In conversation with a friend, I realised I didn’t really know who would be required to store my so-called ‘metadata’ under Australia’s anticipated new data retention regime.

There has been plenty of discussion about what will be retained and for how long, but very little about who will be required to retain the data. If data retention is still new to you, there are a number of outlets and sources online, and I recommend Bernard Keane’s article ‘Your guide to the data retention debate: what it is and why it’s bad’ on Crikey.

Recent events

The Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014 (Cth) (‘Data Retention Bill’) has just passed the House of Representatives with the support of the Liberal-National Coalition Government and the Labor Party ‘opposition’. Voting against the Bill were just three Members of Parliament: Adam Bandt (Greens), Cathy McGowan (independent) and Andrew Wilkie (independent).

It will now go to the Senate where presumably only the small number crossbenchers will vote against it. The Coalition and opposition will vote in favour following obfuscatory statements and non-answers from the Attorney-General George Brandis, and Greens Senator Scott Ludlam’s customary call to action demanding that the Labor Party vote against it.

Once it passes through Senate, it will await Royal Assent from the Governor-General and come into effect six months from that date, according to section 2. This could mean it will be implemented by the end of the year if it passes swiftly through the Senate.

Who will be required to retain data?

The Data Retention Bill is available from the Australian Parliament House website if you want to read it for yourself. It has been amended, but after reading through the sheet of amendments there have not been any significant amendments regarding who will be required to retain data. I’ve included amendments in the extracts below within square brackets.

The Data Retention Bill inserts several new provisions into the Telecommunications (Interception and Access) Act 1979 (Cth) (‘Interception and Access Act), and we are concerned with the proposed section 187A.

Let’s start at the very beginning (‘a very good place to start’). The proposed section 187A(1) reads:

(1) A person (a service provider) who operates a service to which this Part applies (a relevant service) must keep, or cause to be kept, [in accordance with section 187BA and] for the period specified in section 187C:

       (a) information of a kind [specified in or under section 187AA]; or

       (b) documents containing information of that kind; relating to any communication carried by means of the service.

The proposed section 187BA requires that service providers encrypt all retained data and ensure it is protected from unauthorised interference or access. The proposed section 187AA sets out what data will be retained. The Attorney-General may temporarily amend what data will be retained, but any permanent amendments must put through the Parliamentary Joint Committee on Intelligence and Security for scrutiny (s 187AA(5)) and then be passed both Houses of Parliament.

We now know from the proposed section 187A(1) that data retention will be carried out by everyone who is ‘A person (a service provider) who operates a service to which this Part applies (a relevant service)’.

Let’s look at the proposed s 187A(3) for more information:

(3) This Part applies to a service if:

       (a) it is a service for carrying communications, or enabling communications to be carried, by means of guided or unguided electromagnetic energy or both; and

       (b) it is a service:

             (i) operated by a carrier; or

             (ii) operated by an internet service provider (within the meaning of Schedule 5 to the Broadcasting Services Act 1992); or

             (iii) of a kind prescribed by the regulations; and

       (c) the person operating the service owns or operates, in Australia, infrastructure that enables the provision of its relevant services;

but does not apply to a broadcasting service (within the meaning of the Broadcasting Services Act 1992).

There’s a lot to unpack here, so let’s dive straight into it. There are three criteria in paragraphs (a)–(c), and an exclusion at the end. To be included a service provider must meet all three criteria and not fall into the exclusion. The use of the word ‘and’ that separates paragraphs (a), (b) and (c) means that each of these must be read together as codependent criteria.

Criterion (a): services for carrying communications

(3) This Part applies to a service if:

       (a) it is a service for carrying communications, or enabling communications to be carried, by means of guided or unguided electromagnetic energy or both;

Most pieces of legislation include a section titled ‘Dictionary’ or ‘Interpretation’ near the start that define specific terms for that particular law. Some have several scattered throughout that may define or redefine specific words for specific parts, divisions or sections. Section 5 of the Telecommunications (Interception and Access) Act 1979 (Cth) is titled ‘Interpretation’ and includes many key definitions:

carry” includes transmit, switch and receive.

communication” includes conversation and a message, and any part of a conversation or message, whether:

       (a) in the form of:

             (i) speech, music or other sounds;

             (ii) data;

            (iii) text;

             (iv) visual images, whether or not animated; or

             (v) signals; or

       (b) in any other form or in any combination of forms.

