Section 280 Submission Communications Alliance

27January2017

As emailto:

Ms AnneSheehanAssistantSecretaryCommunications SecurityBranch Attorney-General’sDepartment

MsJessicaRobinson

A/gAssistantSecretary

InfrastructureSecurityandResilienceBranch

DepartmentofCommunicationsandthe Arts

RE:Consultationonaccesstoretainedtelecommunicationsdataincivilproceedings

DearAnne,DearJessica,

Thankyouforgivingus theopportunitytoprovidefeedbacktotheMinisterfor Communications andtheArts(Department)andtheAttorney-General’sreviewofaccesstoretained telecommunicationsdatabypartiesincivilproceedings.

TheConsultationPaperposesthreespecificquestionswhichweaddressbelow:

1. Inwhatcircumstancesdopartiestocivilproceedingscurrentlyrequestaccessto telecommunicationsdatainthedatasetoutlinedinsection187AAof theTIAAct[…]?

Thereisnoindustry-wideregisterofsubpoenasandothercivilordersrequiringthedeliveryof informationtolitigantsincivilproceedings.Eachofthemajorcarriersreceivesaregularflowof requestsforinformationfroma largenumberoflawyersactingforcivillitigantsandGovernment agencies.Thereisalsoaregularflowoftelephoneenquiriesregardingwhatinformationmight beavailableandhowtorequestit.Manyrequestsforcivilinformationrelatetoinformationthat C/CSPsdonothave,donothaveatthetimeoftherequestorareunabletoprovide.

Therearesignificantcostsindealingwiththeinquiriesandtheconsiderationandinvestigation process.(See ourcommentsfurtherbelow.)

MajorC/CSPshaveprovidedinformationaboutsourcesofrequestsfordatatotheDepartment andtheAttorney-Generalinmid-2016onaconfidentialbasis.It isrecommendedthatC/CSPs beapproacheddirectlyandindividuallybytheDepartment/Attorney-Generalshouldtheywish toreceiveinformationaboutrequestsfromcivillitigants.However,basedonthetypeofdata usuallyrequestedunderacivilsubpoena,it appearsthatcurrentlycivillitigantsarenot usually seekingproductionof detailedcommunicationsdatathatC/CSPswillberetainingafterthe completionoftheImplementationPhaseoftheDRregime.However,C/CSPsare unableto judgewhethersuchdatawouldbesoughtmoreofteninthefuture.

Ifdatathatisalsobeingretainedunders187AAof theTelecommunications(Interceptionand Access)Act1979(TIAAct)isbeingretainedforpurposesotherthancompliancewiththedata retention(DR)regime(evenif,inadditiontoitsotherpurposes,it continuestobestoredunder

theDRregime),thenthesedatamaybeaccessedincivilproceedingsundersubpoenaora courtorder.

InpracticethismeansthatanydataretainedpriortocompletionoftheImplementationPhase oftheDRregime(13April2017)isaccessibleincivilproceedings.Suchdatamayhavebeen retainedforvaryinglengthsoftimedependingontheindividualC/CSP’sinternalrequirements and/orotherlegalobligationsrequiringthestorage(andsubsequentdeletion)ofdata.

DataretainedaftercompletionoftheImplementationPhaseoftheDRregimeis onlyaccessible ifit hasbeenretainedforpurposesotherthancompliancewiththeDRregime.It isimportantto notethatthesedatawillonlybeaccessibleincivilproceedingsfortheperiodthatthedatahas beenretainedforsuchotherpurposeswhichmaybemoreorlessthanthetwo-yearretention periodoftheDRregime.As anexample,ifdatarequiredtoberetainedundertheDRregimefor twoyearshasonlybeenretainedforsixmonthsforotherpurposes,thenthedatawillnotbe availablefortheremainingeighteenmonthsduringwhichit hasbeenretainedsolelyforthe purposeofcomplyingwiththeDRregime.

