Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/056) 2022 (No. 2)

EXPLANATORY STATEMENT

Issued by authority of the Minister for Home Affairs

Security of Critical Infrastructure Act 2018

Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/056) 2022 (No. 2)

1        The instrument, the Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/056) 2022 (No. 2), is made under section 61 of the Security of Critical Infrastructure Act 2018 (the Act). 

2        The instrument amends the Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021 (LIN 21/039). Subsection 33(3) of the Acts Interpretation Act 1901 relevantly provides that a power to make a legislative instrument includes a power to repeal, rescind, revoke, amend, or vary that instrument in the same manner, and subject to the same conditions, as the power to make the instrument. 

3        The instrument commences on the day after registration on the Federal Register of Legislation, and is a legislative instrument for the purposes of the Legislation Act 2003.

Purpose

4        The instrument amends LIN 21/039 to change the reference to a ‘registrable superannuation entity’ to a ‘RSE licensee’. This will update the definition of critical superannuation asset in LIN 21/039 to reflect changes made to the Act by the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (SLACIP Act) to replace the term ‘registrable superannuation entity’ with ‘RSE licensee’.

5         The instrument amends LIN 21/039 to insert new subsection 16(3), for paragraph 12KA(3)(a) of the Act. The effect of this is to prescribe assets, which are critical to the administration of an Australian domain name system. These amendments give effect to the definition of critical domain name system, at section 12KA of the Act, and are consequential to amendments made to the Act by the SLACIP Act.

6         Prior to the amendments made by the SLACIP Act, an asset only needed to meet two tests to be a critical domain name system: (1) to be managed by an entity that is critical to the administration of an Australian domain name system (see paragraph 12KA(1)(a) and subsection 12KA(2) of the Act), and (2) to be used in connection with the administration of an Australian domain name system (see paragraph 12KA(1)(b) of the Act). The SLACIP Act amended this test to include that the system must be an asset that is critical to the administration of an Australian domain name asset (see paragraph 12KA(1)(c) and subsection 12KA(3) of the Act). The instrument is consequential to those amendments. See further detail at Item 9, in Attachment A, below.

7        The instrument provides that certain sugar mills are not critical infrastructure assets under the Act. This means that these sugar mills do not attract the obligations under the Act in relation to critical infrastructure assets.

8        The instrument amends Schedule 1 to LIN 21/039 to update the list of intermodal transfer facilities that are critical freight infrastructure assets under the Act. By operation of LIN 21/039 and the Act, these intermodal transfer facilities are critical infrastructure assets under the Act.

Consultation

9        The Office of Best Practice Regulation (OBPR) was also consulted and considered that the instrument is unlikely to have more than a minor regulatory impact. As such, no regulatory impact statement was required.  The OBPR reference number is OBPR22-03365.

10     The Department consulted with .au Domain Administration Ltd (ABN 38 079 009 340) to prescribe the system that is critical to the administration of an Australian domain name system under new subsection 16(2) and the critical assets under new subsection 16(3).

11     No further consultation was conducted in relation to the remainder of the instrument. The instrument makes only minor amendments to LIN 21/039, and broadly maintain what is already in force. The amendments ensure the correct operation of the Act, and that information provided by the responsible entities mentioned in Schedule 1 to LIN 21/039 is accurate.

Details of the instrument

12     Details of the Amendment Rules are set out in Attachment A. 

Parliamentary scrutiny etc. 

13     The instrument is subject to disallowance under section 42 of the Legislation Act 2003.

14     A Statement of Compatibility with Human Rights has been completed in accordance with the Human Rights (Parliamentary Scrutiny) Act 2011. The overall assessment is that the instrument is compatible with human rights. The Statement is included at Attachment B. 

Attachment A

Details of the Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/056) 2022 (No. 2)

Section 1 Name

The title of this legislative instrument is the Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/056) 2022 (No. 2). 

Section 2 Commencement

The instrument commences on the day after it is registered on the Federal Register of Legislation. 

Section 3 Schedules

Section 3 of the instrument provides that Schedule 1 amends the Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021 (LIN 21/039). 