This definition closely resembles the definition of carriage service in section 7 of the Telecommunications Act 1997 (Cth) (‘Telecommunications Act’) as ‘a service for carrying communications by means of guided and/or unguided electromagnetic energy’, and in which the definitions of ‘carry’ and ‘communication’ are substantially the same as the Interception and Access Act. This is relevant to the next part of the article, so remember it.

Services that transmit, switch and receive all or parts of conversations and messages by guided or unguided electromagnetic energy (or that enable this process) are therefore included. What counts as a ‘conversation’ or ‘message’ is defined above, and as you can see it is quite broad.

Criterion (b): services operated by carriers and ISPs

(3) This Part applies to a service if:

       (b) it is a service:

             (i) operated by a carrier; or

             (ii) operated by an internet service provider (within the meaning of Schedule 5 to the Broadcasting Services Act 1992); or

             (iii) of a kind prescribed by the regulations;

Because subparagraphs (b)(i)–(iii) are separated by ‘or’, their requirements are independent of each other. So long as a service meets the requirements of one of them, as well as the requirements of paragraphs (a) and (c), they will fall under the regime.

Carrier operated services

Section 5 of the Interception and Access Act tells us what a carrier is:

carrier’ means:

       (a) except in Parts 5-4 and 5-4A:

             (i) a carrier (within the meaning of the Telecommunications Act 1997); or

             (ii) a carriage service provider; and

       (b) in Parts 5-4 and 5-4A–a carrier (within the meaning of the Telecommunications Act 1997).

The data retention regime will be in Part 5-1A, so this whole definition applies. Now we have to flick over to the Telecommunications Act. They like to make us jump around a bit, don’t they? I warn you: it’s only getting worse, so be prepared.

What is a carrier?

Section 7 of the Telecommunications Act contains the key definitions:

carrier’ means the holder of a carrier licence.

carrier licence’ means a licence granted under section 56.

So, now we’ll turn to section 56:

(1) After considering an application, the ACMA may grant a carrier licence in accordance with the application.

Section 52 explains that a constitutional corporation, eligible partnership or public body may apply for a carrier licence, but not what the purpose of a carrier licence is. For this we need to look at section 42:

(1) If there is only one owner of a network unit, the owner of the network unit must not use the unit, either alone or jointly with one or more other persons, to supply a carriage service to the public, unless:

       (a) the owner holds a carrier licence; or

       (b) a nominated carrier declaration is in force in relation to the unit.

Subsections (2)–(5) extend this to jointly owned network units, and prohibit allowing others to use network units unless the owner of it has a carrier licence or a nominated carrier declaration is in force. So we now know that a carrier licence is basically a permit to let people use network units to supply carriage service to the public. But what the hell is a ‘network unit’ anyway?

Guess what? Section 7 says:

network unit’ has the meaning given by Division 2 of Part 2.

There are four sections in Division 2 of Part 2, and each one deals with telecommunications infrastructure. In short, a network unit is a line or facility that can be used to supply a carriage service that is over a certain distance. We could get bogged down into details of what a ‘line link’ means, and so on, but it’s all just infrastructure essentially.

So we more or less now know who a carrier is. A carrier:

  • has a licence to supply a carriage service to the public over network units they own, or
  • has a licence to let others supply carriage services to the public over their network units.

A network unit is simply a piece of infrastructure like a long bit of cable or a radio tower.

What is a carriage service?

Because we need to know what a carriage service is, let’s look at again at section 7 of the Telecommunications Act. It says a carriage service is ‘a service for carrying communications by means of guided and/or unguided electromagnetic energy.’ The definitions of ‘carry’ and communication’ are found in the same section and are substantially the same as those in section 5 of the Interception and Access Act. You’ll also note that this definition of carriage service is the same as the proposed s 187A(3)(a).

What does ‘supply to the public’ mean? It’s defined in section 44 of the Telecommunications Act and is pretty much what you’d assume: to make your service available to people outside your immediate circle (defined in section 23).

Therefore we can say that under s 157A(3)(b)(i) carriers are those who own the infrastructure used to supply a communications service to the public.

What is a service provided by an Internet service provider?

Now we turn to Schedule 5 of the Broadcasting Services Act 1992 (Cth), which is titled ‘Online services’. It tells us to look at clause 8 which says:

(1) For the purposes of this Schedule, if a person supplies, or proposes to supply, an internet carriage service to the public, the person is an internet service provider.

