Therapeutic Goods (Information Specification—Therapeutic Vaping Goods and Vaping Goods) Instrument 2024

The instrument operates by mapping categories of information to authorised recipients and purposes. The main legal concepts it uses are drawn from the Act: therapeutic goods information and vaping goods information, both of which take the meaning given in subsection 61(1) of the Act (s 4(1)). The instrument does not reproduce subsection 61(1); instead it builds on the term as defined by the Act and specifies which kinds of that information can be disclosed and in what circumstances.

Two disclosure pathways are central:

• Information disclosure to persons, bodies or authorities (Schedules 1 and 3): These schedules list the kinds of therapeutic goods information and vaping goods information that may be released to specified classes of public authorities (for example, law enforcement, customs, State health departments), and they set out the permitted purposes for release (for example, to support cooperation in monitoring, compliance and enforcement under Commonwealth, State or Territory law) (see s 5(1) and s 6(1) and the respective Schedules).
• Information disclosure to the public (Schedules 2 and 4): These schedules list categories of information that may be released by the Secretary to the general public, including product details, sponsor/supplier identity, testing and safety information, adverse events, authorisations and recalls (see s 5(2) and s 6(2), Schedules 2 and 4).

Key definitional and scope points in the instrument:

• The instrument distinguishes between “therapeutic vaping goods” and “vaping goods”. Relevant therapeutic vaping goods are explicitly defined to include therapeutic cannabis vaping goods, therapeutic vaping kits and goods in therapeutic vaping packs (s 4). Vaping goods is a term defined in the Act and used in Schedules 3 and 4 for the non‑therapeutic category.
• The definition of “authority” in s 4(1) is broad and expressly includes Commonwealth authorities, State departments and other authorities with functions relating to vaping goods, therapeutic goods, health, revenue or law enforcement. The instrument lists examples in its notes (Department of Home Affairs and Australian Border Force, Australian Federal Police, Australian Commission on Safety and Quality in Health Care, ATO, certain State health departments and police).
• “Sample” and “testing” are given an extended scope in s 4(2) and s 4(3): they include samples or tests taken or conducted under the Act, under the TG Regulations or MD Regulations, under a corresponding State law, or taken/conducted by or at the request of Commonwealth, State or Territory officers acting under those powers. That broad articulation brings within scope a wide set of samples and analyses that may be disclosed under the specification.
• The permitted recipients and purposes are expressed in functional and operational terms: Schedule 1 and Schedule 3 state that the information can be provided to an authority “to support cooperation, and otherwise to seek or provide assistance, in monitoring, compliance and enforcement activities” under Commonwealth, State or Territory law. For public release, schedules list public‑facing categories: authorisations, product details, sponsor identity, adverse events, testing results, safety alerts and recall information.

Mechanically the instrument further:

• Repeals the previous 2023 instrument in full (Schedule 5) and so replaces the prior information specification with this updated schedule (see Schedule 5).
• Requires the Secretary to act within existing Act powers: the instrument does not itself authorise disclosure beyond the scope of subsection 61(5AA), 61(5C), 61(7A) and 61(7C) of the Act; rather it specifies the categories the Secretary may disclose within that established statutory framework (see s 3 and the notes in ss 5 and 6).

Several operational features follow from these concepts: the Secretary’s discretion is permissive (may disclose, not must disclose); the lists are detailed but not exhaustive (the Schedules use “including (but not limited to)” language); and the instrument explicitly contemplates multi‑jurisdictional cooperation by referencing corresponding State law and customs legislation.

The instrument directly affects three broad groups: regulated entities (private sector businesses and individuals connected to vaping products), government agencies that are potential recipients or users of disclosed information, and members of the public who may receive information publicly released by the Secretary.

Regulated entities

• Sponsors, wholesalers, suppliers, advertisers, possessors, importers, exporters, manufacturers and persons involved in the supply chain of vaping goods and therapeutic vaping goods are explicitly named in the Schedules (see Schedule 1 column 2 and Schedule 3 column 2). These entities are the subjects of the categories of information that may be disclosed: product particulars, identities, import/export activity, compliance and authorisation details, testing results and adverse events (for example, Schedule 2 items 1 and 2 list sponsor and supplier details, testing and adverse event information).
• Entities that hold samples or test samples are in scope because the instrument defines “sample” and “testing” broadly (s 4(2)-(3)). That brings commercial testing laboratories, customs testing facilities and regulator-conducted tests within the universe of activities that can generate disclosable information.

