The New Metadata Retention Laws & Organisation’s
Published on October 13, 2015 by Patricia Monemvasitis and Kim Leontiev
The New Metadata Retention Laws start today (13/10/15) – Is your organisation affected? Is your organisation prepared?
From October 13 2015, the data retention amendments to the Telecommunications (Interception and Access) Act 1979 (TIAA) come into force imposing a mandatory requirement that a wide range of information known as “metadata” to be retained by certain persons and organisations with a failure to do so attracting a civil penalty of up to $10,800 per infringement. In an interview with ABC Radio this morning (13/10/15), the Attorney-General, George Brandis, characterised the data retention laws as “an important national security obligation on Internet Service Providers (ISPs), – a clear emphasis on the seriousness of compliance. Further, as “metadata” can constitute “personal information” under the Privacy Act (1995) (Cth), there may be additional obligations under the Australian Privacy Principles to consider even though the Privacy Act did not previously apply to a business or organisation – for example because of the small business exemption. Given these changes, it is important to consider whether and how your business or organisation might be affected and what you might need to do to prepare. This post provides a short overview to assist.
1. What is metadata?
- Metadata is described in the new Section 187AA of the TIAA as information as to the:
- Source of communication: identifiers of the service account or device from which the communication was sent by means of that service
- Destination of a communication: identifiers of the account, device or relevant service to which the communication has been sent or forwarded, routed or transferred (including attempt of each)
- Date, time, duration of communication or connection to a device or service
- Type of communication (e.g. voice, sms, email, chat, forum, social media) or of a relevant service used in connection with a communication (e.g. ADSL, Wi-Fi, VoIP, cable, GPRS, VoLTE, LTE).
- Location of equipment used in a connection with a communication.
Loosely speaking, it is all the information about a communication apart from the actual substance of the communication itself. Web-browsing history, however, is not required to be kept under a specific exemption per Section 187A(4)(b).
2. Who needs to retain it?
The new Section 187A of the TIAA contains the core mandatory obligation that a “service provider” (defined as a person who operates a “relevant service”) retain metadata for a period of two years.
To understand whether or not one is a “service provider” it is therefore necessary to consider whether or not one is providing a relevant service as defined in Section 187A(3). Section 187A(3) provides that a relevant service is:
- A service for carrying communications or enabling communications to be carried by means of guided or unguided electromagnetic energy or both; and
- that is operated by a carrier or internet service provider (ISP); and
- that the person operating the service owns or operates in Australia, infrastructure that enables the provision of any of its relevant services.
The definition of communications under the Telecommunications Act 1997 (Cth) (TA) is significantly broad capturing conversation and a message (or any part thereof) whether in the form of: speech, music, sound, data, text, visual images (animated or not), signals, as well as any other form or combination of forms.
ISPs (providers of internet carriage services to the public) will need to comply with the metadata retention requirements under Section 187A in respect of the internet access services suppled, as will some carriers – the definition of which is more layered.
The definition of carrier under the TIAA involves two types of entities:
1. a holder of a carrier licence under the Telecommunications Act;
2. a carriage service provider (CSP).
A carrier licence is required where a person is the owner of a telecommunications network unit (one or more line links of more than 500 metres connecting distinct places in Australia) and supplies via that network unit (either alone or jointly with another) a carriage service to the public. Carriers will therefore typically be telecommunication providers (Telco’s) such as telephone companies and some ISPs that own the network infrastructure via which they provide the internet service to the public.
A CSP on the other hand, is defined through 5 categories, the two more relevant of which may have a broad application.
CSPs use a telecommunications network unit to supply carriage services (a service for carrying communications by means of guided and/or unguided electromagnetic energy) to the public, but do not require a carrier licence as they do not own the network unit used for the service. A person might also be a CSP as an intermediary provider –that is, one who arranges for reward a supply of a carriage service to a third person under an agreement for supply within a commercial relationship.
3. Is my business or organisation required to retain it
While many carriage services such as internet access and telephone services are the domain of ISPs and Teleco’s, the broad definition of a “carriage service” means that there will be many other such services that may concern business and organisations other than the larger CSPs, ISPs and carriers.
For example, a local area network (LAN) linking several computers or other devices such as in an office or organisational space may be carriage service if the distance is 500 metres or greater between the two points. The same applies to a range of other services such as wireless local area networks (WLAN), Wi-Fi services, internal telephony services and virtual private networks (VPNs). In such a case, the metadata conveyed between the devices over the LAN or other of the above services would need to be retained by the service provider as this would be a service separate from an internet connection (also used by the devices on the LAN/WLAN or Wi-Fi), in respect of which the ISP would be separately responsible for the retention of the metadata. The services and the obligation to retain the metadata for each must therefore be treated distinctly.
