National Security Legislation Amendment (Comprehensive Review and Other Measures No. 3) Act 2024

No. 24, 2024

An Act to amend the law relating to national security and intelligence services, and for related purposes

Contents

1 Short title 2

2 Commencement 2

3 Schedules 3

Schedule 1—Security assessments 4

Part 1—Prescribed administrative action 4

Division 1—Decisions relating to parole, firearm licences and security guard licences 4

Australian Security Intelligence Organisation Act 1979 4

Division 2—Regulations to prescribe actions as prescribed administrative action 5

Australian Security Intelligence Organisation Act 1979 5

Part 2—Security assessments and preliminary communications 8

Division 1—Decisions under the Foreign Acquisitions and Takeovers Act 1975 8

Australian Security Intelligence Organisation Act 1979 8

Division 2—Clarification of effect of definitions on certain security assessments 8

Australian Security Intelligence Organisation Act 1979 8

Division 3—Preliminary communications to States 9

Australian Security Intelligence Organisation Act 1979 9

Division 4—Temporary actions by Commonwealth agencies 11

Australian Security Intelligence Organisation Act 1979 11

Part 3—Delayed security assessments 12

Australian Security Intelligence Organisation Act 1979 12

Schedule 2—Protecting identities and information 15

Part 1—Cover employment 15

Australian Security Intelligence Organisation Act 1979 15

Intelligence Services Act 2001 18

Part 2—Consolidating secrecy offences 23

Division 1—Main amendments 23

Intelligence Services Act 2001 23

Division 2—Consequential amendments 28

Privacy Act 1988 28

Part 3—Protection from disclosure under Archives Act 1983 29

Administrative Appeals Tribunal Act 1975 29

Archives Act 1983 29

Part 4—Protecting the identity of ASIO employees and ASIO affiliates 32

Division 1—Main amendments 32

Australian Security Intelligence Organisation Act 1979 32

Division 2—Consequential amendments 35

Australian Crime Commission Act 2002 35

Business Names Registration Act 2011 36

Commonwealth Registers Act 2020 36

Corporations Act 2001 36

Criminal Code Act 1995 36

Freedom of Information Act 1982 36

National Consumer Credit Protection Act 2009 36

Privacy Act 1988 37

Schedule 3—Authorisations for intelligence activities 38

Part 1—Sequencing of ministerial authorisations and clarifying references to persons 38

Intelligence Services Act 2001 38

Part 2—References to Attorney-General not to include junior Minister 42

Australian Security Intelligence Organisation Act 1979 42

Telecommunications (Interception and Access) Act 1979 42

Part 3—Applicant for special intelligence operation authority 43

Australian Security Intelligence Organisation Act 1979 43

Schedule 4—Security vetting and security clearance related activities 44

Part 1—Security clearance suitability assessments 44

Australian Security Intelligence Organisation Act 1979 44

Part 2—Delayed assessments and security clearance decisions 45

Australian Security Intelligence Organisation Act 1979 45

An Act to amend the law relating to national security and intelligence services, and for related purposes

[Assented to 21 May 2024]

The Parliament of Australia enacts:

1 Short title

This Act is the National Security Legislation Amendment (Comprehensive Review and Other Measures No. 3) Act 2024.

2 Commencement 1

Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Commencement information	Commencement information	Commencement information
Column 1	Column 2	Column 3
Provisions	Commencement	Date/Details
1. Sections 1 to 3 and anything in this Act not elsewhere covered by this table	The day this Act receives the Royal Assent.	21 May 2024
2. Schedule 1, Part 1, Division 1	The day after this Act receives the Royal Assent.	22 May 2024
3. Schedule 1, Part 1, Division 2	Immediately after the commencement of the provisions covered by table item 2.	22 May 2024
4. Schedule 1, Part 2, Divisions 1 and 2	The day after this Act receives the Royal Assent.	22 May 2024
5. Schedule 1, Part 2, Divisions 3 and 4	At the same time as the provisions covered by table item 3.	22 May 2024
6. Schedule 1, Part 3	A single day to be fixed by Proclamation. However, if the provisions do not commence within the period of 6 months beginning on the day this Act receives the Royal Assent, they commence on the day after the end of that period.
7. Schedules 2 and 3	The day after this Act receives the Royal Assent.	22 May 2024
8. Schedule 4, Part 1	The day after this Act receives the Royal Assent.	22 May 2024
9. Schedule 4, Part 2	At the same time as the provisions covered by table item 6.

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3 Schedules

Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.

Security assessments

Australian Security Intelligence Organisation Act 1979

1 Subsection 35(1) (after paragraph (f) of the definition of prescribed administrative action)

Insert:

; or (g) the exercise of any power, or the performance of any function, in relation to any of the following decisions under a law of the Commonwealth, a State or a Territory:

a decision about whether to release a person from prison on parole or on licence;

a decision otherwise relating to the release of a person on parole or on licence (including a decision in relation to conditions or supervision);

iii

a decision about whether to revoke a parole order or a licence mentioned in subparagraph (i); or

the exercise of any power, or the performance of any function, in relation to any of the following decisions under a law of a State or Territory:

a decision about whether to issue a firearms licence or a licence to work as a security guard to a person or otherwise relating to the issue of such a licence (including in relation to conditions);

a decision about whether to revoke a licence mentioned in subparagraph (i).

2 Subsection 39(1)

Omit “subsection (2)”, substitute “subsections (2) and (3)”.

3 At the end of section 39

Add:

(3) Subsection (1) does not prevent a Commonwealth agency from taking prescribed administrative action within the meaning of paragraph (h) of the definition of prescribed administrative action in subsection 35(1) on the basis of a communication made under subsection 18(3) or 19A(4) to a staff member of the Commonwealth agency.

4 At the end of section 40

Add:

(3) However, subsection (2) does not prevent the communication of information under subsection 18(3) or 19A(4) which the Organisation knows is intended or likely to be used by a State or an authority of a State in considering prescribed administrative action within the meaning of paragraph (h) of the definition of prescribed administrative action in subsection 35(1).

5 Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Division apply in relation to a communication made by the Organisation on or after the commencement of this item.

