Telecommunications (Interception and Access) (Requirements for Authorisations, Notifications and Revocations) Determination 2007

EXPLANATORY STATEMENT

Issued by the authority of the Communications Access Co‑ordinator

Telecommunications (Interception and Access) Act 1979

Chapter 4 of the Telecommunications (Interception and Access) Act 1979 (the Act) establishes a regime that permits the disclosure of telecommunications information or documents to security and enforcement agencies for limited purposes.

The Act distinguishes between information that has already come into existence (‘existing information’) and information that will come into existence during the period that the authorisation is in force (‘prospective information’).[1]

The Act permits an eligible person of the Australian Security Intelligence Organisation (the Organisation) to authorise the disclosure of information or documents where such disclosure would be in connection with the performance by the Organisation of its functions. The Organisation is able to authorise the disclosure of historical and prospective information.

Similarly, the Act permits an authorised officer of an enforcement agency to authorise the disclosure of existing information or documents where such disclosure is reasonably necessary for the enforcement of the criminal law, for the enforcement of a law imposing pecuniary penalty or for the protection of the public revenue. All enforcement agencies are able to authorise the disclosure of historical information, but only criminal law‑enforcement agencies, being a limited subset of all enforcement agencies, are able to authorise the disclosure of prospective information.

Subsections 176(6) and 180(7) provide eligible persons of the Organisation and authorised officers of criminal law‑enforcement agencies respectively with the power to revoke an authorisation for the disclosure of prospective information.

Section 184 of the Act requires that an authorisation or revocation made by the Organisation or an enforcement agency must be notified to the person from whom the disclosure is sought.

Section 183 of the Act provides that the Communications Access Co‑ordinator (‘the CAC’), a statutory position within the Attorney‑General’s Department currently filled by the First Assistant Secretary, Security and Critical Infrastructure Division, may, by legislative instrument, determine requirements for the form of authorisations, notifications of authorisations, revocations of authorisations and notifications of revocations. The Telecommunications (Interception and Access) (Authorisations, Notifications and Revocations) Determination 2007 (the Determination) is the first such determination made by the CAC.

Subsection 183(3) of the Act provides that the CAC must consult with the ACMA and the Privacy Commissioner prior to making a determination under section 183. The CAC has duly consulted with these two agencies and has taken their comments into account prior to making the Determination. In addition, the CAC has also consulted with a number of the agencies who are able to authorise the disclosure of information under Chapter 4 of the Act and the key industry participants who may be requested to disclose information under this Chapter.

While the Determination generally focuses on the form of authorisations, notifications and revocations, it also provides greater guidance to agencies utilising these provisions on how these provisions should be used. In particular, criminal law‑enforcement agencies must consider the impact of privacy before making an authorisation for the disclosure of prospective data and the Determination, coupled with this explanatory statement, seeks to provide greater guidance to agencies on how the impact on privacy should be considered.

The Determination is a legislative instrument for the purposes of the Legislative Instruments Act 2003.

The Determination commences on 1 December 2007.

Further details on each of the requirements set out in the Determination are provided in Attachment A. The terms defined in the Act and used in the Determination are set out at Attachment B for reference.

ATTACHMENT A

Schedule 1 – Requirements relating to authorisations, notifications and revocations

Part 1 – Authorisations made by the Organisation

Clause 1.01 – Authorisation for access to existing information or documents

Clause 1.01 sets out the matters that an authorisation for the disclosure of existing information made by an eligible person of the Organisation must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary:

The identity of the eligible person. The identity of the eligible person must be established uniquely. While this would usually be met by including the person’s name, the Determination also permits the use of a pseudonym, where this is required for operational reasons, or a unique identifier generated by an electronic system.

Where a person’s name is not used, the agency must be able to uniquely and indelibly link the identifier to the eligible person who made the authorisation.
The basis on which the eligible person is an eligible person. This item is included to ensure that it is clear from the face of an authorisation how the eligible person was given his or her authority. As an example, this requirement might be met by a statement that reads: ‘I, …, am an eligible person as I am an officer or employee of the Organisation who has been approved by the Director‑General of Security under subsection 175(4) of the Act’.

In this context, the language of the authorisation should reflect the language used in the instrument of approval by the Director‑General. For example, if the instrument of approval lists a number of positions (either by position title or position number), the eligible person should include their position title or number (eg. ‘I, [name], [position], am an eligible person…). In contrast, if the instrument of approval provides authorisation by class of persons (eg. ‘I authorise all officers or employees of the Organisation who are members of the Senior Executive Service’), the authorisation would reflect this accordingly (eg. ‘I, [name], a member of the Senior Executive Service of the Organisation, am an eligible person…)
The relevant provision of the Act under which the authorisation is made. This requirement might be met by a statement that reads: ‘Acting under subsection 175(2) of the Act, I authorise…’
The name of the person from whom disclosure is sought. In this context, where disclosure is sought from a telecommunications carrier, it may be more appropriate to refer to a company rather than a person (paragraph 22(1)(a) of the Acts Interpretation Act 1901 provides that ‘person’ includes a body corporate).