WhileIndustrydoesnotseektoprovideanopiniononprivacyorciviljusticeimplicationsofan extendedaccessregime,wewouldliketonotethefollowing:AsIndustryunderstandsit,acivil courtregistrywillusuallyissueasubpoenaat therequestofapartytotheproceedingswithout theregistryhavingregardtothereasonablenessorscopeoftherequestortheprivacyor confidentialityimpactsofdisclosureofthedatabeingsought.Asubpoenamayseek productionofdataaboutanyperson,includingpersonswhoarenotapartytothe

proceedings.Thismeansthatthesubpoenaprocessallowsapartytocivilproceedingstoobtain

accesstodataaboutapersonwhoisnotapartytotheproceedingsandwhomayonlybe vaguelyrelatedtotheproceedings.Inaddition,onlythepartiestotheproceedingsorthe recipientofthesubpoena(inthiscasetheC/CSPwhorespondedtothesubpoena)wouldhave noticethatthedatahavebeenrequestedandarebeingprovidedtothecourtforproduction. Apersonwhoisnotapartytothe proceedingsandwhoserecordsarebeingproducedbythe C/CSPwouldusuallynot bepresentatthesubpoenareturndateandwouldnothavean opportunitytoargueagainstproductionof thedatarelatingtothem.Oncethecourthas receivedthedata,itmaybeverydifficulttocontroltheuse oraccesstothedata.

2. What,if any,impactwouldtherebeoncivilproceedingsif partieswereunableto accessthetelecommunicationsdatasetasoutlinedinsection187AAof theTIA Act?

InthecontextoftheConsultationPaper,thisquestionisconfusing:ifdatahasbeenretainedfor purposesotherthancompliancewiththeDRregime,it isaccessibleincivilproceedings.Ifnot andit isretainedsolelyforDRpurposes,it isnotaccessibleincivilproceedings(asof13 April

2017).Accordingly,it isnot necessarilythecasethatpartiesincivilproceedingsarecurrently

abletoaccessthecommunicationsdatasetasoutlinedinsection187AAoftheTIAAct.

OurunderstandingoftheConsultationPaperisthatthereviewwillconsideranextensionof accesstodatacurrentlyinaccessiblepost13 April2017,ratherthanreducingaccesstocurrently accessibledata(i.e.dataretainedforotherpurposes).

However,shouldaccesstocommunicationsdatabycivillitigantsbefurtherrestricted,wewould expectagreaterlevelofprivacyforindividuals.AsalreadyindicatedintheConsultationPaper, suchimprovedprivacymayoperateasanimpedimenttociviljustice.

Thetrade-offbetweenthetwoappearstobeanoverarchingquestionthatneedstobedealt withbylegislationwhenconsideringtheissueofaccesstometadatainprovidingassistanceto

civiljusticeratherthanleavingituptoC/CSPstodeterminewhocanobtainaccesstoretained datapost13 April2017.

3. Arethereparticularkindsof civilproceedingsorcircumstancesinwhichtheprohibitionin section280(1B)of theTelecommunicationsAct1997shouldnotapply?

Whileindividualmembersof ourorganisationsmayhaveanopiniononthismatter,thequestion mightbebestansweredby civiljusticeandprivacyexperts.

However,giventhatthetelecommunicationsindustrywould berequiredtoassistwiththe executionofanyextendedaccessregime,it isimportanttobearthefollowinginmind:

1. Currently,inrelationtorequestsfordatafromlawenforcementandnationalsecurity agenciesC/CSPsarerequiredtocarefullydistinguishwhethera requestingagencyhas therequiredpowers(i.e.coercive‘powerstoproduce’undertheirownlegislation)and, consequently,whetherdataoughttobereleased.Thisalreadyincreasesuncertainty andliabilityissuesforC/CSPs.(Thisseparatebutrelatedissuehasbeenbroughttothe Department’s/Attorney-General’s attentioninthepastandappearstobeunderinternal investigation.PleaserefertothesectionAccesstocommunicationsdatapursuantto s280of theAct remainsproblematicfurtherbelow.)

Thesituationinrelationtorequestsforinformationincivilproceedingsisalso unnecessarilycomplicated.Itdoesnotmakesensethatsomeinformationisprovided whileotherinformationisnot,basedonapotentiallydifficultandcomplexinvestigation ofhowandforwhatpurposetheinformationwaskeptorusedpriorto13 April2017.

Anyfurtherbroadeningofthesituationthroughadditionaluncertaintyregardingthe legalstatusofthedata (whetherornotitshouldproperlybeprovided)andunderwhat law it isrequestedtobemadeavailablewouldnotbeacceptable.

TheTIAActdidnotstipulatehowC/CSPsmustcomplywiththe TIAAct.However,insome casesC/CSPshavecompliedwiththeirDataRetentionImplementationPlan(DRIP)by ingestingcommunicationsdataintoacentralisedsecuredataretentionsystem(that complieswiththe TIAAct)fromexistingcustomerITsystemsand/ordevelopednew systemsthatdeliverthedataoutlinedins187AAof theTIAAct. Inthisparticularsituation, C/CSPswillneedtodetermineiftherequesteddatahasbeeningestedornotto determinethelegalstatusofthedataandwhetherit canbemadeavailable.