Australian Security Intelligence Organisation Act 1979

6 Subsection 35(1) (after paragraph (h) of the definition of prescribed administrative action)

Insert:

; or (i) subject to subsection 36AA(1), another action prescribed by the regulations for the purposes of this paragraph.

7 After section 35

Insert:

36AA Prescribing actions as prescribed administrative action 1

(1) Regulations made for the purposes of paragraph (i) of the definition of prescribed administrative action in subsection 35(1) (the relevant regulations) may prescribe an action if:

the action is likely to affect a person’s liberty or livelihood; and

matters relating to security would be a primary consideration in deciding whether to take the action.

The Committee on Intelligence and Security must:

review the relevant regulations as soon as possible after they are made; and

report the Committee’s comments and recommendations to each House of the Parliament before the end of the applicable disallowance period for that House.

If the Committee’s report on a review of the relevant regulations is tabled in a House of the Parliament:

during the applicable disallowance period for that House; and

on or after the eighth sitting day of the applicable disallowance period;

then Legislation Act 2003 has effect, in relation to the relevant regulations and that House, as if each period of 15 sitting days referred to in that Part were extended in accordance with the following table.Part 2 of Chapter 3 of the

(4) The applicable disallowance period for a House of the Parliament means the period of 15 sitting days of that House after the relevant regulations, or a copy of the relevant regulations, were laid before that House in accordance with section 38 of the Legislation Act 2003.

8 At the end of section 95

Add:

Note: Regulations made for the purposes of paragraph (i) of the definition of prescribed administrative action in subsection 35(1) are subject to an extended disallowance period (see section 36AA).

Australian Security Intelligence Organisation Act 1979

9 Subsection 35(1) (definition of prescribed administrative action)

Before “means”, insert “, subject to subsections (1A) and (2),”.

10 Subsection 35(1) (at the end of the note to the definition of prescribed administrative action)

Add “A decision made under the Foreign Acquisitions and Takeovers Act 1975 or the regulations under that Act is also not prescribed administrative action (see subsection (1A)).”.

11 After subsection 35(1)

Insert:

(1A) A decision made under the Foreign Acquisitions and Takeovers Act 1975 or the regulations under that Act is not prescribed administrative action.

12 Application of amendments

Australian Security Intelligence Organisation Act 1979

13 Subsection 36(1)

Before “subsections”, insert “section 35 and”.

14 At the end of section 36

Add:

Australian Security Intelligence Organisation Act 1979

This section does not, by implication, affect the interpretation of any other provision of this Part.

15 Paragraph 17(1)(ca)

After “security assessments”, insert “and make preliminary communications”.

16 Paragraph 17(1)(ca)

Omit “paragraph 40(1)(b)”, substitute “paragraphs 40(1)(b) and (1A)(a)”.

17 Section 40 (heading)

After “Assessments”, insert “and preliminary communications”.

18 After subsection 40(1)

Insert:

if the Director-General, or a person authorised by the Director-General under subsection (4), is satisfied that the requirements of security make it necessary as a matter of urgency for the State or authority to take the action referred to in subsection (1B).

It is also a function of the Organisation to make a preliminary communication, pending the furnishing of a security assessment by the Organisation, to:

a State or an authority of a State; or

a Commonwealth agency for transmission to a State or an authority of a State;

For the purposes of subsection (1A), the action is any of the following:

action of a temporary nature to prevent:

access by a person to any information or place access to which is controlled or limited on security grounds; or

a person from performing an activity in relation to, or involving, a thing (other than information or a place), if the person’s ability to perform that activity is controlled or limited on security grounds;

(b) action that is of a temporary nature and of a kind referred to in paragraph (g) or (h) of the definition of prescribed administrative action in subsection 35(1);

action that is of a temporary nature and is of a kind:

(i) referred to in paragraph (i) of the definition of prescribed administrative action in subsection 35(1); and

prescribed by the regulations for the purposes of this subparagraph.

19 Subsection 40(2)

Omit “shall not”, substitute “must not, other than in the form of an assessment or in accordance with subsection (1A)”.

20 Paragraphs 40(2)(a) and (b)

Omit “otherwise than in the form of an assessment”.

21 At the end of section 40

Add:

The Director-General may, in writing, authorise a person for the purposes of subsection (1A) if the person is an ASIO employee, or an ASIO affiliate, who holds, or is acting in, a position in the Organisation that is equivalent to or higher than a position occupied by an SES employee.

22 Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Division apply in relation to a communication made by the Organisation after the commencement of this item.

Australian Security Intelligence Organisation Act 1979

23 Subsection 39(1)

Omit “and (3)”, substitute “, (3) and (4)”.

24 At the end of section 39

Add:

if, on the basis of a preliminary communication by the Organisation, the Commonwealth agency is satisfied that the requirements of security make it necessary to take that action as a matter of urgency pending the furnishing of an assessment by the Organisation.

Subsection (1) does not prevent a Commonwealth agency from taking action that is of a temporary nature and is:

(a) of a kind referred to in paragraph (g) or (h) of the definition of prescribed administrative action in subsection 35(1); or

of a kind:

(i) referred to in paragraph (i) of the definition of prescribed administrative action in subsection 35(1); and

prescribed by the regulations for the purposes of this subparagraph;

25 Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Division apply in relation to a communication made by the Organisation after the commencement of this item.

Australian Security Intelligence Organisation Act 1979

26 Subsection 35(1)

Insert:

delayed security assessment has the meaning given by subsection 41(1).

27 Subsection 36(1)

Omit “section 35”, substitute “sections 35, 41 and 42”.

28 At the end of Division 2 of Part IV

Add:

41 Notification of delayed security assessment

Notification of delayed security assessment

Note: A protocol made under subsection 42(1) must specify when the Organisation is taken to have started to prepare a security assessment, which may be specified differently for different classes of security assessments (see subsections 42(3) and (4)).

Exceptions to requirement to notify

Application of this section

(1) If a security assessment is not furnished under this Part within 12 months after the Organisation starts to prepare the assessment (the delayed security assessment), the Director-General must cause the Inspector-General of Intelligence and Security to be notified of the delayed security assessment.