Government and regulatory recipients

• The instrument names categories of recipients as authorities with functions relating to vaping goods, therapeutic goods, health, revenue or law enforcement (s 4(1)). Examples in the instrument include the Department of Home Affairs (including the Australian Border Force), the Australian Criminal Intelligence Commission, the Australian Federal Police, the Australian Commission on Safety and Quality in Health Care, the Australian Taxation Office, the Queensland Police Service, the New South Wales Ministry of Health and HealthShare Victoria. Schedules 1 and 3 focus on disclosure to such authorities to support monitoring, compliance and enforcement.
• Departments and agencies at Commonwealth, State and Territory level that exercise powers under the Act, corresponding State laws, or customs legislation are identified as both sources and recipients (s 4(2)-(3) and the Schedules). The instrument therefore formalises cross‑jurisdictional data flows among health regulators, customs, revenue and law enforcement bodies.

The public

• The instrument authorises public disclosure (Schedules 2 and 4). The public is affected as recipients of information about products, sponsors, testing, adverse events, and safety alerts and recalls. Public disclosure can include details of authorisations, withdrawals from supply, testing results, and information about appropriate disposal and safe use.

Decision‑makers

• The Secretary of the Department of Health and Aged Care is the statutory office that may authorise releases under the Act; the instrument was made by a delegate of the Minister (Nick Henderson), and s 3 records the legislative authority under which the instrument was made. Practically, the Secretary (or authorised delegates within the Department) will decide whether to disclose particular categories of information under the permission created by the instrument.

Who ultimately pays (practical consequences)

• Commercial entities operating in the vaping market bear the compliance and reputational costs of the instrument’s operation. Where the Secretary discloses sponsor identities, testing results or enforcement actions, those entities may face regulatory follow‑up, reputational impacts, supply chain disruption, or enforcement action by receiving authorities (Schedules 1-4).
• Government agencies that receive information will bear administrative costs of processing disclosures and acting upon them, including investigative, enforcement and public communication costs. The instrument anticipates that those agencies will use the information for monitoring, compliance and enforcement activities and public health/safety alerts.

What behaviour changes

• Businesses supplying vaping goods and therapeutic vaping goods will have incentives to maintain accurate records, testing data and compliance documentation because that information can be shared with enforcement bodies and the public (Schedules 1-4).
• Authorities will have a clearer legal basis for requesting and receiving TGA-held data to support cross‑agency enforcement and public safety communications.

The instrument therefore affects a broad network of market participants, regulators and the public, not by creating new offences but by enabling particular information flows that the regulated parties may find consequential.

The instrument does not impose new statutory duties on private parties in the form of criminal or civil penalties. Instead it creates a specification of the Secretary’s discretion to release classes of information. The principal legal duties and rights to note are therefore administrative and informational rather than penal.

Duties (as expressed or implicated by the instrument)

• Secretary’s duty to operate within statutory authority: the instrument is made under subsections 61(5AB), (5D), (7B) and (7D) of the Act and expressly confines disclosure to the kinds of information and recipients set out in the Schedules (s 3; ss 5-6). The Secretary must act within that statutory framework when deciding whether to release information.
• Implied duties on authorised recipients: the instrument contemplates disclosure to Commonwealth, State and Territory authorities for specified purposes (Schedules 1 and 3). Although the instrument does not itself impose handling, confidentiality or use restrictions on recipients, authorised recipients will be bound by their own statutory frameworks and internal policies in relation to the handling and use of the disclosed information. The instrument explicitly frames releases as supporting cooperation in monitoring, compliance and enforcement activities (Schedule 1 and Schedule 3 column 4).
• Record and testing duties on regulated entities (indirect): because the Schedules make testing data, sample results and authorisation information disclosable, entities that generate or submit such information (for example, sponsors and suppliers) have an indirect duty to maintain accurate documentation and to be prepared for potential public or inter‑agency disclosure. That duty is one of practical compliance risk rather than a positive statutory obligation introduced by this instrument.

