This consultation is closed. The deadline for submissions was 31 January 2020.
The Office of the Australian Information Commissioner (OAIC) is seeking your views in relation to two applications it has received for public interest determinations (PIDs) in relation to international money transfers (IMTs).
Background
Part VI of the Privacy Act 1988 gives the Australian Information Commissioner (Information Commissioner) the power to make a determination, by legislative instrument, that an act or practice of an Australian or Norfolk Island Government agency, or a private sector organisation, which may constitute a breach of an Australian Privacy Principle (APP) shall be regarded as not breaching that APP for the purposes of the Privacy Act.
In doing so, the Information Commissioner must be satisfied that the public interest in the act or practice substantially outweighs the public interest in adhering to the APP. A determination made under Part VI is referred to as a public interest determination (PID). The Information Commissioner also has the power to make a temporary public interest determination (TPID), in limited circumstances, where an application for a PID raises issues that require an urgent decision.
Applications for new public interest determinations received
The OAIC has received two applications for PIDs under section 73 of the Privacy Act.
- An application from the Reserve Bank of Australia (RBA), received on 2 December 2019
- An application from the Australia and New Zealand Banking Group Limited (ANZ), received on 5 December 2019.
Owing to the similar nature of the applications, the OAIC considers that consultation on both applications can occur in the same process.
The applications seek new PIDs to permit ANZ — along with other authorised-deposit taking institutions within the meaning of the Banking Act 1959 (ADIs) —and the RBA to disclose the personal information of a beneficiary of an IMT to an overseas financial institution when processing an IMT without breaching the APPs.
These new PIDs would replace existing PIDs concerning IMTs that are due to sunset on 25 February 2020:
- Privacy (International Money Transfers) Public Interest Determination 2015 (No. 1) (made under subsection 72(2) in respect of the ANZ)
- Privacy (International Money Transfers) Public Interest Determination 2015 (No. 2) (made under subsection 72(2) in respect of the RBA)
- Privacy (International Money Transfers) Generalising Determination 2015 (made under subsection 72(4) that no other ADI is taken to contravene section 15 or 26A if, while that determination is in force).
These PIDs have allowed the ANZ, other ADIs, and the RBA to continue their existing practices in relation to processing IMTs without breaching the Privacy Act since 2014.
The applications for PIDs from both the RBA and ANZ are substantially similar to those received previously in 2014. Therefore, it is proposed that new PIDs (set out as draft determinations in the Consultation Paper) be remade on substantially the same terms as the PIDs that are currently in force.
In their application, the RBA has requested that the Commissioner consider making a generalising determination under section 72(4) of the Privacy Act to apply to all ADIs that process IMTs. The ANZ have acknowledged this request for a generalising determination in their application. The RBA is not an ADI and, therefore, has sought its own determination under section 72(2).[1]Due to the limited period of time available between lodging of the applications to the OAIC and the expiry of the PIDs, both ANZ and the RBA have included a request for temporary public interest determinations (TPIDs) in the event that PIDs are unable to be registered prior to sunsetting on 25 February 2020. If significant issues are raised during consultation, it is open to the Commissioner to make TPIDs which would preserve the status quo whilst also allowing for a further period of time to consider the applications for longer-term PIDs.
View ANZ’s application for a public interest determination
View RBA’s application for a public interest determination
Purpose of consultation
The OAIC has issued a consultation paper to assist interested parties to providing submissions as part of the Commissioner’s consideration of the PID applications and the proposed making of PIDs to replace existing PIDs.
How to make comments
Submissions can be made by:
Post | GPO Box 5218 |
|---|
The closing date for submissions is Friday 31 January 2020.
We intend to make all submissions publicly available. Please indicate when making your submission if it contains confidential information you don’t want made public and why it should not be published. Requests for access to confidential comments will be determined in accordance with the Freedom of Information Act 1982 (FOI Act).
Although you may lodge submissions electronically or by post, electronic lodgement is preferred. To help us meet our accessibility obligations, we would appreciate you providing your submission in a web accessible format or, alternatively, in a format that will allow us to easily convert it to HTML code — for example Rich Text Format (.rtf) or Microsoft Word (.doc or .docx) format.
Consultation questions
The OAIC seeks views on the following matters:
- What additional steps (if any) ANZ, other ADIs, and the RBA could take to comply with APP 8.1 (that is, to ensure that the overseas financial institution to which they disclose the beneficiary’s personal information does not breach the APPs in relation to that information)
- Whether ANZ, other ADIs, and the RBA should remain accountable for the handling of the beneficiary’s personal information by the overseas financial institution under s 16C (that is, whether ANZ, the relevant ADI, or the RBA as the case may be, or the beneficiary, should bear the risk of the overseas financial institution not handling the beneficiary’s personal information in accordance with the APPs)
- Whether the draft PIDs in attachments A to C should only apply to a disclosure by ANZ, another ADI or the RBA, as the case may be, to an overseas financial institution that takes place over the SWIFT network
- The extent to which the draft PIDs in attachments A to C are inconsistent with an individual’s reasonable expectation of privacy
- The nature of the public interest objectives served by the proposed interference with privacy
- The impact on the public interest if PIDs are not made
- Any relevant matters which have changed since 2015 and may impact on the public interest test
- The number of years that the PIDs, if made, should remain in force.
These questions are not intended to limit the issues that may be raised. You may wish to respond to some or all questions, or to raise other issues related to the applications.
Privacy collection statement
The OAIC will use the personal information it collects in the course of this consultation for the purpose of finalising the guidelines and to facilitate our ongoing engagement with you.
Footnote
[1] The RBA is not an ADI but is authorised under the Banking Act 1959 (section 8(1)), and under the Reserve Bank Act 1959 (sections 26 and 27), to carry on banking business. It provides payment and collection services for the Australian Government, various Australian government agencies, and a number of overseas central banks and official institutions. It also provides limited international payment services for its staff. In the course of its banking business it processes IMTs for its customers in a similar way to the way that ANZ and other ADIs process IMTs for their customers.
