laws on reportable conduct. The regulation prescribes entities exercising functions under corresponding laws. It does not identify specific laws, so the interaction is dynamic. If a jurisdiction enacts a new reportable conduct scheme, the ACT Ombudsman may need to assess whether that law "substantially corresponds" to the ACT division 2.2A. The regulation creates a reliance on the laws of other jurisdictions rather than tying the prescription to a list that requires amendment.

Previously referenced laws. Earlier versions of the regulation included provisions related to the Education Act 2004 and the Emergencies Act 2004. Those provisions were removed in republication 5, so they no longer form part of the regulation. The current regulation does not interact with those Acts.

Privacy laws. The disclosure of child safety information under section 3 may engage the Information Privacy Act 2014 (ACT) or the Privacy Act 1988 (Cth). The Ombudsman Act contains its own secrecy and disclosure provisions, and the regulation provides an additional lawful basis for disclosure. However, the regulation does not override other obligations; the Ombudsman would still need to comply with privacy principles when deciding whether to disclose.

The regulation was originally made in 1989 as the Ombudsman Regulations and has undergone a series of amendments, most of which stripped away content to reach its current lean form.

The original instrument SL1989-9 was notified on 10 May 1989 and commenced the same day. It initially contained more extensive provisions about which bodies were prescribed authorities. The first amendment, the Ombudsman Regulations (Amendment) 1991 No 4, added a section on interpretation (section 1A), amended section 2, inserted a new section 2A (prescribed authorities), and inserted a schedule 1A (prescribed authorities) and a schedule 2 (principal offices). That amendment expanded the regulation's scope.

A significant contraction occurred with the Betting (Corporatisation) (Consequential Amendments) Act 1996 (A1996-33), which omitted section 2A and schedule 1A entirely. This reduced the regulation's content, likely because the definitions of prescribed authorities were moved into the Act itself or otherwise dealt with.

The Legislation (Consequential Amendments) Act 2001 (A2001-44) made technical amendments as part of the transition to the Legislation Act 2001. It omitted section 1A (interpretation), which had been inserted in 1991. That section was no longer necessary because the Legislation Act provides general interpretation provisions.

The Education Act 2004 and the Emergencies Act 2004 made consequential amendments to schedule 2 (principal offices), reflecting changes in the names of agencies. Later, schedule 2 was omitted entirely in republication 5 (1 January 2005) under the editorial powers of the Legislation Act.

The Statute Law Amendment Act 2007 (A2007-3) omitted section 3 entirely. That section had previously dealt with the Ombudsman's power to disclose child safety information to prescribed entities. Its omission removed the cross-jurisdictional information-sharing power for more than 18 years.

The most recent amendment, the Ombudsman Amendment Regulation 2025 (No 1) (SL2025-21), reinserted a new section 3 with identical effect to the pre-2007 version but drafted in current style. That amendment was notified on 23 October 2025, with section 1 and 2 commencing on that day and the remainder (section 3) commencing on 24 October 2025. This is the current republication, number 7.

The overall trajectory is one of simplification: the regulation once contained a detailed list of prescribed authorities, principal offices, and an interpretation section, but now retains only the auditor-general exclusion and the reinserted information-sharing provision.

The source text does not refer to any court cases, tribunal decisions, or legal proceedings involving the Ombudsman Regulation 1989. The legislation history and endnotes contain no mention of litigation. Given the minor and narrow scope of the regulation, it is unlikely that it has been the subject of direct judicial consideration.

Several factors reduce the likelihood of litigation. First, the regulation is a subordinate instrument that modifies definitions already set out in the Act. Disputes about the Ombudsman's jurisdiction are more likely to turn on the Act itself than on the regulation. For example, a challenge to the Ombudsman's decision to investigate the auditor-general would involve interpretation of section 2 and schedule 1, but such a challenge would probably be resolved by reference to the plain language of the regulation rather than generating complex case law.

Second, the information-sharing provision (section 3) was only reinserted in October 2025. It had been omitted since 2007, so there has been no opportunity for litigation under the current version. The pre-2007 version may have been used in practice, but no reported cases are mentioned. Even if there were unreported disputes, they would be confidential given the sensitive nature of child safety information.

Third, the auditor-general exclusion is straightforward: one office is named. While the exclusion could be challenged on grounds of legal error or ultra vires if the regulation were inconsistent with the Act, there is no indication that such a challenge has occurred. The Australian Capital Territory does not have a strong history of litigating ombudsman jurisdiction issues at the subordinate law level.

Practitioners researching this area should be aware that the absence of litigation does not mean the regulation is immune from legal challenge. Questions could arise about whether the auditor-general exclusion is consistent with the Ombudsman Act's purpose, or whether the functional test in section 3 is too vague to be valid. However, no such proceedings are recorded in the source.

Despite its brevity, the regulation contains several features that could catch out practitioners.

