The government’s controversial data retention legislation, under which telcos and ISPs will be required to store a range of metadata in relation to customer activity for two years, will become reality having passed Parliament on 26 March 2015.

The Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014 has been heavily criticised for failing to justify the high level of interference and intrusion into the privacy of ordinary Australians it mandates, but is defended as necessary on safety and security grounds.

The government has said the legislation is needed to make Australians safer from serious crime and threats to national security.

TELCOS AND ISPS OBLIGED TO RETAIN CUSTOMER ‘METADATA’

The new law will oblige Australian telcos and ISPs to store a broad range of customer ‘metadata’ for up to two years including records of telephone calls, mobile phone messaging and email correspondence.

The stored data will include:

  • customer identities
  • type of communication
  • who a customer communicated with
  • the source and destination of the communication
  • the date, time and duration of the communication
  • the location of the equipment used during the communication

Government agencies such as the Australian Federal Police and ASIO will then have the right to access the data – on demand and without a warrant.

As a counterbalance to this power, the Commonwealth Ombudsman will have authority to review government agency records detailing what data has been accessed and how it was used.

The Parliamentary Joint Committee on Intelligence and Security will also have oversight of the use of metadata by the Australian Federal Police and ASIO.

Specifically excluded from the data retention regime is the content of any telecommunications and customers’ internet browsing history.

In response to concerns as to how the data retention regime will impact upon freedom of expression and the media, government agencies, other than ASIO, will require a warrant if they want to access data for the purpose of identifying a journalist’s source.

The government and the opposition rejected further amendments proposed by the Greens and independents which would have, amongst other things, mandated warrants for access to communications data between lawyers and their clients, compelled the destruction of stored metadata after the two year retention period and included a full definition of metadata ‘content’ in the legislation.

THE CRITICISM

The data retention regime has been criticised by privacy experts, civil libertarians, leading telcos and the media who urged a scrapping or dramatic rewrite of the legislation.

Arguments against the regime have focused on its potential to seriously invade privacy, restrict freedom of expression and the ability of journalists to maintain confidential sources, and be vulnerable to data security breaches.

Data about all Australians will be collected and retained for two years – even where there is no link to investigations of serious crimes or threats to national security.

THE COST TO BUSINESS

The upfront capital cost to business of implementing the regime is expected to be between $188 million and $319 million. The Federal government has said it will contribute to the costs of implementing the regime although this is undefined. The legislation allows for grants of financial assistance to be made on a ‘case by case’ basis to telcos and ISPs to assist in meeting compliance costs.

DOES THE LEGISLATION BREACH PRIVACY RIGHTS?

International courts and human rights bodies, including the UN High Commissioner for Human Rights, have found that mandatory blanket data retention regimes breach human rights, and specifically, the right to privacy.

A recent judgment of the Court of Justice of the European Union declared the European Data Retention Directive (largely analogous to the Australian data retention legislation) invalid on the basis it seriously interferes with the fundamental right to privacy and the protection of personal data, without such interference being limited to what is strictly necessary.

THE REGIME SHOULD BE MORE TARGETED

Under some circumstances, data retention will undoubtedly assist in prosecutions, in criminal investigations, and perhaps even in crime prevention. However, opponents of the reforms say there is no substantive evidence to suggest that the blanket regime will achieve its stated objectives of preventing terrorism and reducing serious crime.

It remains to be seen whether the end result will justify the means.