The Determination requires the name of the person or company from whom the disclosure is sought. This differs from simply requiring the identity of the eligible person. The reason for this distinction is that the person or company from whom the disclosure is sought will always be known, there will be no operational reason to withhold it and there will always be a need for the requesting agency to include this information in the authorisation.
Details of the information or documents to be disclosed. This item requires sufficient detail to enable the person from whom the disclosure is sought to identify the information or documents to be disclosed.

It is left to the individual agencies to determine how they will sufficiently describe the information or documents to be disclosed. There is no requirement to specify whether the disclosure sought is of information or of documents – the Act treats the terms as interchangeable. In any event, agencies will often not be able to determine ahead of time what format the requested data will be in.
A statement that the eligible person is satisfied that the disclosure of the information or documents would be in connection with the performance by the Organisation of its functions. Subsection 175(3) of the Act provides that an eligible person may not authorise the disclosure of information or documents unless he or she is satisfied that the disclosure would meet this threshold.

Inclusion of this statement in an authorisation will ensure that the eligible person turns his or her mind to this test prior to making the authorisation and will satisfy the person from whom the disclosure is sought that the authorisation has been validly made.
The date on which the authorisation is made.

2. Paragraph 183(1)(e) of the Act provides that an authorisation may be in written or electronic form. Subclause 1.01(2) provides that an authorisation, regardless of whether it is in writing or in electronic form, must be signed by the eligible person who made it. In the context of written authorisations, this requirement is self-explanatory, whereas in the context of electronic authorisations, this requirement relies on section 10 of the Electronic Transactions Act 1999 (the ETA).

3. Section 10 of the ETA sets out how a requirement under a law of the Commonwealth for a person’s signature can be met in relation to an electronic communication. It provides that a signature is taken to have been provided on an electronic communication if a method is used to identify the person and to indicate the person’s approval of the information communicated and having regard to all the relevant circumstances at the time the method was used, the method was as reliable as was appropriate for the purposes for which the information was communicated.

4. The Determination therefore requires that if an authorisation is in electronic form, it must contain an identifier that uniquely and indelibly identifies the person and that fulfils the same role as a written signature (that is, to indicate the person’s endorsement of the content of the authorisation).

5. The Determination utilises the intentionally general words used in section 10 of the ETA to reflect the fact that different electronic systems use different types of identifiers. Any identifier that is sufficient in the circumstances to uniquely and indelibly identify the person will be appropriate.

6. Examples of appropriate identifiers could include digital signatures, unique logins or other account identifiers. Whether an identifier such as an email address is appropriate will depend on how unique and indelible that email address is.

Clause 1.02 – Authorisation for access to prospective information or documents

7. Clause 1.02 sets out the matters that an authorisation for the disclosure of prospective information made by an eligible person of the Organisation must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary, although where the requirement is the same as for access to historical information, the explanation is not repeated:

The identity of the eligible person. Refer to clause 1.01 for further detail.
The basis on which the eligible person is an eligible person. In relation to authorisations for the disclosure of prospective information, an eligible person means the Director‑General of Security, the Deputy Director‑General of Security or an officer or employee of the Organisation who holds, or is acting in, a position that is equivalent to, or higher than, a Senior Executive Service Band 2 position in the Attorney‑General’s Department. There is no ability for the Director‑General of Security to further approve a person to be an ‘eligible person’ for the persons of this authorisation process.

As there is no approval instrument, the language of the authorisation should reflect the language used in subsection 176(2) of the Act (eg. ‘I, [name], holding/occupying a position in the Organisation that is equivalent to or higher than a Senior Executive Service Band 2 position in the Department, am an eligible person…).
The relevant provision(s) of the Act under which the authorisation is made. As the note to this item makes clear, authorisations for disclosure of prospective information may also authorise the disclosure of existing information. Where this information is also sought, a separate statement in the authorisation should be included to this effect.

That is, each authorisation might use a statement that reads: ‘Acting under subsection 176(2) of the Act, I authorise…’ and where disclosure of existing information is also sought, it might also use a statement that reads: ‘Acting under subsection 176(3) of the Act, I also authorise…’
The name of the person from whom disclosure is sought. Refer to clause 1.01 for further detail.
Details of the information or documents to be disclosed. If both prospective and historical information is sought, details of each type of information should be spelt out separately.
A statement that the eligible person is satisfied that the disclosure of the information or documents would be in connection with the performance by the Organisation of its functions.
The date on which the authorisation is made and the date on which it is to end, being a date that is no later than the end of the period of 90 days beginning on the day the authorisation is made. The note to this item highlights that an authorisation for the disclosure of prospective information only comes into force when it is received by the person from whom the disclosure is sought. However, to ensure certainty, paragraph 176(5)(b) requires the authorisation to specify an end-date not more than 90 days from the date the authorisation is made. This has the result that in practice, the maximum time that an authorisation can be in force is just under 90 days, as an authorisation can only be notified after it has been made.

