National Transport Commission (Model Legislation—Intelligent Access Program) Regulations 2006
In ForceCTH
Jurisdiction
Commonwealth
Act Number
164 of 2006
Collection
legislative instrument
Plain English Summary
7/10 complexity
This instrument publishes model legislation that sets up an Intelligent Access Program (IAP): heavy vehicles may get access or improved access to roads in return for monitoring by approved intelligent transport systems (s3). It allocates who sets access conditions (the Authority), who certifies and audits devices (TCA), and creates offences and reporting duties for operators, drivers and service providers.
The compliance costs largely fall on participating operators and IAP service providers (monitoring, reporting and record‑keeping); decision‑making power sits with the Authority and TCA; the model tightly restricts use, retention and disclosure of IAP data and gives system reports presumptive evidentiary weight (ss14–21, 23–33, 47–53).
This instrument in Schedule 1 sets out model legislation, in Bill form, for an Intelligent Access Program (IAP). The Regulations themselves (Regulation 3) place that model Bill before jurisdictions under the National Transport Commission Act 2003 framework; the model text is not law unless adopted by a jurisdiction (Reg 3, notes 1 and 5). The model Bill defines a statutory architecture that ties conditional access by heavy vehicles to automated monitoring by certified intelligent transport systems, backed by obligations on operators, drivers, IAP service providers, IAP auditors and Transport Certification Australia (TCA).
Mechanically, the Bill:
defines the IAP as access or improved access to roads in return for monitoring by an approved intelligent transport system (s3, s4);
gives the Authority power to specify IAP conditions that spatially and temporally define permitted access and other access rules (s7, s8);
contemplates IAP agreements between operators and certified IAP service providers (s4);
requires operators to inform drivers about monitoring and privacy rights (s11);
requires operators and drivers to report malfunctions immediately and to keep written records of such reports (s12-13);
imposes duties on IAP service providers to make non‑compliance reports and tampering reports to the Authority, to manage and secure IAP information, and to allow audits (s14-21, s18);
establishes TCA as the certifier, auditor appointing authority and manager of the certification and audit regime (s23), with rules on its use, disclosure and retention of information (s24-33);
creates IAP auditors with defined audit functions and reporting duties (Pt 7, s34-43);
Current sections
Direct links to the current provisions in National Transport Commission (Model Legislation—Intelligent Access Program) Regulations 2006.
65
1
Name of Regulations
1 Name of Regulations
These Regulations are the National Transport Commission (Model Legislation—Intelligent Access Program) Regulations 2006.
2
Commencement
2 Commencement
These Regulations commence on the day after they are registered.
3
Model legislation—Intelligent Access Program
3 Model legislation—Intelligent Access Program
For section 7 of the National Transport Commission Act 2003 (the NTC Act), Schedule 1 sets out model legislation, in the form of a Bill for an Act, about the Intelligent Access Program.
Note 1: The model legislation set out in Schedule 1 does not have the force of law (see paragraph 7(2)(a) of the NTC Act).
Note 2: These Regulations must be made in accordance with the Agreement (see subparagraph 3(b)(ii) of the NTC Act).
Note 3: These Regulations are not subject to disallowance—see regulations made for the purposes of paragraph 44(2)(b) of the Legislation Act 2003.
Note 4: These Regulations are not subject to sunsetting—see regulations made for the purposes of paragraph 54(2)(b) of the Legislation Act 2003.
Note 5: The text set out in Schedule 1 is that of a draft Bill prepared for the National Transport Commission and approved by the Australian Transport Council on 2 December 2005, but never actually enacted.
Part 1
Preliminary
Part 1—Preliminary
4
Definitions
4 Definitions
(1) In this Act:
approved intelligent transport system means an intelligent transport system approved for the purposes of the IAP by TCA.
Note: Intelligent transport system is defined in the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003].
IAP is the acronym for Intelligent Access Program.
IAP agreement means an agreement between the operator of a vehicle and an IAP service provider under which the IAP service provider agrees to provide IAP monitoring services to the operator.
IAP audit—see section 34.
IAP auditor means a person approved as an IAP auditor by TCA.
IAP condition—see section 7.
IAP information means information that has been generated or collected for any purpose relating to the IAP.
IAP service provider means a person that is certified as an IAP service provider by TCA.
IAP vehicle means a vehicle that is subject to an IAP condition, is equipped for monitoring under the IAP, and is covered by an IAP agreement.
intelligent access map means the spatial data set, issued by TCA from time to time, that defines the national public road system.
Note: The intelligent access map may not include some private roads.
Intelligent Access Program—see section 3.
law‑enforcement purposes means the purposes of investigating or prosecuting an offence (whether summary or indictable) against:
(a) a road law; or
(b) \[the law corresponding to the Australian Road Rules\]; or
(c) a law relating to the transport by road of dangerous goods; or
(d) a law prescribed for the purposes of this paragraph.
malfunction of an approved intelligent transport system—see subsection (4).
non‑compliance report—see subsection (2).
participating operator means an operator of a vehicle or vehicles that has entered into an IAP agreement, and operates at least 1 IAP vehicle.
personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
tampering with an approved intelligent transport system—see section 44.
TCA means Transport Certification Australia Ltd ACN 113 379 936.
(2) A non‑compliance report:
(a) is a report, generated by an approved intelligent transport system, of a contravention by an IAP vehicle of an IAP condition; and
(b) may include information, about apparent tampering with that system, electronically generated by the system itself.
(3) A reference in a provision of this Act to an approved form is a reference to the form approved by the Authority for the purposes of the provision.
(4) An approved intelligent transport system malfunctions if:
(a) it ceases to work at all, or works only intermittently; or
(b) it does not perform 1 or more functions required under the IAP, or performs any such function only intermittently; or
(c) it performs such a function in such a way that the results of its doing so are inaccurate or unreliable (including intermittently inaccurate or unreliable).
(5) An expression used in this Act that is also used (whether or not defined) in the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003] has, unless the contrary intention appears, the same meaning in this Act as in that Act.
Note: The following significant terms are defined in the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003]:
5
Act to be read with Compliance and Enforcement Act
5 Act to be read with Compliance and Enforcement Act
This Act is to be read as one with the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003].
6
Other means of enforcement not excluded
6 Other means of enforcement not excluded
Nothing in this Act has the effect of preventing or excluding any other method of enforcement of a road law.
Part 2
Powers and duties of Authority in relation to IAP
Part 2—Powers and duties of Authority in relation to IAP
7
What IAP conditions do
7 What IAP conditions do
(1) In this section:
IAP road means a road or road‑related area specified in an IAP condition for use by IAP vehicles.
(2) An IAP condition is the specification of the conditions in relation to the IAP under which IAP vehicles are allowed to be used on an IAP road.
(3) An IAP condition:
(a) must specify at least 1 IAP road (spatial data); and
(b) may specify:
(i) periods during which IAP vehicles are permitted to use the specified IAP road (temporal data); and
(ii) maximum speeds at which IAP vehicles may travel during that use (speed data); and
(iii) any other condition of access to the IAP road (for example, a condition about mass limits); and
(c) may specify a period within which an approved intelligent transport system must generate, and send to the Authority, a non‑compliance report after the system detects a non‑compliance with the condition by an IAP vehicle.
(4) If an IAP condition does not specify speed data, it is taken to authorise the use of IAP vehicles on the IAP road at any speed at which a non‑IAP vehicle of the same class could be used on the IAP road.
(5) An IAP condition that specifies speed data does not authorise an IAP vehicle to travel at a speed in excess of a speed limit that applies to vehicles generally.
(6) If an IAP condition does not specify temporal data, it is taken to authorise the use of IAP vehicles on the IAP road at any time at which a non‑IAP vehicle of the same class could be used on the IAP road.
(7) An IAP condition may require an IAP vehicle to be monitored whether or not it uses an IAP road.
Drafting note: In any legislation of a jurisdiction that incorporates this model legislation, a note should be inserted stating where copies of the standard conditions of monitoring can be obtained.
8
Authority may specify IAP conditions
8 Authority may specify IAP conditions
(1) The Authority may specify IAP conditions.
(2) The Authority may combine an IAP condition with a mass, dimension or load restraint concession (within the meaning given by [the relevant provision of the Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003].
(3) An IAP condition not combined with such a concession must be published in …
Drafting note: An IAP condition not included in a mass, dimension or load restraint concession could be published in the Gazette or in some other way—this is to be left up to each jurisdiction.
9
Issue of IAP identifiers
9 Issue of IAP identifiers
(1) The Authority may issue an IAP identifier for an IAP vehicle.
(2) If an IAP identifier is, or becomes, known to a person or entity that has the ability to associate it with a particular individual, the person or entity must treat the identifier as personal information for the purposes of a law relating to privacy.
Part 3
Duties and obligations of operators of vehicles
Part 3—Duties and obligations of operators of vehicles
10
Offence—providing false or misleading information to IAP service provider
10 Offence—providing false or misleading information to IAP service provider
(1) The operator of an IAP vehicle commits an offence if:
(a) the operator gives information to an IAP service provider with which the operator has entered into an IAP agreement; and
(b) the information is relevant to the operation of the vehicle; and
(c) the information:
(i) is false or misleading; or
(ii) omits anything without which the information is false or misleading.
Maximum penalty: $10 000.
Drafting note: The penalty specified for an offence in this Bill is intended to be indicative only, as a general guide to the offence’s perceived seriousness.
(2) Subsection (1) does not apply because of subparagraph (1)(c)(i) if the information was not false or misleading in a material particular.
(3) Subsection (1) does not apply because of subparagraph (1)(c)(ii) if the information omitted did not render the information given false or misleading in a material particular.
(4) Without limiting paragraph (1)(b), information about an IAP condition that applies, or is capable of applying, to a vehicle is relevant to the operation of the vehicle.
(5) The operator of a vehicle commits an offence if:
(a) the operator gives information to an IAP service provider; and
(b) the operator intends that the IAP service provider will enter into an IAP agreement with the operator in reliance on the information; and
(c) the information:
(i) is false or misleading; or
(ii) omits anything without which the information is false or misleading.
Maximum penalty: $10 000.
(6) Subsection (5) does not apply because of subparagraph (5)(c)(i) if the information was not false or misleading in a material particular.
(7) Subsection (5) does not apply because of subparagraph (5)(c)(ii) if the information omitted did not render the information given false or misleading in a material particular.
Drafting note: The fact situation envisaged by subsections (5), (6) and (7) may possibly be covered by a fraud‑type offence in a particular jurisdiction. If so, those subsections can be omitted.
