Review of the Security Legislation Amendment (Critical Infrastructure) Bill 2020 – Submission to the Parliamentary Joint Committee on Intelligence and Security

1. Introduction

1. The Office of the Australian Information Commissioner (OAIC) welcomes the opportunity to provide this submission to the Parliamentary Joint Committee on Intelligence and Security (Committee) on the Security Legislation Amendment (Critical Infrastructure) Bill 2020 (Bill).[1] The draft Bill seeks to introduce “an enhanced regulatory framework, building on existing requirements under the Security of Critical Infrastructure Act 2018 (Cth) (SCI Act).”[2]
2. The Bill seeks to:
   • introduce a positive security obligation for a range of critical infrastructure assets across critical sectors
   • increase the cyber obligations on systems of national significance
   • ensure that Government has the necessary powers to provide direct assistance to industry in the event of a serious cyber security incident.
3. The OAIC has regulatory oversight of the Privacy Act 1988 Cth (Privacy Act), which sets out how Australian Privacy Principle (APP) entities (including most Australian Government agencies, and all private sector and not-for-profit organisations with an annual turnover of more than $3 million) must collect, use and disclose individuals’ personal information.[3]
4. The obligations under the Privacy Act apply to entities that will be regulated by the Bill.  Further, the Notifiable Data Breaches Scheme (NDB scheme) and binding principles for governance and security of personal information contained in the Privacy Act will intersect with functions proposed by the Bill. It is important that the Bill does not override or curtail those existing obligations and that sharing of information can occur to ensure a coordinated and efficient regulatory system.
5. The OAIC supports measures that would strengthen the security or resilience of systems, assets, or data that are critical to Australia’s national interests or defence. However, we note that initiatives which impact personal information handling and privacy must be reasonable, necessary, and proportionate to achieving legitimate policy aims.
6. The OAIC makes four recommendations as follows:

2. Protected information

7. The Bill amends s 5 of the SCI Act to significantly expand the definition of ‘protected information’. The OAIC wishes to ensure that the restrictions on an entity making a record of, using or disclosing protected information under Division 3 of Part 4 of the SCI Act do not limit the ability of the OAIC to exercise its privacy functions, or prevent entities from disclosing information required for compliance with and the administration of the Privacy Act.
8. Section 46 of the SCI Act provides that the offence for unauthorised use or disclosure of protected information in s 45 does not apply if the making of the record, or the disclosure or use of the information, is required or authorised by or under a law of the Commonwealth. However, s 47 of the SCI Act provides that, except where it is necessary to do so for the purposes of giving effect to that Act, an entity is not to be required to disclose protected information, or produce a document containing protected information to “a tribunal, authority or person that has the power to require the answering of questions or the production of documents.”
9. The OAIC has the power to require the answering of questions or production of documents under the Privacy Act. The OAIC may make inquiries, handle complaints, or conduct investigations into matters which relate to protected information. By way of example, an eligible data breach, notifiable to the OAIC under the relevant provisions of the Privacy Act may include protected information as defined by the SCI Act and expanded by the Bill.
10. Clause 54B of the Bill would expand s 47 of the SCI Act, allowing entities to disclose protected information in certain circumstances, including for the purposes of giving effect to any Act that confers functions, powers, or duties on the Inspector-General of Intelligence and Security (IGIS). The Explanatory Memorandum (EM) states that the effect of cl 54B of the Bill is to:
    extend the exception to also apply when it is necessary to disclose or produce protected information for the purposes of the IGIS Act, or any other Act conferring functions, powers or duties on the IGIS…The extension of this exception is intended to ensure that the IGIS is able to compel access to information that may be relevant to an inquiry despite the protection against disclosure provided by section 47.[5]

11. We recommend that the Committee consider a similar amendment to s 47 to ensure that the disclosure of protected information is permitted for the purposes of giving effect to the exercise of the Information Commissioner’s privacy functions.
12. We also refer to ss 43A to 43D of the Bill, which authorise the use and disclosure of protected information to and between IGIS officials, Ombudsman officials, or by the Director-General of the Australian Signals Directorate (ASD) or a staff member of ASD for the purpose of the exercise of their powers or performance of their functions or duties. The EM to the Bill[6] states that these sections provide an authorisation for the purposes of excluding the application of the offence provision in s 45 of the SCI Act relating to the unauthorised use or disclosure of protected information.
13. We recommend the Committee consider these provisions as mechanisms through which to clearly authorise the use and disclosure of protected information to the Information Commissioner or delegate. In relation to information sharing between regulators and agencies, we also refer to Recommendation 2 below.

3. Enhanced cyber security obligations and the Positive Security Obligation

14. The Bill introduces a ‘Positive Security Obligation’ for critical infrastructure, including a risk management program, to be delivered through sector-specific requirements and mandatory cyber incident reporting. In particular, if a cyber incident has occurred or is occurring in relation to a critical infrastructure asset, the entity will be obliged to report the incident to the relevant Commonwealth body (s 30BC).
15. Under the NDB scheme, entities across the economy must notify affected individuals and the OAIC when a data breach is likely to result in serious harm to an individual whose personal information is involved. This includes cyber-security incidents involving personal information.
16. We consider that there is a potential overlap of the reporting obligations proposed in the Bill and those already applicable to entities covered by existing privacy legislation. The OAIC envisages the need for efficient assessment and response coordination between the receiving agencies to leverage the combined capability of the Commonwealth and ensure proportionate and targeted responses.  It also mitigates against a risk of fractured, overlapping or inconsistent responses where there are multiple reporting obligations in relation to particular incidents.
17. While the Bill envisages information-sharing between regulatory agencies will be set out in the rules, the OAIC recommends this be considered in light of the secrecy provisions of the SCI Act. A consequential amendment to s 29 of the Australian Information Commissioner Act 2010 will also be needed, to ensure that information sharing of the kind required to support efficient regulation is permitted.