The auditor-general exclusion is absolute. Section 2 says a person holding or performing the duties of the office specified in schedule 1 "is not a prescribed authority for the Act". This is not a discretionary exemption; it is a blanket removal from jurisdiction. The Ombudsman cannot investigate any administrative action taken by the auditor-general or their delegates. This includes actions that might otherwise be within the Ombudsman's remit, such as decisions about procurement, staffing, or the conduct of audits. Complaints about the auditor-general must be directed elsewhere, and the Ombudsman's office must refuse to accept them.

No list of prescribed entities in section 3. Section 3 does not name any specific entity. Instead, it uses a functional test: an entity that exercises a function under a law of a State or the Commonwealth "corresponding, or substantially corresponding" to the Ombudsman's reportable conduct function. This creates uncertainty. The Ombudsman must determine whether an entity qualifies before disclosing information. The safest approach is to obtain confirmation from the receiving entity that it exercises such a function. Over time, the Ombudsman's office may develop a list, but the regulation itself does not provide one. Misidentification could lead to an unauthorised disclosure.

The note about "State" includes the Northern Territory but not the ACT. The note to section 3 states that "State includes the Northern Territory (see Legislation Act, dict, pt 1)". This is important because the regulation prescribes entities under laws of a "State or the Commonwealth". The ACT is not a State, and the note does not extend the term to include the ACT itself. The ACT Ombudsman already has authority to disclose child safety information to ACT entities under other paragraphs of section 34A(1) of the Ombudsman Act. But section 3 is specifically for interstate and Commonwealth bodies. The Ombudsman cannot rely on section 3 to disclose to an ACT government agency; that would need a different legal basis.

No transitional provisions. The reinsertion of section 3 in October 2025 does not come with transitional rules. Information obtained before that date might still be subject to the previous restrictions. Whether the Ombudsman can retroactively use the new section to disclose information gathered before 24 October 2025 depends on the interpretation of the Ombudsman Act and the amending instrument. The regulation itself is silent, so the general rule that amendments apply prospectively likely governs.

Schedule 1 contains only one entry. A reader might assume that the schedule could be expanded in the future to include other offices. But as it stands, only the auditor-general is excluded. This means all other ACT public authorities that are prescribed authorities under the Act are subject to Ombudsman investigation. The narrowness of schedule 1 is notable. It does not exclude judges, MLAs, or other high offices. Only the auditor-general receives this special treatment.

The regulation does not address record-keeping or accountability for disclosures. The Ombudsman, when using section 3, must still comply with the Ombudsman Act's requirements for disclosure. The regulation does not impose any additional conditions, such as requiring a written agreement with the receiving entity or logging each disclosure. Practitioners should ensure that internal policies address these gaps.

Compliance with the Ombudsman Regulation 1989 is primarily a matter for the ACT Ombudsman and, indirectly, for the auditor-general and interstate bodies. The regulation does not impose requirements on the general public.

For the Ombudsman. The Ombudsman must maintain accurate records of which entities are prescribed under section 3. Because the test is functional, the Ombudsman should develop a documented process for assessing whether an entity exercises a corresponding or substantially corresponding function. This might include obtaining a copy of the relevant state or Commonwealth law, comparing it to division 2.2A of the Ombudsman Act, and seeking legal advice if necessary. Before disclosing child safety information, the Ombudsman should verify the entity's status and keep a log of the disclosure, including the basis for concluding the entity is prescribed. The Ombudsman should also ensure that the information disclosed is limited to child safety information as defined in the Act, and that disclosure complies with any other legal restrictions (such as privacy laws or court orders). The Ombudsman must also refuse to investigate complaints about the auditor-general. Staff handling complaints should be trained to identify when a complaint relates to the auditor-general and redirect the complainant appropriately.

For the auditor-general. The auditor-general need take no action to comply, because the regulation imposes no duties. However, the auditor-general should be aware of the jurisdictional boundary. If the Ombudsman attempts to investigate, the auditor-general can rely on section 2 and schedule 1 to object. The auditor-general's office may wish to inform complainants that the Ombudsman is not an available avenue and suggest alternative recourse (e.g., contacting the ACT Legislative Assembly or seeking judicial review).

For interstate and Commonwealth bodies. Entities that may be prescribed under section 3 should determine whether they meet the functional test. If they receive information from the ACT Ombudsman, they must handle it in accordance with their own laws. They have no obligations under the ACT regulation, but they should have internal procedures for managing sensitive child safety information, including storage access, and further disclosure limitations. They may wish to enter into an information-sharing agreement with the ACT Ombudsman to clarify expectations.

For complainants and members of the public. Anyone wishing to complain about the auditor-general cannot use the Ombudsman. They should be directed to other avenues, such as the ACT Legislative Assembly's Standing Committee on Public Accounts or the Auditor-General's own complaints process. Persons whose child safety information is disclosed have no specific rights under the regulation, but they can exercise any rights they have under the Ombudsman Act (e.g., seeking review of the Ombudsman's decision) or under privacy laws.

The regulation is not high-compliance-cost, but it does require accurate legal characterisation of entities and careful record-keeping for disclosures. The recent reintroduction of section 3 may prompt the Ombudsman to update internal policies and training materials.