The notification must:

be made within the period specified, for the purposes of subparagraph 42(3)(b)(i), in the protocol made under subsection 42(1), as in force from time to time; and

include the information specified in that protocol for the purposes of subparagraph 42(3)(b)(ii); and

comply with any other requirements specified in the protocol for the purposes of paragraph 42(3)(d).

However, subsection (1) does not apply if:

the Organisation has been notified that the security assessment is no longer required; or

the Organisation initiated the preparation of the security assessment without a request for the assessment being made by another Commonwealth agency, a State or an authority of a State.

This section applies to a security assessment that the Organisation starts to prepare on or after the commencement of this section.

42 Protocol for dealing with delayed security assessments

Requirement to make protocol

Note 1: For variation of a protocol, see subsection 33(3) of the Acts Interpretation Act 1901.

Note 2: A protocol made under this subsection may be combined with a protocol made under subsection 82GB(1) (protocol for dealing with delayed security clearance decisions and delayed security clearance suitability assessments).

Requirement to comply with protocol

The Director-General must make a written protocol for dealing with delayed security assessments.

The Director-General must consult with the Inspector-General of Intelligence and Security before making a protocol under subsection (1).

The protocol:

must specify when the Organisation is taken to have started to prepare a security assessment; and

must specify the following in relation to the notification of a delayed security assessment under section 41:

the period within which the notification must be made;

the information to be included in the notification; and

must deal with steps to be taken by the Organisation in relation to the delayed security assessment after the notification referred to in paragraph (b) is made; and

may specify other requirements, or deal with any other matters, that:

relate to a delayed security assessment or the notification of the assessment under section 41; and

the Director-General considers appropriate.

Without limiting subsection (1), the protocol may provide differently for different classes of security assessments.

A protocol made under subsection (1) is not a legislative instrument.

The Organisation must, in relation to a delayed security assessment to which subsection 41(1) applies, comply with a protocol made under subsection (1) of this section, as in force from time to time.

Protecting identities and information

Australian Security Intelligence Organisation Act 1979

1 Subsection 16(1)

Omit “The”, substitute “Subject to subsection 92C(8), the”.

2 At the end of Part V

Add:

92B Cover employment for ASIO employees and ASIO affiliates 1

A person who is an ASIO employee or ASIO affiliate, or a former ASIO employee or former ASIO affiliate, may identify an authority of the Commonwealth as that person’s employer or place of work, in relation to a period during which the person is or was an ASIO employee or ASIO affiliate, in accordance with a determination made by the Director-General under subsection 92C(1).

Subsection (1) applies despite any other law of the Commonwealth, a State or a Territory (whether passed or made before, on or after the commencement of this section), including such other law that is expressed to apply despite any other law.

92C Cover employment—determining a specified authority of the Commonwealth

Determining specified authority of the Commonwealth

Note: For variation and revocation of an instrument, see subsection 33(3) of the Acts Interpretation Act 1901.

Note: The Defence Force is an authority of the Commonwealth: see paragraph (b) of the definition of authority of the Commonwealth in section 4.

Delegation

(1) Subject to subsection (5), the Director-General may, in writing, determine one or more specified authorities of the Commonwealth, within the meaning of paragraphs (a), (aa), (b) and (c) of the definition of authority of the Commonwealth in section 4, that may be identified as the employer or place of work of ASIO employees, ASIO affiliates, former ASIO employees or former ASIO affiliates.

Without limiting subsection (1), a determination under that subsection may do either or both of the following:

determine a specified authority of the Commonwealth in relation to a specified class of ASIO employees, ASIO affiliates, former ASIO employees or former ASIO affiliates;

specify limitations or restrictions in relation to the identification of a specified authority of the Commonwealth as the employer or place of work of ASIO employees, ASIO affiliates, former ASIO employees or former ASIO affiliates.

(3) To avoid doubt, and without limiting subsection (1) or (2), if a determination under subsection (1) determines a specified authority of the Commonwealth in relation to a class of ASIO employees, ASIO affiliates, former ASIO employers or former ASIO affiliates holding, occupying or performing the duties of a specified office or position, the class includes such an office or position that comes into existence after the determination is made.

Subsection (3) does not, by implication, affect the interpretation of any other provision of this Act.

The Director-General must not determine a specified authority of the Commonwealth under subsection (1) unless the head of that authority has agreed, in writing, to the authority being so determined.

(6) To avoid doubt, the Chief of the Defence Force (within the meaning of the Defence Act 1903) is the head of the Defence Force for the purposes of subsection (5).

The following are not legislative instruments:

a determination under subsection (1);

an agreement under subsection (5).

The Director-General may, in writing, delegate the Director-General’s powers or duties under this section to an ASIO employee, or an ASIO affiliate, who holds or is acting in a position in the Organisation that is equivalent to or higher than a position occupied by an SES employee with a classification of SES Band 3.

In exercising powers or discharging duties under a delegation under subsection (8), the delegate must comply with any written direction given by the Director-General to the delegate.

92D Protection from criminal liability—third parties 1

If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if:

the person is a staff member of any authority of the Commonwealth; and

the thing is done in the course of the person exercising or performing the person’s powers, functions or duties as such a staff member; and

(c) the thing is done to facilitate an ASIO employee or ASIO affiliate, or a former ASIO employee or former ASIO affiliate, (the ASIO person) to identify an authority of the Commonwealth as the ASIO person’s employer or place of work in relation to a period for the purposes of subsection 92B(1), in accordance with a determination under subsection 92C(1); and

doing the thing would not be an offence if the authority of the Commonwealth referred to in paragraph (c) were the ASIO person’s employer or place of work for the period mentioned in that paragraph.

If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if:

the thing is done in the performance of the functions attaching to the person’s professional capacity; and

(b) the thing is done to facilitate an ASIO employee or ASIO affiliate, or a former ASIO employee or former ASIO affiliate, (the ASIO person) to identify an authority of the Commonwealth as the ASIO person’s employer or place of work in relation to a period for the purposes of subsection 92B(1), in accordance with a determination under subsection 92C(1); and

doing the thing would not be an offence if the authority of the Commonwealth referred to in paragraph (b) were the ASIO person’s employer or place of work for the period mentioned in that paragraph.

Intelligence Services Act 2001

3 Subsection 3(1) (definition of staff member)

Before “means”, insert “, subject to subsection 41AC(3),”.

