Rules to Protect the Privacy of Australians 2021

Made by the Minister for Defence, 30 November 2021

Letter of Introduction

I, Peter Dutton, Minister for Defence, being the Minister responsible for the Australian Signals Directorate (ASD), hereby make the attached rules, in accordance with section 15 of the Intelligence Services Act 2001 (the Act), regulating the communication and retention by ASD of intelligence information concerning Australian persons.  'Intelligence information' means information obtained by ASD through, and incidental to, its foreign intelligence function under section 7(1)(a) of the Act.

In making the attached rules, I have had regard to the need to ensure that the privacy of Australian persons is preserved as far as is consistent with the proper performance by ASD of its functions.

Before making the attached rules, I:

1. consulted the Director-General of ASD, the Inspector-General of Intelligence and Security (IGIS) and the Attorney-General; and
2. provided a copy of the rules I was proposing to the IGIS and Attorney-General.

Dated this 30th day of November 2021

[Signed] Peter Dutton

Rules to Protect the Privacy of Australians

Rule 1: Protecting the privacy of Australian persons – presumptions

1.1  These rules regulate the communication and retention of intelligence information concerning Australian persons. Where it is not clear whether a person is an Australian person:

1. a person within Australia is to be presumed to be an Australian person; and
2. a person outside Australia is to be presumed not to be an Australian person;

unless there is evidence to the contrary, including from the context in which the information was collected or the content of the information.

Rule 2: Retention of intelligence information concerning Australian persons

2.1  ASD may retain intelligence information concerning an Australian person only where it is necessary to do so for the proper performance of ASD's functions or the retention is authorised or required by or under another Act.

2.2  Where ASD does retain intelligence information concerning an Australian person, ASD is to ensure that:

1. the information is protected, by such security safeguards as it is reasonable in the circumstances to take, against loss, against unauthorised access, use, modification or disclosure, and against other misuse; and
2. access to that information is only to be provided to persons who require such access for the proper performance of an ASD function.

Rule 3: Communication of intelligence information concerning Australian persons

3.1  ASD may communicate intelligence information concerning Australian persons only where it is necessary to do so for the proper performance of ASD's functions or where such communication is authorised or required by or under another Act. In addition, the following specific rules apply.

Specific rules for the communication of intelligence information concerning Australian persons

3.2  ASD may only communicate intelligence information concerning an Australian person where:

1. the Australian person has consented, either expressly or impliedly, to the obtaining of that intelligence information and the communication of that intelligence information; or
2.  the information is publicly available; or
3. the information concerns activities in respect of which the Australian person is a representative of the Commonwealth or a State or Territory in the normal course of official duties; or
4. deletion of that part of the information concerning the Australian person would significantly diminish the utility of the information for the purposes of:
   
   1. maintaining Australia's national security
   2. maintaining Australia's national economic well-being
   3. promoting Australia's foreign relations
   4. preventing or investigating the commission of a serious crime
   5. responding to an apparent threat to the safety of a person, or
5. the information concerns an Australian person who is, or was at the time the information was collected, the subject of an authorisation under sections 9, 9A or 9B of the Act.

Communication to ASIS, ASIO, AGO, DIO or ONI for their purposes

3.3  Intelligence information concerning an Australian person may be communicated to ASIS, ASIO, AGO, DIO or ONI (as the case requires) where it relates, or appears to relate, to the performance of the functions of the relevant agency.

Rule 4: Communication of information not deliberately collected

4.1  ASD may communicate intelligence information concerning an Australian person that was not deliberately collected to an authority that ASD is permitted to cooperate with under section 13 of the Act, provided the authority has been approved by the Minister for the purpose of this rule.

4.2  Before approving an authority for the purpose of rule 4.1, the Minister is to be satisfied that there are satisfactory arrangements in place to ensure that the authority will abide by the ASD privacy rules.

Rule 5: Accuracy of information

5.1  ASD is to take reasonable steps to ensure that intelligence information that ASD retains or communicates concerning Australian persons is recorded or reported in a fair and reasonable manner.

Rule 6: Oversight by the IGIS

6.1  To facilitate the oversight role of the IGIS, ASD is to take the following measures:

1. the IGIS is to have access to all intelligence information held by ASD concerning Australian persons;
2. the IGIS is to be consulted about the processes and procedures applied by ASD to the communication and retention of information concerning Australian persons; and
3. where a presumption under rule 1.1(b) has been found to be incorrect ASD is to advise the IGIS of the incident and measures taken by ASD to protect the privacy of the individual; and
4. in any case where a breach of these rules is identified, ASD is to advise the IGIS of the incident and the measures taken by ASD to protect the privacy of the Australian person or of Australian persons generally.

Rule 7: Public access to the rules

7.1  ASD is to ensure that a copy of these rules is publicly available on the ASD website.