Scott Ludlam (WA, Australian Greens) Share this | Hansard source

I am honestly not sure why the Labor Party even turned up to work today. I am going to stand down amendments (2) and (3) because I think identical amendments have already been dealt with by Senator Leyonhjelm, so I will not be proceeding with those.

The CHAIRMAN: Yes, I helped you dispose of those earlier.

But what I would point out, and it is the reason why we have paused here to make these points, is that you have quite conceivably, presumably unintentionally, could have companies arbitrarily brought into the ambit of this legislation by an Attorney-General of the day. I am sure it would not be one as august as Senator Brandis. Maybe 'Attorney-General Cory Bernardi', for example, in some future government, would decide to bring a whole new sector or new platform of industry within the scope of the data retention act, as it will be, whatever the view of the PJCIS. That would then get committed to parliament seven or eight months later, and the parliament may disagree, but you would have had platforms, industries or companies arbitrarily brought within the ambit of an act that imposes quite stringent collection requirements on them that are potentially quite expensive only to be told eight months down the track that, 'No, we got it wrong; the parliament disagrees.'

That is why we have paused here. This eight- or nine-month lag seems to me totally unseemly both in the case of an emergency that you did not see coming, where you would need to move very rapidly, and also in the case of gradual technological evolution, where you could simply make the case and then legislate rather than having this arbitrary decision by executive fiat that then either gets backed up and endorsed by parliament months and months later or not. Anyway, I think I have made my point.

I move Australian Greens amendment (5) on sheet 7669:

(5) Schedule 1, item 1, page 10 (lines 16 to 34), omit subsections 187C(1) and (2), substitute:

(1) The period for which a service provider must keep, or cause to be kept, information or a document under section 187A is the period:

(a) starting when the information or document came into existence; and

(b) ending 3 months after it came into existence.

I foreshadow that what we are going to propose to do later in the running order is contract the two-year data retention period, for which no case has been made. It seems to me that where the two-year period came from is somewhat lost in the mists of time. I think, Senator Brandis, this came up briefly last night, and you observed that it fell out of the PJCIS or out of the agencies themselves. It is shorter than five years and it is longer than 12 months, and that is where we have landed. To me, that is not particularly satisfactory. The Australian Greens will be seeking to contract that two-year obligation period to three months, partly in order to reduce costs and also the potentially invasive nature of holding on to this material for such a long period of time.

I am foreshadowing that because our amendment (5) removes the requirement that data be kept for at least two years after the closure of a customer account. I would be keen to hear the government's account or reasoning as to why data should be kept for that long after the closure of account, because that could effectively mandate material be hanging around for four years. For example, if I generate particular contact records, location records or whatever—there are masses of material that is going to be created—and then, two years after creating that record, I close my account, the government proposes that it should be retained for another 48 months. There is no real justification for that, as far as I am concerned. It is entirely possible that data could be kept way beyond two years. Many service providers leave customer accounts open even if the customer is not explicitly using them. That is no fault of the service provider; you could cease using a service, and you are not under any obligation to tell the service provider that you have done so. That, again, creates this very long tail of material hanging around, certainly for much longer periods than two years.

This amendment is reasonably simple. It provides that the period for which the service provider has to keep information is the period starting when the information or document came into existence and ending three months after it came into existence. What that would effectively do is bring it into consistency with the amendment, which I foreshadowed earlier, to contract that two-year period down to three months. This amendment, coming slightly out of order, I guess, would provide that that be the case, even if it is an account that is closed and is no longer active.