Rights

• Regulatory decision‑making rights: sponsors and other regulated parties retain any procedural rights available under the Act and other applicable laws with respect to authorisations, compliance reviews, and enforcement actions. The instrument does not alter those procedural rights; it only specifies the TGA’s discretion about releasing information about such matters.
• Privacy and confidentiality interests: the instrument does not expressly extinguish privacy or confidentiality protections that may otherwise apply. The Schedules authorise public release of certain categories of information (Schedules 2 and 4), including sponsor identity and testing results. Entities retain whatever rights they may have under privacy law or administrative law to challenge particular releases; the instrument itself does not set out notice or consultation obligations prior to release.
• No private right to prevent disclosure: the Schedules are permissive (“may be released”) and do not confer a right upon a sponsor or other private party to prevent release. Where disclosure occurs, the decision to disclose is a matter for the Secretary under the Act.

Practical administrative duties

• The instrument requires the Department to identify and classify kinds of information that fall within the Schedule entries. For personnel administering disclosure there is a duty to interpret the “including (but not limited to)” lists, to determine whether a particular piece of information fits a listed category, and to choose whether to exercise the Secretary’s discretion to disclose.
• For authorities receiving information, the instrument implies a duty to use the information for the stated purposes (for example, monitoring, compliance and enforcement) but does not set out detailed handling procedures or retention limits.

What the instrument does not do (limits on duties and rights)

• It does not create new statutory offences, penalties or civil causes of action against private entities for disclosure itself. Any enforcement actions referenced in the Schedules (for example civil penalty proceedings, criminal prosecution or injunctions) are examples of the types of enforcement activities information sharing may support rather than new liabilities created by the instrument.
• It does not prescribe procedural steps, timelines, or mandatory pre‑release notifications to affected private parties prior to public disclosure.

Mechanisms that determine duties and rights

• The Schedule entries and the definitions in section 4 determine the scope of disclosable information. The Secretary’s discretion is bounded by the Act’s subsections referenced in the instrument; therefore duties and rights arising from release will be interpreted against that statutory scaffolding.

In short, the instrument creates administrative obligations on the Secretary and practical compliance incentives for regulated parties by making specified information releasable to specified recipients and to the public. It leaves intact other statutory processes and does not, on its face, create new criminal or pecuniary penalties.

The instrument itself does not create or alter criminal offences, civil penalties or enforcement powers. It is an information specification that enables the Secretary to share or publish information collected under the Therapeutic Goods Act 1989, the TG Regulations, MD Regulations, customs legislation or corresponding State laws. Nevertheless the specification is calibrated to support enforcement activities by other agencies and by the Department itself. The Schedules repeatedly list monitoring, compliance and enforcement activities, and the instrument thus serves as an operational vehicle to enable such activities.

How enforcement is supported by the instrument

• Information types that are explicitly identified as disclosable include details relevant to enforcement: the actual, attempted, suspected or proposed importation, exportation, manufacture, supply, possession or advertising of goods; identities of sponsors, wholesalers, suppliers and advertisers; decisions and actions taken under the Act; monitoring, compliance or enforcement activities conducted or proposed (including surveillance, search, seizure, forfeiture, destruction or recall); and the commencement, progress or result of civil penalty proceedings, criminal prosecutions or injunctions (see Schedule 1, Schedule 3). Making this information available to authorities facilitates investigations and enforcement.
• The instrument authorises disclosure to a broad set of authorities involved in enforcement, including customs, police, prosecuting authorities, Australian Federal Police and the Australian Criminal Intelligence Commission (see definition of authority in s 4(1) and example list). Where the Secretary releases information to these agencies, the agencies can use it in enforcement actions under their statutory powers.
• The instrument contemplates the sharing of samples and test results obtained under statutory powers (s 4(2)-(3)). Laboratory analyses and evidence derived from statutory testing can therefore be provided to enforcement authorities for use in prosecutions, civil penalty proceedings or injunction applications, subject to admissibility and evidentiary rules outside the instrument.

