Explanatory Memorandum
(Circulated by authority of the Attorney-General, Senator the Honourable George Brandis QC)Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Regulatory Powers (Deregulation) Bill 2016
8. This Bill is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Bill
9. This Bill makes amendments to 15 Commonwealth Acts in order to implement the Regulatory Powers Act. The Regulatory Powers Act received Royal Assent on 21 July 2014 and commenced on 1 October 2014. The Regulatory Powers Act only has effect where Commonwealth Acts are drafted or amended to trigger its provisions.
10. The purpose of this Bill is to amend various Commonwealth Acts to repeal current provisions providing for regulatory regimes in those Acts, and instead trigger the standard provisions of the Regulatory Powers Act. The purpose of this standardisation is to simplify and streamline Commonwealth regulatory powers across the statute book.
11. The Bill also makes minor amendments to the Regulatory Powers Act.
12. As noted by the Parliamentary Joint Committee on Human Rights in its consideration of the Regulatory Powers (Standard Provisions) Bill 2014, it is necessary to consider the human rights impact in the specific context of each legislative regime that triggers the Regulatory Powers Act. Accordingly, the human rights impact is considered separately for each of the Acts to be amended by this Bill.
Overview of Schedule 13 - Privacy Act 1988
351. The Privacy Act 1988 regulates the handling of personal information about individuals. This includes the collection, use, storage and disclosure of personal information, and access to and correction of that information. Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with his or her privacy, family, home or correspondence. The Privacy Act gives effect to Article 17 of the ICCPR, giving individuals rights in relation to how organisations and agencies handle personal information, both online and offline.
352. Schedule 13 to this Bill amends the Privacy Act to trigger the civil penalty provisions in Part 4 of the Regulatory Powers Act, which means that the civil penalty provisions of the Privacy Act are enforceable under that Part of the Regulatory Powers Act.
353. Under these amendments, the Commissioner (defined in the Privacy Act as the Information Commissioner within the meaning of the Australian Information Commissioner Act 2010) is authorised to apply to a relevant court for a civil penalty order requiring a person to pay the Commonwealth a pecuniary penalty for a contravention of the Privacy Act. Subsections 82(5) and (6) of the Regulatory Powers Act provide for how the pecuniary penalty in a civil penalty order is to be determined.
354. The Privacy Act is also amended to trigger the enforceable undertakings provisions in Part 6 of the Regulatory Powers Act, which will enable the Commissioner to accept and enforce undertakings relating to compliance with the provisions of the Privacy Act. Further, if the Commissioner is satisfied that the person has breached the undertaking, he or she may apply to a relevant court for an order relating to the undertaking.
355. Schedule 13 to this Bill also amends the Privacy Act to trigger the injunctions provisions in Part 7 of the Regulatory Powers Act, which will enable the Commissioner to apply to a relevant court for an injunction to restrain the person from engaging in conduct or requiring the person to do a thing. Further, the Commissioner may apply to a relevant court for an interim injunction.
Human rights implications
Civil penalties and Article 14
356. The Privacy Act creates civil penalties for contraventions of that Act by setting out civil penalty provisions. Those civil penalty provisions are retained under Schedule 13 to this Bill. However, the amendments in Schedule 13 mean that the enforcement framework for those civil penalty provisions is provided by the Regulatory Powers Act, instead of by the Privacy Act.
357. Triggering the civil penalty provisions of the Regulatory Powers Act could engage the criminal process rights under Article 14 of the ICCPR if the imposition of civil penalties is classified as 'criminal' under international human rights law. As set out above, determining whether the penalties could be considered to be criminal under international human rights law requires consideration of the classification of the penalty provisions under Australian domestic law, the nature and purpose of the penalties, and the severity of the penalties.
358. The civil penalty provisions of the Privacy Act expressly classify the penalties as civil penalties. These provisions create solely pecuniary penalties in the form of a debt payable to the Commonwealth. The purpose of these penalties is to encourage compliance with the Privacy Act, which supports the implementation of Australia's obligations under the ICCPR. The civil penalty provisions do not impose criminal liability, and do not lead to the creation of a criminal record. The penalties only apply to the regulatory regime of the Privacy Act, rather than to the public in general. Further, the imposition of the civil penalties is not dependent on a finding of guilt. These factors all suggest that the civil penalties imposed by the Privacy Act are civil rather than criminal in nature.
