Rules to Protect the Privacy of Australians 2012

Made by the Minister for Defence, 2 October 2012, and superseded by 2020 Privacy Rules

Letter of Introduction

I, Stephen Francis Smith, Minister of State for Defence, being the Minister responsible for the Australian Signals Directorate (ASD), hereby make the attached rules, in accordance with section 15 of the Intelligence Services Act 2001 ("the Act"), regulating the communication and retention by DSD of intelligence information concerning Australian persons.

In making the attached rules, I have had regard to the need to ensure that the privacy of Australian persons is preserved as far as is consistent with the proper performance by DSD of its functions.

Before making the attached rules, I have:

1. consulted the Director of DSD, the Inspector-General of Intelligence and Security (IGIS) and the Attorney-General; and
2. provided a copy of the rules I was proposing to the IGIS and Attorney-General.

Dated this 2nd day of October 2012

[Signed] Stephen Smith

Rules to Protect the Privacy of Australians

Rule 1: Protecting the privacy of Australian persons – presumptions

1.1  These rules regulate the communication and retention of intelligence information concerning Australian persons. Where it is not clear whether a person is an Australian person:

1. a person within Australia is to be presumed to be an Australian person; and
2. a person outside Australia is to be presumed not to be an Australian person;

unless there is evidence to the contrary, including from the context in which the information was collected or the content of the information.

Rules 2: Retention of intelligence information concerning Australian persons

2.1  DSD may retain intelligence information concerning an Australian person only where it is necessary to do so for the proper performance of DSD's functions or the retention is authorised or required by another Act.

2.2  Where DSD does retain intelligence information concerning an Australian person, DSD is to ensure that:

1. the information is protected, by such security safeguards as it is reasonable in the circumstances to take, against loss, against unauthorised access, use, modification or disclosure, and against other misuse; and
2. access to that information is only to be provided to persons who require such access for the proper performance of a DSD function.

Rule 3: Communication of intelligence information concerning Australian persons

3.1  DSD may communicate intelligence information concerning Australian persons only where it is necessary to do so for the proper performance of DSD's functions or where such communication is authorised or required by or under another Act. In addition, the following specific rules apply.

Information that is important for specified purpose

3.2  Intelligence information concerning an Australian person may be communicated where:

1. the information is publicly available; or
2. the information concerns activities in respect of which the Australian person is a representative of the Commonwealth or a State or Territory in the normal course of official duties; or
3. deletion of that part of the information concerning the Australian person would significantly diminish the utility of the information for the purposes of:
   
   1. maintaining Australia's national security
   2. maintaining Australia's national economic well-being
   3. promoting Australia's foreign relations
   4. preventing or investigating the commission of a serious crime
   5. responding to an apparent threat to the safety of a person, or
4. the information concerns an Australian person who is, or was at the time the information was collected, the subject of an authorisation given by the Minister under section 9 of the Act.

Communication to ASIS, ASIO or DIGO for their purposes

3.3  Intelligence information concerning an Australian person may be communicated to ASIS, ASIO or DIGO (as the case requires) where it relates, or appears to relate, to the performance of the functions of the relevant agency.

Rule 4: Communication of information not deliberately collected

4.1  DSD may communicate intelligence information concerning an Australian person that was not deliberately collected to an authority that DSD is permitted to cooperate with, provided the authority has been approved by the Minister for the purpose of this rule.

4.2  Before approving an authority for the purpose of rule 4.1, the Minister is to be satisfied that there are satisfactory arrangements in place to ensure that the authority will abide by the DSD privacy rules.

Rule 5: Accuracy of information

5.1  DSD is to take reasonable steps to ensure that intelligence information that DSD retains or communicates concerning Australian persons is recorded or reported in a fair and reasonable manner.

Rule 6: Oversight by the IGIS

6.1  To facilitate the oversight role of the IGIS, DSD is to take the following measures:

1. the IGIS is to have access to all intelligence information held by DSD concerning Australian persons;
2. the IGIS is to be consulted about the processes and procedures applied by DSD to the communication and retention of information concerning Australian persons; and
3. where a presumption under rule 1.1(b) has been found to be incorrect DSD is to advise the IGIS of the incident and measures taken by DSD to protect the privacy of the individual; and
4. in any case where a breach of these rules is identified, DSD is to advise the IGIS of the incident and the measures taken by DSD to protect the privacy of the Australian person or of Australian persons generally.

Rule 7: Public access to the rules

7.1  DSD is to ensure that a copy of these rules is publicly available on the DSD website.