EXPLANATORY STATEMENT
Issued by the authority of the Communications Access Co-ordinator
Telecommunications (Interception and Access) Act 1979
Telecommunications (Interception and Access) (Requirements for Authorisations, Notifications and Revocations) Determination 2023
Introduction
Purpose
- Chapter 4 of the Telecommunications (Interception and Access) Act 1979 (TIA Act) permits the disclosure of telecommunications information or documents to criminal law enforcement agencies and enforcement agencies for limited purposes.
2. The TIA Act distinguishes between information that has already come into existence (‘existing information’) and information that will come into existence during the period that the authorisation is in force (‘prospective information’).
3. The TIA Act permits the Australian Federal Police (AFP) to authorise the disclosure of information or documents on behalf of foreign law enforcement agencies where that disclosure is reasonably necessary for the enforcement of foreign or international laws. The Australian Federal Police may authorise disclosures for either existing or prospective information and further authorise the disclosure of the obtained information to the requesting foreign law enforcement agency.
4. Section 183 of the TIA Act provides that the Communications Access Co-ordinator (the Coordinator), a statutory position held by the Secretary of the Attorney-General’s Department (section 6R of the TIA Act), may by legislative instrument, determine requirements for the form of these authorisations, notifications of authorisations, revocations of authorisations and notifications of revocations.
5. The Telecommunications (Interception and Access) (Requirements for Authorisations, Notifications and Revocations) Determination 2023 (Principal Determination) revokes the Telecommunications (Interception and Access) (Requirements for Authorisations, Notifications and Revocations) Determination 2018 (2018 Determination)
6. The requirements for authorisations, notifications and revocations made in the Principal Determination are substantially similar to those in the 2018 Determination with the exception of changes to include requirements for authorisations under section 178A of the TIA Act, and adjustments to align requirements to the operational environment and needs, such as the potential for one authorisation seeking disclosure from more than one person.
Operation
7. The Principal Determination is necessary to:
- include requirements for authorisations under section 178A of the TIA Act
- adapt the requirements to the operational environment and needs of service providers and investigation/law enforcement agencies, and
- reinforce the legal basis for the requirements, following machinery of government changes affecting the Communications Access Co-ordinator.
Financial Impact Statement
8. The Principal Determination does not have a financial impact.
Regulation Impact Statement
9. The Office Impact Analysis has advised that a Regulation Impact Statement was not required (OIA Reference OIA23-045656).
Statement of Compatibility with Human Rights
10. Under section 42 of the Legislation Act 2003, the Principal Determination is subject to disallowance and therefore a Statement of Compatibility with Human Rights is included at Attachment A.
Consultation
11. Subsection 183(3) of the TIA Act provides that the Communications Access Co‑ordinator must consult with the Australian Communications and Media Authority and the Information Commissioner in relation to privacy functions before making a determination under subsection 183(2) of the TIA Act. The Co-ordinator consulted with the Australian Communications and Media Authority and the Office of the Australian Information Commissioner in March 2023 and took their views into account prior to making the Principal Determination. The Commonwealth Ombudsman was also consulted. No significant issues were raised during this consultation.
Details of the instrument
12. Details of the instrument are set out in Attachment B.
13. The Principal Determination is a legislative instrument for the purposes of the Legislation Act 2003.
14. The Determination commences upon registration.
ATTACHMENT A
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
- This Determination is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Legislative Instrument
2. The Telecommunications (Interception and Access) (Requirements for Authorisations, Notifications and Revocations) Determination 2023 (Principal Determination) reflects adjustments to the 2018 Determination to account for changing operational environment and needs of investigation/law enforcement agencies.
3. The Principal Determination establishes the form requirements for authorisations, revocations, and notifications for authorisations and revocations.
Human rights implications
4. The Principal Determination engages the right to protection against arbitrary and unlawful interferences with privacy (Article 17 of the International Covenant on Civil and Political Rights (ICCPR)).