8. Subclause 1.02(2) provides that an authorisation, whether it is in written or electronic form, must be signed by the eligible person who made it. Refer to subclause 1.01(2) for further detail.

Part 2 – Authorisations made by enforcement agencies

Clause 2.01 – Authorisation for access to existing information or documents

9. Clause 2.01 sets out the matters that an authorisation for the disclosure of existing information made by an authorised officer of an enforcement agency must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary, although where the requirement has been addressed already, the explanation is not repeated.

10. As a preliminary matter, it is noted that each criminal law‑enforcement agency is by definition also an enforcement agency. When a criminal law‑enforcement agency is authorising the disclosure of existing information or notifying such an authorisation, it is acting as an enforcement agency and should refer to itself accordingly. However, when a criminal law‑enforcement agency is authorising the disclosure of prospective information or notifying such an authorisation, it should refer to itself as a criminal law‑enforcement agency.

The identity of the enforcement agency. As there are a number of enforcement agencies, an authorisation must make clear which enforcement agency is requesting the information.

As with eligible persons and authorised officers, the Determination only requires that the enforcement agency be identified. Where an electronic system uses identifiers that are uniquely and indelibly linked to specific agencies, it is sufficient for the system to ensure that this identifier is attached to the authorisation, rather than the name of the enforcement agency itself. However, it is expected that most authorisations will contain the name of the enforcement agency in the interests of clarity.
The basis on which the enforcement agency is an enforcement agency. Unlike with the Organisation, where its status is expressed in the Act, an enforcement agency must identify the provision of the Act that gives it its authority to authorise the disclosure of information.

Some agencies, such as the Australian Federal Police, are expressly covered by the Act and a statement to this effect will satisfy this requirement (eg. ‘The Australian Federal Police is an enforcement agency within the definition of ‘enforcement agency’ in subsection 5(1) of the Act’).

In contrast, an agency that is not expressly mentioned will need to state its basis in more detail, including to identify whether it is a body whose functions include administering a law imposing a pecuniary penalty or administering a law relating to the protection of the public revenue. It should be noted that some agencies will have both functions and it does not matter which is used – any ‘enforcement agency’ can authorise the disclosure of existing information for any reason (eg. enforcement of the criminal law, enforcement of a law imposing a pecuniary penalty, protection of the public revenue).

As an example, the Australian Taxation Office might use the following words: ‘The Australian Taxation Office is an enforcement agency within subparagraph (n)(ii) of the definition of ‘enforcement agency’ in subsection 5(1) of the Act’.
The identity of the authorised officer. Refer to clause 1.01 for further detail.
The basis on which the authorised officer is an authorised officer. This item is included to ensure that it is clear from the face of an authorisation how the authorised officer was given his or her authority. This is particularly important in the case of enforcement agencies who may ultimately seek to use the information disclosed in evidence.

Importantly, paragraph (c) of the definition of ‘authorised officer’ in subsection 5(1) refers to a person who holds, or is acting in, an office or position in the enforcement agency that is covered by an authorisation in force under subsection 5AB(1). This means that a person cannot personally be made an authorised officer, but must be holding or acting in a position that is covered by an authorisation from the head of the enforcement agency.

As an example, this requirement might be met by a statement that reads: ‘I, …, am an authorised officer as I am a person who holds, or is acting in, an office or position in [name of enforcement agency] that is covered by an authorisation in force under subsection 5AB(1) of the Act’.

In this context, the language of the authorisation should reflect the language used in the instrument of authorisation by the agency head. For example, if the instrument of authorisation lists a number of positions (either by position title or position number), the authorised officer should include their position title or number (eg. ‘I, [name], [position], am an authorised officer …). In contrast, if the instrument of authorisation provides authorisation by class of persons (eg. ‘I authorise all management offices or positions filled at the rank of Inspector or above’), the authorisation should reflect this accordingly (eg. ‘I, [name], holding/acting in a position at the rank of Inspector, am an authorised officer …).
The relevant provision(s) of the Act under which the authorisation is made. An authorisation by an enforcement agency for disclosure of existing information may be made under subsection 178(2) or 179(2). It is important that the source of the authority to authorise the disclosure of the information is included in the authorisation.
The name of the person from whom disclosure is sought. Refer to clause 1.01 for further detail.
Details of the information or documents to be disclosed.
A statement that the authorised officer is satisfied that the disclosure of the information or documents is reasonably necessary for the enforcement of the criminal law, for the enforcement of a law imposing a pecuniary penalty or for the protection of the public revenue, as applicable. Only the relevant threshold should be included in any given authorisation.