11
Operators’ obligation to tell drivers about collection of personal information and other matters
11 Operators’ obligation to tell drivers about collection of personal information and other matters
(1) The operator of an IAP vehicle must take reasonable steps to tell the vehicle’s driver, before the vehicle begins a journey:
(a) that the vehicle will be monitored by an IAP service provider; and
(b) what information will be collected by the IAP service provider; and
(c) the purposes for which that information is collected; and
(d) the persons and authorities to which information so collected may be disclosed; and
(e) that the collection of the information is authorised by this Act; and
(f) that the driver has the rights of reasonable access to, and of correction of, personal information so collected, and how those rights can be exercised; and
(g) the name and address of the IAP service provider.
Maximum penalty: $10 000.
Note: Driver includes a two‑up driver if he or she is in the vehicle—see the Compliance and Enforcement Model Bill, subsection 6(1) and section 5 of this Act.
(2) The operator of an IAP vehicle must take reasonable steps to tell the vehicle’s driver, before the vehicle begins a journey:
(a) about the driver’s obligation under section 13; and
(b) how the driver can make the reports required by that obligation.
Maximum penalty: $10 000.
Note: Driver includes a two‑up driver if he or she is in the vehicle—see the Compliance and Enforcement Model Bill, subsection 6(1) and section 5 of this Act.
(3) An operator may comply with subsections (1) and (2) by:
(a) placing a notice that gives the required information in a place in the vehicle’s driving cab where it is clearly visible; or
(b) giving the required information to the driver in writing as part of a written contract of employment between the driver and the operator.
(4) The regulations may prescribe:
(a) a form of notice that may be used for the purposes of paragraph (3)(a); and
(b) for paragraph (3)(b), a standard form of words that may be used as part of a written contract of employment.
12
System malfunctions—duties of operators of IAP vehicles
12 System malfunctions—duties of operators of IAP vehicles
(1) If the operator of an IAP vehicle becomes aware that an approved intelligent transport system fitted to the vehicle is malfunctioning, the operator must tell the Authority about the malfunction immediately, in person or by radio, telephone, fax or email.
Maximum penalty: $6 000.
(2) The operator of such a vehicle must keep a written record of reports of such malfunctions, including:
(a) the date, time and type of the malfunction, and the location of the vehicle concerned at the time of the malfunction; and
(b) the date, time, location of the vehicle, type of report, who made the report and who the report was made to.
Maximum penalty: $6 000.
Part 4
Duties of vehicle drivers
Part 4—Duties of vehicle drivers
13
System malfunctions—drivers’ duties
13 System malfunctions—drivers’ duties
(1) If the driver of an IAP vehicle becomes aware that an approved intelligent transport system fitted to the vehicle is malfunctioning, the driver must tell the vehicle’s operator about the malfunction immediately, in person or by radio, telephone, fax or email.
Maximum penalty: $6 000.
(2) The driver of such a vehicle must keep a written record of such reports, including:
(a) the date, time and type of the malfunction, and the location of the vehicle concerned at the time of the malfunction; and
(b) the date and time of the malfunction, the location of the vehicle at the time, the type of report, who made the report and who the report was made to.
Maximum penalty: $6 000.
Part 5
Duties, powers and obligations of IAP service providers
Part 5—Duties, powers and obligations of IAP service providers
14
IAP service providers’ duties in regard to use and disclosure of information
14 IAP service providers’ duties in regard to use and disclosure of information
An IAP service provider must not use or disclose IAP information otherwise than as required or authorised by or under this Act or any other law.
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
15
IAP service providers’ powers to collect, store, use and disclose IAP information
15 IAP service providers’ powers to collect, store, use and disclose IAP information
(1) An IAP service provider may collect, store and use IAP information (including personal information) for compliance purposes.
Note: ‘For compliance purposes’ is defined in Part 3 of the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003].
(2) An IAP service provider may disclose IAP information (including personal information) to the Authority, or to TCA, for compliance purposes.
(3) An IAP service provider may disclose IAP information (including personal information, but not including a non‑compliance report or a report under section 21) to a police officer, or to an authorised officer of the Authority, for law‑enforcement purposes if so authorised by a warrant issued by a court.
Note: An IAP service provider has a separate obligation to make non‑compliance reports to the Authority—see section 20.
Drafting note: Subclause (3) has been read as possibly giving an IAP service provider the choice of not complying with a valid warrant. This is not the intention. If a jurisdiction has any concern that subclause (3) might have that effect, perhaps the subclause could be replaced with one that simply states that nothing in the Bill is intended to affect the operation of any law relating to warrants.
(4) If an IAP service provider discloses IAP information to a police officer or an Authority officer under subsection (3), the police officer or Authority officer must not use the information, or disclose it to any other person, unless:
(a) the police officer or Authority officer believes the use or disclosure is reasonably necessary for law‑enforcement purposes; or
(b) the use or disclosure is otherwise authorised by or under this Act.
(5) With the consent of a participating operator, an IAP service provider may use or disclose IAP information about the operator to a person other than the operator for any purpose if the information:
(a) does not identify any individual; and
(b) contains nothing by which the identity of any individual can reasonably be ascertained.
(6) An IAP service provider may disclose IAP information (except a non‑compliance report) about a participating operator to the operator.
(7) In addition, an IAP service provider may use or disclose IAP information (including personal information):
(a) with the consent of any person about whom the IAP information includes personal information; or
(b) as otherwise authorised by this Act or any other law.
(8) An IAP service provider must give an IAP auditor access to any record kept by the IAP service provider for the purposes of this Act.
16
IAP service providers’ duties in regard to recording use and disclosure of information
16 IAP service providers’ duties in regard to recording use and disclosure of information
(1) If an IAP service provider uses or discloses IAP information, the IAP service provider must make a record of the use or disclosure containing the following information:
(a) the name of the person who used or disclosed the IAP information;
(b) the date of the disclosure or use;
(c) in the case of a disclosure of IAP information, the person or body to whom or to which that information was disclosed;
(d) in the case of the use of IAP information by the IAP service provider, a brief description of how the information was used;
(e) what provision of this Act or another law the disclosure or use was authorised by;
(f) if the authority for the disclosure or use also required a document (for example, a warrant, a certificate or a consent), a copy of the document.
(2) The IAP service provider must make the record within 5 business days after the relevant use or disclosure.
(3) The IAP service provider must make the record in a form that allows the record to be readily inspected.
(4) The IAP service provider must retain the record for 2 years.
(5) An IAP service provider commits an offence if it does not comply with a requirement of any of subsections (1) to (4).
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
(6) An offence against subsection (5) is an offence of strict liability.
17
IAP service providers’ obligations in regard to quality and security of IAP information
17 IAP service providers’ obligations in regard to quality and security of IAP information
(1) An IAP service provider must take reasonable steps to ensure that the IAP information it collects:
(a) is necessary for, or is directly related to, the purpose for which it is collected, or a directly related purpose; and
(b) is not excessive for that purpose; and
(c) is accurate, up‑to‑date and complete.
Penalty: $6 000.
(2) An IAP service provider must take reasonable steps to ensure that the collection of IAP information does not intrude to an unreasonable extent on the personal privacy of any individual to whom the information relates.
(3) If an individual (including an individual who is a participating operator) about whom an IAP service provider holds personal information so requests, an IAP service provider must make appropriate alterations to the personal information to ensure that the information is accurate, complete, up‑to‑date and not misleading
(4) If the IAP service provider considers that the personal information the subject of such a request is not inaccurate, incomplete, out‑of‑date or misleading, it may refuse to comply with the request, but must then:
(a) give the individual a statement in writing of its reasons for refusing; and
(b) if the individual so requests, attach to, or include with, the information a statement by him or her.
18
IAP service providers’ obligations to keep records of monitoring
18 IAP service providers’ obligations to keep records of monitoring
(1) An IAP service provider must keep a record of the IAP information that it collects.
(2) The record must be organised in a way that allows the record to be conveniently and properly audited.
(3) An IAP service provider must keep:
(a) a copy of a non‑compliance report; and
(b) the data that were relied on to generate the report;
for at least 4 years after the report is made by the provider.
Penalty: $10 000.
(4) An IAP service provider must take reasonable steps to protect IAP information collected by it against unauthorised access, unauthorised use, misuse, loss, modification or unauthorised disclosure.
(5) An IAP service provider must take reasonable steps to destroy IAP information (including personal information), other than information required by subsection (3) to be kept, 1 year after the information is collected.
Penalty: $10 000.
19
IAP service providers’ obligation to make individuals aware of personal information held
19 IAP service providers’ obligation to make individuals aware of personal information held
(1) An IAP service provider must prepare, and make publicly available, a document that sets out its policies on the management of information.
(2) If an individual about whom an IAP service provider holds personal information so requests, the IAP service provider must, subject to subsection (4), take reasonable steps to inform him or her of:
(a) the kinds of information it holds about him or her; and
(b) the purpose for which the information is held; and
(c) the way in which it collects, holds, uses and discloses the information; and
(d) the persons and authorities to whom or to which the information may be disclosed; and
(e) that he or she has the rights of reasonable access to, and of correction of, the information; and
(f) how to exercise those rights.
(3) Subject to subsection (4), an IAP service provider must, on request by an individual about whom the IAP service provider holds personal information, give him or her access to the information, and must do so without undue delay or cost.
(4) However, nothing in subsection (2) or (3) requires an IAP service provider:
(a) to inform an individual that a report under section 20 or 21 exists or has been made; or
(b) to give an individual access to such a report.
Penalty: $10 000.
20
IAP service providers’ obligation to make non‑compliance reports
20 IAP service providers’ obligation to make non‑compliance reports
(1) For the purposes of this section, an IAP service provider is taken to know of a breach of an IAP condition if the IAP service provider’s monitoring equipment has detected the breach.
(2) An IAP service provider commits an offence if the IAP service provider:
(a) knows of:
(i) a breach by a participating operator of an IAP condition; or
(ii) anything that indicates that a participating operator may have breached such a condition; and
(b) does not make a non‑compliance report that complies with subsection (4) to the Authority within the time allowed, in the circumstances, under subsection (5).
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
(3) Strict liability applies to paragraph (2)(b).
(4) A non‑compliance report must be in the form approved for the purpose by TCA, and must contain any information required by the IAP service provider’s certification.
(5) The IAP service provider must make the report:
(a) within any time specified in the relevant IAP condition; or
(b) within any time specified by the Authority (by written direction) for the purpose.
21
IAP service providers’ obligation to report tampering
21 IAP service providers’ obligation to report tampering
(1) In this section, a reference to knowledge or suspicion does not include knowledge or suspicion resulting only from:
(a) a report, contained in a non‑compliance report or otherwise made by an approved intelligent transport system, of the electronic detection of apparent tampering with that system; or
(b) the analysis of data produced by such a system.
