Letter of Exchange signed by Home Affairs and OAIC

1 Participants

1.1 This Letter of Exchange (LOE) is made between the following Participants:

1. the Department of Home Affairs (Home Affairs); and
2. the Office of the Australian Information Commissioner (the OAIC).

2 Commencement and Duration

2.1 This LOE commences on:

1. the date it is signed by both Participants; or
2. the date the last Participant signs, where the Participants do not sign this LOE on the same day; and remains in effect until 30 June 2026, unless terminated under paragraph 13 of this LOE.

3 Purpose

3.1 This purpose of this LOE is:

1. As per the schedule agreed to by both Participants, at the time of each assessment, set out the operational arrangements between Home Affairs and the OAIC by which OAIC will conduct a privacy assessment under s 33C of the Privacy Act 1988 (Cth) (Privacy Act) on Home Affairs' handling of European Union-sourced Passenger Name Record (EU PNR) data;
2. Specify the Activities the OAIC agrees to undertake, and the level of resources that Home Affairs undertakes to provide to the OAIC, for the period of this MOU;
3. to reflect the agreement of the Participants with respect to Home Affairs providing the OAIC with funding, as set out in this LOE, to undertake the Activities set out in paragraph 6 of this LoE; and
4. to set out the principles for the mutual cooperation of the Participants in carrying out the Activities, recognising the independent role of the OAIC as a statutory office with regulatory functions.

3.2 This LOE is not intended to fetter any powers that may be exercisable by the OAIC, the Information Commissioner or the Privacy Commissioner under   the Privacy Act or the Australian Information Commissioner Act 2010 (Cth) (AIC Act) or any other law.

4 Roles

4.1 The role of Home Affairs is to:

1. protect Australia's sovereignty, security and safety by managing its border, including through managing the entry, stay and departure of all non­citizens.
2. support a prosperous and inclusive society, and advance Australia's economic interests through the effective management of the visa and citizenship programs and provision of refugee and humanitarian assistance.
3. advance Australia's economic interests through the facilitation of the trade of goods to and from Australia and the collection of border revenue.
4. provide coordinated strategy and policy leadership for Australia's national and transport security, federal law enforcement, criminal justice, cyber security, border, immigration, multicultural affairs, emergency management and trade related functions.

4.2 The OAIC is:

1. an independent statutory agency created by the AIC Act.
2. headed by the Australian Information Commissioner (the Commissioner).

4.3 The Commissioner has the privacy functions and powers as set out under sections 9 and 10(1)(c) and (2) of the AIC Act. Under the Privacy Act, the Commissioner has the following powers relevant to this LoE:

1. to conduct an assessment of whether personal information held by an APP entity (as defined by the Privacy Act) is being maintained and handled in accordance with:
   • the Australian Privacy Principles (section 33C(1)(a)(i)); and
   • a registered APP code that binds the entity (section 33C(1)(a)(ii)).
2. to conduct an assessment of the ability of an entity subject to Part IIIC of the Privacy Act to:
   • comply with that Part, including the extent to which the entity has processes and procedures in place to assess suspected eligible data breaches (section 33C(1)(ca)(i)); and
   • provide notice of eligible data breaches to the Commissioner and to individuals at risk from such breaches (section 33C(1)(ca)(ii)).

5 Status and Interpretation

Status

5.1 This LoE is:

1. administrative in nature and does not intend to create, maintain or govern legal relations or obligations between the Participants. The legal obligations for each Participant are not affected by this LoE.
2. to remain in effect where there is a machinery of government change affecting either Participant or in the event the name of a Participant is changed, providing that the functions of any new Participant are concerned with the purposes of this LoE.
3. supersedes any earlier arrangements, written or otherwise, between the Participants on this subject, including the previous LoE on this subject, signed by the respective Participants on 16 October 2020 and amended on 10 December 2021.

Definitions

5.2 Unless the contrary intention appears, a term used in this LoE has the meaning shown in the table below:

6 Activities of the Participants

6.1 The Participants jointly determine:

1. Home Affairs will provide OAIC with:
   1. funding resources as set out under paragraph 7; and
   2. all relevant information required by the OAIC for the Activities.
2. Home Affairs will not:
   1. represent the OAIC as endorsing or approving any proposal unless the OAIC has specifically done so in writing; or
   2. release any document referring to consultation with the OAIC under this LoE or any press release without first consulting with the OAIC.
3. OAIC will provide Home Affairs with:
   1. one (1) assessment and final report over the term of the LoE that is related to Home Affairs' handling of EU PNR data for the purpose of ascertaining whether the records are held according to the APPs. In doing so, the OAIC will also have regard to the Australia - EU PNR Agreement.

6.2 The Participants acknowledge the importance of employees and contractors maintaining a high standard of integrity.

7 Financial Arrangements

7.1 Home Affairs will pay the OAIC the total amount of $162,000 for the provision of services set out in paragraph 6.1(c), over the course of two financial years: 2024-2025 and 2025-2026.

Home Affairs will provide the OAIC with the financial year payments as specified below, upon receipt of an invoice in accordance with paragraph 8:

1. $81,000 for the financial year 1 July 2024 to 30 June 2025.
2. $81,000 for the financial year 1 July 2025 to 30 June 2026.

8 Payments and Invoices

8.1 Payments under this LoE will be made in two equal yearly payments, payable by Home Affairs within 30 days of receipt of an invoice issued by the OAIC.