Agencies should ensure that each authorisation states the threshold that corresponds to the relevant provision of the Act (eg. ‘Acting under subsection 178(2) of the Act, … I am satisfied that the disclosure is reasonably necessary for the enforcement of the criminal law’).
The date on which the authorisation is made.

11. Subclause 2.01(2) provides that an authorisation, whether it is in written or electronic form, must be signed by the authorised officer who made it. Refer to subclause 1.01(2) for further detail.

Clause 2.02 – Authorisation for access to prospective information or documents

12. Clause 2.02 sets out the matters that an authorisation for the disclosure of prospective information made by an authorised officer of a criminal law‑enforcement agency must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary, although where the requirement has been addressed already, the explanation is not repeated:

The identity of the criminal law‑enforcement agency. Refer to clause 2.01 for further detail.
The basis on which the criminal law‑enforcement agency is a criminal law‑enforcement agency. The definition of criminal law‑enforcement agency cross-references the definition of enforcement agency (‘a body covered by any of paragraphs (a) to (k) of the definition of enforcement agency’), which should therefore be the words used to justify that an agency is a criminal law‑enforcement agency (eg. ‘The Australian Federal Police is a criminal law‑enforcement agency as it is within the meaning of paragraph (a) of the definition of ‘enforcement agency’ in subsection 5(1) of the Act’).
The identity of the authorised officer. Refer to clause 1.01 for further detail.
The basis on which the authorised officer is an authorised officer. Unlike ‘eligible person’, ‘authorised officer’ has the same meaning for authorising the disclosure of both existing information and prospective information. Refer to clause 2.01 for further detail.
The relevant provision(s) of the Act under which the authorisation is made. As the note to this item makes clear, authorisations for disclosure of prospective information may also authorise the disclosure of existing information. Where this information is also sought, a separate statement in the authorisation should be included to this effect.

That is, each authorisation might use a statement that reads: ‘Acting under subsection 180(2) of the Act, I authorise…’ and where disclosure of existing information is also sought, it might also use a statement that reads: ‘Acting under subsection 180(3) of the Act, I also authorise…’
The name of the person from whom disclosure is sought. Refer to clause 1.01 for further detail.
Details of the information or documents to be disclosed.
A statement that the authorised officer is satisfied that the disclosure of the information or documents is reasonably necessary for the investigation of an offence against a law of the Commonwealth, a State or a Territory that is punishable by imprisonment for at least three years, including short particulars of the offence.

Unlike authorising the disclosure of existing information, where the disclosure need only be reasonably necessary for the enforcement of the criminal law, disclosure of prospective information may only be authorised in relation to a specific investigation of a specific offence. This item therefore requires an authorisation for the disclosure of prospective information to include the offence under investigation, which ensures that the authorised officer has turned his or her mind to the gravity of the offence in question. This is particularly important as part of the privacy assessment, which is explored further in relation to the next item.

Only short particulars of the offence are required (eg. ‘I am satisfied that the disclosure is reasonably necessary for the investigation of an offence against section 307.1 of the Criminal Code (Cth), being an offence against a law of the Commonwealth that is punishable by imprisonment for at least three (3) years’).
A statement that the authorised officer has had regard to how much the privacy of any person or persons would be likely to be interfered with by the disclosure and that the authorised officer is satisfied that the impact on privacy is outweighed by the seriousness of the conduct being investigated.

This item is a direct reference to the privacy consideration that is expressly required by subsection 180(5) and to the ‘balancing’ approach that is implicitly required by that subsection. Subsection 180(5) requires an authorised officer to have regard to how much the privacy of any persons would be likely to be interfered with by the disclosure. It follows from this that the authorised officer must then compare the conduct being investigated with this privacy impact before determining whether the authorisation should be issued.

This balancing approach is implicit in the threshold of ‘reasonably necessary’ which exists in relation to accessing both existing and prospective information. However, the Act includes an express requirement to consider privacy implications prior to making an authorisation for the disclosure of prospective information. A requirement to include a statement to this effect in each authorisation will ensure that the authorised officer turns his or her mind to these important issues before deciding whether or not to make an authorisation in the circumstances.

