Human Source Management Regulations 2024

Several key concepts run through the regulations and are defined in regulation 4. First, secure delivery is the mandated method for most communications. It can be achieved in three ways: (a) delivery in a double-sealed envelope by a member of Victoria Police personnel, the Public Interest Monitor, the Victorian Inspectorate or IBAC; (b) by secure electronic means; or (c) by telephone. The double-sealed envelope itself is defined as an inner envelope containing documents which is sealed and displays markings indicating the security classification level, and that inner envelope is enclosed in a second sealed envelope. This physical security measure is required even for documents transmitted between oversight bodies on the same site unless they are viewed in person. The unique identifying number is a practical tool: a unique number or name assigned to an application for reference purposes by a member of Victoria Police personnel. It appears in almost every notification and document provision requirement under regulations 10, 12, 15, 16, 17 and 18, ensuring that each human source registration matter can be tracked across different notifications without relying on names or other identifying details. The written receipt is defined in regulation 5 as a receipt given by the Public Interest Monitor that specifies the unique identifying number, the type of notification or documents received, the regulation under which the notification was made or documents delivered, and if the notification included other documents a list of those documents. This creates a positive feedback mechanism: the Chief Commissioner sends a notification; the Public Interest Monitor must confirm in writing with a specific content requirement. Regulation 19 and 20 impose the confirmation duties on the Public Interest Monitor, not on the other bodies. Another important concept is that of information security event and information security incident, defined in regulation 6(2) in relation to the written procedures that the Public Interest Monitor and IBAC must develop. An information security event is an identified occurrence indicating a possible breach of an information security policy, a failure of safeguards, or a previously unknown situation relevant to security. An information security incident is a single or series of events likely to have compromised the security of information. These definitions trigger obligations to have reporting, escalation and response procedures in place. The regulations also distinguish between applications made under section 21 and section 30A of the Act. Section 21 appears to be the ordinary route for registration; section 30A appears to be an emergency or expedited route requiring a Supreme Court application. Notifications under regulation 12 must specify which section the application is made under, and for a section 30A application the notification must also state whether the application was made in writing, by telephone or by other electronic communication. Regulation 13 adds a pre-application step for section 30A: the Chief Commissioner must contact the Public Interest Monitor to ascertain availability for the hearing before a police officer applies to the Supreme Court. This is a notable procedural hurdle that may create delay in genuine emergencies. The document register concept in regulation 7 requires the Public Interest Monitor to keep a register of all documents received in relation to applications and emergency registrations, their location, and the date hard copies are returned to the applicant. This register is not required to be shared with Victoria Police, IBAC or the Victorian Inspectorate, though it would presumably be subject to oversight.

The regulations directly affect four primary institutions and the individuals within them. First, Victoria Police personnel, particularly the Chief Commissioner and police officers who deal with human source applications and registrations. They are responsible for assigning unique identifying numbers (regulation 4 definition), making notifications by secure delivery (regulations 12, 13, 14, 16, 17, 18), providing documents and information with unique identifying numbers by secure delivery (regulation 15), and ensuring that information about persons determined not to require registration is retained in a manner that assists IBAC (regulation 9). The Chief Commissioner has specific duties to contact the Public Interest Monitor before a section 30A application (regulation 13) and to notify of changes to notification details (regulation 14). Second, the Public Interest Monitor is the most heavily burdened body. The Public Interest Monitor must develop written procedures for dealing with documents and information (regulation 6), keep a document register (regulation 7), store all documents in a secure place (regulation 8), give written receipts for notifications and document provisions (regulations 19 and 20), and receive all notifications and documents under the regulations. The Public Interest Monitor is also the recipient of the unique identifying number requirements and must specify it in written receipts. Third, IBAC is also required to develop written procedures under regulation 6, keep documents securely under regulation 8, and receive information transmitted by secure delivery under regulation 11. However, IBAC is not required to give written receipts or keep a register under these regulations, though it may do so under other obligations. Fourth, the Victorian Inspectorate is the recipient of direction documents under regulation 10, which must be provided by secure delivery with the unique identifying number. The Victorian Inspectorate must also transmit and receive documents under the secure delivery requirements of regulation 11, but it is not required to develop written procedures or keep registers under these specific regulations. Indirectly, the regulations affect applicants for registration (human sources themselves or police officers acting on their behalf) because the procedural requirements affect the speed and security of the registration process. For example, a section 30A emergency application cannot proceed to the Supreme Court until the Chief Commissioner has contacted the Public Interest Monitor about their availability (regulation 13). This could delay an emergency registration if the Public Interest Monitor is unavailable. The regulations also affect anyone who might be the subject of an information security event or incident, as the required procedures under regulation 6 may lead to reporting to oversight bodies. The practical effect is that anyone whose information is handled under these regulations has some assurance (or burden) of a formalised chain of custody, but also faces the risk that procedural non-compliance could lead to oversight scrutiny. There is no direct impact on the general public, as human source matters are by their nature secret.

