The Power Clause: How Section 70 Changes Everything
Most Australians will never read a piece of federal legislation word for word, but sometimes a single clause can quietly change how government works.
In the Australian Centre for Disease Control Act 2025, that clause is Section 70.
It reads:
“An authorisation or direction under this Act has effect despite any other law of the Commonwealth, a State or a Territory.”
(Section 70, Australian Centre for Disease Control Act 2025, Bill as introduced)
Those twelve words give the new Australian Centre for Disease Control (ACDC) the ability to override existing laws, including long-standing privacy and confidentiality rules.
What that means in practice
Under Section 44, the Director-General of the ACDC can “request or require” information from Commonwealth bodies, States, Territories or “any other person” for the purpose of performing the Centre’s functions.
When that power is combined with Section 70, it means that these requests or directions take precedence over other legislation, including:
The Privacy Act 1988 (Cth), which normally restricts the disclosure of “personal information” without consent (Australian Privacy Principle 6);
State and Territory health-privacy statutes, such as the Health Records Act 2001 (Vic) or Health Records (Privacy and Access) Act 1997 (ACT); and
Common-law duties of confidentiality between patients and health professionals.
In plain language, if the ACDC issues a valid direction under this Act, the recipient is legally obliged to comply, even if another law would ordinarily forbid it.
Why Section 70 is unusual
“Despite” clauses are not unheard of in Australian legislation, but they are typically reserved for narrow, time-limited emergency powers or specific national-security contexts.
By contrast, the CDC Act creates an ongoing authority that can invoke Section 70 at any time, for any function within its scope, including:
Health surveillance and data collection,
Disease prevention programs, and
Agreements with other governments or international bodies (see Section 13).
Once an authorisation is made under Section 70, the law does not require the Director-General to publish it, and Parliament has no disallowance mechanism to review or revoke it.
This is a departure from the norm. In most federal legislation, broad executive powers are paired with parliamentary oversight, either through tabling requirements or sunset clauses. Section 70 stands alone.
Implications for privacy and consent
Under the Privacy Act 1988, agencies must collect and disclose personal information only where it is “reasonably necessary” and with appropriate safeguards.
Section 70 cuts through that safeguard by stating that, in the event of a conflict, the CDC’s authorisation prevails.
The explanatory memorandum for the Bill states that this is designed to ensure “rapid information sharing in the national interest”. However, no thresholds are specified for when this power can be triggered, and there are no explicit criteria for assessing what counts as “necessary”.
The effect is that the balance of decision-making shifts from Parliament to the Director-General — from law to discretion.
What about emergencies?
Sections 67 to 69 already allow for data-sharing declarations during a “severe or unforeseen threat to public health”. Those declarations run for up to twelve months and cannot be disallowed by Parliament.
Given those existing powers, the addition of Section 70 — which applies even outside emergencies — appears redundant from a public-health standpoint but powerful from a bureaucratic one.
Why it matters
Transparency and privacy are not abstract principles. They are what make Australians confident enough to engage with public institutions.
When a new federal agency is given authority that overrides every other law in the country, the public has a right to ask who checks that power, and how.
The CDC Act contains no dedicated oversight body, no real-time reporting requirement, and no independent review until five years after commencement.
That leaves Section 70 as more than a technical clause. It becomes the foundation of a new legal hierarchy — one where health authority outranks privacy law.
The path forward
There is still time to install safeguards before the Act begins on 1 January 2026.
Stand Up Now Australia is calling for:
A standing parliamentary oversight committee for the CDC;
Tabling and potential disallowance of any data-sharing declarations or directions issued under Section 70; and
Clear rules confirming that the Privacy Act continues to apply to identifiable personal data.
Australia can have effective public health coordination without compromising accountability.
What we need is a safety switch — not a blank cheque.
References
Australian Centre for Disease Control Bill 2025 (Cth), Sections 13, 44, 67–70.
Privacy Act 1988 (Cth), Australian Privacy Principles 3 and 6.
Legislation Act 2003 (Cth), Part 2, Division 2 (disallowance provisions).
Explanatory Memorandum, Australian Centre for Disease Control Bill 2025, House of Representatives, 2025.