The gravity of the offence and how much the disclosure will assist the investigation of the offence are other elements of the privacy consideration that an authorised officer may wish to take into account, although this is not expressly required by either the Act or the Determination.
The date on which the authorisation is made and the date on which it is to end, being a date that is no later than the end of the period of 45 days beginning on the day the authorisation is made. The note to this item highlights that an authorisation for prospective information only comes into force when it is received by the person from whom the disclosure is sought. However, to ensure certainty, paragraph 180(6)(b) requires the authorisation to specify an end-date not more than 45 days from the date the authorisation is made. This has the result that in practice, the maximum time that an authorisation can be in force is just under 45 days, as an authorisation can only be notified after it has been made.

13. Subclause 2.02(2) provides that an authorisation, whether it is in written or electronic form, must be signed by the authorised officer who made it. Refer to subclause 1.01(2) for further detail.

Part 3 – Notifications of authorisations

14. Part 3 of the Schedule to the Determination is part of the new two‑stage process that the Act has established for authorisations. Section 184 of the Act provides that authorisations must be notified to the person from whom the disclosure is sought, while not requiring the authorisation itself to be provided to that person. Accordingly, telecommunications carriers are entitled to disclose information after having received notification that an authorisation has been issued without ever needing to see the original authorisation.

15. Once an authorisation has been made, the Determination provides for two alternative methods of notifying the person from whom the disclosure is sought. The first requires inclusion of a copy of the authorisation, while the second requires the inclusion of all of the information contained in the authorisation. In each case, one item of the relevant table provides these two options as direct alternatives.

16. The purpose of permitting the two‑stage process is to allow for different authorisation and notification methods that are not directly compatible. As an example, an agency may use a written authorisation process and an electronic notification process. The two‑stage process allows these two processes to operate together while ensuring that the senior officers in the agency who are able to make authorisations are not required to actually enter the information electronically as part of the notification process.

Clause 3.01 – Notification of an authorisation made by the Organisation

17. Clause 3.01 sets out the matters that a notification of an authorisation for the disclosure of either existing or prospective information made by an eligible person of the Organisation must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary. Where information has been explained earlier in this document, it is not repeated:

The identity of the officer or employee of the Organisation who is making the notification. Refer to clause 1.01 for further detail.

Subsection 184(1) provides that an authorisation made by an eligible person of the Organisation must be notified to the person from whom the disclosure is sought by any officer or employee of the Organisation. Accordingly, while it is necessary to include the identity of the person actually requesting the disclosure, there is no need to establish that person’s credentials other than that they are an officer or employee of the Organisation.
The relevant provision of the Act under which the notification is made. This requirement might be met by a statement that reads: ‘Acting under subsection 184(1) of the Act, I notify you of …’
Either a copy of the authorisation or a statement specifying the information that must be included in the authorisation.

This item is the critical part of the notification process. The two options provided are mutually exclusive (as made clear by the note for this item), meaning that if a copy of the authorisation is provided to the person from whom the disclosure is sought, no further information about the contents of the authorisation needs to be included.

It should be noted that it is acceptable to provide both an authorisation and a notification in a single document, provided that it meets the requirements for both authorisations and notifications. In this event, the eligible person issuing the authorisation would also be the officer or employee of the Organisation notifying the authorisation and the authorisation and notification would take place on the same date.

An acceptable alternative approach to providing a copy of the authorisation is the provision of the information contained in the authorisation. Paragraphs 3(b)(i) to (vii) reflect the information that must be included in an authorisation for the disclosure of existing information or an authorisation for the disclosure of prospective information (although some of the information, such as the relevant provisions of the Act under which the authorisation is made, will be different depending on the type of authorisation made). Subitem 3(b)(viii) is only applicable and need only be included for the notification of an authorisation for the disclosure of prospective information.

Refer to clauses 1.01 and 1.02 for further detail on the information to be included in authorisations.
The means by which the information or documents should be disclosed to the officer or employee. This item requires a notification to specify how the information to be disclosed should be delivered to the requesting officer or employee, including both the means by which it should be delivered (eg. facsimile, email, etc) and the address(es) for delivery (eg. facsimile number, email address, etc).

The language used permits an agency to specify any type of delivery method, including but not limited to facsimile, email, telephone, post, in-person delivery or other electronic means (such as secure web-based electronic transmission). Agencies are also entitled to request delivery by more than one means. The Determination simply requires that sufficient information is included to enable the person from whom the disclosure is sought to disclose the information in accordance with the agency’s wishes.

Inclusion of the means by which disclosure is to occur does not require disclosure by these means. This requirement is included to ensure that the job of the person from whom disclosure is sought is as clear as possible. However, if the means of disclosure set out in the notification is not possible, practical in the circumstances or the most efficient means of disclosure (for financial or other reasons), the person may disclose the information by alternative means. An alternative means of disclosure should only be used where it has been agreed between the person and the agency.
The date on which the notification is made.

18. Subclause 3.01(2) provides that a notification that is in writing must be signed by the officer or employee of the Organisation who made it, while a notification that is in electronic form must include a unique identifier of the Organisation. The latter wording is intentionally different to the wording used for authorisations.

