My Health Records (Information Commissioner Enforcement Powers) Guidelines 2016 (Cth)

My Health Records (Information Commissioner Enforcement Powers) Guidelines 2016 My Health Records Act 2012

I, TIMOTHY PILGRIM, Acting Australian Information Commissioner, make this legislative instrument under subsection 111(2) of the My Health Records Act 2012.

Dated 18 March 2016

TIMOTHY PILGRIM

Acting Australian Information Commissioner

Contents Part 1 Preliminary 1 Name of instrument 2 Commencement 3 Definitions 4 Introduction Part 2 General principles relating to enforcement action and the exercise of investigative powers under the My Health Records Act and the Privacy Act 7 5 Types of enforcement powers and investigative powers available to the Information Commissioner 7 6 Investigations – general principles 9 7 Enforcement action – general principles 10 Part 3 Use of enforcement powers under the My Health Records Act and Privacy Act 13 8 Enforceable undertakings under the My Health Records Act 13 9 Enforceable undertakings under the Privacy Act 15 10 Determinations under the Privacy Act 11 Injunctions under the My Health Records Act 19 12 Injunctions under the Privacy Act 19 13 Civil penalties under the My Health Records Act 20 14 Civil penalties under the Privacy Act 21

Part 1 Preliminary

1 Name of instrument This instrument is the My Health Records (Information Commissioner Enforcement Powers) Guidelines 2016. 2 Commencement 2.1 This instrument takes effect on the day following the day of its registration in the Federal Register of Legislation maintained under section 15A of the Legislation Act 2003. 2.2 The PCEHR (Information Commissioner Enforcement Powers) Guidelines 2013 (Federal Register of Legislative Instruments No. F2013L01085) is repealed when this My Health Records (Information Commissioner Enforcement Powers) Guidelines 2016 commences. Note: Section 33(3) of the Acts Interpretation Act 1901 (Cth) provides that when an Act confers a power to make, grant or issue an instrument of a legislative or administrative character, the power shall be construed as including a power to repeal, rescind, revoke, amend or vary any such instrument. 2.3 From the date of commencement, the Information Commissioner will have regard to this instrument when exercising enforcement powers or investigative powers under both the My Health Records Act and the Privacy Act 1988 (Privacy Act), in relation to the My Health Record system. 3 Definitions 3.1 Unless the contrary intention appears, terms used in these guidelines have the same meaning as in the My Health Records Act. 3.2 In this instrument: agency has the same meaning as in section 6 of the Privacy Act. AIC Act means the Australian Information Commissioner Act 2010. Commissioner initiated investigation is an investigation initiated by the Information Commissioner under subsection 40(2) of the Privacy Act. Court means: (a) the Federal Court of Australia; (b) the Federal Circuit Court of Australia; or (c) a court of a State or Territory that has jurisdiction in relation to matters arising under the My Health Records Act. Information Commissioner means the person appointed as Australian Information Commissioner under subsection 14(1) of the AIC Act, or under subsection 21(1) of that Act. Note: For acting appointments, section 33A of the Acts Interpretation Act 1901 also applies.