Service providers that use communications infrastructure in Australia to operate any of their services may be subject to data retention obligations. Service providers include: licenced carriers, carriage service providers and internet service providers. Some services are excluded from the data retention obligations.
The data retention obligations require some telecommunications service providers to retain specific telecommunications data (the data set) relating to the services they offer for two years. The retained data must be encrypted and protected from unauthorised interference or unauthorised access. Some subscriber information (a category of data in the data set) must be retained for the life of the account and for a further two years after the account is closed.
Service providers will need to consider the application of the data set to each service they offer. Depending on the type of service offered, service providers may not be required to retain all of the categories.
Service providers must begin retaining the required data for each relevant service they provide from 13 October 2015, unless they are acting under an approved Data Retention Implementation Plan and/or have a relevant exemption from and/or variation of their obligations. Service providers are not required to have two years of retained data at 13 October 2015. As of 13 April 2015, a service provider must not reduce the period for which it keeps or causes to be kept any information or document which it will be required to keep from 13 October 2015.
Data Retention Industry Grants Programme
The Australian Government has allocated up to $128.4 million over three years to assist industry in meeting the upfront costs of implementing the mandatory data retention regime. Carriers, carriage service providers and internet service providers undertaking work to meet their obligations may be eligible to apply for a grant.
The Data Retention Industry Grants Programme closed on 23 February 2016. The Data Retention Industry Grants Programme is a single funding round. For more information on the Data Retention Industry Grants Programme, please see the Programme Guidelines below.
Data retention implementation plans
Service providers may submit a Data Retention Implementation Plan to the Communications Access Coordinator to request more time to develop capability to meet their data retention obligations.
If the Data Retention Implementation Plan is approved, service providers can use the additional time to develop data retention systems. The last day which a service provider may still operate under an approved Data Retention Implementation Plan is 12 April 2017.
Exemptions and/or variations
Service providers may apply to the Communications Access Coordinator for exemptions from and/or variations of their data retention obligations. Exemptions and/or variations will be considered on a case by case basis and are confidential in nature.
The Department is committed to supporting industry in understanding its data retention obligations. Accordingly, the Department has developed a package of guidance materials. The materials may be subject to further updates. The most recent iterations are linked below:
Service providers may email the office of the Communications Access Coordinator at email@example.com or call 02 6141 2884.