Schedule 1—Amendments

Items [1 – 5] Section 3

Items 1 – 5 insert, in the relevant place in section 3, the new definitions of:

• .au ccTLD system is defined to mean the system used in providing the ‘.au’ country code Top Level Domain (ccTLD) internet service.
• authoritative DNS name server is defined to mean a computer server that provides authoritative DNS information about a domain name, which may include the Internet Protocol address of a website server or an email server.
• DNS is defined to mean a domain name system, which is a component of the Internet that enables users to find and connect to local websites, email addresses and other Internet connected resources by mapping domain names to their corresponding Internet Protocol numeric addresses. 
• DNSSEC is defined to mean DNS Security Extensions that facilitate the digital signing of DNS records, to assist in ensuring the integrity and authenticity of DNS information.
• registrant information is defined to include: the registrant legal entity name, registrant identification number, eligibility type, eligibility name, and eligibility identification.
• registrable superannuation entity is defined as having the same meaning as in the Superannuation Industry (Supervision) Act 1993.
• WHOIS service is defined to mean a service or tool that provides domain information, including (any of) the following:

(a)    domain registrar;

(b)    registrar contact information;

(c)    domain name status;

(d)    DNS name servers;

(e)    IP address of DNS name servers;

(f)     DNSSEC information;

(g)    registrant information;

(h)    registrant contact information;

(i)     technical contact information.

Item [6] Section 14

Section 14 of LIN 21/039 defines requirements for an RSE licensee to be critical to the security and reliability of the financial services and markets sector for paragraph 12J(2)(b) of Act. Subsection 12J(1) of the Act provides that:

 (1) An asset is a critical superannuation asset if:

 (a) it is owned or operated by an RSE licensee that, in accordance with subsection (2), is critical to the security and reliability of the financial services and markets sector; and

 (b) it is used in connection with the operation of a superannuation fund.

Item 6 amends section 14 of LIN 21/039 to appropriately reflect the arrangements for management of critical superannuation assets. This is to reflect amendments made to the Act by the SLACIP Act that replaced references to ‘registrable superannuation entity’ with references to ‘RSE licensee’. The main purpose of those amendments was to amend the definition of ‘critical superannuation asset’ so that it referred to the correct type of entity.

Item 6 updates section 14 of LIN 21/039 to provide that an RSE licensee is critical to the security and reliability of the financial services and markets sector if it is a trustee of a registrable superannuation entity that has assets over $20 billion.

Item [7] Subsection 16(1)

This item corrects the reference to ‘paragraph’ 12KA(2)(a) of the Act.

Item [8] Subsection 16(2)

This item corrects the reference to ‘paragraph’ 12KA(2)(b) of the Act and updates the legislative drafting to improve the readability of subsection 16(2).

Subsection 16(2) prescribes an entity that administers the .au ccTLD system as critical to the administration of an Australian domain name system.

The .au ccTLD system is defined in section 3 to mean the system used in providing the ‘.au’ country code Top Level Domain (ccTLD) internet service.  

Item [9] After subsection 16(2)

This item inserts new subsection 16(3), for paragraph 12KA(3)(a) of the Act, to prescribe specified assets within the .au ccTLD system as critical to the administration of an Australian domain name system.

These assets are as follows:

• registry database. This is the database of the domain names within the .au ccTLD system, the DNS settings for each domain, details of the legal entities that hold each domain name license, and contact details (name, phone number, postal address, and email address) for the administrative and technical contacts for each domain name.

• public WHOIS service (https://whois.auda.org.au/). This is the public lookup service that allows any member of the public to find out information on the legal entities that hold each domain name licence, and contact details (name, phone number, postal address, and email address) for the administrative and technical contacts for each domain name. This is a key component of ensuring that holders of domain name licences can be held legally accountable for their use of those licences. It provides transparency to the members of the public that use domain names for access to websites and as part of email addresses.
• .au top level authoritative DNS name server. This is a computer server used by Internet Service Providers to translate a .au top level (.au) domain name into a physical Internet Protocol address for users.
• second level authoritative DNS name servers. This is a computer server used by Internet Service Providers to translate a second level domain name (i.e. .com.au, .net.au, .org.au, .asn.au, .id.au, .gov.au, and edu.au) into a physical Internet Protocol address for users.

Item [10] After section 18

Item 10 inserts new Division 2.3 in LIN 21/039 to prescribe assets that are specified not to be critical infrastructure assets under paragraph 9(2)(j) of the Act. As part of this, item 10 inserts new section 19 into the instrument to provide that the sugar mills mentioned in the section are not critical infrastructure assets.