Limits and safeguards implicit in the instrument

• The instrument operates within the Act’s disclosure powers (subsections 61(5AA), (5D), (7B), (7D) etc.). It does not purport to expand the enforcement powers of other agencies; it simply provides a defined set of information that the Secretary may release to support enforcement that those agencies may lawfully undertake under their legislation.
• The instrument does not specify evidentiary thresholds for disclosure nor does it provide procedural constraints (for example, mandatory internal approvals, affected party notice or confidentiality conditions) on information released. Those operational safeguards, if any, would need to be supplied by departmental policy, inter‑agency memoranda of understanding, or other processes.

Practical enforcement effects and costs

• By facilitating information flows to law enforcement, customs and revenue authorities, the instrument reduces the transaction costs those agencies face in obtaining TGA data. It therefore lowers the friction for cross‑agency investigations into non‑compliant imports, illicit manufacture or unlawful advertising.
• Conversely, entities whose information is disclosed may experience enforcement action, asset seizure, product removal from the market or prosecutions commenced by other agencies. The instrument lists such outcomes (seizure, forfeiture, destruction, recall, prosecutions) as categories of monitoring or enforcement activity that information sharing might reveal or catalyse.

Interaction with enforcement proceedings

• The Schedules list “the commencement, progress or result of a civil penalty proceeding, a criminal prosecution or a proceeding seeking an injunction” as disclosable categories (Schedules 1 and 3). This authorises the Secretary to share status information about enforcement actions that relate to vaping goods and therapeutic vaping goods, which may assist enforcement coordination or inform public safety alerts (Schedules 2 and 4 list public‑facing versions of such information).

Procedural and legal risk

• Because the instrument does not set out processes for classification of information or pre‑release consultation with affected parties, there is potential for administrative‑law challenges where affected parties contend that a disclosure was ultra vires, procedurally unfair, or breached privacy protections. The instrument enables disclosure but does not itself define internal governance safeguards; risk mitigation relies on departmental practice and the statutory bounds of the Act.

In summary, the instrument is an operational tool for enforcement: it does not create penalties but facilitates the transfer of information that enforcement bodies use to investigate and prosecute contraventions under existing law. The instrument’s practical enforcement value is the clarity it provides about which categories of TGA‑held information may lawfully be shared with other authorities or the public.

The instrument is explicitly framed as operating within and alongside several statutory regimes. Its interaction with other laws is primarily through permitting the release of information that was collected or generated under those laws, and by enabling data sharing between the Department and other governmental authorities empowered under different legislative regimes.

Legislative foundations and express connections

• The instrument is made under the Therapeutic Goods Act 1989 (s 3). It therefore relies on, and must be read consistently with, the Act’s disclosure provisions, specifically subsections 61(5AA), (5D), (7B) and (7D) (see s 3 and the notes in ss 5 and 6). The Schedules are a specification of the kinds of information the Secretary may disclose pursuant to those statutory subsections.
• The instrument cross‑references the Therapeutic Goods Regulations 1990 (TG Regulations) and the Therapeutic Goods (Medical Devices) Regulations 2002 (MD Regulations) in its definitions and scope (s 4). That linkage makes clear that samples, authorisations and testing conducted under those regulations are within the information universe that can be disclosed.
• The instrument explicitly includes customs legislation , the Customs Act 1901 and its regulations , as a legislative source of disclosable information and as a target domain for information sharing (s 4). This recognises the central role of customs and border enforcement where imports of vaping goods are concerned.

Interactions with State and Territory law

• The instrument contemplates that samples and testing may be done “under the Act or a corresponding State law” and that officers of State and Territory departments exercising powers under corresponding laws may take samples or conduct testing (s 4(2)-(3)). The Secretary may therefore disclose information derived from State enforcement actions to other Commonwealth and State authorities as specified in the Schedules.
• The definition of “authority” includes State departments and authorities, and the Schedules explicitly refer to cooperation “under Commonwealth, State or Territory law” (Schedules 1 and 3 column 4). The instrument therefore operates as an inter‑jurisdictional information‑sharing specification.

