Telecommunications (Interception and Access) Amendment Bill 2023 [2023] AUPJCHR 88 (6 September 2023)

	Home \| Databases \| WorldLII \| Search \| Feedback Australian Parliamentary Joint Committee on Human Rights

Purpose	This bill (now Act) amended sections 65 and 137 of the Telecommunications (Interception and Access) Act 1979 regarding the communication, use and recording of foreign intelligence information
Portfolio	Attorney General
Introduced	House of Representatives, 7 August 2023 Finally passed both Houses, 9 August 2023
Rights	Privacy; effective remedy; life; torture or cruel, inhuman or degrading treatment or punishment

1.57 This bill (now Act) amended sections 65 and 137 of the Telecommunications (Interception and Access) Act 1979 (the Act) regarding the communication, use and recording of foreign intelligence information. Foreign intelligence information is defined as information obtained under certain warrants for the collection of foreign intelligence.^[79]

1.58 Prior to the amendments passed by this bill, subsection 65(1) allowed the Director-General of Security (Director-General) or a person authorised by the Director-General to communicate to another person, in accordance with certain provisions in the Australian Security Intelligence Organisation Act 1979 (the ASIO Act), lawfully intercepted information (other than ASIO computer access intercept information) and interception warrant information.^[80] Subsection 65(2) provided that the person to whom this foreign intelligence information was communicated may communicate that information to such persons, and in such manner, and use that information for such purposes as approved by the Attorney-General. They could also make a record of that information. Section 137 of the Act provided that the Director-General may, in accordance with certain provisions in the ASIO Act,^[81] communicate lawfully accessed information, preservation notice information and stored communications warrant information to another person.^[82] It also permitted the person to whom foreign intelligence information had been communicated to communicate, use and make record of that information to such persons and in such a manner, and for such purposes, as approved by the Attorney-General.^[83]

1.59 This bill amended these sections to provide that the Director-General may, for the purposes (if any) approved by the Attorney-General and subject to the conditions (if any) specified by the Attorney-General, communicate foreign intelligence information to another person (the second person), other than those persons to whom the Director-General could already communicate information.^[84] In the case of foreign intelligence information communicated pursuant to new subsection 65(1A), the Director-General may communicate the information either personally or by a person authorised by the Director-General.^[85] The second person to whom the foreign intelligence information is communicated, as well as any other person to whom information is communicated, is also permitted to communicate the information to 'another person', and use and make a record of it.^[86] A person who receives foreign intelligence information^[87] is required to communicate, use or make a record of that information 'in the proper performance or exercise of the person's functions, duties or powers'.^[88]

1.60 This bill, in effect, removed the requirement that the Attorney-General specify the persons, manner and purposes for which information may be communicated and permits the Director-General and other persons to whom foreign intelligence information is communicated to communicate that information to 'another person' and use and make record of the information.^[89]

Rights to privacy; effective remedy; life; and prohibition against torture or cruel, inhuman or degrading treatment or punishment

1.61 The statement of compatibility states that the rights to life and security of person are promoted by the bill insofar as the measure enhances the ability of agencies to identify and respond to national security threats. It states that foreign intelligence information plays a critical role in enabling intelligence agencies to identify, mitigate and combat such threats.^[90] If the measure facilitates the investigation, disruption and prevention of serious crimes against persons (such as terrorist attacks), it may promote the rights to life and security of the person. The right to life imposes an obligation on the state to protect people from being killed by others or identified risks.^[91] The right imposes a duty on States to take positive measures to protect the right to life, including an obligation to take adequate preventative measures in order to protect persons from reasonably foreseen threats, such as terrorist attacks or organised crime, as well as an obligation to take appropriate measures to address the general conditions in society that may threaten the right to life, such as high levels of crime and gun violence.^[92] Furthermore, States have an obligation to investigate and, where appropriate, prosecute perpetrators of alleged violations of the right to life.^[93]

1.62 However, by broadening the scope of information sharing provisions in the Act with respect to foreign intelligence information, including potentially expanding the persons to whom, and the circumstances in which, foreign intelligence information may be communicated, used and recorded, the measure engages and limits the right to privacy. The statement of compatibility acknowledges the right to privacy is limited by enabling the communication of foreign intelligence information, which could include personal information, to 'another person', who may then also use, communicate to other persons, and make a record of, the information.^[94] The right to privacy includes respect for informational privacy, including the right to respect for private and confidential information, particularly the storing, use and sharing of such information.^[95] It also includes the right to control the dissemination of information about one's private life. The right to privacy may be subject to permissible limitations which are provided by law and are not arbitrary. In order for limitations not to be arbitrary, the measure must pursue a legitimate objective, and be rationally connected (that is, effective to achieve) and proportionate to achieving that objective. An assessment is provided below as to this.