Under the Act, a responsible entity for a critical infrastructure asset has a range of obligations in relation to the relevant assets. Subsection 9(1) of the Act sets out the types assets that are critical infrastructure assets. Paragraph 9(1)(df) of the Act provides that a critical electricity asset is a critical infrastructure asset.

However, subsection 9(2) of the Act provides that the rules may prescribe that a specified asset referred to in the subsection is not a critical infrastructure asset. This includes paragraph 9(2)(j), which refers to a critical electricity asset.

The effect of new section 19 of the instrument is that the sugar mills mentioned in subsection 19(2) are not critical infrastructure assets. This means that the responsible entities for these assets do not have obligations under the Act in relation to these assets.

Items [11-13] Schedule 1

Items 11 – 13 amend the list of intermodal transfer facilities in Schedule 1 of LIN 21/039. In summary, these amendments:

• substitute item 1 of the table to spell out ‘New South Wales’, rather than ‘NSW’ for consistency with the table;
• update at item 2 of the table the responsible entity details for the intermodal transfer facilities located at Parkes, New South Wales;
• update the Australian Business Number (ABN) information at items 3 and 4 of the table relating to Altona and Barnawartha;
• update the ABN information at items 7 and 8 of the table relating to Acacia Ridge and Bromelton;
• update the ABN information at items 11 and 12 of the table relating to Penfield and Forrestfield;
• re-insert at item 12A the location ‘Kewdale-Welshpool, Western Australia’ and corresponding responsible entity Pacific National (ABN 48 052 134 362), which had previously been inadvertently omitted from LIN 21/039 as a result of an amendment to LIN 21/039 by Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/021) 2022.

Paragraph 12B(1)(c) of the Act provides that an asset is a critical freight infrastructure asset if it is an intermodal transfer facility that, in accordance with subsection 12B(4), is critical to the transportation of goods between two States, a State and a Territory, two Territories, or two regional centres (the relevant locations).

Paragraph 12B(4)(a) of the Act provides that, for paragraph 12B(1)(c), the rules may prescribe specified intermodal transfer facilities that are critical to the transportation of goods between the relevant locations.

Paragraph 9(1)(dn) of the Act provides that a critical freight infrastructure asset is a critical infrastructure asset.

Subsection 8(1) of LIN 21/039 provides that an intermodal transfer facility specified in Schedule 1 to LIN 21/039 is critical to the transportation of goods between the relevant locations.

The combined effect of the above is that the intermodal transfer facilities specified in Schedule 1 are critical infrastructure assets under the Act. The responsible entity for a critical infrastructure asset may be subject to a range of obligations under the Act in relation to the asset.

Subsection 12L(18) of the Act sets out which entity is the responsible entity for a critical freight infrastructure asset. Paragraph 12L(18)(e) of the Act provides that the responsible entity for a critical freight infrastructure asset (where none of paragraphs 12L(18)(a)-(d) apply) is the entity prescribed by the rules in relation to the asset.

Subsection 8(2) of LIN 21/039 provides that, for paragraph 12L(18)(e) of the Act, the entity mentioned in an item of the table in Schedule 1 to LIN 21/039 is the responsible entity for the asset mentioned in the item. This provides that the entities mentioned in the table in Schedule 1 to LIN 21/039 are the responsible entities for the critical infrastructure assets mentioned in Schedule 1.

Attachment B

Statement of Compatibility with Human Rights

Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011

Security of Critical Infrastructure (Definitions) Amendment Rules 2022 (No. 2)

This Disallowable Legislative Instrument is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the
Human Rights (Parliamentary Scrutiny) Act 2011.

Overview of the Disallowable Legislative Instrument

1         The purpose of the instrument, the Security of Critical Infrastructure (Definitions) Amendment Rules (LIN 22/056) 2022 (Amendment Rules), is to amend the Security of Critical Infrastructure (Definitions) Rules (LIN 21/039) 2021 (Definitions Rules) to:

• update the reference to a ‘registrable superannuation entity’ to ‘RSE licensee’ in section 14 of the Definitions Rules;
• specify that prescribed critical electricity assets are not critical infrastructure assets for the purposes of subsection 9(2) of the Security of Critical Infrastructure Act 2018 (the Act);

• update the list of intermodal transfer facilities mentioned in Schedule 1 to the Definitions Rules; and

• prescribe specified assets within the “.au ccTLD system” (being the system used in providing the ‘.au’ country code Top Level Domain (ccTLD) internet service) as critical to the administration of an Australian domain name system for paragraph 12KA(3)(a) of the Act.