Privacy, confidentiality and other legal regimes (silence and implication)

• The instrument is silent on how disclosure interacts with privacy law (for example, the Privacy Act 1988) or with statutory confidentiality protections that may apply to information held by the Department. It neither overrides nor expressly incorporates privacy protections. Practically, that means any disclosure must still be consistent with the Act and with laws that regulate the handling of personal or commercially sensitive information; the instrument itself does not create an express carve‑out from privacy obligations.
• The instrument does not address evidentiary rules, civil litigation procedure, or administrative remedies that may constrain the use of disclosed information in judicial or quasi‑judicial processes. Use of TGA‑derived information in prosecutions or civil proceedings will proceed under the applicable evidentiary and procedural frameworks of those courts and tribunals.

Operational instruments and inter‑agency frameworks

• Because the Schedules authorise disclosure to a wide range of authorities, practical implementation will likely depend on inter‑agency agreements, memoranda of understanding and departmental policies that set out the mechanics of disclosure, data security, permitted uses, retention periods, and confidentiality commitments. Such instruments are not part of the text; they will determine how the legal permission in this instrument is operationalised.
• The instrument’s repeal of the 2023 specification (Schedule 5) updates the authoritative specification of disclosable information. Agencies relying on the 2023 instrument will need to transition to the 2024 specification where relevant.

Implications for regulated businesses

• Information provided to customs and law enforcement under the instrument may interact with other legal regimes affecting businesses, such as the Australian Consumer Law, competition law, taxation law, and criminal law. Disclosure of TGA information may trigger investigations or enforcement action under those other regimes where conduct appears to violate their requirements. The instrument itself does not create those cross‑regime obligations but facilitates the flow of evidence that other regimes may use.

In sum, the instrument is a specification for disclosure of information that sits within a network of Commonwealth and State laws. Its primary legal interactions are with the Therapeutic Goods Act and associated regulations, customs legislation, corresponding State laws, and the statutory frameworks of the authorities that will receive the disclosed information. It neither amends those laws nor creates express overrides of privacy or other legal protections; implementation will therefore be mediated by existing statutory constraints and by departmental and inter‑agency procedures.

This instrument replaces the earlier Therapeutic Goods (Information Specification,Therapeutic Vaping Goods and Vaping Devices) Instrument 2023. Schedule 5 of the 2024 instrument repeals the entire 2023 instrument (Schedule 5 item 1: “The whole of the instrument , Repeal the instrument”). The 2024 instrument is dated 30 June 2024 and was made by a delegate of the Minister for Health and Aged Care (Nick Henderson, Acting Deputy Secretary, Health Products Regulation Group) as recorded in the instrument header.

Commencement mechanics

• The instrument’s commencement is conditional: section 2 sets out that the whole instrument commences “at the same time as Parts 5 to 11 of Schedule 1 to the Therapeutic Goods and Other Legislation Amendment (Vaping Reforms) Act 2024 commences.” The instrument will not commence at all if that amending Act does not commence (s 2(1)). The commencement table in s 2 therefore makes operation contingent on the broader vaping reforms entering into force.
• Section 2(2) explains that the column 3 information in the commencement table is not part of the instrument; this is a standard drafting note and indicates that the commencement table in section 2 controls commencement timing only.

Authority for amendment

• The instrument is made under subsections 61(5AB), (5D), (7B) and (7D) of the Therapeutic Goods Act 1989 (s 3). Those subsections provide the Secretary’s statutory authority to release therapeutic goods information and vaping goods information for specified purposes. The instrument functions as a specification under those statutory provisions.

No further amendments inside the instrument

• Other than the repeal of the 2023 instrument, the 2024 instrument does not amend other instruments or Acts directly. It is purely a specification that lists categories of information for disclosure and sets out recipients and purposes (ss 5-6, Schedules 1-4).

Notes on future amendment pathways (procedural)

• As an instrument made under the Act, changes to what information may be released or to recipient lists can be effected by the Secretary issuing a new specification instrument under the same subsections of the Act. The instrument itself records the kinds of information in detail, but it can be updated in the future by the Secretary (or their delegate) in accordance with the Act’s procedures for making such instruments.
• The commencement linkage to the Therapeutic Goods and Other Legislation Amendment (Vaping Reforms) Act 2024 also means that any amendments or delays to that primary Act will affect the effective date of this specification.

In short, the immediate amendment history is limited: the 2024 instrument replaces the 2023 instrument in full, and it is framed to commence only when specified parts of the 2024 Vaping Reforms Act commence. Future changes would follow the statutory route for the Secretary to make or amend information specification instruments under the Act.