1.63 Further, as the amended provisions do not specify who can receive, use, share and record foreign intelligence information and there appears to be no limit on the number of persons who may onwards disclose the information, it is unclear whether other human rights may be engaged by the measure. For example, if the measure authorised the sharing of foreign intelligence information with foreign persons, such as foreign police, intelligence or security agencies, and this resulted in the investigation and prosecution of a person for an offence that is punishable by the death penalty in that foreign country, the measure may also engage and limit the right to life.^[96] The right to life imposes an obligation on Australia to protect people from being killed by others or from identified risks. While the International Covenant on Civil and Political Rights does not completely prohibit the imposition of the death penalty, international law prohibits states which have abolished the death penalty (such as Australia) from exposing a person to the death penalty in another state.^[97] The provision of information to other countries that may be used to investigate and convict someone of an offence to which the death penalty applies is also prohibited.^[98]

1.64 Additionally, if the sharing of foreign intelligence information, including personal information, with foreign persons, could expose individuals to ill treatment this may engage the prohibition against torture or other cruel, inhuman or degrading treatment or punishment. International law absolutely prohibits torture and cruel, inhuman or degrading treatment or punishment.^[99] There are no circumstances in which it will be permissible to subject this right to any limitations. The statement of compatibility does not acknowledge that the right to life or the prohibition against torture and cruel, inhuman or degrading treatment or punishment may be engaged by the bill.

1.65 Furthermore, it is not clear that a person would have access to an effective remedy if their rights were violated as a result of the communication and use of foreign intelligence information under these sections (for example, a person's right to privacy may be violated if their personal information was inappropriately used or disclosed without authorisation). The right to an effective remedy requires access to an effective remedy for violations of human rights.^[100] This may take a variety of forms, such as prosecutions of suspected perpetrators or compensation to victims of abuse. While limitations may be placed in particular circumstances on the nature of the remedy provided (judicial or otherwise), States parties must comply with the fundamental obligation to provide a remedy that is effective.^[101] The statement of compatibility does not acknowledge that the measure may have implications for the right to an effective remedy and as such, there is no human rights compatibility assessment in this regard. The right to an effective remedy is absolute in requiring there be a remedy that is effective.

1.66 The stated objective of the measure is national security.^[102] The statement of compatibility states that the amendments are necessary to support information sharing practices that are critical to the protection of Australia's national security.^[103] It states that the measure enables agencies to use and communicate foreign intelligence information to persons who are best placed to take actions, mitigate risk and protect national security interests.^[104]

1.67 In general terms, national security has been recognised as being capable of constituting a legitimate objective for the purposes of international human rights law and, insofar as the sharing and use of foreign intelligence information assists intelligence agencies to identify and disrupt national security threats, the measure may be rationally connected to this objective.

1.68 However, in order to establish that this objective constitutes a legitimate one in the context of this specific measure, it must be demonstrated that there is a pressing and substantial concern which gives rise to the need for the measure. While the statement of compatibility provides general statements regarding the necessity of the measure for protecting Australia's national security, it neither articulates the specific national security threats which this measure seeks to address nor explains why the previous information sharing provisions were insufficient to achieve the stated objective, particularly given these provisions already provided broad authorisation to communicate, use and record foreign intelligence information. In this regard, the UN High Commissioner for Human Rights has stated, with respect to surveillance and communications interception legislation, that '[v]ague and overbroad justifications, such as unspecific references to "national security" do not qualify as adequately clear laws'.^[105] On the basis of the information provided in the explanatory materials, it has not been demonstrated that the measure is necessary to address a pressing and substantial concern and as such, it is not possible to conclude that the measure pursues a legitimate objective for the purposes of international human rights law.

