The Telecommunications (Interception and Access) Amendment (Data Retention) Act 2015 (Cth) is an amending Act of the Parliament of Australia that adds to the Telecommunications (Interception and Access) Act 1979 (the Principal Act) to introduce a statutory obligation for Australian service providers to retain, for at least a period of two years, particular types of telecommunications data.
The Act was passed with bipartisan support in April 2015, and was the third tranche of national security legislation passed by the Australian Parliament since September 2014.
The data retention obligation included the following types of data: - subscriber information - the date, time and duration of a phone call; - the location of the device from which a call was made - the IP address of the device from which a webpage was searched - the unique identifier number assigned to a particular mobile phone of the phones involved in each particular phone call; - the email address from which an email is sent - if it is an email managed by the service provider; - the time, date and recipients of emails the size of any attachment sent with emails and their file formats - if it is an email managed by the service provider; - account details held by the internet service provider (ISP) such as whether or not the account is active.
Agencies including the Australian Security Intelligence Organisation (ASIO), state police forces, Australian Crime Commission, Australian Taxation Office and NSW Independent Commission Against Corruption (ICAC) are authorised to request service providers to provide access to communications data (without a warrant).
A warrant is required if agencies are seeking access to communications data generated by journalists, as defined in the legislation. In this context, agencies need to seek a warrant before a judicial officer before they are able to request access to journalists' data. ASIO needs to seek permission of the Attorney-General to request access to journalists' data.
The Abbott government's decision to introduce a mandatory telecommunications data regime led to considerable community debate.
Mandatory data retention was supported by law enforcement and national security agencies, including the Australian Federal Police and ASIO, who argued telecommunications data is critical to criminal investigations and that it is only through legislation that they can be assured that it will be available. The decision was opposed by a wide range of groups and individuals including journalists, human rights organisations and civil liberties groups. Their objections were made on a number of grounds, such as the consequences for journalism and journalistic practice, the non-proportionate and increasing encroachment of the privacy of Australia's population, and the effectiveness of the regime as a tool to combat crime.
Questions over its cost and the consequences for the telecommunications industry, in particular small to medium-sized providers, have also been raised as arguments against mandatory data retention. TSPs and ISPs were given an 18-month grace period to improve their systems and establish processes to comply with the legislation. Telstra has indicated it will store data it retains within Australia, but other TSPs and ISPs are not obligated to do so under the law.
Background Access to telecommunications data Under the previous regime set down under the Telecommunications (Interception and Access) Act 1979 (the original Act), ‘enforcement agencies’ and ASIO could access telecommunications data through issuing an internal, or intra-organisation, authorisation.
During the 2012-2013 inquiry into Australia's national security legislation conducted by the PJCIS, the Attorney General's Department issued a document detailing what it considered to be telecommunications data. This included "information that allowed a communication to occur", such as the date, time and duration of the communication, the devices involved in the communication, and the location of those devices such as mobile phone tower, and "information about the parties to the communication", such as their names and addresses.
Section 5 of the Act defined an enforcement agency to include the Australian Federal Police (AFP), the police force of a State or Territory, the Australian Customs and Border Protection Service, crime commissions, anti-corruption bodies and the CrimTrac Agency. The definition also included an allowance enabling organisations whose remit either involves the administration of law involving a financial penalty or the administration of a law to protect taxation revenue to access telecommunications data.
The head of an enforcement agency, the deputy head of an agency, or a management level officer or employee of an agency, given permission in writing by the head of the agency, had the power to authorise access to telecommunications data. For ASIO, authorisations for access to telecommunications data could only be made when the individual making the authorisation was "satisfied that the disclosure would be in connection with the performance by the Organisation of its functions". ASIO also had to comply with guidelines issued under Section 8A of the Australian Security Intelligence Organisation Act 1979. These guidelines demanded that the initiation and continuation of investigations only be authorised by the Director-General, or an officer at or above Executive Level 2 authorised by the Director-General for that purpose; and that any means used for obtaining information must be proportionate to the gravity of the threat posed and the probability of its occurrence.
In 2012-13, more than 80 Commonwealth, State and Territory enforcement agencies accessed telecommunications data under the original Act. In that same period, more than 330,640 authorisations were dispensed allowing access to data. These authorisations resulted in 546,500 disclosures.