4 Subsection 27(1)

Omit “The”, substitute “Subject to subsection 41AB(8), the”.

5 After section 41

Insert:

41AA Cover employment for ASIS and ASD staff members 1

A person who is a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, may identify a Commonwealth authority as that person’s employer or place of work, in relation to a period during which the person is or was a staff member of that agency, in accordance with a determination made by the relevant agency head under subsection 41AB(1).

41AB Cover employment—determining a specified Commonwealth authority

Determining specified Commonwealth authority

Note: For variation and revocation of an instrument, see subsection 33(3) of the Acts Interpretation Act 1901.

Note: The Defence Force is a Commonwealth authority: see paragraph (c) of the definition of Commonwealth authority in subsection 3(1).

Delegation

(1) Subject to subsection (5), the agency head of ASIS or ASD may, in writing, determine one or more specified Commonwealth authorities, within the meaning of paragraphs (a), (b), (c) and (d) of the definition of Commonwealth authority in subsection 3(1), that may be identified as the employer or place of work of staff members or former staff members of that agency.

Without limiting subsection (1), a determination under that subsection may do either or both of the following:

determine a specified Commonwealth authority in relation to a specified class of staff members or former staff members of the agency;

(b) specify limitations or restrictions in relation to the identification of a specified Commonwealth authority as the employer or place of work of staff members or former staff members of the agency.

(3) To avoid doubt, and without limiting subsection (1) or (2), if a determination under subsection (1) determines a specified Commonwealth authority in relation to a class of staff members or former staff members of the agency holding, occupying or performing the duties of a specified office or position, the class includes such an office or position that comes into existence after the determination is made.

Subsection (3) does not, by implication, affect the interpretation of any other provision of this Act.

The agency head must not determine a specified Commonwealth authority under subsection (1) unless the head of that authority has agreed, in writing, to the authority being so determined.

(6) To avoid doubt, the Chief of the Defence Force (within the meaning of the Defence Act 1903) is the head of the Defence Force for the purposes of subsection (5).

The following are not legislative instruments:

a determination under subsection (1);

an agreement under subsection (5).

(8) The agency head of ASIS or ASD may, in writing, delegate the agency head’s powers or duties under this section to a staff member of that agency who holds or is acting in a position in the agency that is equivalent to or higher than a position occupied by an SES employee with a classification of SES Band 3.

In exercising powers or discharging duties under a delegation under subsection (8), the delegate must comply with any written direction given by the agency head to the delegate.

41AC Protection from criminal liability—third parties 1

If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if:

the person is a staff member of any Commonwealth authority (see subsection (3)); and

the thing is done in the course of the person exercising or performing the person’s powers, functions or duties as such a staff member; and

(c) the thing is done to facilitate a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, (the ASIS or ASD person) to identify a Commonwealth authority as the ASIS or ASD person’s employer or place of work in relation to a period for the purposes of subsection 41AA(1), in accordance with a determination under subsection 41AB(1); and

doing the thing would not be an offence if the Commonwealth authority referred to in paragraph (c) were the ASIS or ASD person’s employer or place of work for the period mentioned in that paragraph.

If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if:

the thing is done in the performance of the functions attaching to the person’s professional capacity; and

(b) the thing is done to facilitate a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, (the ASIS or ASD person) to identify a Commonwealth authority as the ASIS or ASD person’s employer or place of work in relation to a period for the purposes of subsection 41AA(1), in accordance with a determination under subsection 41AB(1); and

doing the thing would not be an offence if the Commonwealth authority referred to in paragraph (b) were the ASIS or ASD person’s employer or place of work for the period mentioned in that paragraph.

(3) For the purposes of paragraphs (1)(a) and (b), a staff member of a Commonwealth authority means:

the head (however described) of the Commonwealth authority, or another person who holds an office or appointment in relation to the Commonwealth authority; and

a person who is otherwise a member of the staff of the Commonwealth authority, whether:

an employee of the Commonwealth authority; or

a consultant or contractor to the Commonwealth authority; or

iii

a person who is made available, to perform services for the Commonwealth authority, by another Commonwealth authority, a State authority or other person.

Note: If a person referred to in paragraphs (1)(a) and (b) is a staff member of ASIO or an agency (staff member in subsection (3) of this section applies for the purposes of those paragraphs rather than the definition of staff member in subsection 3(1).within the meaning of subsection 3(1)), the definition of

6 Application of amendments 1

(1) The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Part apply in relation to a person identifying, on or after the commencement of this item, their employer or place of work in relation to a period, regardless of the following:

whether the person became an ASIO employee or ASIO affiliate before, on or after that commencement;

whether the period occurred, partly or wholly, before, on or after that commencement.

(2) The amendments of the Intelligence Services Act 2001 made by this Part apply in relation to a person identifying, on or after the commencement of this item, their employer or place of work in relation to a period, regardless of the following:

whether the person became a staff member of ASIS or ASD before, on or after that commencement;

whether the period occurred, partly or wholly, before, on or after that commencement.

Intelligence Services Act 2001

7 Subsection 3(1) (at the end of the definition of staff member)

Add:

; and (c) in relation to DIO—a member of the staff of that part of the Defence Department known as the Defence Intelligence Organisation, whether:

an employee, a consultant or contractor that works in that part of the Defence Department; or

a person who is made available by another Commonwealth authority, a State authority or other person to perform services for that part of the Defence Department.

8 Section 39 (at the end of the heading)

Add “, AGO, DIO and ASD”.

9 Paragraph 39(1)(a)

Omit “ASIS in connection with its functions or relates to the performance by ASIS”, substitute “ASIS, AGO, DIO or ASD (the relevant agency) in connection with its functions, or relates to the performance by the relevant agency”.

10 Paragraph 39(1)(b)

Repeal the paragraph, substitute:

the information or matter has come to the knowledge or into the possession of the person by reason of the person:

being, or having been, a staff member of the relevant agency or an agent of ASIS; or

having entered into any contract, agreement or arrangement with the relevant agency; or

iii

having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and

11 Subparagraphs 39(1)(c)(i) and (ii)

Omit “Director-General of ASIS or a staff member”, substitute “head of the relevant agency or a staff member of the relevant agency”.