1.69 A key aspect of whether a limitation on a right can be justified is whether the limitation is proportionate to the objective being sought. In this respect, it is necessary to consider a number of factors, including whether a proposed limitation is sufficiently circumscribed and whether it is accompanied by sufficient safeguards, including access to oversight and review. The UN Commissioner for Human Rights has emphasised the importance of subjecting intelligence sharing to the principles of 'legality, strict necessity and proportionality'. It stated that there 'must be rigorous rules for using and storing the data obtained [by secret surveillance] and the circumstances in which the data collected and stored must be erased need to be clearly defined, based on strict necessity and proportionality'.^[106]

1.70 The breadth of the measure is relevant in considering whether it is sufficiently circumscribed. Indeed, the UN Human Rights Committee has stated that legislation must specify in detail the precise circumstances in which interferences with privacy may be permitted.^[107] In the context of mass surveillance and other broad measures to collect and retain communications data, the European Court of Human Rights has emphasised the importance of precisely circumscribing the extent of interference with fundamental rights, notably the right to privacy, to ensure that the interference is limited to what is strictly necessary.^[108]

1.71 The measure permits the communication of foreign intelligence information to 'another person' and the use and recording of that information. However, the persons or class of persons who fall into the category of 'another person' are not specified in the bill and there does not appear to be any limit on the number of persons who can receive and communicate the information. This raises serious concerns regarding the breadth of the measure, as it is not clear on the face of the legislation the persons who are authorised to use and share the information, and thus the circumstances in which interferences with the right to privacy are permitted. The greater the number of persons to whom personal information may be shared and used, without the consent of the individual concerned, the more likely the interference with privacy will be substantial and thus less likely to be proportionate.

1.72 There also does not appear to be any legislative limit on the purposes for which the information may be used, so long as it is for the purposes (if any) approved by the Attorney-General and, where it relates to certain types of information,^[109] in the proper performance or exercise of the person's functions, duties or powers. The explanatory memorandum states that if the Attorney-General decides not to approve any purposes, foreign intelligence information may still be communicated pursuant to the relevant sections.^[110]

1.73 The statement of compatibility identifies the following safeguards accompanying the measure:

1.74 It is not clear that these safeguards would be sufficient to protect the right to privacy in practice.^[112] This is because discretionary safeguards, such as the Attorney-General's ability to approve purposes or impose conditions with respect to the communication and use of information, are less stringent than the protection of statutory processes as there is no requirement to implement them. Indeed, the explanatory materials contemplate that the Attorney-General may not approve any purposes or impose any conditions, in which case information may broadly be communicated to 'another person'. The requirement that the recording, use and communication of information be in the 'proper performance or exercise of the person's functions, duties or powers' has limited safeguard value as it only applies to specific subsections. Further, it is not clear what the scope of a person's functions, duties or powers are, as the persons to whom information may be communicated are not specified.

1.75 Additionally, there do not appear to be any oversight mechanisms with respect to the measure. The European Court of Human Rights has highlighted the importance of external supervision and remedial measures in the context of governments 'transferring and sharing amongst themselves intelligence retrieved by virtue of secret surveillance'.^[113] The court found 'external, preferably judicial, a posteriori control of secret surveillance activities, both in individual cases and as general supervision' to be of particular importance.^[114] The UN High Commissioner for Human Rights has also stated that intelligence-sharing 'should be authorized, reviewed and supervised by independent bodies at all stages'.^[115] The measure does not contain such a control mechanism whereby an independent, preferably judicial, authority has oversight or control over the provisions which authorise the onwards disclosure of foreign intelligence information.

1.76 Further, if the measure violated a person's right to privacy or other rights, it is not clear that they would have access to an effective remedy in practice. This is because the person whose privacy is interfered with is highly unlikely to be aware that their personal information is being used, shared and recorded by other persons as such information is obtained by covert means.^[116]

1.77 In considering what constitutes an effective remedy where personal information is being collected in the context of covert surveillance activities, United Nations (UN) bodies and the European Court of Human Rights have observed that while effective remedies can take a variety of forms, they must be known and accessible to anyone with an arguable claim that their rights have been violated.^[117] It is not clear that a person whose privacy might be interfered with under this measure would ever be made aware of that fact (if it does not lead to a prosecution). In such circumstances, it does not appear that such a person would have access to adequate review mechanisms or to an effective remedy for any potential violation of their right to privacy.

1.78 It is also not clear whether any safeguards exist to ensure that personal information is not shared with a foreign person or agency in circumstances that could expose a person to the death penalty or lead to a person being tortured, or subjected to cruel, inhuman or degrading treatment or punishment.