(2) An IAP service provider commits an offence if the IAP service provider:
(a) either:
(i) knows that intelligent transport system equipment has been tampered with; or
(ii) has reasonable grounds to suspect that intelligent transport system equipment has been tampered with; and
(b) does not report, in accordance with subsection (3), to the Authority within 5 business days.
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
(3) The report must be in the form approved by TCA for the purpose, and must contain any information required by the IAP service provider’s certification.
(4) Strict liability applies to paragraph (2)(b).
(5) If an IAP service provider knows, or has reasonable grounds to suspect, that approved intelligent transport system equipment has been tampered with, the IAP service provider must not disclose to any person other than the Authority:
(a) that the provider has that knowledge or suspicion; or
(b) any information from which the person to whom the disclosure is made could reasonably infer that the provider had that knowledge or suspicion.
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
(6) If an IAP service provider has made a report to the Authority under subsection (2) or (3) of apparent tampering or suspicion of tampering, the provider must not disclose to any person other than the Authority:
(a) that the report has been made; or
(b) any information from which the person to whom the disclosure is made could reasonably infer that the provider had made such a report.
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
22
Offence—IAP service provider providing false or misleading information to Authority or TCA
22 Offence—IAP service provider providing false or misleading information to Authority or TCA
(1) An IAP service provider commits an offence if:
(a) the IAP service provider gives information to the Authority or TCA; and
(b) the information is relevant to the operation of an IAP vehicle; and
(c) the information:
(i) is false or misleading; or
(ii) omits anything without which the information is false or misleading.
Maximum penalty: $10 000.
(2) Subsection (1) does not apply because of subparagraph (1)(c)(i) if the information was not false or misleading in a material particular.
(3) Subsection (1) does not apply because of subparagraph (1)(c)(ii) if the information omitted did not render the information given false or misleading in a material particular.
Part 6
Duties, powers and obligations of TCA
Part 6—Duties, powers and obligations of TCA
23
Functions of TCA
23 Functions of TCA
For the purposes of this Act, the functions of TCA are:
(a) to manage the certification and audit regime for the Intelligent Access Program; and
(b) to certify and audit, and cancel the certification of, IAP service providers; and
(c) to appoint and coordinate IAP auditors.
24
TCA’s duties in regard to use and disclosure of information
24 TCA’s duties in regard to use and disclosure of information
(1) TCA must not use or disclose IAP information unless it first takes reasonable steps to ensure that, having regard to the purpose for which the information is to be used or disclosed, that the information is accurate, complete, up‑to‑date and not misleading.
(2) Subject to sections 26 and 27, TCA must not use or disclose information for a purpose other than the purpose for which the information was collected.
(3) TCA must not use or disclose information relating to a particular participating operator other than to:
(a) the operator; or
(b) an IAP auditor; or
(c) the Authority;
unless the disclosure is authorised under this Act or another law.
(4) TCA must not disclose information relating to a breach of an IAP service provider’s obligations except to:
(a) the Authority; or
(b) an IAP auditor.
(5) If TCA uses or discloses IAP information (other than use or disclosure for law enforcement), TCA must make a record of the use or disclosure containing the following information:
(a) the name of the person who used or disclosed the IAP information;
(b) the date of the disclosure or use;
(c) in the case of a disclosure of IAP information, the person or body to whom or to which the information was disclosed;
(d) in the case of the use of IAP information by TCA, a brief description of how the information was used;
(e) what provision of this Act or another law the disclosure or use was authorised by;
(f) if the authority for the disclosure or use also required a document (for example, a warrant, a certificate or a consent), a copy of the document.
(6) TCA must make the record within 5 business days after the relevant use or disclosure.
(7) TCA must make the record in a form that allows the record to be readily inspected.
(8) TCA must retain the record for 2 years (or another period prescribed by the regulations for the purposes of this subsection).
25
TCA’s powers to collect, store, use and disclose IAP information
25 TCA’s powers to collect, store, use and disclose IAP information
(1) TCA may collect, store, use and disclose IAP information (including personal information) for the performance of its functions and for law enforcement purposes.
(2) With the consent of a participating operator, TCA may use or disclose IAP information about the operator for any purpose if the information:
(a) does not identify any individual; and
(b) contains nothing by which the identity of any individual can reasonably be ascertained.
(3) TCA may use or disclose IAP information (including personal information):
(a) with the consent of any person about whom the IAP information includes personal information; or
(b) of a kind, or in circumstances, prescribed by the regulations for this paragraph; or
(c) as otherwise authorised by this Act or any other law.
26
Disclosure of information for law‑enforcement purposes etc
26 Disclosure of information for law‑enforcement purposes etc
(1) TCA may disclose IAP information (including personal information but not including a non‑compliance report or a report under section 21) to a nominated police officer or an authorised officer of the Authority for law‑enforcement purposes if so authorised by a warrant issued by a court.
Drafting note: Subclause (1) has been read as possibly giving an IAP service provider the choice of not complying with a valid warrant. This is not the intention. If a jurisdiction has any concern that subclause (1) might have that effect, perhaps the subclause could be replaced with one that simply states that nothing in the Bill is intended to affect the operation of any law relating to warrants.
(2) If TCA discloses information to a police officer or an Authority officer under subsection (1), the police officer or Authority officer must not use that information, or disclose the information to any other person unless:
(a) the police officer or Authority officer believes the use or disclosure is reasonably necessary for law‑enforcement purposes; or
(b) the use or disclosure is otherwise authorised under this Act.
27
Use of information for research
27 Use of information for research
TCA may use or disclose information for research purposes, but only if the information contains no personal information.
28
TCA’s obligations in regard to collecting IAP information
28 TCA’s obligations in regard to collecting IAP information
(1) TCA must take reasonable steps to ensure that IAP information that it collects:
(a) is necessary for, or is directly related to, the purpose for which it is collected, or a directly related purpose; and
(b) is not excessive for that purpose; and
(c) is accurate, up‑to‑date and complete.
(2) TCA must take reasonable steps to ensure that the collection of IAP information does not intrude to an unreasonable extent on the personal privacy of any individual to whom the information relates.
29
TCA’s obligation to keep information secure
29 TCA’s obligation to keep information secure
(1) TCA must take reasonable steps to protect IAP information collected by it against unauthorised access, unauthorised use, misuse, loss, modification or unauthorised disclosure.
(2) TCA must take reasonable steps to destroy IAP information (including personal information) after 1 year unless the information is required as evidence.
(3) TCA may comply with subsection (2) by permanently removing anything by which an individual can be identified from the IAP information that it holds.
30
TCA’s obligation to make individuals aware of personal information held
30 TCA’s obligation to make individuals aware of personal information held
(1) TCA must prepare, and make publicly available, a document that sets out its policies on the management of information.
(2) If an individual so requests, TCA must take reasonable steps to inform him or her of:
(a) the kinds of information it holds about him or her; and
(b) the purpose for which the information is held; and
(c) the way in which it collects, holds, uses and discloses the information; and
(d) the persons and authorities to whom or to which the information may be disclosed; and
(e) that the collection of the information is authorised by this Act; and
(f) that he or she has the rights of reasonable access to, and of correction of, the information, and how those rights can be exercised.
(3) TCA must, on request by an individual about whom TCA holds personal information, give him or her access to the information, and must do so without undue delay or cost.
(4) With the consent of a participating operator, TCA may use or disclose IAP information about the operator for any purpose if the information:
(a) does not identify any individual; and
(b) contains nothing by which the identity of any individual can reasonably be ascertained.
31
TCA’s obligation to keep records of transactions
31 TCA’s obligation to keep records of transactions
(1) TCA must keep and retain records, in accordance with this section, of its transactions with the Authority, IAP service providers and IAP auditors.
(2) The records must be organised in such a way as will enable them to be conveniently and properly audited.
(3) TCA must keep a non‑compliance report for at least 4 years after its receipt.
(4) TCA must retain any other record referred to in subsection (1) for at least 1 year after the record is made.
32
TCA’s obligation to correct errors etc
32 TCA’s obligation to correct errors etc
(1) TCA must take reasonable steps to ensure that personal information that it collects is accurate, complete, up‑to‑date and not misleading.
(2) If so requested by a participating operator or an IAP service provider, TCA must make appropriate alterations to any personal information it holds to ensure that the information is accurate, complete, up‑to‑date and not misleading.
(3) If TCA considers that the personal information the subject of such a request is not inaccurate, incomplete, out‑of‑date or misleading, it may refuse to comply with the request, but must then:
(a) give the operator or provider a written statement of its reasons for refusing; and
(b) if the operator or provider so requests, attach to, or include with, the information a statement by the operator or provider.
33
TCA’s obligation to report tampering
33 TCA’s obligation to report tampering
(1) In this section, a reference to knowledge or suspicion does not include knowledge or suspicion resulting only from:
(a) electronic detection, by an approved intelligent transport system, of apparent tampering with that system; or
(b) the analysis of data produced by such a system.
(2) If TCA knows, or has reasonable grounds to suspect, that intelligent transport system equipment has been tampered with, TCA must report that fact to the Authority within 5 business days.
(3) If TCA knows, or has reasonable grounds to suspect, that approved intelligent transport system equipment has been tampered with, TCA must not disclose to any person other than the Authority:
(a) that the provider has that knowledge or suspicion; or
(b) any information from which the person to whom the disclosure is made could reasonably infer that TCA had that knowledge or suspicion.
(4) If TCA has made a report to the Authority of apparent tampering or suspicion of tampering, TCA must not disclose to any person other than the Authority:
(a) that the report has been made; or
(b) any information from which the person to whom the disclosure is made could reasonably infer that TCA had made such a report.
Part 7
Duties, powers and obligations of IAP auditors
Part 7—Duties, powers and obligations of IAP auditors
34
What IAP audit is
34 What IAP audit is
IAP audit is the process of:
(a) reviewing IAP information held by an IAP service provider to determine its completeness and reliability; and
(b) reviewing the processes by which that information was collected; and
(c) examining how it is stored, used and disclosed; and
(d) examining IAP equipment installed in a vehicle or used by an IAP service provider.
35
IAP auditors’ duties in regard to use and disclosure of information
35 IAP auditors’ duties in regard to use and disclosure of information
(1) An IAP auditor must not use or disclose IAP information unless it first takes reasonable steps to ensure that, having regard to the purpose for which the information is to be used or disclosed, that the information is accurate, complete, up‑to‑date and not misleading.
(2) An IAP auditor must not use or disclose information for a purpose other than the purpose for which the information was collected.