The regulations impose a mixture of positive duties and compliance obligations. The principal duties fall on the Public Interest Monitor and IBAC to develop written procedures under regulation 6. Regulation 6(1) lists seven categories: an information security policy; an access control policy; procedures for monitoring access activities; procedures for ensuring adequate protection of documents and information; a risk management policy for identifying, analysing and treating security risks; reporting, escalation and response procedures for information security events or identified weaknesses; and a process of continual monitoring and improvement. These are not optional; they must be developed and evidently maintained. Non-compliance may expose the responsible body to adverse findings by the Victorian Inspectorate or other oversight. The Public Interest Monitor also has a duty to keep a register under regulation 7 covering all documents received in relation to applications and emergency registrations, their location, and the date hard copy documents are returned to the applicant. This register must be kept current. Both the Public Interest Monitor and IBAC must keep all documents (including copies of applications and supporting affidavits) in a secure place accessible only to authorised persons (regulation 8). Victoria Police personnel have a duty under regulation 9: if a police officer is reasonably satisfied a person does not need to be registered as a human source, the officer must retain and store all information received in a manner that reasonably assists IBAC to perform its functions and exercise its powers under section 65 of the Act. The retained information must include information going to the officer's reasonable satisfaction. This ensures IBAC can later review decisions not to register, preventing evasion of oversight. The Chief Commissioner has a duty under regulation 10 to provide a copy of a direction given under section 52(2)(b) of the Act to the Victorian Inspectorate, specifying the unique identifying number and using secure delivery. The most frequently triggered duty is the requirement to use secure delivery for all document and information transmissions between the four bodies (regulation 11), subject to exceptions for physically present persons and purely administrative documents. The notification duties are set out in regulations 12 through 18. The Chief Commissioner must notify the Public Interest Monitor of applications to register a reportable human source, including the unique identifying number, the section under which the application is made, and for section 30A applications whether it was written, telephone or electronic. Before a section 30A application can be made to the Supreme Court, the Chief Commissioner must contact the Public Interest Monitor to ascertain availability (regulation 13). Notification of the scheduled hearing time, date and place must follow. Any change to details in those notifications must be notified as soon as practicable (regulation 14). Emergency registration notifications under section 56 of the Act must also be by secure delivery and include the unique identifying number and the method of application (regulation 16). Notification of recommendation outcomes (regulation 17) and referral outcomes (regulation 18) must similarly include the unique identifying number and be by secure delivery. The rights created by these regulations are limited. The Chief Commissioner has a right to receive a written receipt from the Public Interest Monitor as confirmation of notifications and document provisions under regulations 19 and 20. Regulation 20(2) excludes oral information from the receipt requirement, meaning that information given orally does not trigger a confirmatory duty. No other rights are created for human sources or third parties; the regulations are a closed administrative system.

