National Cancer Screening Register Act 2016 (Cth)

National Cancer Screening Register Act 2016 No. 65, 2016 Compilation No. 4 Compilation date: 31 May 2024 Includes amendments: Act No. 29, 2024 Registered: 3 June 2024 About this compilation This compilation This is a compilation of the National Cancer Screening Register Act 2016 that shows the text of the law as amended and in force on 31 May 2024 (the compilation date). The notes at the end of this compilation (the endnotes) include information about amending laws and the amendment history of provisions of the compiled law. Uncommenced amendments The effect of uncommenced amendments is not shown in the text of the compiled law. Any uncommenced amendments affecting the law are accessible on the Register (www.legislation.gov.au). The details of amendments made up to, but not commenced at, the compilation date are underlined in the endnotes. For more information on any uncommenced amendments, see the Register for the compiled law. Application, saving and transitional provisions for provisions and amendments If the operation of a provision or amendment of the compiled law is affected by an application, saving or transitional provision that is not included in this compilation, details are included in the endnotes. Editorial changes For more information about any editorial changes made in this compilation, see the endnotes. Modifications If the compiled law is modified by another law, the compiled law operates as modified but the modification does not amend the text of the law. Accordingly, this compilation does not show the text of the compiled law as modified. For more information on any modifications, see the Register for the compiled law. Self‑repealing provisions If a provision of the compiled law has been repealed in accordance with a provision of the law, details are included in the endnotes. Contents Part 1—Preliminary 1 Short title 2 Commencement 3 Simplified outline of this Act 4 Definitions 5 Meaning of commercial‑in‑confidence 6 Act binds the Crown 7 Act extends to external Territories Part 2—Register Division 1—Simplified outline of this Part 8 Simplified outline of this Part Division 2—Establishment, contents and purposes 9 Establishment of the register 10 Coverage of the register 11 Contents of the register 12 Purposes of the register Division 3—Notification to the register 13 Requirement to notify Division 4—Requests about the register 14 Requests about participation in the register Division 5—Alternative constitutional bases 15 Alternative constitutional bases Part 3—Dealing with information in the register 16 Simplified outline of this Part 17 Authorised dealings with information 18 Offence relating to protected information 19 Exception for use in good faith 20 Exception if unaware information is commercial‑in‑confidence 21 Exceptions relating to the person to whom the protected information relates 22 Exception for disclosure to person who provided the information 22A Data breaches 22B Contravention is an interference with privacy 22C Information Commissioner may disclose details of investigations to the Secretary Part 4—Other matters 23 Simplified outline of this Part 24 Civil penalty provisions 25 Approved forms 26 Agreements 27 Delegation 28 Rules Endnotes Endnote 1—About the endnotes Endnote 2—Abbreviation key Endnote 3—Legislation history Endnote 4—Amendment history An Act to establish and provide for a cancer screening register, and for related purposes Part 1—Preliminary 1 Short title This Act is the National Cancer Screening Register Act 2016. 2 Commencement (1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms. Commencement information Column 1 Column 2 Column 3 Provisions Commencement Date/Details 1. Sections 1 to 12 and anything in this Act not elsewhere covered by this table The day after this Act receives the Royal Assent. 21 October 2016 2. Section 13 1 May 2017. 1 May 2017 3. Sections 14 to 28 At the same time as the provisions covered by table item 1. 21 October 2016 Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act. (2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act. 3 Simplified outline of this Act This Act establishes a register of information about screening associated with certain types of cancer. The purposes of the register relate to: (a) supporting cancer screening programs; and (b) providing access to information about cancer screening and diagnoses; and (c) cancer screening matters more broadly. There are protections for sensitive information. 4 Definitions In this Act: approved form means a form approved under subsection 25(1). child protection officer means an officer or employee of a State or Territory, or of a State or Territory authority, who has functions, powers or duties in relation to the care, protection or welfare of children. civil penalty provision has the same meaning as in the Regulatory Powers Act. claims information means information about: (a) claims for medicare benefit under Part II of the Health Insurance Act 1973; or (b) treatment, other than information that relates to compensation or benefits, provided under any of the following Acts: (i) the Australian Participants in British Nuclear Tests and British Commonwealth Occupation Force (Treatment) Act 2006; (ii) the Military Rehabilitation and Compensation Act 2004; (iii) the Safety, Rehabilitation and Compensation Act 1988; (iiia) the Treatment Benefits (Special Access) Act 2019; (iv) the Veterans' Entitlements Act 1986. commercial‑in‑confidence has the meaning given by section 5. contracted service provider has the meaning given by subsection 22A(10). designated cancer means one of the following types of cancer: (a) bowel cancer; (b) cervical cancer; (c) lung cancer. enforcement body has the same meaning as in the Privacy Act 1988. entity means: (a) a person; or (b) a partnership; or (c) any other unincorporated association or body; or (d) a trust; or (e) a part of another entity (under a previous application of this definition). healthcare means health service within the meaning of subsection 6(1) of the Privacy Act 1988. healthcare provider means: (a) an