And then we find what an ‘internet carriage service’ is in the same schedule:

internet carriage service means a listed carriage service that enables end-users to access the internet.

listed carriage service’ has the same meaning as in the Telecommunications Act 1997.

So now we have to go back to the Telecommunications Act to work out what a ‘listed carriage service’ is. We’re told to look in section 16, which says a listed carriage service is a ‘carriage service’ between two or more points, where at least one point is in Australia. This includes fixed points, mobile points and points in the atmosphere or ‘in or below’ the stratosphere, so long as at least one point is in (or above) Australia.

And we already know what a carriage service is. Therefore, an internet service provider in this context seems to be anyone who provides Internet access to the public in Australia.

What kind of services are prescribed in the regulations?

Answer: we don’t know yet. Regulations will be made by the Attorney-General most likely in order to expand who is required to retain data. This is not strictly speaking an unusual practice: it is common for Parliament to delegate these sorts of powers (hence why it is referred to as delegated legislation). But it does mean we won’t know until they’re written and published.

Criterion (c): service infrastructure in Australia

(3) This Part applies to a service if:

       (c) the person operating the service owns or operates, in Australia, infrastructure that enables the provision of its relevant services;

There isn’t much to say here, except that it is clear that to fall under the obligations of the data retention regime the operator of the service must ‘own or operate’ relevant infrastructure in Australia. That obviously includes ownership or operation of any hardware used to enable the service.

This law will apply throughout Australia, which under section 15B of the Acts Interpretation Act 1901 (Cth) extends to the coastal sea of Australia, being the territorial sea of Australia, the sea on the landward side of the territorial sea (but not within the limits of a state or internal territory), the airspace above it, and the seabed and subsoil below.

‘Australia’ to avoid any ambiguity means ‘in any Act … the Commonwealth of Australia and, when used in a geographical sense, includes the Territory of Christmas Island and the Territory of Cocos (Keeling) Islands, but does not include any other external Territory’ according to section 2B of the Acts Interpretation Act 1901 (Cth).

I am unsure whether this means the data retention regime would not extend to Australia’s external territories: Ashmore and Cartier Islands, the Australian Antarctic Territory, Coral Sea Islands, Heard and McDonald Islands, and Norfolk Island. Given the population on two of those is listed as ‘none’ and the combined population of all is under 10,000 I suppose it doesn’t really matter.

Broadcasting services exception

(3) This Part …

does not apply to a broadcasting service (within the meaning of the Broadcasting Services Act 1992).

The definition of a broadcasting service is not hard to find. Section 6 of the Broadcasting Services Act 1992 (Cth) gives us a meaning:

broadcasting service’ means a service that delivers television programs or radio programs to persons having equipment appropriate for receiving that service, whether the delivery uses the radiofrequency spectrum, cable, optical fibre, satellite or any other means or a combination of those means, but does not include:

       (a) a service (including a teletext service) that provides no more than data, or no more than text (with or without associated still images); or

       (b) a service that makes programs available on demand on a point-to-point basis, including a dial-up service; or

       (c) a service, or a class of services, that the Minister determines, by notice in the Gazette, not to fall within this definition.

It also defines ‘program’ as being material primarily intended to entertain, educate or inform, or material that is advertising or sponsorship matter. Let’s not get into the murky area of what a ‘radio program’ is. Suffice to say it’s the ordinary meaning. We’re dealing with services that deliver programs from one source to many persons, rather than from persons to persons. It is unlikely that these entities would have much if any ‘metadata’ to retain even if they were required to do so.

Concluding remarks

This was a bit of a marathon article, and I’m glad it’s over. But it does need a conclusion to pull everything together. Let’s recap:

A service provider will be required to retain data if it meets all three criteria:

  1. It is a service for carrying communications to be carried, by means of guided or unguided electromagnetic energy or both.
    • This is met if the service transmits, switches or receives all or part of a communication or message.
  2. It is a service either operated by a carrier, or operated by an Internet service provider, or of a kind prescribed by the regulations.
    • This is met if the service is operated by a person with a carrier licence, obtained as a result of owning telecommunications infrastructure which is used to offer communications services to the public.
    • This is met by anyone who provides public access to the Internet.
  3. The operator of the services owns or operates relevant infrastructure in Australia.
    • This is met as long as one conduit for the service is in Australia.

It will not be required to retain data if it delivers content in only one direction — this will likely push it under the broadcasting services exception.