The regulations themselves do not prescribe any penalties, fines, imprisonment terms or infringement notices. They are made under the rule-making power in section 90 of the Human Source Management Act 2023, and any penalty provisions would need to be contained in the Act itself. The regulations focus exclusively on procedural requirements. Enforcement of these requirements would likely occur through existing oversight mechanisms. The Act establishes roles for IBAC and the Victorian Inspectorate, and non-compliance with the regulations could be reported to those bodies. For example, failure to develop written procedures under regulation 6 might be grounds for a critical report by the Victorian Inspectorate or could be considered misconduct by the responsible officer. Failure to use secure delivery as required by regulation 11 could compromise the security of human source information, and if it leads to an information security incident, that would trigger the reporting procedures under regulation 6(1)(f). The regulations themselves do not say what consequences follow if a notification is not given, is given late, or is given without the required details. However, because the regulations are made for the purposes of specific sections of the Act (for example, section 54(2)(a) for notification of applications, section 54(1A) for providing applications, section 54(3) and (4) for providing information and documents), a failure to comply with the relevant regulation might mean that the requirements of that section are not satisfied. That could, in turn, affect the legal validity of the underlying human source registration or the steps taken in reliance on it. For instance, if an application is registered without the required notification to the Public Interest Monitor under regulation 12, a court or oversight body might find the registration procedurally defective. There is also a potential for contempt of court or other sanctions if a Supreme Court hearing proceeds under section 30A without the pre-hearing contact required by regulation 13. The regulations do not provide a mechanism for waiver or cure of procedural defects, though the Act might contain such provisions elsewhere. From a practical enforcement perspective, the written receipt mechanism is the primary feedback loop. If the Public Interest Monitor does not give a written receipt, the Chief Commissioner may lack evidence that the notification was properly made. This creates an implicit incentive for both sides to comply: the Chief Commissioner wants receipts to prove compliance; the Public Interest Monitor wants to maintain an accurate register. In summary, enforcement is indirect and relies on the oversight architecture of the Act rather than on direct penalties in the regulations. This means compliance depends heavily on institutional culture and the perceived risk of adverse findings, rather than on a clear schedule of fines.

The regulations are expressly made under section 90 of the Human Source Management Act 2023. They derive their legal force from that Act and must be read consistently with its provisions. The regulations fill in procedural details left by the Act, but they cannot override or contradict the Act. If a regulation is inconsistent with the Act, the Act prevails. The regulations also interact with the Subordinate Legislation Act 1994, which imposes the ten-year sunset period mentioned in Endnote 1. Regulation 3 fixes the commencement date at 30 September 2024. The Interpretation of Legislation Act 1984 applies to the construction of these regulations. Endnote 1 explains that headings, examples, diagrams, notes, punctuation and provision numbers form part of the regulations (section 36 of the ILA). This is important because some practitioners might assume that headings or examples are merely explanatory, but they are legally operative. The regulations do not directly interact with privacy laws, freedom of information laws or evidence laws, though such interactions would arise through the Act. For example, documents held by IBAC or the Victorian Inspectorate might be subject to the Freedom of Information Act 1982 (Vic), but these regulations impose restrictions on handling that could affect FOI processing. The secure delivery and storage requirements are designed to protect sensitive information, which may also align with obligations under the Privacy and Data Protection Act 2014 (Vic) and the Victorian Protective Data Security Standards. However, since the regulations do not reference those statutes, the interaction is indirect. There is no explicit override of the common law as to legal professional privilege or public interest immunity; the documents and information covered by these regulations would still be subject to those doctrines. The regulations also interact with the Supreme Court Act 1986 (Vic) insofar as regulation 13 contemplates applications to the Supreme Court under section 30A of the Act. The procedural requirements for those applications are governed by the Supreme Court rules, but the regulations add a pre-application requirement to contact the Public Interest Monitor. This is not a typical court procedure and could create tension if the court expects a certain standard of urgency. The regulations do not purport to amend or repeal any other statutory instrument. There are no references to other regulations being revoked or amended. The Table of Amendments in Endnote 2 confirms that no amendments have been made to these regulations since they were made. The regulations are a stand-alone instrument under the Act. They will interact with any future regulations made under the same Act, particularly if the Act is amended to create new categories of human sources or new oversight functions.