1.79 In conclusion, while the general objective of national security is capable of constituting a legitimate objective, it is not clear that this specific measure is necessary and addresses a pressing and substantial concern. The breadth of the measure, including the lack of clarity as to whom foreign intelligence information may be communicated and the purposes for which information may be used, shared and recorded, raises concerns that the measure is not sufficiently circumscribed. Noting that many of the safeguards identified are discretionary, it is not clear that they are adequate in all circumstances and in relation to all rights that may be limited. As such, there is a risk that the measure constitutes an arbitrary limitation on the right to privacy and, in circumstances where the person whose privacy might have been interfered with is unaware of that fact, there does not appear to be access to an effective remedy for any potential violation of their rights. Additionally, if information is communicated with foreign persons or agencies where there are substantial grounds for believing there is a real risk that disclosure of information to that person may expose a person to the death penalty or to torture or cruel, inhuman or degrading treatment or punishment, the measure risks being incompatible with Australia's obligations with respect to these rights.

1.80 The committee considers that this bill, now Act, in broadening the scope of information sharing provisions with respect to foreign intelligence information may promote the rights to life and security of person insofar as it facilitates the sharing of intelligence information for the purposes of identifying and disrupting threats to Australia's national security. However, the committee also notes that by authorising the sharing, use and recording of foreign intelligence information, the measure engages and limits the right to privacy. The committee notes that it is unclear whether the measure may have implications for other human rights. For example, if the measure facilitated the sharing of foreign intelligence information with foreign persons, such as foreign police or intelligence agencies, it may have implications for the right to life and the prohibition against torture or other cruel, inhuman or degrading treatment or punishment.

1.81 The committee acknowledges that foreign intelligence information can play a critical role in enabling intelligence agencies to perform their functions and keep Australia safe. However, the committee considers it has not been demonstrated in the statement of compatibility that this specific measure is necessary and addresses a pressing and substantial concern – noting that no information has been provided in respect of its necessity. With respect to proportionality, the committee considers that it does not appear that the measure is sufficiently circumscribed, having regard to its breadth, or accompanied by sufficient safeguards, noting that discretionary safeguards are not as stringent as statutory protections. As such, the committee considers there is a risk that the measure may constitute an arbitrary limitation on the right to privacy, and affected persons may not have access to an effective remedy. Additionally, if information is communicated with foreign persons or agencies where there are substantial grounds for believing there is a real risk that disclosure of information to that person may expose a person to the death penalty or to torture or ill-treatment, the committee considers there is a risk the measure would not be compatible with Australia's obligations with respect to these rights.

1.82 The committee notes with significant concern from a scrutiny perspective that this bill passed both Houses of Parliament two sitting days after its introduction. As a result, the committee was unable to scrutinise this legislation and engage with the Attorney-General as to its compatibility with human rights while it was before Parliament.

^[84] Scheduled 1, item 1, proposed subsection 65(1A) and item 7, proposed subsection 137(1A). The persons to whom the Director-General could already communicate information include those persons to whom information may be communicated under subsections 65(1), 64(2), 137(1) and 136(2), including an ASIO employee, ASIO affiliate or IGIS official.

^[91] International Covenant on Civil and Political Rights, article 6(1) and Second Optional Protocol to the International Covenant on Civil and Political Rights, article 1. UN Human Rights Committee, General Comment No. 6: article 36 (right to life) (2019) [3]: the right ‘concerns the entitlement of individuals to be free from acts and omissions that are intended or may be expected to cause their unnatural or premature death, as well as to enjoy a life with dignity’.

^[92] UN Human Rights Committee, General Comment No. 6: article 36 (right to life) (2019) [21], [26]. See also UN Human Rights Committee, General Comment No. 6: article 6 (right to life) (1982) [5].

^[93] UN Human Rights Committee, General Comment No. 6: article 36 (right to life) (2019) [27]. At [28], the UN Human Rights Committee has stated that investigations in alleged violations of the right to life ‘must always be independent, impartial, prompt, thorough, effective, credible and transparent’. Further, the right to security of the person requires the state to take steps to protect people against interference with personal integrity by others, see International Covenant on Civil and Political Rights, article 9(1).

^[96] International Covenant on Civil and Political Rights, article 6(1) and Second Optional Protocol to the International Covenant on Civil and Political Rights, article 1.

^[97] Second Optional Protocol to the International Covenant on Civil and Political Rights.