2        Section 14 of the Definitions Rules outlines requirements for an RSE licensee to be critical to the security and reliability of the financial services and markets sector for paragraph 12J(2)(b) of the Act, and therefore be a critical superannuation asset for subsection 12J(1) of the Act. Item 6 of Schedule 1 to the instrument updates the specification of assets that are critical superannuation assets. The purpose of this change is to reference the correct entity that owns or operates that asset in line with section 12J of the Act. This change is technical in nature.

3        Subsection 9(2) of the Act provides that rules may prescribe that a specified asset, including a critical electricity asset for paragraph 9(2)(j), is not a critical infrastructure asset.

4        Item 10 of Schedule 1 to the instrument inserts new section 19 to the Definitions Rules, which prescribes four specified critical electricity assets, being four sugar mills, are not critical infrastructure assets for paragraph 9(2)(j) of the Act. The purpose of this amendment is to remove these entities from the scope of the Act.

5        The change made by item 10 of the instrument has the effect of removing the four sugar mills from the scope of the Act. These entities are therefore no longer subject to the limitations on human rights that may result from the regulatory regime of the Act.

6        Items 11-13 of Schedule 1 to the Definitions Rules prescribe the intermodal transfer facilities that are ‘critical freight infrastructure assets’ for the purpose of section 12B(4)(a) of the Act. Items 11-13 of Schedule 1 to the instrument amend Schedule 1 of the Definitions Rules to update the list of intermodal transfer facilities and corresponding responsible entities for these facilities. The purpose of these amendments are to:

• change the Australian Business Number (ABN) associated with the responsible entity for several of the intermodal terminals to identify the correct entity with ownership and operational responsibility for the asset;
• re-insert the Kewdale-Welshpool, Western Australia intermodal terminal into Schedule 1, after it was erroneously removed.

7         By amending Schedule 1 of the Definitions Rules, these additional specified entities will be subject to obligations under the Act. The Security of Critical Infrastructure (Application) Rules (LIN 22/026) 2022 (Application Rules) prescribe specific obligations of the Act that are switched on for specific critical infrastructure asset classes. This includes:  

• the requirement for the entity to provide ownership and operational information to the Register under Part 2 of the Act; and
• the requirement for the entity to provide reports about cyber incidents to the Australian Cyber Security Centre (ACSC) under Part 2B of the Act.

8         Paragraph 12KA(3)(a) of the Act provides that rules may prescribe that a specified asset is critical to the administration of an Australian domain name system.

9         The instrument amends LIN 21/039 to insert new subsection 16(3), for paragraph 12KA(3)(a) of the Act. The effect of this is to prescribe assets, which are critical to the administration of an Australian domain name system. These amendments give effect to the definition of critical domain name system, at section 12KA of the Act, and are consequential to amendments made to the Act by the Security Legislation Amendment (Critical Infrastructure Protection) Act 2022 (SLACIP Act).

10     Prior to the amendments made by the SLACIP Act, an asset only needed to meet two tests to be a critical domain name system: (1) to be managed by an entity that is critical to the administration of an Australian domain name system (see paragraph 12KA(1)(a) and subsection 12KA(2) of the Act), and (2) to be used in connection with the administration of an Australian domain name system (see paragraph 12KA(1)(b) of the Act). The SLACIP Act amended this test to include that the system must be an asset that is critical to the administration of an Australian domain name asset (see paragraph 12KA(1)(c) and subsection 12KA(3) of the Act). The instrument is consequential to those amendments.

11     Both sections 18A and 30BB of the Act provide for the ability to offer a delayed commencement or ‘grace period’ for obligations when an asset becomes a critical infrastructure asset, allowing the entity a reasonable period to adjust their business. These grace periods have been specified in subsections 4(3) and 5(5) of the Application Rules.

