Financial Sector (Shareholdings) (Resolution Life) Instrument 2021

I, Josh Frydenberg, Treasurer, make the following instrument.

Dated   24 September 2021

Josh Frydenberg

Treasurer

Contents

Part 1—Preliminary

1  Name 

2  Commencement

3  Authority

4  Schedules

5  Definitions

Part 2—Approvals to exceed 20% shareholding limit

6  Approvals of applications

7  Conditions on approvals

Schedule 1—Repeals

Notice of Approval under the Financial Sector (Shareholdings) Act 1998
(made on 22 June 2020) [C2020G00603]

Part 1—Preliminary

1  Name

  This instrument is the Financial Sector (Shareholdings) (Resolution Life) Instrument 2021.

2  Commencement

 (1) Each provision of this instrument specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Note: This table relates only to the provisions of this instrument as originally made. It will not be amended to deal with any later amendments of this instrument.

 (2) Any information in column 3 of the table is not part of this instrument. Information may be inserted in this column, or information in it may be edited, in any published version of this instrument.

3  Authority

  This instrument is made under the Financial Sector (Shareholdings) Act 1998.

4  Schedules

  Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

5  Definitions

Note: Paragraph 13(1)(b) of the Legislation Act 2003 has the effect that expressions have the same meaning in this instrument as in the Financial Sector (Shareholdings) Act 1998 as in force from time to time.

  In this instrument:

ABN has the meaning given by the A New Tax System (Australian Business Number) Act 1999.

accounting standards has the meaning given by the Corporations Act 2001.

ACSC mean the Australian Cyber Security Centre.

auditing standards has the meaning given by the Corporations Act 2001.

Australian law has the meaning given by the Income Tax Assessment Act 1997.

Australian policy holder means a person who ordinarily resides in Australia and who holds an insurance policy that is governed by Australian law.

control has the same meaning it has in section 50AA of the Corporations Act 2001.

entity has the same meaning it has in section 64A of the Corporations Act 2001.

entity connected with a corporation has the same meaning it has in section 64B of the Corporations Act 2001.

hold, in relation to personal information, has the meaning given by the Privacy Act 1988.

personal information has the meaning given by the Privacy Act 1988.

the Act means the Financial Sector (Shareholdings) Act 1998.

the Treasury means the Department of the Treasury.

Part 2—Approvals to exceed 20% shareholding limit

6  Approvals of applications

 (1) Under paragraph 14(1)(a) of the Act, each applicant covered by subsection (2) is granted approval:

 (a) to hold more than a 20% stake in a financial sector company covered by subsection (3); and

 (b) to hold no more of the stake specified in the financial sector company as is specified in subsection (3).

 (2) For the purposes of subsection (1), an applicant is covered by this subsection if the applicant is listed in an item of the following table:

 (3) For the purposes of subsection (1), a financial sector company is covered by this subsection if the company is listed in an item of the following table:

 (4) To avoid doubt, subsection (1) does not have the effect of granting an applicant approval to hold any stake in itself.

 (5) The approvals granted under subsection (1) remain in force until repealed or otherwise revoked.

7  Conditions on approvals

 (1) Under section 16 of the Act, an approval granted under subsection 6(1) is subject to each of the conditions set out in this section.

Condition 1:  information storage

 (2) Each of the applicants covered by items 1, 2, 5 and 8 of the table in subsection 6(2) (the applicants) must use their best endeavours to ensure any personal information relating to a previous, current or prospective Australian policy holder of a financial sector company covered by subsection 6(3) (a covered financial sector company) or a subsidiary of a covered financial sector company, and held or collected by that company or subsidiary, is stored only in Australia, and is accessible only from within Australia, except where:

 (a) the information is stored or accessed outside of Australia by a reinsurer in connection with a reinsurance arrangement with a covered financial sector company; or

 (b) the information is accessed outside of Australia in connection with the provision of services to a covered financial sector company (or a subsidiary of a covered financial sector company), and that information is only accessible using desktop virtualisation technology which complies with the Centre for Internet Security’s Level 1 Controls and Benchmarks and the ACSC’s Essential Eight Maturity Model (or any successor or replacement standards) and all of the following apply:

 (i) the desktop virtualisation environment employs controls to prevent the information from being sent outside of the environment (including network segregation, environment‑wide authentication and authorisation, and restrictions for email and internet access) (which comply with the ACSC’s Secure Administration Guidelines (or any successor or replacement standard); and

 (ii) if the desktop virtualisation environment processes the information outside of Australia—the locations at which the information is being processed employ physical security controls to prevent the information from being sent out of the environment, which comply with the ACSC’s Guidelines for Physical Security (or any successor or replacement standard); and

 (iii) user activity in such desktop virtualisation environments, and any connected systems, are routinely reviewed and monitored; or

 (c) the information is required to be accessed outside of Australia to comply with an Australian law; or

 (d) the information relates to a policy holder who has required or expressly, or by necessary implication, permitted the information to be stored or accessed outside of Australia.