5. Article 17 of the ICCPR provides that no one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence and that everyone has the right to the protection of the law against such interference or attacks. Interference with privacy is not arbitrary if it is in accordance with the provisions, aims and objectives of the ICCPR, is authorised by law and is reasonable in the particular circumstances. Reasonableness, in this context, incorporates notions of proportionality to the end sought and necessity in the circumstances.
6. The Principal Determination sets out form requirements for authorisations, notifications and revocations in relation to the release of information. It also requires authorised officers to state that they are satisfied the elements in section 180F regarding privacy have been met in every authorisation and notification of authorisation that is issued. This ensures that the consideration of privacy is a central element of the authorisation-making process.
7. The Principal Determination also requires authorised officers to state that the disclosure of the information or documents is reasonably necessary for enforcing the law, locating missing persons, or protection of the public revenue. To the extent that the right to privacy is affected, the interference corresponds to the need for law enforcement agencies to effectively investigate and prosecute serious crimes and find missing persons. The limitation is proportionate because the measures are directly linked to this aim.
Conclusion
8. The Principal Determination is compatible with human rights given it promotes the protection of human rights, specifically the right to privacy. To the extent that it may limit human rights, those limitations are reasonable, necessary and proportionate.
ATTACHMENT B
Details of the Telecommunications (Interception and Access) (Requirements for Authorisations, Notifications and Revocations) Determination 2018
Part 1 – Preliminary
Section 1 – Name of Determination
- Subsection 1(1) provides that the name of the Determination is the Telecommunications (Interception and Access) (Requirements for Authorisations, Notifications and Revocations) Determination 2023 (the Principal Determination).
Section 2 – Commencement
2. This section provides that the Principal Determination commences upon registration.
Section 3 – Authority
3. This section provides that the Principal Determination is made under subsection 183(2) of the Telecommunications (Interception and Access) Act 1979 (the TIA Act). Subsection 183(2) of the TIA Act provides that the Communications Access Co‑ordinator may, by legislative instrument, determine requirements for the purposes of paragraph 183(1)(f) of the TIA Act.
4. Paragraph 183(1)(f) of the TIA Act provides that an authorisation under Division 3, 4 or 4A of Part 4-1, the notification of such an authorisation, the revocation of such an authorisation and the notification of such a revocation, must comply with such requirements as are determined in a legislative instrument under subsection 183(2) of the TIA Act.
Section 4 – Definitions
5. This section provides that a reference to ‘Act’ in the Principal Determination refers to the Telecommunications (Interception and Access) Act 1979.
6. Note 1 lists key terms in the Principal Determination as defined under subsection 5(1) of the TIA Act. Note 2 refers to the definition of ‘eligible person’ in subsections 175(2) and 176(2) of the TIA Act. Note 3 refers to the definition of ‘international offence’ in subsection 162(3) of the TIA Act.
Section 5 – Consultation
7. Subsection 183(3) of the TIA Act requires the Communications Access Co‑ordinator to consult with the Australian Communications Media Authority and the Information Commissioner prior to making a determination regarding the form of authorisations, notifications and revocations under section 183(2) of the TIA Act.
8. The Co-ordinator consulted with the Australian Communications and Media Authority and the Office of the Australian Information Commissioner in March 2023 and took their views into account prior to making the Principal Determination.
Section 6 – Schedules
9. Section 6 provides that each instrument that is specified in a Schedule to the Principal Determination is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to the Principal Determination has effect according to its terms.
10. Schedule 1 to the instrument provides for the repeal of the 2018 Determination.
Section 7 – Purpose
11. This section states that for the purposes of paragraph 183(1)(f) of the TIA Act, the Principal Determination determines the requirements relating to an authorisation made under Division 3, 4 or 4A of Part 4-1 of Chapter 4 of the TIA Act, and the requirements relating to the notification of an authorisation, the revocation of an authorisation and the notification of such a revocation.
Part 2 – Requirements relating to authorisations, notifications and revocations
Division 1 – Authorisations made by the Organisation
Section 8 – Authorisation for access to existing information or documents
Subsection 8(1)
12. Subsection 8(1) specifies information that must be included in an authorisation made by the Australian Security Intelligence Organisation (the Organisation) for access to existing information or documents under subsection 175(2) of the TIA Act. This subsection is unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in paragraph 8(1)(d).