19. For authorisations, the authority attaches to an eligible person in his or her personal capacity. In contrast, any officer or employee of the Organisation may notify the person from whom the disclosure is sought, so all that is required is to uniquely identify that the notification has come from the Organisation.

20. In written form, this is best achieved by the signature of the notifying officer or employee. As noted above, if a single document represents both an authorisation and a notification, this will be the signature of the eligible person.

21. In electronic form, any electronic identifier that uniquely identifies the Organisation may be included. This may be an identifier that is uniquely attached to a specific officer or employee of the Organisation or it may be an identifier that is attached to the Organisation as a whole. This distinction is necessary as some electronic systems do not give separate unique identifiers to each employee of an agency but simply one unique code to that agency. It is important that the requirements set out in the Determination permit the use of electronic systems of this nature to notify authorisations.

Clause 3.02 – Notification of an authorisation made by an enforcement agency

22. Clause 3.02 sets out the matters that a notification of an authorisation for access to existing or prospective information made by an authorised officer of an enforcement agency must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary. Where information has been explained earlier in this document, it is not repeated:

23. As noted earlier, each criminal law‑enforcement agency is by definition also an enforcement agency. When a criminal law‑enforcement agency is authorising the disclosure of existing information or notifying such an authorisation, it is acting as an enforcement agency and should refer to itself accordingly. However, when a criminal law‑enforcement agency is authorising the disclosure of prospective information or notifying such an authorisation, it should refer to itself as a criminal law‑enforcement agency.

The identity of the relevant staff member of the enforcement agency who is making the notification. Refer to clause 1.01 for further detail.

As the definition of ‘relevant staff member’ includes any employee, member of staff or officer of an enforcement agency, any person engaged by the enforcement agency, regardless of the form of that engagement, is able to notify a person from whom disclosure is sought of an authorisation for that disclosure.
The relevant provision of the Act under which the notification is made.
Either a copy of the authorisation or a statement specifying the information that must be included in the authorisation. As there are significantly different requirements for authorisations for the disclosure of existing information and authorisations for the disclosure of prospective information, these two notifications processes are set out separately in the Determination.

Accordingly, an agency can either provide a copy of the relevant authorisation (in accordance with subitem (3)(a)), set out the information in the authorisation for the disclosure of historical information (in accordance with subitem (3)(b)) or set out the information in the authorisation for the disclosure of prospective information (in accordance with subitem (3)(c)). These three steps are mutually exclusive – once one has been met, there is no need to provide any further information about the contents of the authorisation (as made clear by the note for this item).

Subitem 3(b) reflects the information that must be included in an authorisation for the disclosure of existing information and is only applicable to those authorisations (ie. if the authorisation was made under subsection 178(2) or 179(2)). Refer to clause 2.01 for further detail on the information to be included in an authorisation for the disclosure of existing information.

Subitem 3(c) reflects the information that must be included in an authorisation for the disclosure of prospective information and is only applicable to those authorisations (ie. if the authorisation was made under subsection 180(2), whether or not it also included an authorisation for the disclosure of existing information under subsection 180(3)). Refer to clause 2.02 for further detail on the information to be included in an authorisation for the disclosure of prospective information.
The means by which the information or documents should be disclosed to the relevant staff member. Refer to clause 3.01 for further detail.
The date on which the notification is made.

24. Subclause 3.02(2) provides that a notification that is in writing must be signed by the relevant staff member of the enforcement agency who made it, while a notification that is in electronic form must include a unique identifier of the enforcement agency. Refer to subclause 3.01(2) for further detail.

Part 4 – Revocations of authorisations

25. Subsection 176(6) of the Act provides that if an authorisation for the disclosure of prospective information has been made by the Organisation, an eligible person of the Organisation must revoke that authorisation if he or she is satisfied that the disclosure is no longer required. Subsection 180(7) places a similar obligation on authorised officers of criminal law‑enforcement agencies.

Clause 4.01 – Revocation of an authorisation made by the Organisation

26. Clause 4.01 sets out the matters that a revocation of an authorisation for the disclosure of prospective information made by an eligible person of the Organisation must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary. Where information has been explained earlier in this document, it is not repeated:

The identity of the eligible person who is making the revocation. Refer to clause 1.01 for further detail.
The basis on which the eligible person is an eligible person. Refer to clause 1.01 for further detail.
The relevant provision(s) of the Act under which the revocation is made. This requirement might be met by a statement that reads: ‘Acting under subsection 176(6) of the Act, I revoke the authorisation …’
Details of the authorisation to be revoked sufficient to identify it. The Determination sets out the minimum requirements to be included to identify the authorisation, including the identity of the eligible person who made it, the date on which it was made, the name of the person from whom the disclosure was sought and details of the information or documents to be disclosed. The Determination also provides the Organisation with the ability to use any other information that may assist in identifying the original authorisation (such as a reference number), but does not require this information to be included.
A statement that the eligible person is satisfied that the disclosure of the information or documents is no longer required.
The date on which and the time at which the revocation is made. The Act does not specify a time that revocations take effect, which means that they take effect when they are made. It is therefore important that both the date on which and time at which the revocation is made are included on the revocation itself.