Condition 2:  Information use, access and disclosure, and notification of data breaches

 (3) Each of the applicants must use their best endeavours to ensure that all of the following are satisfied at all times:

 (a) any personal information relating to a previous, current or prospective Australian policy holder of a covered financial sector company (or a subsidiary of a covered financial sector company), and held or collected by that company or subsidiary, is not accessed, used or disclosed by any of the following entities:

 (i) the directors, executive managers, employees, agents and representatives (including the agents or representatives of each of these entities) of each applicant;

 (ii) each entity (other than a covered financial sector company or a subsidiary of a covered financial sector company) that:

 (A) is controlled by an applicant; or

 (B) controls an applicant; or

 (C) is controlled by an entity that controls an applicant;

 (iii) the limited partners of the entity covered by item 6 of the table in subsection 6(2);

 (iv) the directors, executive managers, employees, agents and representatives of each limited partner covered by subparagraph (iii);

 (v) the representatives of each applicant on the board of directors of a covered financial sector company or a subsidiary of a covered financial sector company;

  except where:

 (vi) such access, use or disclosure is required to discharge a duty as a director or executive manager under an Australian law; or

 (vii) such access, use or disclosure is required to comply with an Australian law; or

 (viii) such access, use or disclosure is necessary to deliver a covered financial sector company’s (or a subsidiary of a covered financial sector company’s) ordinary business services; or

 (ix) in relation to personal information of a particular policy holder—such access, use or disclosure has been authorised by the policy holder;

 (b) in relation to each 12-month period starting on 1 July 2021:

 (i) each applicant certifies, in writing, that they have satisfied paragraph (a); and

 (ii) and each director of the board of each applicant, certifies in writing that the director has not accessed, used or disclosed the personal information relating to Australian policy holders except as permitted in paragraph (a); and

 (iii) each applicant nominate an officer of the applicant to collect all the written certifications relating to that entity and forward them to the Treasury by email to FSSA‑IATA@treasury.gov.au, within 30 days from end of the 12‑month period; and

 (c) if an applicant becomes aware that the applicant, or an entity that the applicant controls, is required to give notice to the Australian Information Commissioner of an eligible data breach under the Privacy Act 1988, the applicant must provide a report about the breach (including identity of the entity involved, a description of the breach, kinds of information concerned and dates on which the breach occurred) to the Treasury, by email to FSSA‑IATA@treasury.gov.au, within 10 days of becoming so aware; and

 (d) each applicant has all reasonable mechanisms in place to ensure that the applicant is alerted to all eligible data breaches of a covered financial sector company (or a subsidiary of a covered financial sector company) within 14 days of the company or subsidiary becoming aware of the breach; and

 (e) in the event that there is unauthorised access to, or loss of, the personal information relating to the Australian policy holders, or systems which hold such data, the policy holders whose data was accessed or lost are notified, in writing, within 14 days of a covered financial sector company (or a subsidiary of a covered financial sector company) becoming aware of the unauthorised access or loss.

Condition 3: Notification of acquisitions

 (4) Each of the applicants must notify the Treasury of each acquisition that the applicant has made and that is approved under this instrument, by email to FSSA‑IATA@treasury.gov.au, within 30 days of the acquisition happening.

Condition 4:  Independent audit reporting

 (5) Each of the applicants must, by no later than 3 months after end of each of the applicant’s financial reporting years, give a written report to the Treasury, by email to FSSA‑IATA@treasury.gov.au, on the applicant’s compliance with the conditions in subsections (2), (3) and (4), in relation to the reporting year.

 (6) A report under subsection (5) must satisfy the following requirements:

 (a) be prepared in accordance with the accounting standards and auditing standards; and

 (b) be prepared by one or more auditors that each satisfy the auditor independence requirements set out in Part 2M.4 of the Corporations Act 2001;

 (c) be informed, where appropriate, by relevant experts who are both independent and impartial; and

 (d) set out the identity of the auditors and experts (including any individuals involved if the auditor or expert is not an individual), the scope of the audit work undertaken, and the level of assurance to be provided by the report; and

 (e) any other matter advised by the Treasury, in writing to an applicant, prior to the end of a reporting period.

 (7) Each of the applicants must satisfy all of the following in relation to a report under subsection (5):

 (a) no less than 60 days before the end of a reporting period, seek and obtain the Treasury’s agreement to the auditors, experts and related individuals to be engaged in preparing the report; and

 (b) no less than 60 days before the end of a reporting period, seek and obtain the Treasury’s agreement to the scope of the audit work to be undertaken and the level assurance to be provided by the auditor and experts; and

 (c) authorise the auditors and experts to consult with, and accept instructions directly from, the Treasury, in relation to the report, prior to the any audit work starting; and

 (d) authorise the auditors and experts to provide answers to inquiries from the Treasury on the content of the report or to give the Treasury access to any data or analysis underlying statements in the report; and

 (e) consent to, or arrange another party to consent to, reasonable access to premises and system by officials from the Treasury for the purposes of reviewing, confirming or responding to a report; and

 (f) if a report identifies non‑compliance with a condition—the relevant applicant or applicants must prepare a draft and detailed work program for achieving compliance (including specified actions to be taken within specified time) and give that plan to the Treasury, in writing by email to FSSA‑IATA@treasury.gov.au, within 3 months of the report being completed; and

 (g) if a plan mentioned in paragraph (f) is approved, action the plan according to its terms; and

 (h) if a plan mentioned in paragraph (f) is not approved, resubmit another draft plan within a further 3 months, properly responding to any comments received from the Treasury.

 (8) Where the applicants are required to each notify or each give a report to the Treasury under a condition in this section, one or more of the applicants (the group) may arrange for a chosen entity, to notify or report, as the case requires, on behalf of all members of the group. A notification or report given to the Treasury by the chosen entity is taken, for the purposes of the conditions, to have been given by each member of the group.

Application

 (9) This section (other than subsection (2)) applies on or after the commencement of this instrument. Subsection (2) applies from 30 June 2022.

Schedule 1—Repeals

Notice of Approval under the Financial Sector (Shareholdings) Act 1998 (made on 22 June 2020) [C2020G00603]

1  The whole of the instrument

Repeal the instrument.