^[98] UN Human Rights Committee, Concluding observations on the fifth periodic report of Australia, CCPR/C/AUS/CO/5 (2009) [20]. The UN Human Rights Committee further raised its concern that Australia lacks 'a comprehensive prohibition on the providing of international police assistance for the investigation of crimes that may lead to the imposition of the death penalty in another state', and concluded that Australia should take steps to ensure it 'does not provide assistance in the investigation of crimes that may result in the imposition of the death penalty in another State'.

^[99] International Covenant on Civil and Political Rights, article 7; Convention Against Torture and Other Cruel, Inhuman or Degrading Treatment or Punishment.

^[101] See, UN Human Rights Committee, General Comment 29: States of Emergency (Article 4), (2001) [14].

^[105] UN High Commissioner for Human Rights, The right to privacy in the digital age, A/HRC/39/29 (2018) [35]. In its concluding observations on New Zealand, the UN Human Rights Committee raised concerns about 'the absence of a clear definition of the terms "national security" and "private communication" in the Telecommunications (Interception Capability and Security) Act 2013': UN Human Rights Committee, Concluding observations on the sixth periodic report of New Zealand, CCPR/C/NZL/CO/6 (2016) [15].

^[106] UN High Commissioner for Human Rights, The right to privacy in the digital age, A/HRC/39/29 (2018) [37].

^[107] NK v Netherlands, UN Human Rights Committee Communication No.2326/2013 (2018) [9.5].

^[108] Digital Rights Ireland Ltd v Ireland, European Court of Human Rights (Grand Chamber), Joined Cases C-293/12 and C-594/12 (2014) [65].

^[109] The requirement that the communication, use and recording of information be 'in the proper performance or exercise of the person's functions, duties or powers' only relates to persons who have received information under subsections 65(1) and 137(1), which relate to lawfully intercepted information, interception warrant information, lawfully accessed information, preservation notice information and stored communications warrant information.

^[112] European Court of Human Rights jurisprudence offers some useful guidance as to minimum safeguards with respect to the right to privacy in the context of secret surveillance measures, including 'the procedure to be followed for examining, using and storing the data obtained; the precautions to be taken when communicating the data to other parties; and the circumstances in which recordings may or must be erased or destroyed': Szabó and Vissy v Hungary, European Court of Human Rights, Application No. 37138/14 (2016) [56].

^[113] Szabó and Vissy v Hungary, European Court of Human Rights, Application No. 37138/14 (2016) [78]. The UN Human Rights Committee has also recommended that States parties provide for 'judicial involvement in the authorization or monitoring of surveillance measures' and consider establishing 'strong and independent oversight mandates with a view to preventing abuses'. See, UN Committee on Human Rights, Concluding observations on the fourth periodic report of the United States of America, CCPR/C/USA/CO/4 (2014) [22]. See also UN Special Rapporteur on the right to privacy, Draft Legal Instrument on Government-led Surveillance and Privacy, Version 0.6 (2018), p. 16.

^[114] Szabó and Vissy v Hungary, European Court of Human Rights, Application No. 37138/14 (2016) [79]. The Court stated: '[t]he significance of this control cannot be overestimated in view of the magnitude of the pool of information retrievable by the authorities applying highly efficient methods and processing masses of data, potentially about each person, should he be, one way or another, connected to suspected subjects or objects of planned terrorist attacks'.

^[115] UN High Commissioner for Human Rights, The right to privacy in the digital age, A/HRC/39/29 (2018) [39], see also [21] and [40].

^[116] In the context of information obtained by secret surveillance see Roman Zakharov v Russia, European Court of Human Rights, Grand Chamber, Application No. 47143/06 ( 2015) [233].

^[117] Report of the Office of the United Nations High Commissioner for Human Rights on the right to privacy in the digital age (A/HRC/27/37) [40]; Szabó and Vissy v Hungary, European Court of Human Rights, Application No. 37138/14 (2016) [86]. See also Roman Zakharov v Russia, European Court of Human Rights, Grand Chamber, Application No. 47143/06 (2015) [234], [287] and Klass and Others v Germany, European Court of Human Rights, Plenary Court, Application No. 5029/71 (1978) [57].

Australian Parliamentary Joint Committee on Human Rights

Telecommunications (Interception and Access) Amendment Bill 2023 [2023] AUPJCHR 88 (6 September 2023)

Telecommunications (Interception and Access) Amendment Bill 2023[78]

Telecommunications (Interception and Access) Amendment Bill 2023^[78]