(3) An IAP auditor must not use or disclose information relating to a particular participating operator other than to:
(a) the operator; or
(b) TCA; or
(c) the Authority;
unless the use or disclosure is authorised under this Act or another law.
(4) An IAP auditor must not disclose information relating to non‑compliance or tampering except to:
(a) the Authority; or
(b) TCA.
(5) If an IAP auditor uses or discloses IAP information (other than use or disclosure for law‑enforcement purposes), the IAP auditor must make a record of the use or disclosure containing the following information:
(a) the name of the person who used or disclosed the IAP information;
(b) the date of the disclosure or use;
(c) in the case of a disclosure of IAP information, the person or body to whom or to which the information was disclosed;
(d) in the case of a use of IAP information, a brief description of how the information was used;
(e) what provision of this Act or another law the disclosure or use was authorised by;
(f) if the authority for the disclosure or use also required a document (for example, a warrant, a certificate or a consent), a copy of the document.
(6) The IAP auditor must make the record within 5 business days after the relevant use or disclosure.
(7) The IAP auditor must make the record in a form that allows the record to be readily inspected.
(8) The IAP auditor must retain the record for 2 years (or another period prescribed by the regulations for the purposes of this subsection).
(9) An IAP auditor commits an offence if it does not comply with a requirement of any of subsections (1) to (8).
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
(10) An offence against subsection (9) is an offence of strict liability.
36
IAP auditors’ powers to collect, store, use and disclose IAP information
36 IAP auditors’ powers to collect, store, use and disclose IAP information
(1) An IAP auditor may collect, store, use and disclose IAP information (including personal information) for:
(a) the performance of its functions; and
(b) to report, to TCA, non‑compliance or tampering by a participating operator; or
(c) to report, to TCA, tampering by an IAP service provider, or a failure by an IAP service provider to comply with its obligations.
(2) An IAP auditor may use or disclose IAP information (including personal information):
(a) with the consent of any person about whom the IAP information includes personal information; or
(b) of a kind, or in circumstances, prescribed by the regulations for this paragraph; or
(c) as otherwise authorised by this Act or any other law.
37
IAP auditors’ obligations in regard to collecting IAP information
37 IAP auditors’ obligations in regard to collecting IAP information
(1) An IAP auditor may collect IAP information that is reasonably necessary to enable the auditor to prepare an audit report on an IAP service provider.
(2) An IAP auditor must take reasonable steps to ensure that IAP information that it collects:
(a) is necessary for, or is directly related to, the purpose for which it is collected, or a directly related purpose; and
(b) is not excessive for that purpose; and
(c) is accurate, up‑to‑date and complete.
(3) An IAP auditor must take reasonable steps to ensure that the collection of IAP information does not intrude to an unreasonable extent on the personal privacy of any individual to whom the information relates.
38
IAP auditors’ obligation to keep information secure
38 IAP auditors’ obligation to keep information secure
(1) An IAP auditor must take reasonable steps to protect IAP information collected by it against unauthorised access, unauthorised use, misuse, loss, modification or unauthorised disclosure.
(2) An IAP auditor must take reasonable steps to destroy personal information no longer needed for IAP purposes, or remove permanently from such information anything by which an individual can be identified.
39
IAP auditors’ obligation to make individuals aware of personal information held
39 IAP auditors’ obligation to make individuals aware of personal information held
(1) If an individual so requests, an IAP auditor must take reasonable steps to inform him or her of:
(a) the kinds of information it holds about him or her; and
(b) the purpose for which the information is held; and
(c) the persons and authorities to which information so collected may be disclosed; and
(d) that the collection of the information is authorised by this Act; and
(e) that he or she has the rights of reasonable access to, and of correction of, personal information so held, and how those rights can be exercised.
(2) An IAP auditor must, on request by an individual about whom the IAP auditor holds personal information, give him or her access to the information, and must do so without undue delay or cost.
40
IAP auditors’ obligation to keep records of transactions
40 IAP auditors’ obligation to keep records of transactions
(1) An IAP auditor must keep and retain records, in accordance with this section, of its transactions with IAP service providers and TCA.
(2) The records must be organised in such a way as will enable them to be conveniently and properly audited.
41
IAP auditors’ obligation to correct errors etc
41 IAP auditors’ obligation to correct errors etc
(1) An IAP auditor must take reasonable steps to ensure that information that it collects is accurate, complete, up‑to‑date and not misleading.
(2) If so requested by a participating operator or an IAP service provider, an IAP auditor must make appropriate alterations to any information it holds to ensure that the information is accurate, complete, up‑to‑date and not misleading.
(3) If the IAP auditor considers that the information the subject of such a request is not inaccurate, incomplete, out‑of‑date or misleading, it may refuse to comply with the request, but must then:
(a) give the operator or service provider a statement in writing of its reasons for refusing; and
(b) if the operator or service provider so requests, attach to, or include with, the information a statement by the operator or service provider.
42
IAP auditors’ obligation to report breaches by IAP service providers
42 IAP auditors’ obligation to report breaches by IAP service providers
If an IAP auditor knows of a breach by an IAP service provider of the provider’s obligations under this Act, or of anything that indicates that an IAP service provider may have breached such an obligation, the IAP auditor must, as soon as practicable, report that fact to TCA.
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
43
IAP auditors’ obligation to report tampering
43 IAP auditors’ obligation to report tampering
If an IAP auditor knows, or has reasonable grounds to suspect, that intelligent transport system equipment has been tampered with, the IAP auditor must, as soon as practicable, report that fact to:
(a) in the case of tampering or suspected tampering by a participating operator—the Authority; or
(b) in the case of tampering or suspected tampering by an IAP service provider—TCA.
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
Part 8
Tampering with approved intelligent transport systems
Part 8—Tampering with approved intelligent transport systems
44
Meaning of tampering
44 Meaning of tampering
(1) A person tampers with an approved intelligent transport system if:
(a) he or she engages in conduct that has the result that:
(i) the system is altered; or
(ii) the system is installed or used in a way that is not in accordance with the conditions of its certification by TCA; or
(iii) any data instruction that the system uses internally is altered; and
(b) he or she does so with the intention of causing the system to:
(i) fail to collect IAP information, or fail to collect such information correctly; or
(ii) fail to store IAP information, or fail to store such information correctly; or
(iii) fail to report IAP information, or fail to report such information correctly.
(2) A person also tampers with an approved intelligent transport system if he or she:
(a) engages in conduct; and
(b) is negligent or reckless as to whether, as a result of the conduct, the system may:
(i) fail to collect IAP information, or fail to collect such information correctly; or
(ii) fail to store IAP information, or fail to store such information correctly; or
(iii) fail to report IAP information, or fail to report such information correctly.
Note: The Criminal Code of the Commonwealth applies to the interpretation of offence provisions in this Act (see section 5 of this Act and s … of the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003]. For extensions of liability under the Code see Part 2.4 of the Code.
(3) For subsections (1) and (2):
(a) a system fails if it does not perform as intended in terms of accuracy, timeliness, reliability, verifiability or any other performance parameter; and
(b) fail includes fail permanently, fail temporarily, fail on a particular occasion or occasions, and fail in particular circumstances.
45
Offence—tampering with approved intelligent transport system
45 Offence—tampering with approved intelligent transport system
A person must not tamper with an approved intelligent transport system.
Penalty:
(a) if paragraph 44(1)(b) applies—for a first offence, $x; for a second or subsequent offence, $y; or
(b) if paragraph 44(2)(b) applies—for a first offence, $x; for a second or subsequent offence, $y.
Note: For the meaning of tamper, see section 44.
Part 9
Evidence
Part 9—Evidence
46
References to particular time etc
46 References to particular time etc
In this Part:
at a specified time includes on a specified date and during a specified period.
Drafting note: All of the documents that provide for the approval of intelligent transport systems and related matters (such as the forms of reports) are available from TCA. Jurisdictions should consider inserting notes to direct inquirers to TCA, either at its address or by way of its website.
47
Certificates by the Authority
47 Certificates by the Authority
(1) A certificate signed on behalf of the Authority, and stating any of the following, is admissible in evidence and is prima facie evidence of what it states:
(a) that a specified IAP condition was in effect for a specified participating operator at a specified time;
(b) that a specified person is, or was at a specified time, a participating operator;
(c) that a specified IAP condition applied to a specified IAP vehicle at a specified time;
(d) that a specified vehicle is, or was at a specified time, an IAP vehicle;
(e) that a specified participating operator is, or was at a specified time, the operator of a specified IAP vehicle;
(f) that a specified non‑compliance report, tampering report or IAP auditor’s report was received at a specified time, or has not been received;
(g) that no report of a malfunction has been received, or had been received at a specified time, by the Authority in relation to an approved intelligent transport system fitted to a specified IAP vehicle;
(h) that a report of a specified malfunction was received at a specified time, or has not been received;
(i) that a specified form is an approved form for a specified purpose.
(2) A document purporting to be a certificate under subsection (1) is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be what it purports to be.
(3) The person who signed such a document is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to have been authorised by the Authority to do so.
48
Certificate as to intelligent access map
48 Certificate as to intelligent access map
(1) TCA may certify in writing that a particular map is the intelligent access map as issued by TCA at a specified time.
(2) The map may be in the form of an electronic data file.
(3) A certificate under subsection (1) is admissible in evidence and is conclusive evidence of what it states.
(4) The intelligent access map, as issued by TCA at a particular time, is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be a correct representation of the national road network at the time of its issue.
(5) A document purporting to be a certificate under subsection (1) is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be what it purports to be.
(6) The person who signed such a document is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to have been authorised by TCA to do so.
49
Other certificates by TCA
49 Other certificates by TCA
(1) A certificate signed on behalf of TCA, and stating any of the following, is admissible in evidence and is prima facie evidence of what it states:
(a) that a particular intelligent transport system is, or was at a specified time, an approved intelligent transport system;
(b) that on a specified date a specified person was or was not an IAP service provider or an IAP auditor.
(2) A document purporting to be a certificate referred to in subsection (1) is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be what it purports to be.
(3) The person who signed such a document is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to have been authorised by TCA to do so.
50
Presumption of correct operation
50 Presumption of correct operation
The equipment and software that makes up an approved intelligent transport system is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to have operated correctly on any particular occasion.
51
Evidence as to vehicle’s position
51 Evidence as to vehicle’s position
A statement of a vehicle’s position on the surface of the earth at a particular time, in a non‑compliance report or otherwise generated or produced by means of an approved intelligent transport system, is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be a correct statement of the vehicle’s position at the time.
52
IAP information generated etc by approved intelligent transport system
52 IAP information generated etc by approved intelligent transport system
(1) IAP information generated by an approved intelligent transport system is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to have been correctly generated.