individual healthcare provider; or (b) a healthcare provider organisation. healthcare provider organisation means an entity that has conducted, conducts, or will conduct, an enterprise that provides healthcare (including healthcare provided free of charge). Note: Because of paragraph (e) of the definition of entity, a healthcare provider organisation could be part of an entity. individual healthcare provider means an individual who: (a) has provided, provides, or is to provide, healthcare; or (b) is registered by a registration authority as a member of a particular health profession. key information for an individual means the following: (a) the individual's name, address, contact details, date of birth and gender; (b) the individual's healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010) if any; (c) the individual's medicare number (within the meaning of Part VII of the National Health Act 1953) if any; (d) the number allocated to the individual by the Veterans' Affairs Department if any; (e) if applicable, the individual's date of death; (f) if the register includes information relating to the individual in connection with screening associated with cervical cancer: (i) the individual's sex; and (ii) the individual's Human Papillomavirus vaccination status and number of doses of the vaccine administered to the individual; (g) the individual's Indigenous status; (h) the individual's country of origin or cultural identity; (i) the individual's preferred language and whether an interpreter is required to facilitate communication with the individual; (j) the name and contact details of a personal representative of the individual if any; (k) if applicable, information on assistance required by the individual for the purposes of this Act because of a medical condition or disability; (l) any other information of a kind relevant to the purposes of the register and prescribed by the rules for the purposes of this definition. nominated healthcare provider of an individual, for screening associated with a designated cancer, means the healthcare provider the individual requested be recorded for screening associated with the designated cancer in a request in effect under section 14. parent: without limiting who is a parent of anyone for the purposes of this Act, a person is the parent of another person if the other person is a child of the person within the meaning of the Family Law Act 1975. participating State or Territory means a State or Territory that has agreed with the Commonwealth to participate in the register. personal information has the same meaning as in the Privacy Act 1988. personal representative, of an individual, means: (a) a parent or guardian of the individual, if the individual is incapable of managing his or her health affairs; or (b) a trustee of an estate of the individual, if the individual is under a legal disability; or (c) a person who holds an enduring power of attorney granted by the individual; or (d) a person nominated by the individual for the purpose of managing the individual's affairs in relation to screening associated with a designated cancer. professional disciplinary authority means: (a) a registration authority; or (b) the Health Care Complaints Commission established by the Health Care Complaints Act 1993 (NSW); or (c) the Health Ombudsman appointed under the Health Ombudsman Act 2013 (Qld); or (d) any other authority that is responsible for investigating complaints about the professional conduct of individual healthcare providers. protected information means personal information or information that is commercial‑in‑confidence, to the extent that the information is: (a) included in the register or otherwise obtained under, or in accordance with, this Act; or (b) derived from a record of information that was included in the register or was otherwise obtained under, or in accordance with, this Act; or (c) derived from a disclosure or use of information that was included in the register or was otherwise obtained under, or in accordance with, this Act. purposes of the register means the purposes set out in section 12. register means the National Cancer Screening Register established under section 9. registration authority means an entity that is responsible under a law for registering members of a particular health profession. Regulatory Powers Act means the Regulatory Powers (Standard Provisions) Act 2014. rules means the rules made under section 28. screening means a process in which an individual undergoes testing or procedures in order to determine whether the individual has: (a) a designated cancer or a precursor to a designated cancer; or (b) any indicator, including genetic markers or cell abnormalities, that may lead to a designated cancer. screening test means a test or procedure as part of screening. Secretary means the Secretary of the Department. State or Territory authority has the same meaning as in the Privacy Act 1988. Veterans' Affairs Department means the Department administered by the Minister administering the Veterans' Entitlements Act 1986. 5 Meaning of commercial‑in‑confidence Information is commercial‑in‑confidence if a person demonstrates to the Minister that: (a) release of the information would cause competitive detriment to the person; and (b) the information is not in the public domain; and (c) the information is not required to be disclosed under a law of the Commonwealth, or of a State or Territory; and (d) the information is not readily discoverable. 6 Act binds the Crown This Act binds the Crown in each of its capacities. However, it does not make the Crown liable to be prosecuted for an offence. Note: See subsection 24(5) in relation to civil penalties. 