It appearslikelythat anarrowandspecificextensionoftheaccessibilitytodataonlyfor certainkindsofcivilproceedingswouldresultinfurtheruncertaintyforC/CSPsand

indeedleadtoasituationthatwouldrequireC/CSPstoundertakelegalanalysisforeach requesttodisclosedatapriortoreleasing(ordecliningtorelease)therequesteddatafor civilproceedings.

Therefore,manyC/CSPstendtopreferan‘allornothing’approachtothismatter,i.e. eithera continuationofthecurrentlyexistingdisclosurerules (albeitwithaclearer,more limitedregimeofwhichagenciescanlawfullyaccessretainedmetadataorotherdata) oraregimethatallowsaccesstoallretaineddataincivilproceedingsindependentof thecivilmatterunderconsideration.Inanycase,andincludingincaseofanextended accessregime,clearregulationsarerequiredastowhichagenciesandcourtswillbe abletorequestdataandwhetherthesedatacomprisealldataretainedbyC/CSPs, includingdetailedmetadata.Inthiscontextissuesaroundthereimbursementofcosts

associatedwithsuchdatarequestsurgentlyneedtobeaddressed.(Seecomments furtherbelow.)

2. C/CSPsmustnotbeheldliableinrelationtoanydatareleasedorwithheldinrelationto civilproceedings.Currently,s313(5)ands313(6)of theTelecommunicationsAct1997 (Act)affordliabilityprotectiontoproviders,theirofficers,employeesandagentsforacts doneor omittedingoodfaithinconnectionwithhelpthatisreasonablynecessaryfor theenforcementofcriminallawandother securityrelatedactivities.

Theseprotectionsdonotapplytoassistancewithcivilproceedingsandwouldneedto be mirroredforanyassistancesuppliedinthosecases.Wenotethatsuchliability protectionsincivilproceedingsarerequiredindependentofanextendedscopeofdata accessibleincivilproceedings.C/CSPsalsorequestthatdatamadeavailableinrelation tocivilproceedings(andthefactthatdatahasbeendisclosed)beinadmissibletoany otherproceedingsbutthespecificcivilproceedingforwhichtheyweresoughtand madeavailablebyC/CSPs.ThiswillincreaselegalcertaintyforC/CSPsand,thereby,

mayassistwithasmoothdisclosureprocess.

3. Ifthescopeofthedatathatisbeingaccessibleincivilproceedingsweretobe extendedthroughexclusionstos280oftheAct(oranyotherinstrument),C/CSPsmust notbearanyadditionalcostsasaresultofanincreasedvolumeofrequestsoranyother consequencesofthesechanges.Anyexpandedscopeofdataaccesswillresultin substantialadditionalcosts,includingadditionalstaffrequiredtohandle anincreased volumeorhighercomplexityof requestsand/orcapitalexpenditurerequiredtoupdate ordevelopdatabasesandinterrogationtools etc.

Itshouldbenotedthat C/CSPshavedifficultyseekingrecoveryofcostsforcomplying withsubpoenas.Pursuanttos314(2)oftheAct,C/CSPsmayrecoverthecostofassisting anagencyauthorisedtorequestsuchassistanceundertheDRregime.However,this provisiondoesnotextendtorespondingtosubpoenasfromotheragencies.

InthecaseofcivilrequeststhereisgenerallyarightofcostrecoveryavailabletoC/CSPs associatedwiththecivilcourtsystem.Unfortunately,thecompensationofferedisoften inadequateand/ornotpaidwhendue. Researchindicatesthatapproximately40%of invoicesissuedseekingpaymentofreasonablecostsofcomplyingwithasubpoenaare notpaid.TheprocessplacesanonerousfinancialburdenonC/CSPstocomplywithcivil subpoenas.Theamountsinvolvedareusuallysmallanddonotjustifythecosts associatedwithpursuingrecoveryat law.IfGovernmentdecidedtoincreasethescope ofdatatobemadeavailablefor useincivilproceedings,C/CSPsrequestthata

mechanismbeincludedfor C/CSPstochargeupfront(alsoseecommentsbelow)forthe costofconsideration,investigationand,whereavailable,thecostofrecoveringand deliveringthedatainresponsetocivilrequests.Therightofcostrecoveryshouldinclude anabilitytorecoverallcapitalexpenditurenecessarytoputinplaceappropriate

systemsandprocedures.Suchanapproachtocostrecoverywouldhelpensurethatthe informationisrequestedonlywheregenuinelyrequiredandthattheburdenof complyingwiththeexpandeddutydoesnot operateasaburdenon C/CSPs’

customers.