(2) IAP information recorded by an approved intelligent transport system is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to have been correctly recorded.
(3) IAP information stored by an approved intelligent transport system is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) not to be changed by that storage.
(4) If it is established that some of such IAP information has been changed by being so stored, the presumption in subsection (3) continues to apply to any other IAP information so stored.
53
Reports by approved intelligent transport system
53 Reports by approved intelligent transport system
(1) A non‑compliance report, or a report under section 21, made by an approved intelligent transport system:
(a) is admissible in evidence; and
(b) is prima facie evidence of the facts stated in it; and
(c) is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be a correct report of information generated and recorded by the system.
(2) A report made by an approved intelligent transport system setting out IAP information:
(a) is admissible in evidence; and
(b) is prima facie evidence of the facts stated in it; and
(c) is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be a correct report of information generated and recorded by the system.
(3) If it is established that a part of such a report is not a correct report of the relevant part of the IAP information as so recorded, the presumption in paragraph (1)(c) or (2)(c) continues to apply to the remainder of the report.
(4) A document that purports to be a report made by an approved intelligent transport system is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be such a report.
54
Results of mathematical procedures
54 Results of mathematical procedures
(1) A certificate signed on behalf of the Authority:
(a) stating that a specified mathematical (including statistical) procedure was carried out in relation to IAP information specified or referred to in the certificate; and
(b) setting out the results of doing so;
is admissible in evidence and is prima facie evidence of the facts stated in it.
(2) The specified procedure is presumed (unless evidence sufficient to raise doubt about the presumption is adduced):
(a) to be valid and reliable for the purpose for which it was used; and
(b) to have been carried out correctly.
(3) A document that purports to be a certificate mentioned in subsection (1) is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to be what it purports to be.
(4) The person who signed such a document is presumed (unless evidence sufficient to raise doubt about the presumption is adduced) to have been authorised by the Authority to do so.
Part 10
Miscellaneous
Part 10—Miscellaneous
55
Regulations
55 Regulations
The [appropriate authority] may make regulations prescribing matters:
(a) required or permitted to be prescribed by this Act; or
(b) necessary or convenient to be prescribed for carrying out or giving effect to this Act.
Source text: opening excerpt
Sourced from the Federal Register of Legislation (legislation.gov.au), CC BY 4.0.
1 Name of Regulations
1 Name of Regulations
These Regulations are the National Transport Commission (Model Legislation—Intelligent Access Program) Regulations 2006.
2 Commencement
2 Commencement
These Regulations commence on the day after they are registered.
3 Model legislation—Intelligent Access Program
3 Model legislation—Intelligent Access Program
For section 7 of the National Transport Commission Act 2003 (the NTC Act), Schedule 1 sets out model legislation, in the form of a Bill for an Act, about the Intelligent Access Program.
Note 1: The model legislation set out in Schedule 1 does not have the force of law (see paragraph 7(2)(a) of the NTC Act).
Note 2: These Regulations must be made in accordance with the Agreement (see subparagraph 3(b)(ii) of the NTC Act).
Note 3: These Regulations are not subject to disallowance—see regulations made for the purposes of paragraph 44(2)(b) of the Legislation Act 2003.
Note 4: These Regulations are not subject to sunsetting—see regulations made for the purposes of paragraph 54(2)(b) of the Legislation Act 2003.
Note 5: The text set out in Schedule 1 is that of a draft Bill prepared for the National Transport Commission and approved by the Australian Transport Council on 2 December 2005, but never actually enacted.
Part 1 Preliminary
Part 1—Preliminary
1 Citation and purpose
1 Citation and purpose
This Act may be cited as the Road Transport (Intelligent Access Program) Act 2005.
2 Commencement
2 Commencement
This Act commences on a day or days to be fixed by proclamation.
Drafting note: Commencement of the legislation in a jurisdiction will be as determined by the jurisdiction.
3 What the Intelligent Access Program is
3 What the Intelligent Access Program is
The Intelligent Access Program is a program to allow heavy vehicles to have access, or improved access, to the road network in return for monitoring, by an intelligent transport system, of their compliance with specified access conditions.
4 Definitions
4 Definitions
(1) In this Act:
defines tampering with IAP equipment and makes tampering an offence (s44-45); and
sets detailed evidentiary presumptions about equipment operation, system reports and certificates for enforcement and admissibility (Pt 9, s47-54).
The model Bill cross‑references the separate Compliance and Enforcement Act for definitions and statutory positioning (s5). It preserves other enforcement methods (s6). It also leaves several jurisdictional details to local drafting , for example, publication mechanics for IAP conditions (s8 and drafting notes) and some blank penalty figures (s45). The Bill creates compliance and reporting flows, certifier and auditor roles, and a robust evidentiary regime in favour of system‑generated outputs.
The official rationale appears in drafting notes and the Bill's explanatory framing: to enable monitoring‑linked access for heavy vehicles by providing a national certification, reporting and evidentiary architecture. The model text emphasises certification, auditable record‑keeping and limited disclosure for law‑enforcement purposes (see s15(3), s26). The text also builds privacy and data quality duties (s17, s19, s29, s30). The mechanics therefore create both positive rights to access under conditions and a set of compliance burdens and enforcement tools linked to digital monitoring outputs.
Main concepts
The Act organises around a small set of recurring legal concepts that determine rights, duties and enforcement mechanics.
Intelligent Access Program (IAP): defined at s3 as the program permitting heavy vehicle access or improved access to a road network in return for monitoring by an intelligent transport system. The program is operationalised through IAP conditions, IAP agreements and approved intelligent transport systems.
IAP condition: the statutory instrument that specifies the conditions under which an IAP vehicle may use a specified IAP road (s7(2)-(3)). The condition must include at least one IAP road (spatial data), may include temporal windows, speed limits and other access conditions such as mass limits, and may state timeframes for reporting non‑compliance (s7(3)). If speed or temporal data are omitted, default authorisations are available tied to what a non‑IAP vehicle of the same class may do (s7(4), (6)), subject to prevailing general speed limits (s7(5)).
Approved intelligent transport system: a certified system authorised by TCA (s4). The system generates IAP information, including non‑compliance reports (s4(2)), and is the source of much of the evidentiary material used for enforcement (Pt 9).
IAP information and non‑compliance report: IAP information is any information generated or collected for IAP purposes (s4). A non‑compliance report is a specific system‑generated report of contravention (s4(2)); providers must retain such reports and the underlying data for at least 4 years (s18(3)) and must report non‑compliances to the Authority within the time prescribed by condition or direction (s20).
Participants: defined categories include participating operator (operator under IAP agreement who operates IAP vehicles), IAP vehicle (subject to IAP condition, equipped and covered by agreement), IAP service provider (certified by TCA), IAP auditor (approved by TCA), and TCA itself (Transport Certification Australia Ltd) (s4, s23). The model therefore separates commercial providers (service providers), independent auditors, and a certification body.
Authority and TCA responsibilities: the Authority is the statutory body that specifies IAP conditions, issues IAP identifiers and receives reports (s8, s9, Pt 9). TCA manages certification and audits, certifies and audits and appoints auditors (s23), maintains and certifies the intelligent access map (s48), and holds obligations on use, disclosure and destruction of IAP information (s24-33).
Privacy, data quality and disclosure disciplines: the Bill repeatedly frames collection, use and disclosure of personal information for “compliance purposes” (s15(1)-(2)), imposes duties of reasonableness in collection and security (s17, s29), grants rights of access and correction (s17(3), s19(2)-(3), s30), but also carves out exceptions for certain system reports (s19(4)). Disclosure to police/Authority for law‑enforcement purposes is constrained by warrant requirements for service providers and TCA (s15(3), s26(1)), and tampering reports have confidentiality protections (s21(5)-(6), s33(3)-(4)).
Tampering and evidentiary presumptions: tampering is defined with both intention and negligence/recklessness limbs (s44); tampering is an offence (s45). The evidentiary Part creates presumptions that approved systems and their outputs are accurate and that certificates by the Authority and TCA about conditions, provider status and maps are prima facie evidence (Pt 9, s47-54).
These concepts interlock to make access conditional on monitoring, to centralise certification and auditing under TCA, to make IAP providers the frontline reporters to the Authority, and to privilege system‑produced data in enforcement contexts while embedding data quality and privacy duties.
Who it affects
The Bill establishes roles for multiple classes of persons and entities, and allocates duties and rights accordingly.
Participating operators: defined at s4, these are operators who have entered into an IAP agreement and operate at least one IAP vehicle. They are the principal regulated private actors: they must enter agreements with certified IAP service providers (s4), ensure drivers are informed (s11), avoid providing false or misleading information to service providers (s10), and satisfy malfunction reporting and recordkeeping obligations (s12).
Drivers: drivers of IAP vehicles are singled out for in‑cab information duties and immediate reporting obligations. Operators must take reasonable steps to tell drivers before journeys that the vehicle is monitored and to explain what is collected and drivers’ access and correction rights (s11). Drivers have their own duties to report system malfunctions immediately and to keep written records (s13).
IAP service providers: these are private entities certified by TCA to provide monitoring services (s4, s23). They are subject to substantial obligations: to use and disclose IAP information only as authorised (s14), to collect and disclose for compliance purposes (s15), to make non‑compliance and tampering reports to the Authority within specified timeframes (s20-21), to record all uses and disclosures (s16), to keep monitoring records for specified retention periods (s18), to secure and destroy data after prescribed periods (s17(5), s18(5)), to allow access to auditors (s15(8)), and to refrain from making unauthorised disclosures about tampering (s21(5)-(6)). There are criminal penalties for false or misleading information to Authority or TCA (s22).
IAP auditors: persons approved by TCA to audit service providers (s4, s23). Auditors must respect confidentiality and data‑use restrictions (s35), may collect IAP information reasonably necessary for audits (s37), must report breaches by service providers to TCA (s42), and must report tampering to the relevant recipients (s43).
Transport Certification Australia (TCA): established in definition (s4) as a corporate body (Transport Certification Australia Ltd ACN...); TCA’s functions include managing certification and audit regimes, certifying and auditing providers, and appointing auditors (s23). TCA is subject to duties about accuracy, limited use/disclosure, recordkeeping and destruction (s24-33). TCA also issues the intelligent access map and can certify it (s48).
The Authority: a statutory body (cross‑referenced to the Compliance and Enforcement Act) that specifies IAP conditions and receives reports (s7-9). It is given power to direct reporting times (s20(5)) and to accept tampering reports (s21). The Bill requires certificates from the Authority to be admissible evidence (s47).
