A new Australian Centre for Disease Control will begin operation in 2026, centralising public-health power at the federal level with limited mechanisms for parliamentary oversight or public accountability.

The Australian Centre for Disease Control Act 2025 establishes a new statutory authority inside the Department of Health and Aged Care. It is presented as a coordinating body for pandemic response and “health protection”.

Behind that language sits something entirely new: a permanent federal bureaucracy with sweeping powers to collect, share and control health data, to partner with foreign bodies, and to override other laws without parliamentary oversight.

The Australian Centre for Disease Control goes far beyond coordinating outbreaks. It represents a major shift in how public health decisions and data are managed in Australia.

What’s being created and why it matters

What the legislation actually allows

    • Section 44 authorises the Director-General to “request or require” data from Commonwealth, State, or private entities.

    • Section 70 makes those authorisations apply “despite any other law of the Commonwealth, a State or a Territory”.

    • That means the Privacy Act 1988, State health-privacy acts, and hospital confidentiality agreements can all be set aside.

    Once issued, these directions are binding and there is no mechanism for citizens to challenge or refuse disclosure of their personal health information.

    • Sections 67 to 69 allow the Director-General to issue data-sharing declarations during a “public-health threat”.

    • These can run for up to twelve months and can be renewed indefinitely.

    • They are not subject to disallowance under the Legislation Act 2003, which means Parliament cannot overturn them.

    In plain English, the CDC can declare a “threat”, access data nationally, and Parliament cannot stop it.

    • Sections 10–16 give the Minister power to appoint the Director-General, approve the corporate plan, and issue directions, but those directions do not have to be tabled in Parliament.

    • Section 26 requires only an annual report under the PGPA Act, after decisions are made.

    • Section 78 calls for a five-year review at the Minister’s discretion.

    Oversight exists on paper but not in real time, and not through the people’s representatives.

    • Section 13(3) allows the CDC to enter agreements with foreign governments or international organisations.

    • Section 24 requires a register of agreements but permits the Minister to withhold information if disclosure could “damage international relations” or “public confidence”.

    International health partnerships can therefore be struck behind closed doors, with key details kept secret.

What we are asking for

Before the Act begins on 1 January 2026, we call on Minister Mark Butler to:

  1. Establish a standing Parliamentary Oversight Committee for the CDC.

  2. Table and review all data-sharing declarations and international agreements.

  3. Guarantee Australians’ right to privacy and consent under the Privacy Act 1988 and all health-record legislation.

Public health should protect people, not bypass them.

Power Lines: Reading Between the Clauses

FAQs

What is actually changing on 1 January 2026?

The Australian Centre for Disease Control Act 2025 will begin. From that date Australia will have a permanent federal CDC, led by a Director-General who is appointed by the Health Minister. This body will have its own legal powers to request or require health information from Commonwealth agencies, States, health services and some private entities. It will also be able to authorise how that information is shared. That is a step up from the temporary, cooperative model we saw through COVID, because this one is ongoing and set out in legislation.

Can the ACDC really override other laws?

In many cases, yes. Section 70 of the Bill says that authorisations and directions under the CDC Act have effect “despite any other law of the Commonwealth, a State or a Territory”. That wording matters. It means that if the CDC issues a lawful direction to get information, normal privacy settings, State health-record protections or confidentiality rules can be pushed aside. Only a small group of secrecy laws remain out of reach. This is one of the most significant parts of the Bill because it shifts the usual order of things. Instead of privacy being the default and public health asking permission, public health can act first and privacy follows.

What are “data-sharing declarations” and why are they a problem?

Sections 67 to 69 allow the Director-General to issue a data-sharing declaration if there is a “severe or unforeseen threat to public health”. Once that declaration is made, information can be collected and shared for up to 12 months to deal with that threat. The problem is not that emergencies can be managed. The problem is that these declarations are not disallowable by Parliament. In other words, once the Director-General turns this on, the people you elected in Canberra cannot vote it down. That is a structural gap in democratic oversight. It also creates a strong incentive to define situations as “threats” in order to unlock the wider data powers.

Can the CDC make deals with overseas or global bodies without Parliament?

Yes. Section 13(3) allows the CDC to enter arrangements with foreign governments, international organisations, and international public–private partnerships. Section 24 says there must be a register of those arrangements, which sounds transparent at first. However, it also allows the Minister to withhold information from that register if publishing it would harm international relations or public confidence, or if the information was provided confidentially. That means Australians could find out that an arrangement exists, but not see what was agreed. This is a real concern in a context where the same CDC can also move health data around.

Where is Parliament in all this? Isn’t there oversight already?

Parliament is present in a light-touch way. The CDC will produce annual reports, it will be subject to the PGPA Act, and it can be questioned at Estimates. There is also a five-year review clause. What is missing is real-time parliamentary control over the most powerful parts of the Act. Parliament cannot disallow data-sharing declarations. Parliament does not have to approve international arrangements. Ministerial directions to the CDC do not have to be tabled. That is why we are calling for a standing parliamentary oversight committee and for tabling and disallowance of the most intrusive powers.

Can individuals still “opt out” like they can with some health registers?

People should still use every opt-out, privacy and “no secondary use” option available to them. Those tools still matter in day-to-day health administration. However, under this Act, if the CDC validly issues a direction under sections 44–46 and that direction is supported by section 70, personal opt-out settings can be overridden. In simple terms, individual protections remain useful in normal conditions, but they are not a hard shield once the CDC has used its statutory powers. That is why the real fix has to come at the level of Parliament, not just at the level of patients and families.



Could this be used for things other than disease?

Yes. The Bill’s definition of public health and health protection is wide. It can include environmental health, climate-related health impacts, and preventive health. That means the CDC could justify information collection for programs that are not about an outbreak, for example, to monitor compliance, to model population behaviour or to assess uptake of a national health measure. Once the system is in place, it can be used for more than people first imagined. This is a classic “mission creep” risk, which is why earlier and stronger oversight is important.

So what is the actual risk to ordinary Australians?

The biggest risk is loss of control over who sees your health information and for what purpose. A second risk is that Australia normalises executive-led, not Parliament-led, health governance. A third risk is that international bodies gain influence over Australian public-health settings without public debate. None of these things happen loudly. They happen through rules, registers and directions that most people never see. Once normalised, they are very hard to wind back.