Subsection 8(2)
13. Subsection 8(2) provides that an authorisation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Section 9 – Authorisation for access to prospective information or documents
Subsection 9(1)
14. Subsection 9(1) specifies information that must be included in an authorisation made by the Organisation for access to prospective information or documents under subsections 176(2) and 176(3) of the TIA Act. This subsection is unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in paragraph 9(1)(d).
Subsection 9(2)
15. Subsection 9(2) provides that an authorisation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Division 2 – Authorisations made by enforcement agencies
Section 10 – Authorisation for access to existing information or documents
Subsection 10(1)
16. Subsection 10(1) specifies information that must be included in an authorisation made by enforcement agencies for access to existing information or documents under subsections 178(2) and 179(2) of the TIA Act. This subsection is unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in paragraph 10(1)(f).
Subsection 10(2)
17. Subsection 10(2) specifies information that must be included in an authorisation made by police forces for access to existing information or documents under subsection 178A(2) of the TIA Act.
18. This subsection is newly inserted; the 2018 Determination did not include requirements for authorisations made under subsection 178A(2) of the TIA Act.
Subsection 10(3)
19. Subsection 10(3) provides that an authorisation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from subsection 10(2) in the 2018 Determination, except to include mention of the new subsection 10(2).
Section 11 - Authorisations for access to existing information or documents by the Australian Federal Police – enforcing foreign or international laws
Subsection 11(1)
20. Subsection 11(1) specifies information that must be included in an authorisation made by the Australian Federal Police for access to existing information or documents for the purposes of enforcing foreign or international laws under subsection 180A(2) of the TIA Act.
21. This subsection is otherwise unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in paragraph 11(1)(d).
Subsection 11(2)
22. Subsection 180A(4) of the TIA Act enables an authorised officer of the Australian Federal Police to authorise the disclosure of information or documents obtained under subsection 180A(2) to a foreign law enforcement agency. Subsection 11(2) prescribes the information that must be included when authorising such a disclosure.
23. This subsection is unchanged from the 2018 Determination, except the insertion of the words “a statement that” at the start of paragraph 11(2)(k), for clarity and consistency with other similar provisions.
Subsection 11(3)
24. Subsection 11(3) provides that an authorisation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Section 12 – Authorisation for access to prospective information or documents by criminal law-enforcement agencies
Subsection 12(1)
25. Subsection 12(1) prescribes information that must be included in an authorisation made by a criminal law enforcement agency for access to prospective information or documents under subsections 180(2) and 180(3) of the TIA Act. This subsection is otherwise unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in paragraph 12(1)(f).
Subsection 12(2)
26. Subsection 12(2) provides that an authorisation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Section 13 – Authorisations for access to prospective information or documents by the Australian Federal Police – enforcing international laws
Subsection 13(1)
27. Subsection 13(1) prescribes the information that must be included in an authorisation made by the Australian Federal Police for access to prospective information or documents for the purposes of enforcing foreign or international laws under subsection 180B(2) of the TIA Act. This subsection is unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in paragraph 13(1)(d).
Subsection 13(2)—Extension of an authorisation to disclose prospective information or documents
28. Subsection 13(2) prescribes the information that must be included in an extension of an authorisation made by the Australian Federal Police under subsection 180B(6) of the TIA Act for access to prospective information or documents for the purposes of enforcing foreign or international laws. This subsection is unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in paragraph 13(2)(d).
Subsection 13(3)—Disclosure to a foreign law enforcement agency
29. Subsection 180B(8) of the TIA Act enables an authorised officer to authorise the disclosure of prospective information or documents obtained under subsection 180B(2) for enforcing international laws. Subsection 13(3) of the Principal Determination specifies information that must be included when authorising such a disclosure. This subsection is unchanged from the 2018 Determination.