The instrument itself contains no reference to, and the source material names no, litigation concerning its provisions or the earlier 2023 specification. The text of the instrument does not record any judicial decisions or administrative tribunal determinations that interpret or apply it.

What the source does provide

• The instrument is an administrative specification made under the Therapeutic Goods Act and therefore resides in a domain where administrative review and judicial review are theoretically available under general administrative law principles. The instrument, however, contains no litigation record or judicial consideration. It is therefore accurate to say the source contains no litigation history.

Potential legal avenues that parties might invoke (statutory and administrative law context)

• Because the instrument authorises discretionary releases of information by the Secretary, affected parties might seek administrative review or judicial review of particular disclosure decisions on standard public law grounds (for example, jurisdictional error, failure to take into account relevant considerations, procedural fairness or taking into account irrelevant considerations). The instrument itself does not create or limit those review pathways; they are matters for the general law of judicial review and the applicable statutory regimes.
• Parties might also consider privacy law remedies (for example, complaints under the Privacy Act 1988) if they consider a disclosure breaches privacy obligations. The instrument does not state how disclosures interact with privacy protections; accordingly, any litigation or regulatory complaint would turn on the interplay between the instrument, the Act’s disclosure powers, and privacy law.
• Where an information disclosure precipitates enforcement (for example, prosecution or civil penalty proceedings by another authority), the substantive enforcement proceedings would follow their own litigation paths in courts or tribunals; the instrument itself is only a mechanism that may facilitate the evidence flows that trigger such litigation.

No cases named in the instrument

• The instrument does not cite, rely upon or invoke any case law. It is a forward‑looking administrative instrument that specifies information categories and recipients.

In practice, the absence of litigation history in the source does not mean disputes will not arise. Disclosure of commercially sensitive information, adverse‑event data, or enforcement status information can lead to challenges on administrative law or privacy grounds. The instrument establishes the Secretary’s permission to disclose; the procedural assurances, internal approvals and recordkeeping practices the Department follows when exercising that power will influence whether and how litigation occurs. The instrument itself, however, contains no judicial gloss or litigation record to summarise.

The instrument is detailed but leaves several practical, interpretive and procedural issues unaddressed. These are the main “gotchas” a practitioner or compliance officer should note, grounded in the instrument’s text.

1. Broad, non‑exhaustive lists increase interpretive discretion

• Each Schedule uses “including (but not limited to)” language to list examples of disclosable information (for example, Schedules 1-4). That wording means the Secretary’s discretion is not confined to the listed items. Practically, this broadness creates uncertainty for regulated entities about what exactly might be disclosed in a given circumstance.

2. “May” is permissive; no obligation or threshold is prescribed

• The instrument consistently uses permissive language: information “may be released” to named recipients or the public (ss 5, 6). There is no statutory requirement that the Secretary must release information once a category is met, nor are there statutory criteria or thresholds (for example, materiality, public interest balancing tests or minimum evidentiary standards) set out in the instrument for when the Secretary should exercise the power.

3. Public release can include sponsor identity and testing results

• Schedules 2 and 4 authorise public disclosure of details such as product particulars, sponsor/supplier/advertiser identity, testing and test results, adverse events and recalls (Schedule 2 item 1(c)-(j); Schedule 4 item 1(c)-(i)). This means commercial entities can have sensitive operational and safety information disclosed to the public without any procedural requirement for prior consultation in the instrument itself.

4. No express privacy or confidentiality safeguards

• The instrument is silent on how disclosures interact with the Privacy Act 1988, statutory confidentiality provisions or commercial confidentiality claims. The absence of express safeguards in the specification means affected parties must rely on the Secretary’s exercise of discretion and departmental privacy/confidentiality policies to protect personal or commercially sensitive data.

5. Repeal and transition considerations

• The 2023 instrument is repealed in full by Schedule 5. If the Department relied on the 2023 instrument for past disclosures, entities should check whether transitional arrangements or re‑classifications affect previously collected information. The instrument contains no transitional rules for disclosures made under the 2023 instrument.