8.2 The OAIC may issue an invoice on or after 1 July in each year, in accordance with this LoE.

8.3 GST is not applicable on any invoices issued, as the services delivered under this LoE are GST exempt.

8.4 The amount payable by Home Affairs to OAIC for the provision of services will not exceed the amount set out in paragraph 7.1. This reflects the Participants’ understanding that this is a non-commercial arrangement.

8.5 Each Participant will provide the other with reasonably sufficient financial management information on request to enable the other to resolve queries, complete internal audit processes and comply with regulatory requirements and procedures including, but not limited to, those imposed by legislation and the Australian National Audit Office.

9 Confidentiality of information

9.1 The Participants will exchange information, relevant to this LoE, subject to the requirements of the Privacy Act, the AIC Act, the Australian Border Force Act 2015, Migration Act 1958, Customs Act 1901 and any other applicable Commonwealth or State/Territory legislation.

9.2 The Participants will protect any information received from each other and will not use or further disclose such information except for the purpose for which it was obtained or a related purpose, or as required in response to a request from a House or Committee of the Commonwealth Parliament, or as otherwise required or authorised by law.

9.3 Before disclosing any information received from the other in the circumstances described in paragraph 9.2, the Participants will consult on any concerns relating to the security or sensitivity of the information.

9.4 In the event that information received by one Participant from the other Participant becomes subject to a court order or a requirement under statute to produce the information, prior to any lawful disclosure, the Participants will communicate with each other to allow the information provider the opportunity to respond to the requested production.

9.5 The Participants acknowledge that the employees and/or contractors of both Participants are subject to statutory obligations not to record, divulge or communicate information that comes into their possession or knowledge except in the course of their official duties.

9.6 Each Participant agrees that this LoE may be published on each of the Participants’ respective websites, and shared in the context of a media release, with all personal information contained in this LoE to be removed or redacted prior to publication.

10 Reporting and assessment outcomes

10.1 The OAIC will provide an assessment report to Home Affairs that will contain the OAIC’s recommendations from the assessment, which are for Home Affairs to consider and action as appropriate.

10.2 For the finalised assessment during the term of the LoE, the number of assessment recommendations implemented and the number of assessment recommendations outstanding may be reported on in the OAIC’s annual report.

10.3 Within six months of receiving a final assessment report from the OAIC, Home Affairs will update the OAIC in writing on the actions they are taking to implement any recommendations. Should there be any outstanding recommendations following the first update, Home Affairs will provide additional written updates to the OAIC every six months, until the OAIC is satisfied that the recommendations have been appropriately implemented or the OAIC indicates no further updates are required.

Note:  It is the responsibility of Home Affairs to address any risks identified and recommendations made in an OAIC assessment report.

11 Dispute Resolution

11.1 The Participants recognise the importance of expressing issues of concern to each other in a professional manner as a method of improving cooperation between them.

11.2 If a dispute arises under this LoE, the Participants will deal with the dispute as follows:

1. The Participant claiming that there is a dispute will give the other Participant reasonable notice setting out the nature of the dispute;
2. The Participants will use their best endeavours to resolve the dispute at an operational level through direct negotiations between the representatives at paragraph 12.

11.3 If the dispute is not resolved within a reasonable period, having regard to the circumstances, the Participants will continue to escalate the dispute to more senior employees of each of the Participants until a resolution can be reached.

11.4 Disputes will not be referred to any third party or tribunal.

11.5 Despite the existence of a dispute, the Participants will continue to perform their roles under this LoE unless requested otherwise by the other Participant.

12 Contacts

12.1 The following representatives will be responsible for any notifications, liaison and/or agreeing upon routine variations in relation to any issue arising under this LoE.

Home Affairs:

Business area that is the policy owner for the operational access, use and disclosure of EU PNR data:

The person holding the position of Director Intelligence Oversight

Liaison with the OAIC:

The person holding the position of Director, Privacy Operations Section.

OAIC

A/g Assistant Commissioner, Regulation and Strategy

Regulation and Strategy

13 Termination

13.1 This LoE may be terminated at any time by mutual agreement in writing by one Participant giving the other Participant 60 calendar days' notice in writing, or such other period as agreed between the Participants.

13.2 Upon receipt of a notice of termination under paragraph 13.1, unless otherwise agreed, the other Participant must immediately cease work on the Activities.

13.3 Termination of this LoE must be authorised by the representatives listed at paragraph 12.

Where this LoE is terminated:

1. Home Affairs is required to pay any previously issued invoice payable under paragraph 8; and
2. Home Affairs will pay the OAIC any reasonable and substantiated costs which are incurred by the OAIC for work on the Activities between the date of the last invoice and up to the date of termination.

14 Review and Variation

14.1 The Participants acknowledge the importance of ensuring that this LoE and any attachments remain consistent, relevant and current.

14.2 The Participants will review this LoE and any attachments 12 months after commencement or within any other period jointly determined between them to assess the continued suitability of the agreed arrangements.

14.3 This LoE or any attachment to it may be varied at any time by agreement in writing between the Participants.

14.4 Any variation will commence on the date it is signed by both Participants or the date the last Participant signs, where the Participants do not sign on the same day.

15 Costs

15.1 Except where otherwise expressly provided for in this LoE or through a separate written arrangement, each Participant will bear their own costs in relation to the handling and disclosure of information under this LoE.