Keeping records of disclosures under the Telecommunications Act 1997

This resource provides an overview for telecommunication service providers of their obligations to maintain records of disclosures under ss 306 and 306A of the Telecommunications Act 1997. The resource includes a checklist at Appendix A to help providers ensure the relevant requirements are met when creating records of disclosures.

Overview

Generally, the Telecommunications Act 1997 (Telecommunications Act) prohibits the disclosure of information obtained during the supply of telecommunications services.[1] However, both the Telecommunications Act and the Telecommunications (Interception and Access) Act 1979 (TIA Act) contain exceptions to this general prohibition that enables telecommunication service providers to disclose information in limited circumstances.

If a telecommunication service provider discloses information under certain exceptions contained in the Telecommunications Act or the TIA Act, it must create and keep a record of the disclosure. These records must comply with specific requirements contained in ss 306 and 306A of the Telecommunications Act.

The Office of the Australian Information Commissioner (OAIC) is responsible for monitoring compliance with the record keeping requirements contained in Part 13, Division 5 of the Telecommunications Act.[2]

Who needs to comply with the record-keeping requirements?

Generally, the ss 306 and 306A record-keeping requirements in the Telecommunications Act apply to ‘eligible persons’.[3] An ‘eligible person’ includes a carrier, carriage service provider and their respective employees.[4] The record-keeping requirements also apply to ‘associates’, which includes a person who performs services for or on behalf of the carrier or carriage service provider.[5] These entities are collectively referred to as ‘telecommunication service providers’ in this resource.

More information about the terms ‘carrier’ and ‘carriage service provider’ can be found on the Australia Communications and Media Authority’s website at www.acma.gov.au.

When do the record-keeping requirements apply?

Under ss 306 and 306A, if a telecommunication service provider discloses information in accordance with certain exceptions, it must create a record of disclosure. The exceptions fall into two broad categories: s 306 applies to ‘general disclosure exceptions’ and s 306A applies to ‘prospective authorisation exceptions’.

The general disclosure exceptions enable telecommunication service providers to disclose information in certain circumstances, including to prevent or lessen a serious and imminent threat to the life or health of a person, or if summoned to give evidence or produce documents. The prospective authorisation provisions in the TIA Act generally enable criminal law-enforcement agencies to authorise telecommunication service providers to disclose information or documents that may come into existence during a particular future period of time.[6]

The exceptions that impose a record-keeping requirement are outlined at Appendix B.

When does the record need to be created?

For general disclosures, records must be created within five days of the date of disclosure.[7] For prospective authorisations, the record must be created within five days of the day on which the authorisation ceases to be in force.[8]

If an associate makes a disclosure, they must make a record within five days of the date of disclosure and give that record to the carrier or carriage service provider within five days of making the record.[9] For prospective authorisations, the associate must make a record within five days of the day on which the authorisation ceases to be in force and give a copy of that record to the carrier or provider within five days of making the record.[10]

What information needs to be included in the record?

Section 306 of the Telecommunications Act sets out the requirements for records of disclosures made on the grounds of a general disclosure exception (see Table 1 at Appendix B). Section 306A of the Telecommunications Act sets out the requirements for records of disclosures made on the grounds of a prospective authorisation exception (see Table 2 at Appendix B). These records may be made, given or retained in either written or electronic form.[11] The requirements of ss 306 and 306A are dealt with separately in the tables below.

Key concepts

Name of the person who disclosed the information

In most cases, the name of the ‘person’ who disclosed the information will be the name of the telecommunication service provider.[12] However, there may be some instances where a service provider will need to record the name of the individual who makes the disclosure. For example, s 281 of the Telecommunications Act authorises disclosure of information by a person summoned to give evidence. As only individuals may give evidence in court, in this instance the record of disclosure should identify the name of the individual who made the disclosure.

As a matter of best practice, the OAIC recommends that records of disclosure includes both the name of the telecommunication service provider and the name (or other unique identifier) of the individual who made or actioned the disclosure/s. Telecommunication service providers should also be mindful of their obligations under Australian Privacy Principle (APP) 11, which requires APP entities to take reasonable steps to protect personal information they hold. A reasonable step that entities could take to protect the personal information they hold is to record the employee name (or other unique identifier) on records of disclosures to help identify instances of unauthorised access or disclosure.

