George Brandis (Queensland, Liberal Party, Attorney-General) Share this | Hansard source

This is a very important question—that is, the length or the duration of the mandatory data retention regime. It is probably instructive to take you through the history of it. The two-year period had its genesis in the first PJCIS inquiry—that is, the inquiry that reported in May 2013. Because I was a member of the PJCIS during the last parliament and participated in the discussion, I can tell you about it. It found form in recommendation 42 of the original PJCIS report. The sixth dot point of recommendation 42 states:

When the legislation was prepared, the two-year period that had been envisaged by the original PJCIS inquiry was adopted. When this legislation was reviewed by the more recent PJCIS inquiry, which reported on 27 February this year, the committee expressed the view in paragraph 4.120:

… the Committee accepts the unequivocal evidence of the national security and law enforcement agencies, which is supported by the international evidence, that a retention period of up to two years is necessary and proportionate for a range of investigations into particularly serious types of criminal and security-relevant activity.

You use the adjective 'arbitrary' as a pejorative, but any time period is arbitrary in the sense that it identifies a particular span of time, whether it is five years, two years or your three months. It is really a question of judgement, and that judgement has to be informed by the best advice of the national security and law enforcement agencies. Let us come back to first principles. The purpose of this legislation is to assist national security and law enforcement agencies in carrying out investigations, in particular in carrying out investigations which establish and identify networks of individual actors.

I remember from the first PJCIS inquiry we had quite a long discussion about what the appropriate period should be. We looked at various international precedents. I cannot call them all to mind at the moment, but in some countries it was more and in some countries it was less. About two years seemed to us to be around the international standard. We asked the national security agencies—I think it might have been a closed session, so I had better be careful in what I say—and I remember the then director-general of ASIO saying that he would prefer a much longer period, because retained metadata is obviously going to have potentially a utility beyond two years, but equally, as a matter of common sense, it is going to be a diminishing marginal utility across time.

The evidence that the PJCIS received was that within two years the overwhelming number of investigations which would seek to have access to metadata will have either been completed or run their course to the stage at which access to the metadata will have been had. This does not exclude the possibility that, for example, information is received by the agencies quite some time after a particular episode or event of concern is the subject of an investigation. It may be that more than two years has expired and the metadata is gone before the agencies appreciate, in the course of an investigation which has commenced well beyond the occurrence of the relevant events, that it might have been useful for them to access metadata. This is admittedly and advertently a limitation on what the agencies in their perfect world would have wanted, which is a longer retention period. Equally, from a practical point of view, we do not consider it appropriate to impose an unlimited obligation or an unreasonably long retention obligation on the industry.

Having looked at a lot of data and received a lot of evidence, as referred to in the first PJCIS report, by the way, from the agencies, particularly the Australian Federal Police, about the usual lifespan of an investigation of the kind with which we were concerned—counterterrorism, transnational and organised crime, and paedophilia—the Australian Federal Police and the other agencies were able to say to us, 'We think that if we had a two-year retention period that would satisfy us in almost all cases, but shorter than that we think from an investigative capability point of view we would run into problems.' So it was not an arbitrary decision; it was a decision informed by the experience and specialist opinion of those who need to access this data for the investigative purpose for which it is retained.

I can assure you, Senator Ludlam, that on the basis of the evidence that I heard at those hearings and the long discussions we had about this very point the idea of three months is ridiculously short. When you consider that we are dealing with complex crime—counterterrorism, transnational and organised crime, and paedophilia—if you think that investigations of that kind can be carried to fruition within a period of three months of first notification to the authorities you are kidding yourself.