12 Subparagraph 39(1)(c)(iii)

Omit “Director-General of ASIS”, substitute “head of the relevant agency”.

13 Subparagraph 39(1)(c)(iv)

Omit “Director-General of ASIS or of a staff member having the authority of the Director-General of ASIS”, substitute “head of the relevant agency or of a staff member of the relevant agency having the authority of the head of the relevant agency”.

14 At the end of section 39

Add:

Definitions

head of the relevant agency means:

In this section:

in relation to ASIS, AGO or ASD—the agency head of the agency; or

in relation to DIO—the Director of DIO.

15 Sections 39A to 40B

Repeal the sections.

16 Section 40C (at the end of the heading)

Add “, AGO, DIO and ASD”.

17 Paragraphs 40C(1)(b) and (c)

Repeal the paragraphs, substitute:

(b) the record was acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD (the relevant agency) in connection with its functions, or relates to the performance by the relevant agency of its functions; and

the record was obtained by the person by reason of the person:

being, or having been, a staff member of the relevant agency or an agent of ASIS; or

having entered into any contract, agreement or arrangement with the relevant agency; or

iii

having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and

18 Subparagraph 40C(1)(d)(ii)

Omit “ASIS”, substitute “the relevant agency”.

19 Subparagraph 40C(1)(d)(iii)

Omit “Director-General of ASIS”, substitute “head of the relevant agency”.

20 Subparagraph 40C(1)(d)(iv)

21 At the end of section 40C

Add:

Definitions

head of the relevant agency has the same meaning as in section 39.

In this section:

22 Section 40D (at the end of the heading)

Add “, AGO, DIO and ASD”.

23 Paragraphs 40D(1)(b) and (c)

Repeal the paragraphs, substitute:

(b) the information or matter was acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD (the relevant agency) in connection with its functions, or relates to the performance by the relevant agency of its functions; and

the information or matter has come to the knowledge or into the possession of the person by reason of the person:

being, or having been, a staff member of the relevant agency or an agent of ASIS; or

having entered into any contract, agreement or arrangement with the relevant agency; or

iii

having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and

24 Subparagraph 40D(1)(d)(ii)

Omit “ASIS”, substitute “the relevant agency”.

25 Subparagraph 40D(1)(d)(iii)

Omit “Director-General of ASIS”, substitute “head of the relevant agency”.

26 Subparagraph 40D(1)(d)(iv)

27 At the end of section 40D

Add:

Definitions

head of the relevant agency has the same meaning as in section 39.

In this section:

28 Sections 40E to 40M

Repeal the sections.

29 Subsection 41B(3) (definition of information offence provision)

Repeal the definition, substitute:

information offence provision means subsection 39(1), 40C(1) or 40D(1) or paragraph 41(1)(a).

30 Application of amendments 1

(1) The amendment of Intelligence Services Act 2001 made by this Division apply in relation to a communication by a person of any information or matter on or after the commencement of this item, regardless of the following:section 39, and the repeal of sections 39A, 40 and 40B, of the

whether the information or matter came to the knowledge or into the possession of the person before, on or after that commencement;

if that information or matter had been acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD—whether the information or matter was so acquired or prepared before, on or after that commencement.

(2) The amendment of Intelligence Services Act 2001 made by this Division apply in relation to conduct engaged in by a person in relation to a record on or after the commencement of this item, regardless of the following:section 40C, and the repeal of sections 40E, 40G and 40L, of the

whether the record was obtained by the person before, on or after that commencement;

if that record had been acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD—whether the record was so acquired or prepared before, on or after that commencement.

(3) The amendment of Intelligence Services Act 2001 made by this Division apply in relation to the making of a record of any information or matter by a person on or after the commencement of this item, regardless of the following:section 40D, and the repeal of sections 40F, 40H and 40M, of the

whether the information or matter came to the knowledge or into the possession of the person before, on or after that commencement;

Privacy Act 1988

31 Subsection 80P(7) (paragraph (c) of the definition of designated secrecy provision)

Omit “39A, 40, 40B to 40H, 40L, 40M”, substitute “40C, 40D”.

Administrative Appeals Tribunal Act 1975

32 Subsection 3(1) (paragraph (b) of the definition of exempt security record)

After “paragraph 33(1)(a) or (b)”, insert “or subsection 33(4A) or (4C)”.

Archives Act 1983

33 Subsection 3(1)

Insert:

ASIO affiliate has the same meaning as in the Australian Security Intelligence Organisation Act 1979.

ASIO employee has the same meaning as in the Australian Security Intelligence Organisation Act 1979.

34 Paragraphs 29(6)(a) and (7)(a)

After “paragraph 33(1)(a) or (b)”, insert “or subsection 33(4A) or (4C)”.

35 After subsection 33(4)

Insert:

unless the Minister administering Australian Security Intelligence Organisation Act 1979 or the Director-General of Security has consented in writing to the information or matter being made public.section 92 of the

the consent referred to in paragraph (a) of this subsection is taken also to be consent given for the purposes of subsection (4A).

unless the responsible Minister for ASIS (within the meaning of the Intelligence Services Act 2001) or the Director-General of ASIS has consented in writing to the information or matter being made public.

the consent referred to in paragraph (a) of this subsection is taken also to be consent given for the purposes of subsection (4C).

For the purposes of this Act, a Commonwealth record is an exempt record if:

it contains information or matter:

that identifies a person as being, or having been, an ASIO employee or an ASIO affiliate; or

from which the identity of a person referred to in subparagraph (i) could reasonably be inferred, or that could reasonably lead to the identity of such a person being established; and

the information or matter has not been made public by means of broadcasting or reporting proceedings of the Parliament as authorised by the Parliament;

If:

(a) the consent of the Minister administering Australian Security Intelligence Organisation Act 1979 or the Director-General of Security has been given in relation to information or a matter for the purposes of that section (before, on or after the commencement of this subsection); andsection 92 of the

that information or matter is substantially the same as the information or matter referred to in subsection (4A) of this section;

For the purposes of this Act, a Commonwealth record is an exempt record if:

it contains information or matter:

(i) that identifies a person as being, or having been, a staff member of the Australian Secret Intelligence Service (ASIS) (within the meaning of the Intelligence Services Act 2001) or an agent of ASIS; or

from which the identity of a person referred to in subparagraph (i) could reasonably be inferred, or that could reasonably lead to the identity of such a person being established; and

the information or matter has not been made public by means of broadcasting or reporting proceedings of the Parliament as authorised by the Parliament;

If:

(a) the consent of the responsible Minister for ASIS (within the meaning of the Intelligence Services Act 2001) or the Director-General of ASIS has been given in relation to information for the purposes of section 41 of that Act (before, on or after the commencement of this subsection); and

that information is substantially the same as the information referred to in subsection (4C) of this section;

36 At the end of section 33

Add:

is a reference only to the most senior such Minister.