As revocations take effect, and accordingly authorisations cease to be in force, when the revocation is made, agencies will need to ensure that the person from whom the disclosure is sought will not disclose information after the revocation is made. This will require the Organisation to ensure that the person from whom the original disclosure was sought is informed of the proposed revocation, accompanied by a requirement for an eligible person to not make such a revocation until he or she is satisfied that the disclosure under the authorisation has ceased.

27. Subclause 4.01(2) provides that a revocation, whether it is in written or electronic form, must be signed by the eligible person who made it. Refer to subclause 1.01(2) for further detail.

Clause 4.02 – Revocation of an authorisation made by a criminal law‑enforcement agency

28. Clause 4.02 sets out the matters that a revocation of an authorisation for the disclosure of prospective information made by an authorised officer of a criminal law‑enforcement agency must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary. Where information has been explained earlier in this document, it is not repeated:

The identity of the criminal law‑enforcement agency. Refer to clause 2.01 for further detail.
The basis on which the criminal law‑enforcement agency is a criminal law‑enforcement agency. Refer to clause 2.02 for further detail.
The identity of the authorised officer who is making the revocation. Refer to clause 1.01 for further detail.
The basis on which the authorised officer is an authorised officer. Refer to clause 2.01 for further detail.
The relevant provision(s) of the Act under which the revocation is made.
Details of the authorisation to be revoked sufficient to identify it. Refer to clause 4.01 for further detail.
A statement that the authorised officer is satisfied that the disclosure of the information or documents is no longer required.
The date on which and the time at which the revocation is made.

As with revocations by the Organisation, criminal law‑enforcement agencies will be required to ensure that the person from whom the original disclosure was sought is informed of the proposed revocation and to ensure that an authorised officer does not make such a revocation until he or she is satisfied that the disclosure under the authorisation has ceased. Refer to clause 4.01 for further detail.

29. Subclause 4.02(2) provides that a revocation, whether it is in written or electronic form, must be signed by the authorised officer who made it. Refer to subclause 1.01(2) for further detail.

Part 5 – Notifications of revocations

30. The same considerations that apply to notifications of authorisations as set out in relation to Part 3 above also apply to notifications of revocations. That is, a notification of a revocation must either attach the revocation or must set out all of the information included in the revocation.

Clause 5.01 – Notification of a revocation made by the Organisation

31. Clause 5.01 sets out the matters that a notification of a revocation made by an eligible person of the Organisation must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary. Where information has been explained earlier in this document, it is not repeated:

The identity of the officer or employee of the Organisation who is making the notification. Refer to clause 1.01 for further detail.
The relevant provision of the Act under which the notification is made.
Either a copy of the revocation or a statement specifying the information that must be included in the revocation.

As the note to this item makes clear, a notification can either include a copy of the revocation (in accordance with subitem 3(a)) or set out all the information required to be included in the revocation (in accordance with subitem 3(b)). These two options are mutually exclusive. Refer to clause 4.01 for further detail on the information to be included in revocations.
The date on which the notification is made.

32. Subclause 5.01(2) provides that a notification that is in writing must be signed by the officer or employee of the Organisation who made it, while a notification that is in electronic form must include a unique identifier of the Organisation. Refer to subclause 3.01(2) for further detail.

Clause 5.02 – Notification of a revocation made by a criminal law‑enforcement agency

33. Clause 5.02 sets out the matters that a notification of a revocation made by an authorised officer of a criminal law‑enforcement agency must contain. These requirements are generally procedural in nature, but some further explanation is provided where it is considered necessary. Where information has been explained earlier in this document, it is not repeated:

The identity of the relevant staff member of the criminal law‑enforcement agency who is making the notification. Refer to clause 1.01 for further detail.
The relevant provision of the Act under which the notification is made.
Either a copy of the revocation or a statement specifying the information that must be included in the revocation.

As the note to this item makes clear, a notification can either include a copy of the revocation (in accordance with subitem 3(a)) or set out all the information required to be included in the revocation (in accordance with subitem 3(b)). These two options are mutually exclusive. Refer to clause 4.02 for further detail on the information to be included in revocations.
The date on which the notification is made.