A statement of the grounds for the disclosure

The record of disclosure should identify the relevant provision in either the Telecommunications Act or the TIA Act that authorised the disclosure.

Name of the person who made the authorisation

Under the authorisation provisions in the TIA Act (ss 178, 179, 180, 180A and 180B), only an ‘authorised officer’[13] from a requesting entity may authorise a telecommunication service provider to disclose information. Consequently, the ‘name of the person’ who made the authorisation should be the name or other identifier of the individual officer from the requesting entity that authorised the disclosure.

Prospective authorisations — Date of the first and last disclosure

As outlined above, the prospective authorisation provisions in the TIA Act generally enable law enforcement agencies to authorise telecommunication service providers to disclose information or documents that may come into existence during a particular future period of time. The OAIC considers that a disclosure occurs each time specified information or a document comes into existence during the authorisation period and is then released by the service provider to the relevant law enforcement agency.

The ‘date of the first disclosure’ means the date the first specified document or piece of information is disclosed to the relevant law enforcement agency. Similarly, the ‘date of the last disclosure’ refers to the date the last specified document or piece of information is disclosed to the relevant law enforcement agency. Consequently, the record should identify the dates of the first and last disclosure of information to the law enforcement agency. These dates may not necessarily correspond to the dates of the start and end of the authorisation period.

How long do providers need to keep records of disclosures?

All records of disclosure must be retained for three years from the date of creation. Copies of records of disclosures given to a carrier or carriage service provider by an associate must also be kept by the carrier or carriage service provider for three years.

What is the role of the Office of the Australian Information Commissioner?

Under s 309 of the Telecommunications Act, the Information Commissioner has the function of monitoring compliance with the record-keeping requirements of ss 306 and 306A of that Act. The OAIC may conduct inspections of telecommunication service providers’ records to ensure they comply with these requirements. There are offences and penalties under the Telecommunications Act for failing to comply with the record-keeping requirements.[14]

For more information about the OAIC’s activities in this area, see Summary of OAIC’s inspection of telecommunications organisations’ records of disclosure under the Telecommunications Act.

For further information

The OAIC has a range of privacy resources on its website to assist telecommunication service providers comply with the Privacy Act.

Service providers should also consider subscribing to the OAIC’s newsletter, OAICnet, which provides news about the OAIC’s activities, publications and other information.

The information provided in this resource is of a general nature. It is not a substitute for legal advice.

Appendix A: Records of disclosure checklist

The purpose of this checklist is to assist telecommunication service providers’ address the record-keeping requirements contained in ss 306 and 306A of the Telecommunications Act.

Appendix B: Disclosure exceptions that impose a record-keeping requirement

Footnotes

[1] Telecommunications Act 1997 (Cth) ss 276, 277 and 278.

[2] Telecommunications Act 1997 (Cth) s 309.

[3] The ss 306 and 306A record-keeping requirements also apply to ‘eligible number-database persons’. Under the Telecommunications Act, the Minister may make a determination that an entity is a number-database person. However, there are currently no determinations in force. Consequently, ‘eligible number-database persons’ are not referred to in this resource.

[4] Telecommunications Act 1997 (Cth) s 271.

[5] Telecommunications Act 1997 (Cth) s 304.

[6] Under ss 180(3) and 180A(2) of the TIA Act, authorised officers may also authorise disclosure of specified information or documents that came into existence before the time the authorisation comes into force.

[7] Telecommunications Act 1997 (Cth) s 306(2)(a).

[8] Telecommunications Act 1997 (Cth) s 306A(2)(a).

[9] Telecommunications Act 1997 (Cth) s 306(3).

[10] Telecommunications Act 1997 (Cth) s 306A(3).

[11] Telecommunications Act 1997 (Cth) ss 306(6) and 306A(6).

[12] Section 2C of the Acts Interpretation Act 1901 states that, in any Act, expressions used to denote ‘persons’ generally includes a body politic or corporate as well as an individual.

[13] Telecommunication (Interception and Access) Act 1979 s 5.

[14] Telecommunications Act 1997 ss 306(7) and 306A(7).