359. The amendments in Schedule 13 to this Bill do not alter the maximum pecuniary penalties specified for contraventions of the Privacy Act (see current subsection 80U(5) of the Privacy Act). The Privacy Act specifies penalties of 60, 200, 500, 1000 or 2000 penalty units in various civil penalty provisions. Subsection 82(5) of the Regulatory Powers Act, as applied to the Privacy Act, provides that where the person is not a body corporate, a pecuniary penalty must not be more than the penalty specified for the civil penalty provision, and if the person is a body corporate, the pecuniary penalty must not be more than five times the pecuniary penalty specified for the civil penalty provision. The application of this provision preserves the effect of current subsection 80W(5) of the Privacy Act. Accordingly, the maximum penalties for bodies corporate are 300, 1000, 2500 or 10 000 penalty units depending on the provision. This preserves the current maximum penalty amounts.
360. The Privacy Act confers enforcement and other regulatory powers on the Commissioner, which are based on an escalation model that has a range of regulatory responses including civil penalty provisions. The Guide to Privacy Regulatory Action provides guidance on the Commissioner's exercise of regulatory powers in the Privacy Act and indicates the preferred regulatory approach is to work with entities to facilitate legal and best practice compliance. The Guide states the Commissioner will not seek a civil penalty order for all contraventions of a civil penalty provision in the Privacy Act and is unlikely to seek a civil penalty order for minor or inadvertent contraventions.
361. The more serious penalties apply to serious breaches of privacy. For example, section 13G of the Privacy Act imposes a civil penalty of 2000 penalty units for serious interference with an individual's privacy or repeated interference of the privacy of one or more individuals. The penalties set out in the civil penalty provisions are maximum penalties and it is open to a court to exercise its discretion to impose a lower penalty. This discretion would be informed by reference to subsection 82(6) of the Regulatory Powers Act, which provides that a court must take into account all relevant matters in determining a pecuniary penalty, including the nature and extent of the contraventions, the loss or damage suffered, the circumstances in which the contraventions took place and whether a court has previously found the person to have engaged in similar conduct. Subsection 82(6) of the Regulatory Powers Act preserves section 80W(6) of the Privacy Act.
362. The civil penalty provisions do not carry the possibility of imprisonment.
363. The amendments in Schedule 13 to this Bill will also apply section 85 of the Regulatory Powers Act, which provides that a relevant court may make a single civil penalty order against a person for multiple contraventions of a civil penalty provision if proceedings for the contraventions are founded on the same facts, or if the contraventions form, or are part of, a series of contraventions of the same or a similar character; however, the penalty must not exceed the sum of the maximum penalties that could be ordered if a separate penalty were ordered for each of the contraventions. There are no criminal consequences associated with civil penalty orders for multiple contraventions. For example, they do not carry the possibility of imprisonment.
364. As such, the civil penalties under the Privacy Act are not sufficiently severe that they could be considered to be criminal penalties for the purposes of Australia's human rights obligations. Accordingly, the criminal process rights provided for by Article 14 of the ICCPR are not engaged by the amendments relating to civil penalty orders in Schedule 13 to this Bill.
365. The amendments relating to civil penalty provisions in Schedule 13 to this Bill engage, but do not limit, the right to a fair and public hearing in civil proceedings provided for by Article 14(1) of the ICCPR. Under section 82 of the Regulatory Powers Act, civil penalty orders can only be granted by a relevant court, which must consider all relevant matters before determining the amount of the penalty. Accordingly, the right to a fair hearing is not limited.
366. Application of the standard civil penalty provisions of the Regulatory Powers Act does result in a minor expansion of the current regulatory powers framework of the Privacy Act due to the triggering of section 93 of the Regulatory Powers Act. Section 93 of the Regulatory Powers Act provides that if an act or thing is required under a civil penalty provision to be done within a particular period or before a particular time, the obligation to do that act or thing continues until that act or thing is done, even if the period has expired or the time has passed. This section further provides that a person commits a separate contravention of the civil penalty provision in respect of each day during which the contravention occurs, including the day the civil penalty order is made (or any later day). This section is necessary to ensure that failure to comply with an obligation does not excuse a person from meeting that obligation. As discussed above, section 85 of the Regulatory Powers Act provides that a relevant court may make a single civil penalty order against a person for multiple contraventions of a civil penalty provision if proceedings for the contraventions are founded on the same facts, or if the contraventions form, or are part of, a series of contraventions of the same or a similar character. However, the penalty must not exceed the sum of the maximum penalties that could be ordered if a separate penalty were ordered for each of the contraventions. There are no criminal consequences associated with civil penalty orders for multiple contraventions. For example, they do not carry the possibility of imprisonment. The application of section 93 of the Regulatory Powers Act does not engage any human rights.
