Meetings on Data Retention with the AG

Question No. 26

Senator Ludlam asked the following question at the hearing on 29 May 2013:

Senator LUDLAM: ... I understand there were consultations occurring in an earlier iteration of the data retention policy around 2009. ...

Senator LUDLAM: That is fascinating. How many meetings were there? Mr Wilkins: I do not know.

Senator LUDLAM: Is that because these things did not have any formal standing as such?

Mr Wilkins: There were two, apparently.

Senator LUDLAM: Okay, there we go! We are making progress: there were two meetings. It sounds as though you might need to take on notice who actually initiated them. If you are not happy to-

Mrs Smith: I can answer that.

Mr Wilkins: Catherine did!

Senator LUDLAM: Wonderful. We are making progress.

Mrs Smith: Those meetings were initiated by me, as Mr Wilkins said. I went about seeking the advice of industry, which I do in my daily job in assisting the Attorney in administering the Telecommunications (Interception and Access) Act. It was brought to our attention by agencies that they were having issues with data no longer being collected or retained by industry, so they were essentially meetings to ascertain what kind of information they were keeping and no longer keeping so that we could advise government accordingly. Senator LUDLAM: Thank you, that is helpful. And you chaired those meetings with internet service providers?

Mrs Smith: I did indeed, yes.

Senator LUDLAM: Are you able to provide us with the dates when those meetings occurred and any such records as exist of the meetings themselves?

Mrs Smith: I can certainly take that on notice. From memory, one was, I think, in March and one was in September, but I will definitely take those on notice-

Senator LUDLAM: Yes, if you could. Mrs Smith: and as to who attended.

Senator LUDLAM: I suspect you will not be interested in providing me with names-that is fine-but any of the commercial participants who participated?

Mrs Smith: Yes, I do not have problems with providing that on notice.

Senator LUDLAM: That is much appreciated, thank you. ...

Senator LUDLAM: Mrs Smith, you chaired a consultative group around industry. What was the general tenor of industry's response to the data retention proposal?

Mrs Smith: I would need to go back to the minutes of the meeting. I understand that a lot of industry give their comments on an in-confidence basis. I would have to go back to those comments before I could disclose. Generally industry are always very keen to work with us on how we can appropriately modernise the legislation to the best benefit of law enforcement and their own interests.

Senator LUDLAM: Could I ask you to table those minutes for us.

Mr Wilkins: Can we take that on notice?

Senator LUDLAM: Sure; I will play along.

The answer to the honourable senator's question is as follows:

Two industry consultation meetings were held in 2009.

The meetings were held on 26 August 2009 and 30 November 2009.

The meeting of 26 August 2009 covered several relevant topics: a presentation on the European Data Retention Directive and associated ETSI technical standards; what is occurring internationally; work done so far; storage models; and consultation strategy.

The meeting of 30 November 2009 covered the following; overview of developments; AGD policy considerations; technical issues raised; and way forward.

While it was suggested that the Department may be able to provide the names of commercial participants, on reflection it is considered that identifying the private sector organisations that participated would jeopardise industry's willingness to participate in further consultative forums. The Department works very closely with the telecommunications industry on administering the interception regime. This requires law enforcement agencies, national security agencies and the telecommunications industry to be able to discuss issues that affect them with government.

No formal minutes were taken of the industry consultation meetings rather a general, non-identifying summary of industry views was prepared following the two meetings.

Industry suggested that a two year retention period was too onerous. One suggestion from industry was to retain IP data for six months telephone data for twelve months.

Industry asked whether the same terms of access to telecommunications data by agencies will continue.

Industry preferred a centralised storage model as it has advantages for normalising inconsistent data from C/CSPs into a common format. The centralised database would be operated by on or behalf of the government.

Industry stated that data retention would be costly and industry should be compensated.

Aspects of costs include:
 Establishing infrastructure to capture data currently not collected
 Storing collected data for required periods, and
 Transmitting collected data to a central location (if a centralised storage model is chosen).

Industry had various divergent views on whether data retention should include the collection and storage of IP data.

Some industry participants proposed a voluntary industry code supported by statute for data retention, rather than mandatory data retention.
Industry was concerned its obligations under data retention would conflict with its obligations under the Privacy Act 1988. Industry suggested the data retention regime be adjusted or that industry get an exemption from relevant obligations under the Privacy Act.

One industry participant submitted data retention was not an appropriate and proportionate measure within a democratic society and not necessary to safeguard national and public security related interests.