4. Anyreimbursementofcosts(e.g.viaafeeschedule)oughttobeupfront and independentofthetimingofthefinancialsettlementofthecase asit iscommon practicewithmanyotherservicesprovidedintheprivateorpubliceconomy.Thiscould bedoneina similarmannertothefeesleviedbyASICfortheprovisionofinformationon companieslistedintheirdatabases.Asitstands,alreadytodayC/CSPsoftenhavetogo

throughsignificantefforttorecovertheircostsfor assistancerequests.Werethevolume ofrequestsfordatatoincrease,suchupfrontcostrecoverywouldbecomeimperative.

5. Ifthescopeofdataaccessibleincivilproceedingsweretobeincreased,itoughttobe clearthatdealingwithsuchrequestsmaynotbeamatterofhighestpriorityforC/CSPs whosestaffalsodealwithimportantmattersofnationalsecurityandprovideassistance toenforcementincriminalproceedings.Thismeansthatrequestsfordataincivil proceedingsoughttobesubmittedtoC/CSPswithsufficientleadtime,e.g.fourweeks, andtheunderstandingthatnationalsecurityandcriminalmattershavea higherpriority.

As anindustry,C/CSPswouldprefertoseeaconsistent,transparentandpracticallegalprocess putinplacethatwillenableC/CSPstorespondtolawfulrequestsfromallcourtsandagenciesin amannerthatprotectsacustomer’spersonalinformationandenablesC/CSPstorecovertheir costs,includingfromcivillitigants.

Accesstocommunicationsdatapursuanttos280oftheActremainsproblematic:

Inthepast,IndustryhasraisedconcernswiththeDepartment/Attorney-Generalregardingthe currentrulesaroundagencieswhohaveaccesstometadatapursuanttos280oftheActand therecoveryofcostsassociatedwithaccessrequests.

As thisissueislikelytobeexacerbatedweretheaccessregimetobeextended,wewouldliketo reiteratesomeoftheseconcerns.

ThepowertorequestinformationundertheActwaswithdrawnfroma numberofagencieswith theintroductionoftheDRregimewhichincludedtheintroductionofthedefinitionof EnforcementAgency.

Pursuanttos280(1)(b)of theAct, C/CSPsmustrespondtoinformationrequestswhere“the disclosureor useisrequiredorauthorisedby or underlaw”.Severalagenciesthatwereexcluded fromthelist ofEnforcement Agencieswiththeintroductionof theDRregimearenowsimply relyingonpowersintheirownstatutestorequestdata.Suchagenciesincludelocalcouncils (whorequestaccesstodatatomanageminortrafficoffences,unlawfulremovaloftrees,illegal rubbishdumpingandbillposters),theRSPCA,theEnvironmentProtectionAuthorityandstate coroners,tonamea few.Theuseoftheseotherpowerstoaccesscommunicationsdata appearstocircumventprotectionsintheActandTIAAct.Forexample,thefollowingsectionsof theTIAActwouldnotapplytoagenciesusingtheirownpowerstorequestcommunications data:

178(3):Theauthorisedofficermustnotmaketheauthorisationunlessheorsheis satisfied thatthedisclosureisreasonablynecessaryfortheenforcementofthecriminallaw.

180F: Authorisedofficerstoconsiderprivacy

186A:Obligationtokeeprecords

Inaddition,Industryconsidersthat,asC/CSPsrespondtorequestsfordatapursuantto s280of theAct,s313ands314ofthe Act oughttoapplyandIndustryoughttobeabletorecoverany costsassociatedwiththeprovisionoftheassistancethathasbeengiven.Thisiscurrentlyin disputewithmanyagencieswhorelyonpowersoutsideoftheActand,consequently,donot reimburseC/CSPsforthecostsincurred.

WeinvitetheDepartment/Attorney-Generaltoclarifythelegalpositiononthesetwomatters.

Wealsonotethatanyconsiderationsaroundtheavailabilityandaccessibilityofdataoughtto

takeintoaccounttheProductivityCommission’sDraftReportDataAvailabilityand Use.

Pleasecontactusifyouhavefurtherquestionsor wouldliketodiscuss. Yourssincerely,

JohnStantonChrisAlthaus

ChiefExecutiveOfficerChiefExecutiveOfficer

CommunicationsAllianceAustralianMobileTelecommunicationsAssociation