According to the Table of Amendments in Endnote 2, there have been no amendments made to the Human Source Management Regulations 2024 by statutory rules, subordinate instruments or Acts. The regulations are version 001, as at 30 September 2024. They were made on 10 September 2024 and came into operation on 20 September 2024 per the commencement regulation. Because the regulations are recent, there is no amendment history to track. The absence of amendments does not indicate stability; the Act itself may be amended, which could necessitate amendments to the regulations. Practitioners should monitor the Victorian legislation website for future amendments. The regulations are subject to the ten year sunset under the Subordinate Legislation Act 1994, meaning they will automatically repeal on 10 September 2034 unless remade or extended. Any future amendments will appear in a subsequent version. Because the regulations are procedural and detailed, they may be amended frequently if practical problems emerge, for example if secure electronic means are redefined or if new categories of notifications are added.

As of the date of these regulations coming into operation, there is no reported litigation concerning them. They are too recent (made 10 September 2024, in operation 30 September 2024) for any court to have interpreted them. No cases are cited in the regulations themselves. The academic commentaries and tribunal decisions that might emerge in the future will need to address how strictly the courts will enforce the procedural requirements. Potential litigation could arise if a human source challenges the validity of their registration on the ground that the Chief Commissioner failed to follow the notification or secure delivery requirements. Alternatively, a police officer charged with misconduct in relation to human source management might argue that non-compliance with the regulations did not affect the substance of the decision. The absence of penalty provisions in the regulations means that any court challenge would likely be framed around jurisdictional error under the Act or the common law. The Victorian Inspectorate may also make reports that effectively constitute quasi-litigation findings. No such reports are available yet. Practitioners should watch for decisions of the Supreme Court of Victoria and the Victorian Civil and Administrative Tribunal that interpret the Act and these regulations.

Several provisions contain traps that could catch unwary practitioners. The most significant is regulation 13(1), which requires the Chief Commissioner to contact the Public Interest Monitor to ascertain availability before a police officer applies to the Supreme Court under section 30A. This creates a mandatory pre-application step. If the Chief Commissioner forgets or cannot reach the Public Interest Monitor promptly, a section 30A application may be invalid or the hearing may need to be adjourned. Practitioners handling emergency registrations should have a protocol for contacting the Public Interest Monitor well in advance. Another trap is regulation 11(2), which says that secure delivery does not apply to documents and information viewed or transmitted to persons from a body who are physically present at that time. This exception sounds broad but is narrowly worded: it applies only when the viewing or transmission occurs in person. Emails, electronic uploads, courier deliveries and even handing a document to someone in the hallway might not count as physical presence before the intended recipient if not done in a controlled manner. The safest approach is to use secure delivery for everything substantive unless both parties are in the same room. Regulation 11(3) excludes purely administrative documents from secure delivery, but does not define "purely administrative". This is a grey area. A covering letter that contains case-sensitive information could be deemed substantive. Practitioners should err on the side of caution. Regulation 20(2) provides that a written receipt is not required for information given orally. This may create an evidential gap if an oral notification is later disputed. The Chief Commissioner may want to confirm oral communications in writing to trigger a receipt. Regulation 15(2) requires that information under section 54(3) be provided as soon as practicable after preparation but in any case before a decision on the application. This imposes a strict timeline: if the information is prepared the day before the decision and transmitted at the last minute, it may still comply, but any delay after preparation could be non-compliance. Regulation 10 requires that when a copy of a direction is given to the Victorian Inspectorate under section 52(3) of the Act, the copy must specify the unique identifying number and be provided by secure delivery. This seems straightforward, but note that it applies only to directions under section 52(2)(b). Other directions may not be covered, creating a potential inconsistency. Regulation 14 requires notification of a change to any details included in a notification under regulation 12 or 13 "as soon as practicable". If the change occurs after a decision has been made, the duty to notify may still apply. This could catch a Chief Commissioner who does not update the Public Interest Monitor about a change in the estimated timeline. The definition of "unique identifying number" in regulation 4 leaves it to a member of Victoria Police personnel to assign a number or name. If different members assign different numbers for the same application, confusion may arise. A centralised assignment system would be prudent. Finally, the regulation 9 duty to retain and store information about persons not registered is broad. It requires that the information be stored in a manner that reasonably assists IBAC to perform its functions. If IBAC later investigates and finds the information was not stored in a searchable or accessible manner, that could be a breach. Practitioners should ensure that such information is indexed and retained for the relevant retention period under the Act or other laws.