Law enforcement and authorised officers: disclosure to police or authorised Authority officers for law‑enforcement purposes is possible, but the model generally requires a court warrant for service providers and TCA to disclose non‑compliance or other IAP information (s15(3), s26(1)). The Bill, however, expressly excludes non‑compliance reports from the category of information TCA may disclose under some warrant exceptions (s26(1) note).
Other users of the road network and regulators: the model does not directly impose duties on non‑IAP operators, but it alters who may lawfully use particular roads at particular times via IAP conditions (s7) and creates an information ecosystem likely to be used by regulators for compliance oversight.
Who pays and decides: the Bill presumes commercial relationships (IAP agreements) between operators and service providers; it leaves pricing unspecified. TCA decides certification and auditors’ appointment; the Authority decides IAP conditions (s8) and may set reporting timeframes (s20(5)). Operators and service providers carry most of the procedural and operational burdens.
Concentrated burdens and benefits: burdens concentrate on participating operators and certified service providers, who must procure, operate and report on monitoring systems, retain records and meet security and disclosure constraints. Benefits , conditional access to roads and possible mass/dimension concessions if combined under s8(2) , are concentrated to participating operators. The Bill centralises control over certification and maps in TCA, which may concentrate administrative influence over market access for service providers.
Key duties and rights
The Bill sets out a matrix of duties and statutory rights across actors. Below are the principal duties and the statutory rights they create or limit, with section references.
Principal duties of operators and drivers:
Operators must not give false or misleading information to IAP service providers, and face penalties for doing so (s10). Subsections (2) and (3) carve out materiality thresholds.
Operators must inform drivers before a journey about monitoring, what is collected and drivers’ rights of access/correction, and how to report malfunctions and comply with driver obligations (s11). Penalty for failing to take reasonable steps: $10,000 (s11(1) & (2)).
Operators must report to the Authority immediately when they become aware an approved system is malfunctioning and keep written records of such reports (s12). Penalties apply ($6,000) and the records must include time, place and content of reports (s12(2)).
Drivers must report malfunctions to the operator immediately and keep written records (s13), with matching penalties.
Key duties of IAP service providers:
Use and disclosure: providers must not use or disclose IAP information except as authorised by the Act or other law (s14). There are graduated penalties for repeat offences (s14).
Collection, use and disclosure for compliance: providers may collect, store and use IAP information for compliance purposes and may disclose it to the Authority or TCA for compliance (s15(1)-(2)). Disclosure to police/Authority officers for law‑enforcement purposes requires a court warrant (s15(3)).
Reporting non‑compliance: providers must make non‑compliance reports that comply with TCA’s approved form and any provider certification, within the time specified by the IAP condition or by the Authority (s20(2)-(5)). Strict liability applies to the reporting obligation (s20(3)).
Reporting tampering: providers must report known or reasonably suspected tampering within five business days in a TCA form (s21(2)-(3)), with strict liability for the reporting obligation (s21(4)). Providers are also expressly prohibited from disclosing to others that they have knowledge or suspicion of tampering or that a report has been made (s21(5)-(6)), with penalties.
Recordkeeping and retention: providers must make detailed logs when they use or disclose IAP information (s16), keep monitoring records and non‑compliance reports and underlying data for at least four years (s18(3)), and destroy other IAP information one year after collection (s18(5)). Failure to comply with record creation and retention is an offence of strict liability (s16(5)-(6); s18(3)-(5)).
Quality and security: providers must take reasonable steps to ensure information is necessary, not excessive, accurate and that collection does not unreasonably intrude on privacy (s17). They must protect against unauthorised access and take steps to correct personal information on request (s17, s19).
Duties and powers of TCA:
Certification and audit regime manager: TCA must manage certification and auditing and may certify or cancel certification of providers and appoint auditors (s23).
Information duties: TCA must ensure accuracy before use or disclosure (s24(1)), generally restrict use to the purpose collected (s24(2)), keep records of uses and disclosures and retain them for two years (s24(5)-(8)), and destroy IAP information after one year unless evidence is required (s29(2)). TCA may collect, store, use and disclose IAP information for its functions and for law enforcement purposes (s25), and may disclose to police/Authorised officers under a court warrant (s26).
Rights: TCA may use information for research if de‑identified (s27) and may disclose aggregated or de‑identified operator information with consent (s25(2)).
Duties of IAP auditors:
Auditors must not use or disclose IAP information except for audit purposes and must make and retain records of uses or disclosures (s35). They may collect IAP information necessary for an audit (s37), must secure the information (s38), and must report breaches by service providers to TCA (s42) and tampering to the relevant recipients (s43).
Rights and evidentiary presumptions:
Certificates by the Authority and TCA (s47-49) are prima facie evidence of specified facts, and TCA’s certificate about the intelligent access map is conclusive evidence (s48(3)). Equipment and software operation, position statements, reports by approved systems and mathematical procedures are given presumptions of correctness (s50-54). Those presumptions shift evidentiary burdens in enforcement and civil proceedings toward requiring contrary evidence to displace the presumptions.
Other rights and constraints:
Individuals have rights of access and correction to personal information held by providers, auditors and TCA, subject to exceptions for certain reports (s17(3)-(4), s19(2)-(4), s30(2)-(3)). Providers and TCA must make public documents describing their information management policies (s19(1), s30(1)).
The Act explicitly preserves other forms of road law enforcement (s6), so the IAP regime sits alongside other enforcement mechanisms rather than replacing them.
In sum, the Bill creates a layered compliance regime: operators and drivers have immediate reporting and information duties; service providers bear data collection, reporting and secrecy duties; TCA centralises certification, auditing and map authority; auditors have defined audit and reporting roles; and the evidentiary regime privileges machine outputs subject to procedural safeguards.
Penalties and enforcement
The Bill constructs a mix of criminal offences, strict liability obligations and administrative enforcement levers, combined with a robust evidentiary regime designed to facilitate prosecutions or regulatory action based on system‑generated outputs.
Penalties outlined in the model text:
False or misleading information by an operator to an IAP service provider: maximum penalty $10,000 (s10). Subsections (2)-(3) provide materiality exceptions.
Operators’ failure to inform drivers about monitoring and relevant rights: maximum penalty $10,000 (s11).
Operator reporting of system malfunctions and recordkeeping: maximum penalty $6,000 (s12). Drivers face the same penalties for mirror obligations (s13).
IAP service providers’ unauthorised use or disclosure: penalty $10,000 for first offence; $20,000 for second or subsequent offence (s14).
Recordkeeping breaches by IAP service providers: penalty $10,000 for first offence; $20,000 for second or subsequent (s16(5)).
Quality obligations breach by service providers: penalty $6,000 (s17(1) penalty).
Providers’ failure to keep monitoring records and retention obligations: penalty $10,000 (s18(3) and (5)).
Providers’ failure to make non‑compliance reports (s20): $10,000 first offence; $20,000 repeat offences. Strict liability applies to the reporting element (s20(3)).
Tampering report failures and improper disclosure about tampering (s21): $10,000 first offence; $20,000 repeat offences. Strict liability applies to reporting time limits (s21(4)).
Service provider giving false/misleading information to Authority or TCA: $10,000 (s22).
IAP auditors: failure to comply with duties on use/disclosure and recordkeeping attracts $10,000 first; $20,000 repeat offences (s35(9)-(10)). Strict liability applies (s35(10)).
Auditors’ duty to report provider breaches (s42) and to report tampering (s43) carry maximum penalties for non‑compliance: $10,000 first; $20,000 repeat.
A conspicuous blank appears for the penalty for tampering under s45: the template shows placeholder amounts $x and $y. The drafting note registers the penalty figuration as indicative elsewhere (s10 drafting note), and s45 leaves numbers unspecified in this Bill.
Enforcement mechanics:
Statutory presumptions enhance prosecutorial enforceability. Certificates from Authority or TCA stating a condition was in effect, that a person was a participating operator, that a vehicle was an IAP vehicle, or that a non‑compliance report was or was not received, are prima facie evidence and presumed correct absent sufficient contrary proof (s47). TCA certificates about the intelligent access map are conclusive evidence (s48(3)), and system‑generated IAP information and reports are presumed to be correctly generated, recorded and stored (s50-53). A presumption of correct operation of approved equipment is established (s50). Mathematical procedures applied by the Authority are presumed valid and correctly carried out (s54). These presumptions shift evidentiary burdens to defendants or respondents to produce evidence to raise doubt.
Reporting obligations: service providers and auditors are front‑line reporters of non‑compliance and tampering to the Authority or to TCA (s20-21, s42-43). Failure to report is an offence, often under strict liability for the reporting element.
Warrant requirement for law enforcement access: disclosures to police or authorised Authority officers for law‑enforcement purposes by IAP service providers and TCA require a court warrant (s15(3), s26(1)). The Bill flags (in drafting notes) possible drafting confusion about whether subclause (3) could be read to permit refusal to comply with valid warrants and suggests jurisdictions may reword it.
Audit and certification as administrative levers: TCA controls certification and audits and can cancel certification (s23). IAP auditors must report provider breaches to TCA (s42). Certification status and map certification by TCA are given evidentiary weight (s23, s48-49).
Strict liability design:
The model imposes strict liability on certain procedural offences (s16(6), s20(3), s21(4), s35(10)). Those provisions mean providers or auditors can be liable regardless of fault for failure to meet recordkeeping or reporting timelines.
Scope of enforcement:
Section 6 preserves other enforcement methods, so the IAP’s offences augment rather than replace existing road law enforcement. The model cross‑reads with the Compliance and Enforcement Act (s5) and notes the Criminal Code applies to interpretation of offence provisions in the Act (s44 note), suggesting standard criminal procedural rules apply for offence enforcement beyond the bespoke strict liability elements.
Implementation risk and evidentiary asymmetry:
The strong evidentiary presumptions and strict liability reporting offences create an enforcement framework where system outputs and certificates are difficult to displace, and administrative certification status (TCA) supports enforcement. That makes operational compliance and documentary integrity (records, system calibration, retention) practically decisive for regulated parties.
How it interacts with other laws
The model Bill is explicitly designed to be read with other road transport legislation and criminal and privacy regimes; it cross‑references and relies on existing statutory frameworks.
Statutory cross‑reading:
The Bill must be read together with the Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003 (s5). The cross‑reference imports definitions and enforcement concepts from that Act; for example, “driver” is noted to be defined in the Compliance and Enforcement Model Bill (s11 note). Several definitions in the model Bill state that expressions used in both Acts have the same meaning unless contrary intention appears (s4(5)). Practitioners should therefore consult the corresponding Compliance and Enforcement Act to see how terms such as “Authority”, “authorised officer”, “compliance purposes” and particular procedural rules are defined and applied.