12     An overview of these obligations is provided in the Statement of Compatibility with Human Rights for the Application Rules.

Human rights implications

13     This Disallowable Legislative Instrument engages the following human rights:

• the right to an adequate standard of living, including the right to adequate food in Article 11 of the International Covenant on Economic, Social and Cultural Rights (ICESCR); and
• the right to privacy in Article 17 of the International Covenant on Civil and Political Rights (ICCPR).

The right to an adequate standard of living, including the right to adequate food

14     Article 11 of the ICESCR provides for the right of everyone to an adequate standard of living, including adequate food. Article 11 commits States Parties to the Covenant to improve methods of production and distribution of food.

15     Amendments to Schedule 1 of the Definitions Rules will have the effect of requiring direct interest holders and responsible entities for critical freight infrastructure assets to report ownership and operational information to the Register to which Part 2 of the Act applies. Information obtained will inform Government and industry’s understanding of who has influence and control over critical freight infrastructure that is critical to the provision of essential services and supplies that maintain and sustain life throughout Australia. This includes, but is not limited to, food and groceries.

16     Responsible entities for critical freight infrastructure assets will also be required to report cyber security incidents to which Part 2B of the Act applies. Information obtained through cyber incident reporting will enable Government to identify and rapidly respond to emerging threats.

17     Overall, an enhanced understanding of the evolving threat environment will improve Government’s ability to work with industry to reduce the likelihood of a disruption to distribution networks and other key operations of Australia’s major freight infrastructure. This could impact the availability of goods such as critical food and groceries for population centres, critical medicines and vaccines for the health sector and critical fuels for the transport and logistics sector.

Right to privacy

18     Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with their privacy. Interferences with privacy may be permissible where it is authorised by law and is not arbitrary. For an interference with the right to privacy not to be arbitrary, the interference must be for a reason consistent with the provisions, aims and objectives of the ICCPR and be reasonable in the particular circumstances. The United Nations Human Rights Committee has interpreted ‘reasonableness’ in this context to mean that ‘any interference with privacy must be proportional to the end sought and be necessary in the circumstances of any given case’.

19     The term unlawful means that no interference can take place except as authorised under domestic law.

20     Amendments to Schedule 1 of the Definitions Rules will have the effect of requiring the specified direct interest holders and responsible entities for critical freight infrastructure assets and critical domain name systems assets to report ownership and operational information to the Register and cyber incidents to the ACSC. This will allow certain powers to be used in relation to those prescribed assets, and may engage the right to privacy of the owners or operators of the asset’s responsible entity, or that entity’s employees or customers/consumers. Such information is held securely by the Government and will not be made available on a public register.

21     New section 19 to the Definition Rules removes four critical electricity assets – being four sugar mills - from the scope of the Act, with the effect that they are not subject to these obligations.

Register of Critical Infrastructure Assets – obligations to give information and notify of events

22     Whilst the collection of personal information will be rare, Part 2 of the Act requires the responsible entity for a critical freight infrastructure asset and critical domain name systems asset to provide the Secretary of the Department administering the Act with certain interest and control information in relation to the entity and the asset, which is maintained in a Register.

23     The requirements for the Register may result in the incidental collection of personal information in relation to responsible entities who are individuals. The responsible entity for a critical freight infrastructure asset and critical domain name systems asset is required to provide high-level information on who ultimately controls or influences an asset though ownership, including beneficial ownership, or through operation arrangements, such as outsourcing arrangements.

24     The Register is used by the Government to prioritise and inform risk assessments to identify and manage national security risks in critical infrastructure assets. The interest and control information and operational information on the Register provides the Government with a more comprehensive understanding of how the asset and sector operates, and where there may be vulnerabilities. The information on the Register also influences the Government’s ability to develop strategies to mitigate or reduce national security risk for assets which, if disrupted, would significantly impact the operations of large population hubs, economic interests and government operations.

25     The Government has taken sufficient steps to ensure that the limitations on the right to privacy are no more restrictive than necessary as the use and disclosure of information on the Register is restricted to purposes authorised under the Act. All information obtained under the Act, including the information provided for the Register, is protected information. It is a criminal offence to use or disclose protected information other than as authorised by Part 4, Division 3 of the Act. This Division enables disclosure for national security, foreign investment in Australia, taxation policy, industry policy, defence purposes or to assist regulatory bodies with oversight of any relevant industry for the critical infrastructure asset. Part 4, Division 3, Subdivision B of the Act provides criminal penalties to deter the disclosure of protected information.

