George Brandis (Queensland, Liberal Party, Attorney-General) Share this | Hansard source

I will answer your question in a moment, Senator Ludlam. Thank you at least for having the good grace to acknowledge the reduction of the number of agencies to 21 from 85, which is a very substantial improvement on the status quo. That is the point I have been making all along. I tried to make it in my speech winding up the second reading debate. The way this debate has proceeded, you could be forgiven for thinking—if you were not familiar with the legislation and were listening in—that this is an invasion of peoples' liberties, whereas in fact what it does is attenuate very significantly and subject to much more rigorous oversight conduct which at the moment is lawful.

Coming directly to your question, the answer is in accordance with the criteria actually set out in section 110A(4). The criteria that the minister must have regard to in considering whether to make a declaration is set out there, particularly in subsection (c). The minister is, among other things, required to comply with the Australian Privacy Principles, with a binding scheme that provides for the protection of personal information and with other matters which you can read yourself. This is not an ungoverned discretion. It is a discretion that is governed by the specific matters set out in proposed subsection 110A(4)(b). Because these are amendments to the Telecommunications (Interception and Access) Act, the discretion is governed generally by the criteria set out in section 180F. That is augmented and strengthened by this bill, which deals with the overarching considerations to be had regard to in accessing information.

You, in an exuberantly rhetorical way, said that the minister can unilaterally add agencies. As a matter of fact, the minister cannot unilaterally add agencies. What the minister can do is promulgate a legislative instrument which adds agencies. But as you well know, legislative instruments are subject to disallowance by either house of parliament.

Lastly, the 21 agencies are set out in the act not by function but by name. In the existing TIA Act additional agencies can be added. That is how we got to this forest of agencies with the capacity to access metadata under the existing act: they do not have to be named agencies; they can be agencies that answer a functional description. That is removed under this act, so that, once again, is a protection which does not exist under the existing law.