7 Act extends to external Territories This Act extends to every external Territory. Part 2—Register Division 1—Simplified outline of this Part 8 Simplified outline of this Part The National Cancer Screening Register is established to keep information about cancer screening and diagnoses associated with particular types of cancer. The purposes of the register relate to: (a) supporting cancer screening programs; and (b) providing access to information about cancer screening and diagnoses; and (c) cancer screening matters more broadly. Certain healthcare providers are required to notify the Commonwealth Chief Medical Officer about certain types of screening test or diagnosis. In most circumstances, this information will be included on the register. Individuals can make a number of requests in relation to the register. For example, an individual can opt out of receiving information from the register. An individual can also request that information notified by healthcare providers relating to the individual not be included in the register. Division 2—Establishment, contents and purposes 9 Establishment of the register (1) The Commonwealth must establish and keep a register to be called the National Cancer Screening Register. (2) Parts of the register may be kept separate from each other, and be called different names. (3) The register is not a legislative instrument. 10 Coverage of the register (1) The register may include information relating to individuals in connection with screening associated with bowel cancer. (2) The register may include information relating to individuals in connection with screening associated with cervical cancer. (3) The register may include information relating to individuals in connection with screening associated with lung cancer. 11 Contents of the register The register may include the following for each individual: (a) the individual's key information; (b) details of the individual's nominated healthcare provider for screening associated with a designated cancer, if any, including the healthcare provider's healthcare identifier (within the meaning of the Healthcare Identifiers Act 2010); (c) information about screening tests undergone or to be undergone by the individual; (d) if the individual is diagnosed with a designated cancer or a precursor to a designated cancer, that diagnosis; (e) claims information which may indicate whether or not the individual has undergone or should undergo screening associated with a designated cancer; (f) details of any request or withdrawal made by the individual under section 14; (g) any other information relevant to the purposes of the register and prescribed by the rules. 12 Purposes of the register (1) The purposes of the register are to facilitate the following: (a) establishing and keeping an electronic database of records relating to screening and diagnoses associated with the designated cancers; (b) collecting, analysing and publishing statistics and other information relating to screening and diagnoses associated with the designated cancers; (c) monitoring the effectiveness, quality and safety of screening and diagnoses associated with the designated cancers; (d) providing an individual with an invitation to undergo screening; (e) providing an individual with a test kit for screening; (f) advising an individual when the individual is due to undergo a screening test or when action may need to be taken after a screening test; (g) advising an individual's nominated healthcare provider for screening associated with a designated cancer (if any) when the individual is due to undergo, or when action may need to be taken after, a screening test associated with the designated cancer; (h) advising a participating State or Territory when action may need to be taken after a screening test for an individual residing in the State or Territory; (i) providing an individual access to information relating to the individual about screening and diagnoses associated with a designated cancer; (j) providing healthcare providers access to information about screening and diagnoses associated with a designated cancer in relation to an individual, for the purposes of providing healthcare to the individual in relation to the designated cancer; (k) providing a participating State or Territory with access to information relating to individuals residing in the State or Territory in connection with screening and diagnoses associated with the designated cancers; (l) planning, delivering and promoting healthcare and services in relation to the designated cancers; (m) reporting to international organisations in relation to the designated cancers; (n) research relating to healthcare, screening or a designated cancer. (2) For an individual who has a personal representative: (a) paragraphs (1)(d) and (e) also apply to providing the representative with an invitation or test kit for the individual; and (b) paragraph (1)(f) also applies to advising the representative; and (c) paragraph (1)(i) also applies to providing the representative access to information relating to the individual. Division 3—Notification to the register 13 Requirement to notify (1) The individual healthcare provider prescribed by the rules for a type of screening test or diagnosis prescribed by the rules must notify the Commonwealth Chief Medical Officer in the approved form, by the time prescribed by the rules, of the information prescribed by the rules for the type of screening test or diagnosis. (2) A person is liable to a civil penalty if the person contravenes subsection (1). Civil penalty: 30 penalty units. Division 4—Requests about the register 14 Requests about participation in the register (1) An individual may, in the approved form, make any of the following requests: (a) that a particular healthcare provider be recorded as the individual's nominated healthcare provider for screening associated with a designated cancer; (b) that the individual not be given, at all or for a period of time, by (or on behalf of) the Commonwealth: (i) any invitation of a kind referred to in paragraph 12(1)(d) or test kit referred to in paragraph 12(1)(e) in relation to screening associated with a designated cancer; or (ii) any advice of a kind referred to in paragraph 12(1)(f) in relation to screening associated with a designated cancer; (c) that information relating to the individual that is: (i) about a designated cancer; and (ii) notified under section 13 after the date of the request; not be included in the register; (d) that a date by which the