Compliance with the Human Source Management Regulations 2024 requires each affected body to implement systematic administrative processes. The first step is for the Public Interest Monitor and IBAC to develop the written procedures mandated by regulation 6. These procedures should cover the seven listed categories: information security policy, access control, monitoring access, document protection, risk management, incident reporting and response, and continuous monitoring. They should be formally documented, approved at an appropriate level, and reviewed periodically. The policies should define who is entitled to access documents, how access is logged, what constitutes an information security event, and the escalation path. Failure to have such policies in place is a clear non-compliance. The second step is to establish the document register required by regulation 7 for the Public Interest Monitor. This register should track all documents received in relation to applications and emergency registrations, including the location and the date hard copies are returned. A electronic database with timestamped entries would be appropriate. The register must be able to link to the unique identifying number assigned by Victoria Police. The third step is secure delivery protocols. All notifications and document transmissions between Victoria Police, the Public Interest Monitor, IBAC and the Victorian Inspectorate must be by secure delivery, unless the exception for physical presence or purely administrative documents applies. Secure delivery can be by double-sealed envelope, secure electronic means (such as encrypted email or a secure portal) or telephone. Each body should have a roster of authorised personnel to prepare and receive double-sealed envelopes, and should agree on acceptable secure electronic means. Telephone notifications should be documented contemporaneously and the Public Interest Monitor should issue a written receipt for those if possible, though regulation 20(2) does not require it. The fourth step is notification management. The Chief Commissioner should have a checklist for each human source application. The checklist should include: assigning a unique identifying number; notifying the Public Interest Monitor under regulation 12 with all required details; for section 30A applications, contacting the Public Interest Monitor under regulation 13 before applying to the Supreme Court; scheduling the hearing and notifying the Public Interest Monitor; monitoring for changes and notifying under regulation 14; providing applications and information under regulation 15 with the unique identifying number and by secure delivery; and notifying of recommendation and referral outcomes under regulations 17 and 18. The Chief Commissioner should also ensure that notifications under regulation 16 for emergency registrations include the unique identifying number and method of application. The fifth step is confirmation tracking. The Public Interest Monitor must give written receipts for all notifications and document provisions under regulations 19 and 20. The Chief Commissioner should maintain a file of these receipts as evidence of compliance. If a receipt is not received within a reasonable time, the Chief Commissioner should follow up. The sixth step is document security. Both the Public Interest Monitor and IBAC must keep all documents in a secure place accessible only to authorised persons. This means locked filing cabinets in a locked office or an electronic system with role-based access controls. Physical documents must be stored in a manner that prevents unauthorised access. The seventh step is information retention under regulation 9. Victoria Police officers who decide a person does not need registration must retain all information received, including the reasoning for the decision, and store it so that IBAC can access it. This may require creating a separate data repository or marking files with a flag that allows IBAC to find them during reviews. The final step is training. All personnel involved in human source matters must be trained on these regulations, including the definitions of secure delivery, double-sealed envelope, information security events and incidents, and the obligation to use unique identifying numbers. Regular audits should check that notifications are given on time, that registers are current, and that documents are stored securely. Given that the regulations are procedural, compliance is largely a matter of discipline rather than legal interpretation. The risk of non-compliance is that a human source registration could be challenged, or that adverse findings could be made by the Victorian Inspectorate. Practitioners should treat the regulations as a rigid checklist that must be followed step by step.