Subsection 13(4)
30. Subsection 13(4) provides that an authorisation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Section 14 - Secondary disclosure authorisations for the Australian Federal Police to disclose information or documents – enforcing foreign or international laws
Subsection 14(1)
31. Subsection 14(1) specifies information that must be included in an authorisation made by the Australian Federal Police for secondary disclosure of information or documents under section 180C of the TIA Act. This subsection is unchanged from the 2018 Determination.
Subsection 14(2)
32. Subsection 14(2) provides that an authorisation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Section 15 - Secondary disclosure authorisations for the Australian Federal Police to disclose information or documents – enforcement of the criminal law
Subsection 15(1)
33. Subsection 15(1) specifies information that must be included in an authorisation made by the Australian Federal Police for secondary disclosure of information or documents for the purposes of enforcing the criminal law under section 180D of the TIA Act. This subsection is unchanged from the 2018 Determination.
Subsection 15(2)
34. Subsection 15(2) provides that an authorisation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Division 3 – Notifications of Authorisations
Section 16 – Notification of an authorisation
Subsection 16(1)
35. Subsection 16(1) specifies information that must be included in a notification of an authorisation made by the Organisation, an enforcement agency, or the Australian Federal Police under Division 3 of Part 4-1 of the TIA Act. Section 184 of the TIA Act provides the requirements for notification of authorisations and revocations.
36. Subsection 16(1) simplifies the corresponding subsection from the 2018 Determination by removing the requirement that the notification must include either a copy of the authorisation, or a statement that specifies “all the information that is required to be included in the authorisation under Part 2”, and replacing it with specific information which specified in the authorisation.
37. This change provides flexibility to agencies: where current practice is to provide a copy of the authorisation, that may continue; where this is impossible, or it is more expedient to provide the limited range of information specified in 16(1), agencies are able to provide only that information.
Subsection 16(2)
38. Subsection 16(2) provides that the notification of an authorisation must be signed by its maker if it is in written form or state a unique identifier of the relevant agency if it is in electronic form. This subsection is unchanged from the 2018 Determination.
Division 4 – Revocations of authorisations
Section 17 – Revocation of an authorisation made by the Organisation
Subsection 17(1)
39. Subsection 17(1) specifies information that must be included in a revocation of an authorisation made by the Organisation under subsection 176(6) of the Act. This subsection is unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in subparagraph 17(1)(d)(iii).
Subsection 17(2)
40. Subsection 17(2) provides that a revocation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Section 18 – Revocation of an authorisation made by a criminal law-enforcement agency
Subsection 18(1)
41. Subsection 18(1) specifies information that must be included in a revocation of an authorisation made by a criminal law-enforcement agency under subsection 180(7) of the Act. This subsection is unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in subparagraph 18(1)(f)(iii).
Subsection 18(2)
42. Subsection 18(2) provides that a revocation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Section 19 - Revocation of an authorisation made by the Australian Federal Police – enforcing international laws
Subsection 19(1)
43. Subsection 19(1) specifies information that must be included in a revocation of an authorisation made by the Australian Federal Police in relation to the enforcement of a foreign or international law under subsection 180B(4) of the TIA Act. This subsection is unchanged from the 2018 Determination, except that “person” is replaced with “person(s)” in subparagraph 19(1)(d)(iii).
Subsection 19(2)
44. Subsection 19(2) provides that a revocation, whether in written or electronic form, must be signed by its maker. This subsection is unchanged from the 2018 Determination.
Division 5 – Notification of revocations
Section 20 – Notification of a revocation
Subsection 20(1)
45. Subsection 20(1) specifies information that must be included in a notification of a revocation made by the Organisation, an enforcement agency or the Australian Federal Police under subsection 176(6), 180(7) or 180B(4) of the TIA Act. Section 184 of the TIA Act provides the requirements for notification of revocations. This subsection is unchanged from the 2018 Determination.
Subsection 20(2)
46. Subsection 20(2) provides that a revocation must be signed by its maker if it is in a written form, or state a unique identifier of the relevant agency if it is in electronic form. This subsection is unchanged from the 2018 Determination.
Schedule 1
47. Schedule 1 provides for the repeal of the 2018 Determination in its entirety, as the substance of this instrument is replaced by the Principal Determination.