Note: A reference to a Minister mentioned in this section may include a reference to a person acting as that Minister (see subsection 19(4) of the Acts Interpretation Act 1901).

A reference in this section to:

(a) the Minister administering Australian Security Intelligence Organisation Act 1979; orsection 92 of the

(b) the responsible Minister for ASIS (within the meaning of the Intelligence Services Act 2001);

37 At the end of subsection 39(1)

Add “or subsection 33(4A) or (4C)”.

38 Paragraph 39(2)(b)

After “paragraph 33(1)(a), (b) or (e)”, insert “or subsection 33(4A) or (4C)”.

Australian Security Intelligence Organisation Act 1979

39 Section 92

Repeal the section, substitute:

92 Making public the identity of ASIO employees and ASIO affiliates

Offence

Penalty: Imprisonment for 10 years.

Exceptions

Note: A defendant bears an evidential burden in relation to the matters in subsection (2) (see subsection 13.3(3) of the Criminal Code).

Note: A defendant bears an evidential burden in relation to the matters in subsection (3) (see subsection 13.3(3) of the Criminal Code).

Extended geographical jurisdiction

Attorney-General’s involvement in prosecution of offence

Note: For communication of information about an offence against this section to appropriate authorities, see subsection 18(3).

Minister or Director-General’s consent

A person commits an offence if:

the person makes information public, or causes or permits information to be made public; and

any of the following applies:

the information identifies a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate;

the information could reasonably lead to establishing the identity of a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate;

iii

the identity of a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate could reasonably be inferred from the information.

Subsection (1) does not apply to a person making information public, or causing or permitting information to be made public, if the Minister or Director-General has consented in writing to the information being made public.

Subsection (1) does not apply to a person making information public, or causing or permitting information to be made public, if:

the information relates to a person who is a former ASIO employee or former ASIO affiliate; and

the former ASIO employee or former ASIO affiliate has:

consented in writing to the information being made public; or

caused or authorised the fact that the person is a former ASIO employee or former ASIO affiliate to be made public; and

the person making the information public, or causing or permitting the information to be made public, is not that former ASIO employee or former ASIO affiliate.

(4) Section 15.4 of the Criminal Code (extended geographical jurisdiction—category D) applies to an offence against subsection (1) of this section.

Subsection (4) does not, by implication, affect the interpretation of any other provision of this Act or another Act.

A prosecution for an offence against subsection (1) may only be instituted by, or with the consent of, the Attorney-General.

Consent given under this section is not a legislative instrument.

92A Disclosing the identity of ASIO employees and ASIO affiliates

Offence

Penalty: Imprisonment for 10 years.

Extended geographical jurisdiction

Attorney-General’s involvement in prosecution of offences

Note: For communication of information about an offence against this section to appropriate authorities, see subsection 18(3).

(1) A person (the defendant) commits an offence if:

either:

the defendant discloses information to another person; or

the defendant engages in conduct that results in information being disclosed to another person; and

any of the following applies:

the information identifies a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate;

the information could reasonably lead to establishing the identity of a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate;

iii

the identity of a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate could reasonably be inferred from the information; and

any of the following applies:

the defendant intends to endanger the health or safety of a person;

the defendant intends to prejudice the effective performance of the functions or duties, or the effective exercise of the powers, of the Organisation;

iii

the defendant knows that the disclosure will endanger the health or safety of a person;

the defendant knows that the disclosure will prejudice the effective performance of the functions or duties, or the effective exercise of the powers, of the Organisation.

(2) Section 15.4 of the Criminal Code (extended geographical jurisdiction—category D) applies to an offence against subsection (1) of this section.

Subsection (2) does not, by implication, affect the interpretation of any other provision of this Act or another Act.

A prosecution for an offence against subsection (1) may only be instituted by, or with the consent of, the Attorney-General.

40 Application of amendments 1

(1) Subsection 92(1) of the Australian Security Intelligence Organisation Act 1979, as substituted by this Division, applies to information made public, or caused or permitted to be made public, after the commencement of this Division (whether the information was obtained before, on or after that commencement).

(2) Subsections 92(2) and (3) of the Australian Security Intelligence Organisation Act 1979, as substituted by this Division, apply to information made public, or consents given, before, on or after the commencement of this Division.

(3) Subsection 92A(1) of the Australian Security Intelligence Organisation Act 1979, as inserted by this Division, applies to information disclosed after the commencement of this Division (whether the information was obtained before, on or after that commencement).

Australian Crime Commission Act 2002

41 Schedule 1 (entry relating to the Australian Security Intelligence Organisation Act 1979)

Omit “and 92”, substitute “, 92 and 92A”.

Business Names Registration Act 2011

42 Paragraph 62N(3)(a)

Omit “and 92”, substitute “, 92 and 92A”.

Commonwealth Registers Act 2020

43 Paragraph 18(3)(a)

Omit “and 92”, substitute “, 92 and 92A”.

Corporations Act 2001

44 Paragraph 1270M(3)(a)

Omit “and 92”, substitute “, 92 and 92A”.

Criminal Code Act 1995

45 Paragraph 122.5(7)(a) of the Criminal Code

Omit “Australian Security Intelligence Organisation Act 1979 (publication of identity of ASIO employee or ASIO affiliate)”, substitute “section 92 of the Australian Security Intelligence Organisation Act 1979 (making public the identity of ASIO employees and ASIO affiliates) or section 92A of that Act (disclosing the identity of ASIO employees and ASIO affiliates)”.section 92 of the

Freedom of Information Act 1982

46 Schedule 3 (entry relating to the Australian Security Intelligence Organisation Act 1979)

Omit “and (1A)”, substitute “and 92A(1)”.