6. Broad definition of “sample” and “testing”

• Section 4(2)-(3) expressly includes samples and testing conducted under the Act, MD Regulations, TG Regulations, corresponding State law, or by officers exercising powers under those regimes. This heavily broadens the universe of material that can be disclosed (for example, State‑collected samples and private‑lab testing commissioned by the Department could be disclosed).

7. Wide range of recipient authorities and purposes

• The definition of authority in s 4(1) covers many Commonwealth, State and Territory agencies with functions in health, revenue or law enforcement. Schedules 1 and 3 permit sharing to support cooperation in monitoring, compliance and enforcement under Commonwealth, State or Territory law. This wide remit can lead to cross‑border and cross‑sector disclosures (for example, to revenue or police agencies) which regulated entities may not have anticipated when interacting with the TGA.

8. Lack of operational detail about release mechanisms

• The instrument does not set out how disclosures will be made, the format of releases, retention periods, redaction standards or processes for affected parties to seek correction, redaction or reconsideration. Those operational gaps increase compliance uncertainty.

9. Conditional commencement

• Section 2 ties the instrument’s commencement to the commencement of Parts 5-11 of Schedule 1 to the Therapeutic Goods and Other Legislation Amendment (Vaping Reforms) Act 2024. If that Act does not commence, this instrument does not commence. Parties should not assume the instrument is operational until those linked provisions commence.

10. Delegation and internal governance

• The instrument was made by a delegate of the Minister (the Acting Deputy Secretary). The Act provides for the Secretary’s powers and any departmental delegation; however, the instrument does not describe internal authorisation levels for disclosure decisions. This raises practical questions about who within the Department signs off on disclosures and what records will be kept.

11. Overlap between “therapeutic vaping goods” and “vaping goods”

• Both classes are covered by parallel schedules. Entities operating on the borderline between therapeutic and non‑therapeutic product categories should be aware that both Schedules may apply and that similar categories of information can be released under either pathway.

12. Enforcement nexus but no procedural protection

• The instrument explicitly lists enforcement activities (seizure, forfeiture, destruction, recall, prosecutions) as categories of disclosable information, but it provides no procedural protections for entities whose enforcement status might be publicly disclosed.

Practitioners should therefore treat the instrument as granting powerful discretionary information‑sharing authority to the Secretary, paired with limited statutory procedural safeguards. The practical response should be to strengthen recordkeeping, evaluate privacy and confidentiality exposures, and to engage with the Department’s disclosure policies and inter‑agency protocols where possible.

Compliance, in the context of this information specification, entails anticipating and managing the possibility that the Secretary may disclose information you generate, hold, or submit to the TGA in connection with vaping goods or therapeutic vaping goods. The instrument imposes disclosure risks rather than direct new duties, so compliance is primarily about process, recordkeeping and stakeholder management. The following is a practical checklist, grounded in the instrument’s text, for sponsors, suppliers, laboratories, legal teams and government agencies.

For sponsors, manufacturers, wholesalers, suppliers and advertisers

1. Strengthen recordkeeping and documentation

• Maintain auditable records for product particulars (strength, formulation, composition, design specification, presentation), import/export manifests, shipping and customs documentation, supply chain contracts, and advertising materials. The Schedules list these as disclosable categories (Schedules 1-4). Good records reduce the risk of inconsistent or ambiguous disclosures.

2. Preserve testing data and chain of custody

• Ensure that samples, test results, laboratory records and chain‑of‑custody documentation are complete and defensible. Section 4(2)-(3) and the Schedules make testing and sample results disclosable. Accurate testing records help respond to public disclosure and enforcement inquiries.

3. Manage commercial confidentiality and contracts

• Include contractual protections with suppliers and lab partners that require notification prior to the disclosure of commercially sensitive data, insofar as such contracts are lawful. Recognise that contractual clauses cannot bind the Secretary but can regulate relationships among private parties and third‑party lab behaviour.

4. Prepare communication strategies

• Develop templates and processes for public communications in the event the Department discloses sponsor identity, testing problems, adverse events, or enforcement status (Schedules 2 and 4). Speed and clarity of response reduce reputational risk.

5. Monitor authorisation status and compliance reviews

• Track any exemptions, consents, authorisations, applications and compliance review statuses referenced in Schedule 2 and Schedule 4. Be proactive in correcting misinformation or addressing compliance gaps that could trigger adverse disclosures.