register indicates the individual is due to undergo a screening test associated with cervical cancer be changed; (e) that the register use a pseudonym for the individual. (2) An individual may, in the approved form, withdraw any request made under subsection (1). (3) The Commonwealth must give effect to a request or withdrawal under this section as soon as practicable. (4) A personal representative of the individual may make or withdraw a request under this section on behalf of the individual. Division 5—Alternative constitutional bases 15 Alternative constitutional bases (1) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to matters relating to: (a) the provision of pharmaceutical and sickness benefits; or (b) the provision of medical services (without any form of civil conscription); or (c) census and statistics; or (d) postal, telegraphic, telephonic and other like services; or (e) external affairs, including: (i) giving effect to the International Covenant on Economic, Social and Cultural Rights done at New York on 16 December 1966, in particular Article 12, or to another international agreement to which Australia is a party; or (ii) addressing matters of international concern; or (f) a Territory or a Commonwealth place (within the meaning of the Commonwealth Places (Application of Laws) Act 1970); or (g) the implied power of the Parliament to make laws with respect to nationhood; or (h) the executive power of the Commonwealth; or (i) matters incidental to the execution of any of the legislative powers of the Parliament or the executive power of the Commonwealth. Note: The International Covenant on Economic, Social and Cultural Rights is in Australian Treaty Series 1976 No. 5 ([1976] ATS 5) and could in 2016 be viewed in the Australian Treaties Library on the AustLII website (http://www.austlii.edu.au). (2) Without limiting its effect apart from this subsection, this Act also has the effect it would have if its operation were expressly confined to acts or omissions of corporations to which paragraph 51(xx) of the Constitution applies. (3) A term used in this section and the Constitution has the same meaning in this section as it has in the Constitution. Part 3—Dealing with information in the register 16 Simplified outline of this Part Information can be collected for inclusion in the register. Personal information included in the register, or derived from information included in the register, is "protected information". Section 18 makes it an offence for a person to record, disclose or use protected information without authorisation. Recording, disclosure and use of protected information is authorised in specific circumstances, including for the purposes of the register and by healthcare providers and States and Territories. There are also a number of exceptions to the offence. 17 Authorised dealings with information Uploading personal information etc. to the register (1) A person may collect, make a record of, disclose or otherwise use: (a) personal information; or (b) key information for an individual; or (c) information that is commercial‑in‑confidence; if the person does so for the purposes of including information in the register. Note: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles. (2) Subsection (1) does not apply to information notified under section 13 to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14. Using or disclosing information in the register (3) A person may collect, make a record of, disclose or otherwise use protected information, or key information included in the register, if: (a) the person does so for the purposes of the register and is: (i) an officer or employee of the Commonwealth or of an authority of the Commonwealth; or (ii) engaged by the Commonwealth, or by an authority of the Commonwealth, to perform work relating to the purposes of the register; or (iii) an officer or employee of a person referred to in subparagraph (ii), or engaged by a person referred to in subparagraph (ii) to perform work relating to the purposes of the register; or (b) all of the following apply: (i) the person is a healthcare provider; (ii) the information is about screening or diagnosis associated with a designated cancer in relation to an individual; (iii) the collection, recording, disclosure or use is for the purposes of providing healthcare to the individual in relation to the designated cancer; or (c) the collection, recording, disclosure or use is required or permitted by the law of a participating State or Territory, and the person is: (i) a State or Territory authority of the participating State or Territory; or (ii) an officer or employee of the participating State or Territory, or of a State or Territory authority of the participating State or Territory; or (iii) engaged by the participating State or Territory, or by a State or Territory authority of the participating State or Territory, to perform work relating to the information; or (iv) an officer or employee of a person referred to in subparagraph (iii), or engaged by a person referred to in subparagraph (iii) to perform work relating to the information; or (d) the person does so for the purposes of performing the person's functions, or exercising the person's powers, under this Act; or (e) the person is required or authorised to do so by or under a law of the Commonwealth or of a State or Territory; or (f) the information is disclosed to the person under this section and the collection, recording, disclosure or use is for the purposes for which the information was disclosed to the person; or (g) all of the following apply: (i) the person is the Secretary; (ii) the collection, recording, disclosure or use is for the purposes of disclosing information to a professional disciplinary authority, a child protection officer or an enforcement body; (iii) the person reasonably believes that the information will enable or assist the authority, officer or body to perform or exercise any of the authority's, officer's or body's functions or powers; or (h) the person does so for the purposes of court or tribunal proceedings, or in accordance with an order