Criminal law and offences:
The Bill references the Criminal Code for interpretation of offence provisions (note to s44). Tampering includes negligence/recklessness and intentional limbs (s44), and the Criminal Code’s application is explicitly flagged for interpreting offences and for possible extensions of liability. This means that general Commonwealth criminal interpretation rules and definitional regimes are intended to apply.
Privacy and information law:
The model Bill imposes duties on collection, use, disclosure, retention and destruction of personal information (s17, s19, s29-30). It uses privacy language (personal information; rights of access and correction) and delegates some disclosure regimes to warrants for law enforcement (s15(3), s26(1)). The Bill also creates exceptions to disclosure for system reports and tampering reports (s19(4), s21(5)-(6), s33(3)-(4)). These provisions will interact with jurisdictional privacy legislation; practitioners must reconcile the Bill’s obligations and the state/territory or Commonwealth privacy act requirements when implementing.
Evidence and procedure:
Part 9 establishes certificates and presumptions to be admissible evidence (s47-54). That interacts with evidence law in proceedings , the Bill’s provisions create statutory presumptions that the courts will treat as prima facie or conclusive evidence unless sufficient contrary proof is adduced. Practitioners must assess how these presumptions fit with common law rules on admissibility and hearsay and the procedural rules of local courts.
Warrants and law‑enforcement disclosure:
The Bill requires a court warrant for service providers and TCA to disclose IAP information to police or authorised Authority officers for law‑enforcement purposes (s15(3), s26(1)). Those provisions intersect with general laws on warrants and search powers; the drafting notes indicate some concern that the Bill should not be read as allowing providers to refuse valid warrants (s15 note, s26 note).
Regulatory overlap and non‑exclusivity:
Section 6 expressly states nothing in the Act prevents or excludes any other method of enforcement of a road law. That makes the IAP supplementary to existing regulatory and enforcement regimes rather than pre‑emptive. Practitioners must hence manage dual compliance obligations where IAP reporting or certification intersects with local mass/dimension concessions, maintenance of permits, or other regulatory regimes.
Local implementation choices:
The Bill contains drafting notes that require jurisdictional adaptation , for instance, how IAP conditions not combined with a concession are published (s8 drafting note) and that commencement will be jurisdictionally determined (s2 drafting note). Section 55 allows the appropriate authority to make regulations for matters required or convenient to carry out the Act, creating scope for further interaction with local regulatory frameworks (s55).
Administrative centralisation:
The Bill gives TCA central certification authority and creates the intelligent access map as a TCA product (s23, s48). This centralisation will interact with any state mapping, road classification or concession regimes. TCA’s ability to certify maps (s48) and to be a gatekeeper of service provider certification (s23) poses statutory linkages with jurisdictional road authorities and their enforcement roles under existing road laws.
In short, the model Bill is designed to be embedded within a broader statutory ecosystem. It imports definitions and enforcement mechanics from the Compliance and Enforcement Act, relies on general criminal and evidence law for interpretation and admissibility, interacts with privacy regimes by specifying access and correction rights and destruction periods, and deliberately preserves other enforcement methods. Operationalising the Bill will require explicit reconciliation with jurisdictional procedural, privacy and criminal laws and with local administrative arrangements for road access and concessions.
Amendment history
The text supplied is a model Bill included in the National Transport Commission (Model Legislation,Intelligent Access Program) Regulations 2006. The Regulations (Reg 3) state that the model legislation in Schedule 1 is the draft Bill prepared for the National Transport Commission and approved by the Australian Transport Council on 2 December 2005, but never actually enacted (Reg 3, Note 5). The Regulations themselves commenced the day after registration (Reg 2).
Key documentary facts in the instrument about history and drafting:
The Regulations were made under section 7 of the National Transport Commission Act 2003, placing model legislation before jurisdictions (Reg 3).
The model Bill includes several drafting notes identifying areas for local adaptation, for example publication of IAP conditions (s8 drafting note), commencement timing (s2 drafting note), and the suggestion that jurisdictions adjust wording in relation to warrants if there is concern (s15 drafting note and s26 drafting note). Those drafting notes signal intentional indeterminacy to be resolved by jurisdictions when enacting the model into local law.
The model Bill contains placeholders for penalties in at least one place (s45 tampering penalty uses $x and $y). Elsewhere the Bill states that penalties are indicative (s10 drafting note). That indicates the model was intended to be adapted with jurisdictionally appropriate penalty amounts.
The Regulations include notes that the model legislation must be made in accordance with the Agreement (Reg 3, Note 2), and that these Regulations are not subject to disallowance or sunsetting under specified Legislation Act provisions (Reg 3, Notes 3-4). Those procedural notes reflect the statutory path used to present model legislation to states and territories.
No enacted amendments to the model Bill are recorded in the provided text. The Bill itself contains many drafting notes signalling where jurisdictions should fill in blanks or make choices. Because the model was not enacted as federal law, any amendment history after 2 December 2005 would reside in the legislative history of jurisdictions that adopted variants of the model, but that material is not in the supplied text.
What to record for practitioners:
The document is a model Bill approved by the Australian Transport Council in December 2005 and included in 2006 Regulations. It remains a template for jurisdictions to adopt and to adapt.
The model contains explicit drafting notes and placeholders to be resolved locally, which is part of its design. Any actual amendment history will be found in the statute books of jurisdictions that enacted their versions of this model, and in their parliamentary debates and regulation‑making instruments; those materials are outside the provided text.
For compliance or litigation purposes, the model Bill itself has no force unless enacted by a jurisdiction; Reg 3 notes make that explicit (Reg 3 Note 1). Practitioners must therefore identify the local enactment text to determine the operative provisions and any subsequent amendments.
Litigation history
The supplied text contains no cases, adjudications or references to litigation arising under the model Bill. The model expressly states that its text was prepared as a draft Bill and not enacted (Reg 3, Note 5). Consequently, there is no litigation history recorded within this material.
Implications of absence of litigation record:
Because the model is not itself law unless adopted by a jurisdiction, litigation arising under the IAP concept will depend on how individual jurisdictions enacted and perhaps modified the model text. Any precedents, admissibility rulings or challenges to evidentiary presumptions, strict liability constructs or privacy carve‑outs would therefore arise in those jurisdictions and not from the model instrument itself.
The Bill’s evidentiary presumptions (Pt 9, s47-54) are formulated to simplify proof of certain facts in enforcement proceedings. The absence of case law in the text means there is no on‑point judicial construction in the supplied material about how courts might treat the statutory presumptions when, for example, system reliability is contested, or how courts will balance statutory presumptions with expert evidence about GPS inaccuracy or software failure. Any litigation testing those presumptions would be generated in jurisdictions where this model was enacted; practitioners should search local case law after enactment.
The Bill creates strict liability for certain procedural offences (s16(6), s20(3), s21(4), s35(10)). The supplied model has no judicial treatment of how courts might construe strict liability in the context of reporting obligations tied to system outputs or how defences such as reasonable excuse will be applied. That absence increases legal uncertainty until courts address these points in enacted versions.
No judgments about TCA’s certification powers, mapping authority (s48), or the interplay between warrants and statutory reporting duties (s15(3), s26(1) drafting notes) are available in the model text. This leaves open whether and how courts would reconcile a service provider’s statutory reporting duties and confidentiality prohibitions about tampering (s21(5)-(6)) with a valid law‑enforcement warrant.
Practical recommendation for practitioners preparing for disputes:
Do not rely on the model instrument for litigation guidance. Instead, locate the enacted IAP legislation (if any) in the relevant jurisdiction and examine subsequent case law to see how courts have treated the evidentiary presumptions, reporting obligations, privacy exceptions and strict liability offences. The model text indicates where litigation issues are likely to arise , in evidentiary presumptions, tampering definitions and confidentiality obligations, warrant interplay, and strict liability reporting offences , but offers no judicial resolution itself.
Gotchas
The model Bill contains multiple provisions that create traps for the unwary. This section flags specific provisions and the mechanisms by which they can create liability, operational obligation or evidentiary disadvantage, citing the relevant sections.
Strict liability for procedural reporting and record duties
Several reporting and recordkeeping offences are strict liability (s16(6), s20(3), s21(4), s35(10)). That removes fault elements for specific reporting obligations, so a provider or auditor can be guilty even where the non‑reporting was inadvertent. The practical consequence is that organisations must put robust systems in place to detect and meet reporting timelines.
Evidential presumptions favouring machine outputs and certificates
System outputs, position statements and certificates by the Authority/TCA are prima facie or conclusive evidence (s47-54). Unless a defendant adduces sufficient evidence to raise doubt, these presumptions will stand. Practically, this requires keeping original data, calibration records, chain‑of‑custody and audit trails to rebut presumptions.
Tampering reporting nuances and confidentialities
The Bill distinguishes system‑generated detection from “knowledge” for reporting purposes. Section 21(1) says knowledge or suspicion does not include knowledge resulting only from an electronic detection or analysis by the system. That creates a possible evidential gap: a provider may have system flags for apparent tampering but, formally, that alone does not constitute the knowledge that triggers the duty in s21(2). At the same time, s4(2) allows non‑compliance reports to include system‑generated information about apparent tampering. This interplay can create operational ambiguity about when a provider must report and when it may treat flags as internal alerts. Practitioners should design operational rules that convert system flags into the additional assessment steps necessary to produce “knowledge” or reasonable grounds to suspect as required.
Confidentiality constraints on disclosure about tampering
Once a provider or TCA knows or reasonably suspects tampering, s21(5)-(6) and s33(3)-(4) forbid disclosure to any person other than the Authority (or TCA to the Authority or vice versa). That means providers may be prohibited from warning contracting customers, insurers or others about tampering, despite potential safety ramifications. Failure to observe the prohibition attracts penalties. Organisations must therefore clearly understand who to inform and when under these provisions.
Retention and destruction periods are short for non‑preserved data
Providers must keep non‑compliance reports and underlying data for at least four years (s18(3)), but other IAP information must be destroyed one year after collection (s18(5), s17(5), s29(2)). That creates tight windows for access/correction requests and for evidentiary preservation. If litigation or investigations arise more than one year after collection (but within four years for non‑compliance reports), practitioners must ensure the correct subset of data has been preserved and that destruction authorisations are documented to avoid spoliation claims.
Warranted disclosure requirement but drafting ambiguity
The model generally requires a court warrant before providers or TCA disclose IAP information to police or Authority officers for law‑enforcement purposes (s15(3), s26(1)). Drafting notes express concern these clauses might be read as allowing refusal to comply with valid warrants and suggest jurisdictions reword them. Until clarified in enacted text, this remains an interpretive risk.