6. Privacy and data protection planning

• Evaluate how personal data contained in adverse event reports is managed; ensure compliance with privacy obligations. Although the instrument is silent on privacy overrides, disclosures involving personal data may implicate the Privacy Act 1988.

7. Legal preparedness

• Consult counsel on potential administrative or privacy remedies that may be available in the event of a problematic disclosure. Document efforts to be cooperative and compliant, as cooperation may mitigate enforcement escalation.

For testing laboratories, customs agents and supply chain partners

1. Ensure accredited methods and reporting standards

• Adopt validated testing methodologies and transparent reporting practices. The instrument lists testing results as disclosable; good method documentation reduces dispute about results’ reliability.

2. Follow chain‑of‑custody best practice

• Maintain rigorous chain‑of‑custody logs for samples taken under contract, under regulatory direction, or by State or Commonwealth officers, given s 4(2)-(3).

For Commonwealth, State and Territory authorities and internal TGA staff

1. Develop disclosure approval workflows

• Create clear internal procedures for exercising the Secretary’s discretion under the instrument. Although the instrument grants permissive authority, agencies should document decision criteria, authorisation levels, review steps and records of rationale for each disclosure. This assists administrative accountability.

2. Data handling, privacy impact assessments and MOUs

• Conduct privacy impact assessments for data sharing and publish, or keep on file, memoranda of understanding or data‑sharing agreements with recipient authorities to set expectations about permitted uses, security, retention and third‑party disclosure limits. The instrument authorises cross‑agency sharing but does not set operational safeguards.

3. Redaction and minimisation policies

• Implement redaction practices to minimise disclosure of unrelated personal data or commercially sensitive material where the disclosed category permits public release. The Schedules list wide categories; minimisation reduces privacy and reputational harms while enabling public safety communications.

4. Public communication templates and timing

• Prepare templates for public warnings, safety alerts, recall notices and statements about enforcement actions, as the Schedules authorise those communications (Schedules 2 and 4). Decide in advance whether and how affected parties will be notified prior to public release, even if not legally required by the instrument.

5. Recordkeeping and audit trails

• Keep contemporaneous records of decisions to disclose, the legal basis relied upon (specific Schedule item), the recipients, the information disclosed, and the purpose under which disclosure was made. Such records are essential if a disclosure is later challenged.

6. Training and inter‑agency coordination

• Train staff in interpreting the Schedule lists and in distinguishing between therapeutic vaping goods and vaping goods categories to avoid misclassification. Establish points of contact with customs, law enforcement, State health departments and revenue agencies named in s 4(1) to streamline cooperative action.

For industry associations, compliance officers and legal advisers

1. Proactive engagement with the Department

• Seek clarifications on departmental policies regarding disclosure and request guidance on how the Department will handle commercially sensitive or confidential information. Where appropriate, propose MOU language to govern disclosures to particular agencies.

2. Review and update commercial arrangements

• Revisit supplier, manufacturer and testing agreements to ensure they allocate risk appropriately for the possibility of public disclosure of testing or product data.

3. Risk‑based monitoring

• Conduct internal compliance audits focused on the categories the Schedules emphasise: product composition, labelling, advertising, testing, import/export documentation and adverse event reporting.

4. Prepare for enforcement follow‑up

• Anticipate that disclosed information to enforcement authorities may prompt investigations. Have legal strategies in place for responding to information requests from customs, police or prosecuting authorities.

Practical checklists and templates (operational first steps)

• Map all products to the categories “therapeutic vaping good”, “therapeutic vaping kit/pack”, or “vaping good” to determine which Schedules may apply.
• Catalogue all testing and sample histories for each product for at least the statutory retention period suggested by departmental guidance.
• Create an internal incident response plan that sets out who to notify internally, timing for public statement drafts, and legal clearance steps if the Department signals an intended public disclosure.
• Document privacy assessments for adverse event reporting processes.

Compliance under this instrument is therefore largely anticipatory and procedural: maintain robust records, create internal approvals and communication plans, engage with the Department, and ensure that every data flow (samples, tests, authorisations) is documented so that if the Secretary exercises the disclosure discretion the affected parties are prepared to respond promptly and coherently.