Proposals for reform
Since at least June 2010, it had been reported that the Australian Government was considering establishing a telecommunications data retention scheme. On 4 May 2012, the Gillard government announced plans to review a range of national security legislation, including that covering "lawful access to telecommunications… to ensure that vital investigative tools are not lost as telecommunications providers change their business practices and begin to delete data more regularly."
In July 2012 the Attorney-General's Department released "Equipping Australia against Emerging and Evolving Threats", a discussion paper focused on proposed national security reforms. The paper's first chapter outlined the terms of reference for an inquiry to be conducted by the Parliamentary Joint Committee on Intelligence and Security (PJCIS) into the potential reform of national security legislation, specifically the four following Acts: Telecommunications (Interception and Access) Act 1979 Telecommunications Act 1997 Australian Security Intelligence Organisation Act 1979 Intelligence Services Act 2001
The discussion paper grouped these proposals into three different categories: those the Government wished to progress, those the Government was considering, and those on which the Government was seeking the Committee's opinion. Though the paper contained eighteen proposals and forty-one individual reforms, the suggestion that carriage service providers (CSPs) be required to retain information on the way Australians use the internet and mobile phones elicited much consternation and comment from the community. This was a point the Committee highlighted in its final report to the Government:"The potential data retention regime attracted a large amount of criticism and comment from organizations and concerned individuals. These organizations and individuals generally considered any potential data retention regime a significant risk to both the security and their privacy. In addition to these general comments, the Committee received a large volume of form letter correspondence."On 24 June 2013, the Committee issued its report and put the decision on whether to progress with a mandatory data retention scheme back in the Government's hands. On the same day the report was released, Attorney-General Mark Dreyfus announced the Government would not be pursuing its proposal.
On 30 October 2014, the Abbott government introduced the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014 into the House of Representatives. On 21 November 2014, the Attorney-General Senator George Brandis wrote to the PJCIS, referring the provisions of the Bill for inquiry.
Chaired by MP Dan Tehan, the Committee received 204 submissions, 31 supplementary submissions and held three public hearings. On 27 February 2015, the Committee presented its report, containing 39 recommendations. On 3 March 2015, the Government announced it would accept all the Committee's recommendations. However, the opposition Labor Party only agreed to support the passage of the Bill through the Senate after amendments were made to protect journalistic sources. On 26 March 2015, the Senate voted in favour of the Bill. On 13 April 2015, the Governor-General gave his royal assent and the Act entered into law.
Report recommendations
In response to the need for available telecommunications data and growing national security threats, Attorney-General George Brandis asked the PJCIS to inquire into and report on the Act. The Committee handed down its report entitled Report of the Inquiry into Potential Reforms of Australia’s National Security Legislation (2013 PJCIS Report) on 24 June 2013, in which it made these recommendations: The data retention obligation only applies to telecommunications data (not content) and internet browsing is explicitly excluded (Recommendation 42) Service providers are required to protect the confidentiality of retained data by encrypting the information and protecting (Recommendation 42) Mandatory data retention will be reviewed by the PJCIS no more than three years after its commencement (Recommendation 42) The Commonwealth Ombudsman will oversight the mandatory data retention scheme and more broadly law enforcement exercise of powers under Chapter 3 and 4 of the original Act (Recommendations 4 and 42); and Confining agencies’ use of, and access to, telecommunications data through refined access arrangements, including a ministerial declaration scheme based on demonstrated investigative or operations need (Recommendation 5).
The Act was again referred to the PJCIS for inquiry on 21 November 2014, where the Committee tabled its Advisory Report on the Telecommunications (Interception and Access) Amendment (Data Retention) Act 2014 (2015 PJCIS Report) on 25 February 2015. The PJCIS made these additional recommendations: The implementation of a mandatory data retention regime is necessary to maintain the capability of national security and law enforcement agencies and recommended that the Act be passed (Recommendation 39) Establish a ‘journalist information warrants’ regime and restrict the agencies who can access this data (Recommendation 26 and 27) Provide for record-keeping and reporting the use of, and access to, telecommunications data and enable the Commonwealth Ombudsman to assess agency compliance (Recommendation 29) Amend the Australian Security Intelligence Organisation Act 1979(Cth)to provide that certain matters relating to data retention be include in the ASIO Annual Report; and Amend the Intelligence Services Act 2001(Cth) to enable to PJCIS to inquire into operation matters relating to the use of telecommunications data by ASIO and the Australian Federal Police, in relation to counter-terrorism function (Recommendation 34)