26     The information on the Register may be shared with the relevant states and territories. This information may have broader policy implications for states and territories, particularly in relation to maintaining the security and resilience of critical infrastructure assets vital for their jurisdiction. This acknowledges that the states and territories, as owners and regulators of critical infrastructure assets share the responsible with the Government to manage national security risks.

27     Further, safeguards for the protection of personal information specified in the Australian Privacy Principles (APP) under the Privacy Act 1988 will apply to interest and control information, and operational information gathered under Part 2 and Part 2B of the Act. This includes requirements regarding the security of personal information specified under APP 11 and requirements regarding use or disclosure under APP 6.

28     To the extent that the Register may result in the incidental collection of personal information and limit the right to privacy in Article 17, this limitation is permissible as the collection of personal information would be lawful, would not be arbitrary and would be reasonable, necessary and proportionate to achieving a legitimate national security objective.

Secretary’s powers to obtain information or documents

29     The Secretary’s information gathering power is a permissible limitation to the right to privacy. Subsection 37(1) of the Act empowers the Secretary to request certain information from reporting entities and operators of critical infrastructure assets. The Act allows for the Secretary to request information or documents that may be relevant to:

• the Secretary’s duty and function to keep a Register under section 19
• the Minister’s power to issue a direction under subsection 32(2),
• the Secretary’s power to issue a direction under subsection 35AK(2), and
• the Secretary’s power to undertake an assessment of a critical infrastructure asset to determine if there is a national security risk under section 57.

30     The information requested may include procurement plans, tender documentation, contracts, name and citizenship of board members and other documents specifying business operations. The notice may require the provision of personal information, which may limit the right to privacy.

31     The information gathering power is limited to obtaining information or documents that are directly relevant to the purposes of the legislation, as stated in the objects of the Act, as well as the functions, duties, powers and purposes prescribed in the Act. Any personal information collected is incidental to the key objective of developing a more detailed understanding of possible national security risks.

32     This power was drafted with reference to the Administrative Review Council’s best practice principles for implementing and exercising information gathering powers in its 2008 report, Coercive Information Gathering Powers of Government Agencies.

33     In practice, Government agencies will also engage with the relevant entity prior to issuing a notice to discuss the nature of the information required and, if necessary, the terms of the notice. Engagement with the relevant entity will ensure that prior to issuing a notice a range of matters including the impact on the right of privacy will be considered. This ensures the Secretary’s notice is a proportionate response, balancing the impacts on privacy with the Government’s objective of addressing national security risks to critical infrastructure.

34     The information and documents provided to the Secretary in response to a request are protected information and the use and disclosure of the information is restricted in line with provisions at Part 4, Division 3 of the Act. This Division enables disclosure for national security, foreign investment in Australia, taxation policy, industry policy, defence purposes or to assist regulatory bodies with oversight of any relevant industry for the critical infrastructure asset. Part 4, Division 3, Subdivision B of the Act provides criminal penalties to deter the disclosure of protected information.

35     The information on the Register may be shared with the relevant states and territories. This acknowledges that the states and territories, as owners and regulators of critical infrastructure assets share the responsibility with the Government to manage national security risks.

36     Further, safeguards for the protection of personal information specified in the Australian Privacy Principles (APP) under the Privacy Act 1988 will apply to interest and control information, and operational information gathered under Part 2, and Part 2B of the Act. This includes requirements regarding the security of personal information specified under APP 11 and requirements regarding use or disclosure under APP 6.

37     To the extent that the Secretary’s information gathering powers may result in the incidental collection of personal information and limit the right to privacy in Article 17, this limitation is permissible as the collection of personal information would be lawful, would not be arbitrary and would be reasonable, necessary and proportionate to achieving a legitimate national security objective.

Conclusion

This Disallowable Legislative Instrument is compatible with human rights because it promotes human rights and, to the extent that it may limit human rights, those limitations are reasonable, necessary and proportionate to the objective of reducing national security risks, including those presented by cyber threats, to critical freight infrastructure and critical domain name systems assets.