Additional civil penalty provisions without human rights implications
367. Alignment with Regulatory Powers Act will apply additional provisions, which are not currently in the Privacy Act, that are merely procedural in nature. These are sections 94, 95, 96 and 97 of the Regulatory Powers Act.
368. Sections 94, 95 and 97 of the Regulatory Powers Act relate to the relevance of a person's state of mind, mistake of fact and vicarious liability of employees, agents or officers of a body corporate, respectively. These provisions do not engage the criminal process rights in Article 14 of the ICCPR, as they do not impact upon criminal proceedings.
369. Section 96 of the Regulatory Powers Act provides that, in proceedings for a civil penalty order against a person for a contravention of a civil penalty provision, a person bears an evidential burden where that person wishes to rely on any exception, exemption, excuse, qualification or justification provided by the law creating the civil penalty provision. As section 96 of the Regulatory Powers Act only relates to proceedings for civil penalty orders, not offences, the right to be presumed innocent in Article 14(2) of the ICCPR is not engaged.
Enforceable undertakings and Article 14
370. Under the amendments in Schedule 13 to this Bill, enforceable undertakings may be accepted and enforced under the Regulatory Powers Act in relation to contraventions of provisions of the Privacy Act (including offence provisions). As the enforceable undertakings framework applies to the offence provisions, the right to a fair and public hearing and the other criminal process rights and minimum guarantees in Article 14 of the ICCPR are engaged.
371. Under Part 6 of the Regulatory Powers Act, an order enforcing an undertaking that relates to compliance with provisions of the Privacy Act can only be made by a court. Accordingly, the right to a fair and public trial is not limited.
372. The amendments in Schedule 13 to this Bill also do not limit the minimum guarantees and other criminal process rights in Article 14 of the ICCPR.
Injunctions and Article 14
373. Under the amendments in Schedule 13 to this Bill, an injunction can be granted under the Regulatory Powers Act in relation to contraventions of the provisions of the Privacy Act. Accordingly, as the injunctions framework applies to the offence provisions of the Privacy Act, the right to a fair and public trial and the other criminal process rights and minimum guarantees provided for by Article 14 of the ICCPR are engaged.
374. Under Part 7 of the Regulatory Powers Act, an injunction can only be granted by a court. Further, a court may only grant an injunction where a person has engaged, is engaging or is proposing to engage, in conduct that contravenes a provision of the Privacy Act, or where a person has refused or failed, or is refusing or failing, or proposing to refuse or fail, to do a thing and that refusal or failure was, is or would be a contravention of a provision of the Privacy Act. Thus, the right to a fair and public trial is not limited.
375. The other criminal process rights and minimum guarantees in Article 14 of the ICCPR are not limited by the amendments in Schedule 13 to this Bill.
Right to privacy
376. Schedule 13 to this Bill also modifies the operation of Part 6 of the Regulatory Powers Act, and provides that the Commissioner may publish an undertaking given in relation to a provision of that Act on the Commissioner's website . New subsection 80V(4) of the Privacy Act preserves the effect of current subsection 33E(5) of that Act.
377. This provision engages the protection against arbitrary or unlawful interference with privacy. Article 17 of the ICCPR prohibits arbitrary or unlawful interference with an individual's privacy, family, home or correspondence, and protects a person's honour and reputation from unlawful attacks. The right to privacy can be limited to achieve a legitimate objective where the limitations are lawful and not arbitrary. In order for an interference with the right to privacy to be permissible, the interference must be authorised by law, be for a reason consistent with the ICCPR and be reasonable in the circumstances. The United Nations Human Rights Committee has interpreted the requirement of 'reasonableness' as implying that any interference with privacy must be proportionate to a legitimate end and be necessary in the circumstances.
378. The Privacy Act pursues the legitimate objective of giving effect to Australia's obligations under Article 17 of the ICCPR. It pursues this objective by regulating the handling of personal information about individuals. This includes the collection, use, storage and disclosure of personal information, and access to and correction of that information.
379. To the extent that the power in new section 80V(4) of the Privacy Act may limit the right to privacy, this limitation is provided for by law. It is necessary that the Commissioner retain the power in new section 80V(4) of the Privacy Act in order to pursue the legitimate objective of the Privacy Act by promoting compliance with that Act. The power may only be exercised by the Commissioner, ensuring that its use is reasonable, necessary and proportionate to the objectives of the Privacy Act and limiting the risk of abuse of this power. The objectives of the Privacy Act are themselves consistent with the ICCPR. Accordingly, the provision is compatible with the protection from arbitrary or unlawful interference with privacy.
Conclusion
380. Schedule 13 to this Bill is compatible with human rights because to the extent that it may limit human rights, the limitation of those rights is necessary, reasonable and proportionate .