A further way that your business or organisation may come within the definition of a CSP is as an intermediary –i.e. by supplying to a third party for a reward, under an agreement within a commercial relationship, a carriage service obtained from a carrier or CSP. For example, an intermediary might have an internet or telephone service connection which is then sold onwards to another person.
4. Are there exemptions?
The new Section 187B TIAA contains the main exemption to the metadata retention requirements of Section 187A. The exemption provides that the retention requirements under Section 187A will not apply to a service provider (other than a carrier that is not a CSP) if:
- the service is only provided to a person’s’ “immediate circle”; or
- only to places that are in the “same area”.
Services which are provided to persons within the immediate circle are not only an exemption under Section 187B, but also would make the service not a service “to the public” for the purposes of the definition or a carrier or CSP. Immediate circle is defined in Section 23 of the TA as a service being provided to the related body corporate or officer (including employee) of the service provider. Therefore, if your business or organisation provides the service only to your employees or related entities in a corporate structure, you may likely fall under the immediate circle exemption.
Alternatively, the same area exemption protects from the requirements of metadata retention where the service is provided to either the “same property” or a “combined area”
Where the service is provided to places that are all in a single freehold or leasehold title defined by reference to geographical coordinated and not further leased or subleased, the same property limb of the same area exemption applied.
Alternatively, where the places to which the service is provided are contiguous properties and the service within those contiguous properties is used by the same principal user (i.e. same occupant(s) using the property for the same sole or principal purpose). This limb of the same area exemption would therefore allow properties on different freehold or leasehold title that are contiguous and used by the same principal user such as in a situation where a service is provided to all parts of a building or group of buildings with common title boundaries leased on separate leases by several professionals within the by the same group (e.g. accountants, doctors or IT technicians) in occupation for the same purpose.
Free Wi-Fi Services to customers on retail, shopping centre, accommodation premises etc may be exempt
There is also a further exemption under Section 89 of the TA which exempts persons from being considered a CSP where the carriage services is supplied to customers on the same premises (used for a business activity which is the sole or principal use of the premises). “Premises” is defined to include land and a group of buildings in the same vicinity. This exemption would assist such organisations and business as for example cafes, and internet lounges, McDonald’s outlets, shopping centres hotels, motels, hospitals, nursing homes and similar organisations providing a Wi-Fi or other service to their customers on the premises.
5. Being prepared
These exemptions, combined with the capacity of the immediate circle exemption to also limit the application of the definition of carrier and CSP will assist many businesses and organisations to be exempt from metadata retention requirements.
However, should your business or organisation not have the benefit of one of the above exemptions in respect of all services provided it will be required to retain the metadata visible to the service for a period of two years and provide the metadata to certain agencies entitled under the ITAA to collect it. During those two years of retention, the information must be kept confidential and protected by having the information encrypted and guarded from unauthorised access or interference.
Further, the specific provision in Section 187LA provides that the retained data can taken as “personal information” under the Privacy Act 1995 (Cth) if that information relates to an individual or a communication to which the individual is a party. For a more detailed discussion of how metada can be personal information under the Privacy Act (see our earlier blog post here).
If your organisation or business is not exempt or is uncertain as to its status, there are a number of options that may be available to you.
One such option is to seek a decision from the Communication Access Co-ordinator for an exemption or variation of the requirements under the metadata retention provision of the ITAA.
An extension of up to 18 months time is also available to allow affected entities to be prepared for compliance if they are not in such a position on 13 October 2015 when the metadata retention laws commence operating. To apply for an extension the entity must lodge a data retention implementation plan detailing how the entity will achieve compliance and/or an exemption form and/.or variation of the data retention obligations in relation to a relevant service provided.
Attorney-General George Brandis has indicated on ABC Radio that the extension applications will be treated “generously” by his Department and that over the next 18 months the Department will be “more concerned with implementation than law enforcement.”
It is therefore critical in the coming days and months for businesses and organisation to seek professional legal advice as to their status in relation to the metadata retention laws and what steps need to be taken to obtain an exemption, extension or otherwise comply.
 This is defined in Section 16 TA as a service for carrying communications by means of guided and/or unguided electromagnetic energy.”