National Consumer Credit Protection Act 2009

47 Paragraph 212N(3)(a)

Omit “and 92”, substitute “, 92 and 92A”.

Privacy Act 1988

48 Subsection 80P(7) (paragraph (a) of the definition of designated secrecy provision)

Omit “and 92”, substitute “, 92 and 92A”.

Authorisations for intelligence activities

Intelligence Services Act 2001

1 Subsections 9(1A) and (1AAA)

Repeal the subsections, substitute:

Note 1: For serious crime, see section 3.

Note 2: Certain authorisations referred to in this subsection cannot take effect unless the Minister has obtained the agreement of the Attorney-General (see subsection (1AAC)).

(1AAA) Before a Minister gives an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(iaa), the Minister must also be satisfied that the class of Australian persons mentioned in that subparagraph is, or is likely to be, involved with a listed terrorist organisation.

Note: An authorisation referred to in this subsection cannot take effect unless the Minister has obtained the agreement of the Attorney-General (see subsection (1AAD)).

(1A) Before a Minister gives an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(i), (ia), (ib) or (ii) (the relevant subparagraph), the Minister must also be satisfied that the Australian person, or the class of Australian persons, mentioned in the relevant subparagraph is, or is likely to be, involved in one or more of the following activities:

activities that present a significant risk to the safety of any person (including the Australian person or a member of the class of Australian persons mentioned in the relevant subparagraph);

acting for, or on behalf of, a foreign power;

activities that are, or are likely to be, a threat to security;

activities that pose a risk, or are likely to pose a risk, to the operational security of ASIS;

(e) activities related to the proliferation of weapons of mass destruction or the movement of goods listed from time to time in the Defence and Strategic Goods List (within the meaning of regulation 13E of the Customs (Prohibited Exports) Regulations 1958);

activities related to a contravention, or an alleged contravention, of a UN sanction enforcement law by any person (including the Australian person or a member of the class of Australian persons mentioned in the relevant subparagraph);

committing a serious crime by moving money, goods or people;

committing a serious crime by using or transferring intellectual property;

committing a serious crime by transmitting data or signals by means of guided and/or unguided electromagnetic energy.

2 After the heading to subsection 9(1AA)

Insert:

(1AAC) An authorisation referred to in subsection (1A) for an activity, or a series of activities, in relation to an Australian person, or a class of Australian persons, who is, or is likely to be, involved in activities referred to in paragraph (1A)(c) (whether or not the person, or the class of persons, is, or likely to be, involved in activities covered by another paragraph of subsection (1A)) cannot take effect unless and until the Minister has obtained the agreement (orally or in writing, but subject to subsection (1AA)) of the Attorney-General. The agreement may be sought before or after the authorisation is given.

(1AAD) An authorisation referred to in subsection (1AAA) for an activity, or a series of activities, in relation to a class of Australian persons cannot take effect unless and until the Minister has obtained the agreement (orally or in writing, but subject to subsection (1AA)) of the Attorney-General. The agreement may be sought before or after the authorisation is given.

3 Subsection 9(1AA)

Omit “paragraph (1A)(b) or (1AAA)(b)”, substitute “subsection (1AAC) or (1AAD)”.

4 Paragraph 9(5)(b)

Omit “paragraph (1A)(b) or (1AAA)(b)”, substitute “subsection (1AAC) or (1AAD)”.

5 Subsection 9(6)

Omit “paragraph (1A)(b) or (1AAA)(b)”, substitute “subsection (1AAC) or (1AAD)”.

6 Subsection 9A(2) (note)

Repeal the note.

7 Subparagraph 9B(2)(c)(ii)

Omit “serious risk to a person’s safety”, substitute “significant risk to the safety of any person”.

8 Subsection 9B(2) (note)

Repeal the note.

9 Subparagraph 9C(1)(c)(i)

Repeal the subparagraph, substitute:

the authorisation cannot take effect unless and until the agreement of the Attorney-General has been obtained under subsection 9(1AAC);

10 Subsections 9C(2) and (3)

Repeal the subsections, substitute:

Giving authorisation

Obtaining the agreement of the Director-General of Security

Despite subsection 9(1AAC) and subject to subsection (3) of this section, the authorisation:

may be given; and

may take effect without the agreement of the Attorney-General having been obtained.

Before an authorisation is given under section 9A or 9B, the agency head must, unless the agency head is satisfied that the Director-General of Security is not readily available or contactable, obtain the agreement of the Director-General to the authorisation:

being given; and

taking effect without the agreement of the Attorney-General having been obtained.

11 Subsection 9D(2)

Omit “, apart from paragraph 9(1A)(b)”.

12 After subsection 9D(3)

Insert:

Agreement of the Attorney-General not required

Subsection 9(1AAC) does not apply in relation to the authorisation.

13 Paragraph 10AA(3)(a)

Omit “paragraph 9(1A)(b) or (1AAA)(b)”, substitute “subsection (1AAC) or (1AAD)”.

14 Paragraph 11(2AA)(a)

Omit “a person’s safety”, substitute “the safety of that person or any other person”.

15 Subsection 13B(6)

Omit “paragraph 9(1A)(a)”, substitute “subsection 9(1A)”.

16 Application of amendments

The amendments made by this Part apply in relation to an authorisation given under Intelligence Services Act 2001 after the commencement of this Part.Division 1 of Part 2 of the

Australian Security Intelligence Organisation Act 1979

17 After section 4

Insert:

4AA References to the Attorney-General

Despite subsection 19(1) of the Acts Interpretation Act 1901, a reference in this Act to the Attorney-General is a reference only to the Minister with that title.

Note: A reference in this Act to the Attorney-General may include a reference to a person acting as the Attorney-General: see subsection 19(4) of the Acts Interpretation Act 1901.

Telecommunications (Interception and Access) Act 1979

18 After subsection 5(3)

Insert:

Note: A reference in this Act to the Attorney-General may include a reference to a person acting as the Attorney-General: see subsection 19(4) of the Acts Interpretation Act 1901.