of a court or tribunal; or (i) the person does so for the purposes of a coronial inquiry, or in accordance with an order of a coroner. Note 1: This subsection is an authorisation for the purposes of other laws, including the Australian Privacy Principles. Note 2: For paragraph (c), collection, recording, disclosure or use by a listed representative of a participating State or Territory is authorised under this subsection if the law of the State or Territory does not prevent the collection, recording, disclosure or use. (4) Subsection (3) does not apply to protected information or key information to the extent that collection, recording, disclosure or use under the subsection would be contrary to a request in effect under section 14. (5) Collection, recording, disclosure or use of personal information for the purposes of research of a kind to which guidelines approved under section 95 or 95A of the Privacy Act 1988 relate is authorised under paragraph (3)(a) or (f) only if the collection, recording, use or disclosure is in accordance with the guidelines. 18 Offence relating to protected information A person commits an offence if: (a) the person makes a record of, discloses or otherwise uses information; and (b) the information is protected information; and (c) the making of the record, or the disclosure or use, is not authorised by section 17. Penalty: Imprisonment for 2 years or 120 penalty units, or both. 19 Exception for use in good faith Section 18 does not apply to a person to the extent that the person makes a record of, discloses or otherwise uses protected information in good faith and in purported compliance with section 17. Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code). 20 Exception if unaware information is commercial‑in‑confidence Section 18 does not apply to a person if: (a) the person makes a record of, discloses or otherwise uses information; and (b) the information is commercial‑in‑confidence; and (c) the person does not know that the information is commercial‑in‑confidence. Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code). 21 Exceptions relating to the person to whom the protected information relates (1) Section 18 does not apply to a person if: (a) the person discloses protected information to the person to whom the information relates; or (b) the person is the person to whom the protected information relates; or (c) the making of the record, or the disclosure or use, of the protected information is in accordance with the express or implied consent of the person to whom the information relates. Note: A defendant bears an evidential burden in relation to the matters in this subsection (see subsection 13.3(3) of the Criminal Code). (2) Subsection (1) applies as if a reference in that subsection to the person to whom the protected information relates includes a reference to the person's personal representative. 22 Exception for disclosure to person who provided the information Section 18 does not apply to a person if: (a) the person obtains protected information from another person; and (b) the person discloses that information to the other person. Note: A defendant bears an evidential burden in relation to the matters in this section (see subsection 13.3(3) of the Criminal Code). 22A Data breaches Notification of contraventions and possible contraventions (1) If the Secretary becomes aware (otherwise than because of a notice under subsection (2)) that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary must, as soon as practicable, notify the Information Commissioner. Note: This subsection applies when the Secretary becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing. (2) If a contracted service provider or a former contracted service provider becomes aware that a person has, or may have, contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the contracted service provider or former contracted service provider must, as soon as practicable, notify: (a) the Secretary; and (b) the Information Commissioner. Note: This subsection applies when the contracted service provider or former contracted service provider becomes aware of the contravention or possible contravention, regardless of when it occurred or whether it is ongoing. Civil penalty: 100 penalty units. (3) A notice given under subsection (1) or (2) must set out the following: (a) a description of the contravention that has occurred or may have occurred; (b) the kind or kinds of information concerned; (c) if the notice is given under subsection (2)—the identity and contact details of the contracted service provider or former contracted service provider. Handling possible contraventions (4) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person may have contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included in the register, the Secretary, or the contracted service provider or former contracted service provider, must do the following: (a) so far as is reasonably practicable, contain the possible contravention; (b) evaluate any risks that, if the contravention has occurred, may be related to or arise out of the contravention; (c) if there is a reasonable likelihood that the contravention has occurred and the effects of the contravention might be serious for at least one individual whose details are included in the register: (i) in the case of the Secretary—consult the Information Commissioner about notifying individuals who may be affected; or (ii) in the case of a contracted service provider or former contracted service provider—ask the Secretary to consult the Information Commissioner about notifying individuals who may be affected. Note: This subsection applies when the Secretary, contracted service provider or former contracted service provider becomes aware of the possible contravention, regardless of when it occurred or whether it is ongoing. Handling contraventions (5) If the Secretary, or a contracted service provider or former contracted service provider, becomes aware that a person has contravened section 18 in a manner involving an unauthorised recording, use or disclosure of personal information included