34. Subclause 5.02(2) provides that a notification that is in writing must be signed by the relevant staff member who made it, while a notification that is in electronic form must include a unique identifier of the criminal law‑enforcement agency. Refer to subclause 3.01(2) for further detail.

ATTACHMENT B

Definitions in the Act used in the Determination

The following terms are used in the Determination as defined in the Act. The Act definitions are replicated here for ease of reference.

ACMA (subsection 5(1))

ACMA means the Australian Communications and Media Authority

Authorised officer (subsection 5(1) and section 5AB)

authorised officer of an enforcement agency means:

(a) the head (however described) of the enforcement agency or a person acting as that head; or

(b) a deputy head (however described) of the enforcement agency or a person acting as that deputy head; or

(c) a person who holds, or is acting in, an office or position in the enforcement agency that is covered by an authorisation in force under subsection 5AB(1).

5AB Authorised officers

(1) The head (however described) of an enforcement agency may, by writing, authorise a management office or management position in the enforcement agency for the purposes of paragraph (c) of the definition of authorised officer in subsection 5(1).

(2) The head of the enforcement agency must give a copy of an authorisation to the Communications Access Co‑ordinator.

Authorisations are not legislative instruments

(3) An authorisation made under this section is not a legislative instrument.

Communications Access Co‑ordinator (subsection 5(1) and section 6R)

Communications Access Co‑ordinator has the meaning given by section 6R.

6R Communications Access Co‑ordinator

(1) In this Act:

Communications Access Co‑ordinator means:

(a) the Secretary of the Department; or

(b) if a person or body is covered by an instrument under subsection (2)—that person or body.

(2) The Minister may, by legislative instrument, specify a person or body for the purposes of paragraph (b) of the definition of Communications Access Co‑ordinator in subsection (1).

(3) Unless the context otherwise requires, an act done by or in relation to the Communications Access Co‑ordinator is taken to be an act done by or in relation to the Co‑ordinator on behalf of all the interception agencies.

Criminal law‑enforcement agency (subsection 5(1))

criminal law‑enforcement agency means a body covered by any of paragraphs (a) to (k) of the definition of enforcement agency in this subsection.

Enforcement agency (subsection 5(1))

enforcement agency means:

(a) the Australian Federal Police; or

(b) a police force or service of a State; or

(d) the Australian Crime Commission; or

(e) the Crime Commission; or

(f) the Independent Commission Against Corruption; or

(g) the Police Integrity Commission; or

(h) the Office of Police Integrity; or

(i) the Crime and Misconduct Commission; or

(j) the Corruption and Crime Commission; or

(k) an authority established by or under a law of the Commonwealth, a State or a Territory that is prescribed by the regulations for the purposes of this paragraph; or

(l) a body or organisation responsible to the Ministerial Council for Police and Emergency Management ‑ Police; or

(m) the CrimTrac Agency; or

(n) any body whose functions include:

(i) administering a law imposing a pecuniary penalty; or

(ii) administering a law relating to the protection of the public revenue.

Relevant staff member (subsection 5(1))

relevant staff member of an enforcement agency means:

(a) the head (however described) of the enforcement agency; or

(b) a deputy head (however described) of the enforcement agency; or

The Organisation (subsection 5(1))

the Organisation means the Australian Security Intelligence Organisation.

‘Eligible person’ is defined in subsection 175(2) of the Act for the purposes of that section (ie. in relation to authorisations for the disclosure of existing information). ‘Eligible person’ is defined differently in subsection 176(2) of the Act for the purposes of that section (ie. in relation to authorisations for the disclosure of prospective information and revocations of such authorisations). The definitions are as follows:

Eligible person (section 175)

(2) The following persons (each of whom is an eligible person):

(a) the Director‑General of Security;

(b) the Deputy Director‑General of Security;

may authorise the disclosure of specified information or specified documents that came into existence before the time the person from whom the disclosure is sought receives notification of the authorisation.

(4) The Director‑General of Security may, by writing, approve an officer or employee of the Organisation for the purposes of paragraph (2)(c).

Eligible person (section 176)

(2) The following persons (each of whom is an eligible person):

(a) the Director‑General of Security;

(b) the Deputy Director‑General of Security;

(c) an officer or employee of the Organisation who holds, or is acting in, a position that is equivalent to, or that is higher than, an SES Band 2 position in the Department;

may authorise the disclosure of specified information or specified documents that come into existence during the period for which the authorisation is in force.

[1] The Act uses the term ‘information or documents’ to cover both forms of data. However, there is generally no practical distinction between the two – agencies will often not distinguish whether they are requesting information or documents as they cannot determine ahead of time what format the requested data will be in. For ease of reference, this document will refer only to ‘information’ rather than to ‘information or documents’.

Administered by Attorney-General's Department

Interactions

Legislation content

Interactions

Authorises

All Versions