69.76 A growing number of Australian children come into contact with formal child care before commencing school. Vacation and before and after school care is also provided by child care services for school aged children. As with schools, child care services collect a large amount of personal information about a child, and his or her family, in order to provide a service.
69.77 A wide range of formal child care services are available, and each has a different structure. They include community-based non-profit services, services administered by local councils, individuals providing care in their own homes, privately owned and managed centres (including some owned by publicly listed companies), and services provided by employers attached to the workplace of parents. Regulation of the sector is shared between the Australian Government and the states and territories.
69.78 The application of privacy laws to the child care sector is confusing. Larger private or non-profit businesses running child care centres are subject to the NPPs, but many smaller centres, most non-profit services and individuals running a service within their own home would fall within the small business exemption to the Privacy Act. Some otherwise exempt small businesses, however, may fall within the definition of a health service provider under the Privacy Act or state health information legislation. Services operated by a state, territory or local council are subject to any relevant state or territory privacy legislation or scheme.
69.79 National standards have been developed for child care services, and have been utilised to inform child care regulations, funding guidelines and information resources. The degree of implementation has varied between jurisdictions. Each set of standards includes a standard on maintenance of records listing the information (most of which would fall within the definition of personal information) that must be kept confidential, although they differ on when that information may be disclosed. Some child care centres have their own privacy policies in place to govern the collection, use and disclosure of personal information.
69.80 For the administration of payments under the Child Care Benefit scheme, child care services are required to transfer information about child attendances to the Department of Education, Employment and Workplace Relations. The information requirements have become more rigorous since the introduction of the Child Care Management System, which is designed to make the industry more accountable. Information held by the Department is subject to the Privacy Act, and staff are also subject to the confidentiality provisions of the A New Tax System (Family Assistance)(Administration) Act 1999 (Cth).
Submissions and consultations
69.81 The Department of Families, Community Services and Indigenous Affairs was previously responsible for the Child Care Management System, and submitted to this Inquiry that the specific privacy and secrecy provisions in family assistance law provide adequate privacy protection for personal information transferred to the Government by child care services. The NCYLC indicated that the application of privacy laws is confusing in the area of child care services, given the variety of services, varying regulatory mechanisms and the possible range of applicable privacy laws. The NCYLC supported a national strategy to review privacy policies and standards in child care services.
69.82 Most of the concerns about the handling of personal information in child care services stem from the broad range of services available, the varying regulatory structures applied to the services, and the resulting confusion about the applicable privacy requirements. The ALRC’s recommendations to achieve nationally consistent information privacy laws across federal, state and territory jurisdictions will help substantially in reducing the confusion by ensuring that consistent privacy principles apply regardless of the regulatory structure in place for the particular child care service. In the absence of more specific concerns about the handling of personal information in child care services, the ALRC does not recommend specific reform in this area.
 In 2005, 53% of three year olds were receiving some form of formal child care. Overall, for children aged 0–11, formal care (either alone or in combination) was used by 23% of children, up from 19% in 2002 and continuing the upward trend observed since 1996: Australian Bureau of Statistics, Child Care, Australia, 2005, 4402.0 (2006).
 Until 2000, child care service providers that received Commonwealth funding had to enter a contract with the Commonwealth and thus provided services under contract to the Commonwealth, attracting the application of the IPPs. Due to a change in funding arrangements, this is no longer the case.
 Note that the ALRC recommends the removal of the small business exemption from the Privacy Act: see Rec 39–1.
 For a discussion of the different privacy regimes that may be applicable to a child care service, see K Flanagan, Privacy in NSW Children’s Services (2002) Community Child Care Co-operative <www.
ccccnsw.org.au/facts> at 10 April 2008.
 See Children’s Services Sub-Committee, Standards for Centre Based Long Day Care (1993) Australian Government Department of Families, Community Services and Indigenous Affairs; Children’s Services Sub-Committee, National Standards for Family Day Care (1995) Australian Government Department of Families, Community Services and Indigenous Affairs; Children’s Services Sub-Committee, National Standards for Outside School Hours Care (1995) Australian Government Department of Families, Community Services and Indigenous Affairs. All of the Standards can be found at <www.facsia.gov.au>. These Standards are currently under review: see Community and Disability Services Ministers’ Conference, A Review of the Approach to Setting National Standards and Assuring the Quality of Care in Australian Childcare Services (2006).
 The Standards for centre-based long day care indicate that records should be kept up-to-date and in a ‘safe and secure area’, that they ‘remain confidential’ and only made available ‘to those who have a genuine interest’ in obtaining the record: Children’s Services Sub-Committee, Standards for Centre Based Long Day Care (1993) Australian Government Department of Families, Community Services and Indigenous Affairs, 5.3.1. The Standards for family day care are similar but only allow that records be made available ‘to those who have a lawful right to them’: Children’s Services Sub-Committee, National Standards for Family Day Care (1995) Australian Government Department of Families, Community Services and Indigenous Affairs, 4.3.1. The Standards for outside of school hours care are silent on the issue of disclosure: Children’s Services Sub-Committee, National Standards for Outside School Hours Care (1995) Australian Government Department of Families, Community Services and Indigenous Affairs, 5.3.2.
 This information was previously provided to the Australian Government Department of Families, Community Services and Indigenous Affairs.
 The National Child Care Management System is being implemented progressively across child care services from 1 July 2007 to 30 June 2009: Australian Government Department of Families‚ Community Services and Indigenous Affairs, Child Care Management System (2007) <www.facsia.gov.au/internet/
facsinternet.nsf/childcare/ccms.htm> at 10 April 2008.
 A policy for the disclosure of protected information relating to child care services was developed by the Department that previously regulated this area and is included each year in the Child Care Service Handbook: Department of Families, Community Services and Indigenous Affairs, Child Care Service Handbook 2006–2007 (2007), App 1.
 Australian Government Department of Families‚ Community Services and Indigenous Affairs, Submission PR 162, 31 January 2007.
 National Children’s and Youth Law Centre, Submission PR 166, 1 February 2007.
 See Ch 3.