(3A) Despite subsection 19(1) of the Acts Interpretation Act 1901, a reference in this Act to the Attorney-General is a reference only to the Minister with that title.

19 Subsection 5(4)

Omit “A reference”, substitute “However, a reference”.

Australian Security Intelligence Organisation Act 1979

20 Subsection 35B(1)

Omit “, a senior position-holder or an ASIO employee”.

21 Paragraphs 35B(2)(a) and (b)

Omit “the applicant”, substitute “the Director-General”.

22 Subsection 35B(4)

Omit “the applicant”, substitute “the Director-General”.

23 Subsection 35F(1)

Omit “, a senior position-holder or an ASIO employee”.

24 Paragraphs 35F(2)(a) and (b)

Omit “the applicant”, substitute “the Director-General”.

25 Subsection 35F(3)

Omit “the applicant”, substitute “the Director-General”.

26 Application of amendments

The amendments made by this Part apply in relation to an application made under subsection 35B(1) or 35F(1) of the Australian Security Intelligence Organisation Act 1979 on or after the commencement of this Part.

Security vetting and security clearance related activities

Australian Security Intelligence Organisation Act 1979

1 Section 4 (paragraph (b) of the definition of security clearance suitability assessment)

After “security vetting agency”, insert “(within the meaning of Part IVA)”.

2 At the end of paragraph 16(1C)(b)

Add “that is a prejudicial security clearance suitability assessment (within the meaning of Part IVA)”.

3 At the end of subsection 16(1C)

Add:

Note: The Director-General may, under subsection (1B), delegate the power or function under subsection 82D(1) to furnish a security clearance suitability assessment under paragraph 82C(1)(d) that is not a prejudicial security clearance suitability assessment.

4 Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Part apply in relation to a security clearance suitability assessment furnished on or after the commencement of this item.

Australian Security Intelligence Organisation Act 1979

5 Section 82A

Insert:

delayed security clearance decision has the meaning given by subsection 82GA(1).

delayed security clearance suitability assessment has the meaning given by subsection 82GA(2).

6 Section 82B (after the paragraph beginning “There are some limitations”)

Insert:

The Director-General must cause the Inspector-General of Intelligence and Security to be notified of delayed security clearance decisions and delayed security clearance suitability assessments. The Director-General must make a protocol for dealing with such decisions and suitability assessments.

7 At the end of Division 2 of Part IVA

Add:

82GA Notification of delayed security clearance decision or delayed security clearance suitability assessment

Notification of delayed security clearance decision or security clearance suitability assessment

Note: A protocol made under subsection 82GB(1) must specify when the Organisation is taken to have started to consider making a security clearance decision, which may be specified differently for different classes of security clearance decisions (see subsections 82GB(3) and (4)).

Note: A protocol made under subsection 82GB(1) must specify when the Organisation is taken to have started to prepare a security clearance suitability assessment, which may be specified differently for different classes of security clearance suitability assessments (see subsections 82GB(3) and (4)).

Exceptions to requirement to notify

Application of this section

(1) If a security clearance decision is not made under this Part within 12 months after the Organisation starts to consider making the decision (the delayed security clearance decision), the Director-General must cause the Inspector-General of Intelligence and Security to be notified of the delayed security clearance decision.

(2) If a security clearance suitability assessment is not furnished under this Part within 12 months after the Organisation starts to prepare the suitability assessment (the delayed security clearance suitability assessment), the Director-General must cause the Inspector-General of Intelligence and Security to be notified of the delayed security clearance suitability assessment.

A notification under subsection (1) or (2) must:

be made within the period specified, for the purposes of subparagraph 82GB(3)(b)(i), in the protocol made under subsection 82GB(1), as in force from time to time; and

include the information specified in that protocol for the purposes of subparagraph 82GB(3)(b)(ii); and

comply with any other requirements specified in the protocol for the purposes of paragraph 82GB(3)(d).

However, subsection (1) or (2) does not apply if:

the Organisation has been notified that the security clearance decision or security clearance suitability assessment is no longer required; or

the Organisation initiated the making of the security clearance decision or the preparation of the security clearance suitability assessment without a request for the decision or suitability assessment being made by another Commonwealth agency, a State or an authority of a State.

This section applies to:

a security clearance decision that the Organisation starts to consider making on or after the commencement of this section; and

a security clearance suitability assessment that the Organisation starts to prepare on or after the commencement of this section.

82GB Protocol for dealing with delayed security clearance decisions and delayed security clearance suitability assessments

Requirement to make protocol

Note 1: For variation of a protocol, see subsection 33(3) of the Acts Interpretation Act 1901.

Note 2: A protocol made under this subsection may be combined with a protocol made under subsection 42(1) (protocol for dealing with delayed security assessments).

Requirement to comply with protocol

[Minister’s second reading speech made in—

House of Representatives on 30 November 2023

Senate on 15 May 2024]

(152/23)

The Director-General must make a written protocol for dealing with delayed security clearance decisions and delayed security clearance suitability assessments.

The Director-General must consult with the Inspector-General of Intelligence and Security before making a protocol under subsection (1).

The protocol:

must specify the following:

when the Organisation is taken to have started to consider making a security clearance decision;

when the Organisation is taken to have started to prepare a security clearance suitability assessment; and

must specify the following in relation to the notification under section 82GA of a delayed security clearance decision or delayed security clearance suitability assessment:

(i) the period within which the notification must be made;

the information to be included in the notification; and

must deal with steps to be taken by the Organisation in relation to the delayed security clearance decision or delayed security clearance suitability assessment after the notification referred to in paragraph (b) is made; and

may specify other requirements, or deal with any other matters, that:

relate to a delayed security clearance decision or delayed security clearance suitability assessment, or the notification of the decision or suitability assessment under section 82GA; and

the Director-General considers appropriate.

Without limiting subsection (1), the protocol may provide differently for different classes of security clearance decisions or security clearance suitability assessments.

A protocol made under subsection (1) is not a legislative instrument.

The Organisation must, in relation to a delayed security clearance decision or delayed security clearance suitability assessment to which subsection 82GA(1) or (2) applies, comply with a protocol made under subsection (1) of this section, as in force from time to time.