Undefined or jurisdictionally dependent terms and publication mechanics
The Bill cross‑reads with the Compliance and Enforcement Act for many definitions (s5), and contains drafting notes that leave operational details to jurisdictions (s8 drafting note on publication of conditions, s2 note on commencement). The term “Authority” is taken from the Compliance and Enforcement Act; the precise identity and powers of the Authority will therefore vary by jurisdiction. Practitioners must consult local enactments to identify the Authority, its powers, and the local forms required by TCA or the Authority.
Penalty placeholders and inconsistent penalty specification
s45 (tampering offence) uses placeholders ($x, $y) and elsewhere penalties are said to be indicative (s10 drafting note). Jurisdictions may set different penalty levels, so reliance on the figures in this model is unsafe for local compliance planning.
Records of use/disclosure must be readily inspectable and retained
Providers must create records of uses/disclosures within five business days and retain them for two years (s16(1)-(4)). The offence for failure is strict liability. Operationally this requires compliance systems that rapidly capture metadata and preserve documentary evidence in an inspectable form.
IAP identifiers treated as personal information when identifiable
An IAP identifier may become personal information if a person can associate it with an individual, in which case privacy laws apply (s9(2)). Providers and operators must treat identifiers accordingly and assess re‑identification risk.
Each “gotcha” is an implementation or litigation risk source rooted in the Bill’s text. Those implementing the model should translate these clauses into operational procedures, preserve audit trails, clarify decision escalations for system flags, and consult local statutory variants where jurisdictions have adjusted the model.
How to comply
Compliance requires coordinated legal, technical and operational measures across operators, drivers, service providers, auditors and TCA. The model text prescribes specific actions; below are concrete steps derived from the statutory duties and timelines.
Contractual and administrative setup
Ensure an IAP agreement is in place between participating operators and a TCA‑certified IAP service provider (s4 definition of IAP agreement; s23). Confirm the provider’s certification status with TCA and require evidence of the provider’s certification in the contract, including obligations for timely non‑compliance and tampering reporting in the format required by TCA (s20(4), s21(3)).
Include obligations in operator‑service provider contracts to protect confidentiality, to comply with approved forms, to provide timely issuance of non‑compliance reports to the Authority, and to preserve data for statutory periods (s16, s18, s20).
Driver information and engagement
Operators must take reasonable steps to notify drivers before journeys that the vehicle will be monitored and to explain what is collected, the purposes, disclosure recipients, that collection is authorised by the Act, drivers’ access/correction rights and the provider’s name and address (s11(1)(a)-(g)). Use in‑cab notices and/or written employment contracts as suggested in s11(3). Maintain a standardised notice form and ensure drivers can access a written or visible notice.
Malfunction reporting and recordkeeping
Implement processes requiring drivers to immediately report detected malfunctions to the operator (s13(1)), and operators to immediately report to the Authority (s12(1)). Maintain written logs capturing date/time/type/location of malfunction and who reported and received the report, as required by s12(2) and s13(2). Retain those records per local rules and ensure availability for audits.
Non‑compliance reporting procedures
Configure the approved intelligent transport system and provider reporting systems to generate non‑compliance reports in the TCA‑approved form (s20(4)). Implement monitoring to ensure non‑compliance reports are sent to the Authority within times specified in the IAP condition or by Authority direction (s7(3)(c); s20(5)). Because strict liability applies to timing in s20(3), incorporate automated trigger‑to‑report workflows and escalation paths to meet the deadline.
Tampering response and confidentiality
Establish procedures for handling system indications of apparent tampering. Recognise s21(1) excludes system‑generated detection from constituting knowledge alone; therefore, define a documented triage workflow for escalation from system flag to human review that records grounds for concluding that reasonable suspicion or knowledge exists. Where knowledge or reasonable grounds are formed, report to the Authority within five business days in the TCA form (s21(2)-(3)). Do not disclose to third parties that a provider has knowledge or suspicion, or that a report has been made, except to the Authority (s21(5)-(6)). Maintain an internal log of the decision process to show compliance with confidentiality and reporting duty.
Data management, retention and destruction
Providers must keep a record of IAP information and organise it to allow audits (s18(1)-(2)). Retain non‑compliance reports and the underlying data for at least four years (s18(3)). Destroy other IAP information one year after collection unless required for evidence (s18(5), s17(5), s29(2)). Implement secure destruction or irreversible de‑identification procedures and maintain logs of destruction actions to demonstrate compliance. Ensure technical and organisational measures protect against unauthorised access, use, loss, modification or disclosure (s17(4), s18(4), s29(1)).
Records of use and disclosure
When providers or TCA use or disclose IAP information, they must create a record within five business days including the name of user, date, recipient, description of use, authorising provision and supporting documents (s16(1)-(4); s24(5)-(8)). Make these records readily inspectable and retain them for two years. Automate metadata capture where possible to meet the five‑business‑day window and avoid strict liability exposure.
Access and correction when requested
Implement processes to respond to access and correction requests from individuals and participating operators in line with s17(3)-(4), s19(2)-(3) and s30(2)-(3). For requests to correct personal information, follow the prescribed steps: accept and amend promptly if warranted; if refusing, provide a written statement of reasons and, if requested, append the requestor’s statement to the record.
Audit readiness and cooperation with IAP auditors and TCA
Ensure systems, processes and records are maintained in audit‑ready formats. IAP service providers must permit IAP auditors access to any record kept for the Act’s purposes (s15(8)). Auditors must be allowed to review collection, storage, use and disclosure processes and equipment (s34). Maintain a routine internal audit and remediation process to address deficiencies before external audits.
Warrant handling and law‑enforcement requests
Understand that the model requires court warrants for service providers and TCA to disclose certain IAP information to police or Authority officers for law‑enforcement purposes (s15(3), s26(1)). Maintain counsel or legal contacts to vet warrants and ensure compliance. Be aware of the drafting note ambiguity and check the enacted local text for any jurisdictional clarification.
Certification and mapping coordination
For providers: maintain current TCA certification and comply with certification conditions. For operators: ensure any IAP identifier issued by the Authority is handled as personal information where it is identifiable (s9(2)). Coordinate with TCA on the intelligent access map and ensure IAP conditions and permitted routes are understood operationally (s7, s48).
Policy and documentation
Providers and TCA must prepare and publish an information management policy (s19(1), s30(1)). Maintain employee training, access controls, incident response plans, and standard operating procedures for reporting, recordkeeping and data destruction.
Insurance and contractual risk allocation
Because the Bill leaves pricing and contractual liabilities to parties, operators and providers should allocate risk in contracts for data breaches, late reporting, tampering consequences and penalties. Ensure indemnities, caps and notification duties align with statutory confidentiality rules about tampering reporting.
Local enactment review
Finally, because the model Bill itself is not law (Reg 3 Note 1), all operational compliance steps must be checked against the local enacted IAP legislation and any regulations or instruments (s55) that implement or modify the model in that jurisdiction.
These steps map directly to statutory duties (s10-22, s16-21, s17-19, s23-33, s34-43). Compliance is a mix of contractual diligence, real‑time technical monitoring and rigorous records management to meet strict liability and evidentiary risks.
approved intelligent transport system means an intelligent transport system approved for the purposes of the IAP by TCA.
Note: Intelligent transport system is defined in the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003].
IAP is the acronym for Intelligent Access Program.
IAP agreement means an agreement between the operator of a vehicle and an IAP service provider under which the IAP service provider agrees to provide IAP monitoring services to the operator.
IAP audit—see section 34.
IAP auditor means a person approved as an IAP auditor by TCA.
IAP condition—see section 7.
IAP information means information that has been generated or collected for any purpose relating to the IAP.
IAP service provider means a person that is certified as an IAP service provider by TCA.
IAP vehicle means a vehicle that is subject to an IAP condition, is equipped for monitoring under the IAP, and is covered by an IAP agreement.
intelligent access map means the spatial data set, issued by TCA from time to time, that defines the national public road system.
Note: The intelligent access map may not include some private roads.
Intelligent Access Program—see section 3.
law‑enforcement purposes means the purposes of investigating or prosecuting an offence (whether summary or indictable) against:
(a) a road law; or
(b) \[the law corresponding to the Australian Road Rules\]; or
(c) a law relating to the transport by road of dangerous goods; or
(d) a law prescribed for the purposes of this paragraph.
malfunction of an approved intelligent transport system—see subsection (4).
non‑compliance report—see subsection (2).
participating operator means an operator of a vehicle or vehicles that has entered into an IAP agreement, and operates at least 1 IAP vehicle.
personal information means information or an opinion (including information or an opinion forming part of a database), whether true or not, and whether recorded in a material form or not, about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.
tampering with an approved intelligent transport system—see section 44.
TCA means Transport Certification Australia Ltd ACN 113 379 936.
(2) A non‑compliance report:
(a) is a report, generated by an approved intelligent transport system, of a contravention by an IAP vehicle of an IAP condition; and
(b) may include information, about apparent tampering with that system, electronically generated by the system itself.
(3) A reference in a provision of this Act to an approved form is a reference to the form approved by the Authority for the purposes of the provision.
(4) An approved intelligent transport system malfunctions if:
(a) it ceases to work at all, or works only intermittently; or
(b) it does not perform 1 or more functions required under the IAP, or performs any such function only intermittently; or
(c) it performs such a function in such a way that the results of its doing so are inaccurate or unreliable (including intermittently inaccurate or unreliable).
(5) An expression used in this Act that is also used (whether or not defined) in the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003] has, unless the contrary intention appears, the same meaning in this Act as in that Act.
Note: The following significant terms are defined in the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003]:
5 Act to be read with Compliance and Enforcement Act
5 Act to be read with Compliance and Enforcement Act
This Act is to be read as one with the [Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003].
6 Other means of enforcement not excluded
6 Other means of enforcement not excluded
Nothing in this Act has the effect of preventing or excluding any other method of enforcement of a road law.
Part 2 Powers and duties of Authority in relation to IAP
Part 2—Powers and duties of Authority in relation to IAP
7 What IAP conditions do
7 What IAP conditions do
(1) In this section:
IAP road means a road or road‑related area specified in an IAP condition for use by IAP vehicles.
(2) An IAP condition is the specification of the conditions in relation to the IAP under which IAP vehicles are allowed to be used on an IAP road.
(3) An IAP condition:
(a) must specify at least 1 IAP road (spatial data); and
(b) may specify:
(i) periods during which IAP vehicles are permitted to use the specified IAP road (temporal data); and
(ii) maximum speeds at which IAP vehicles may travel during that use (speed data); and
(iii) any other condition of access to the IAP road (for example, a condition about mass limits); and
(c) may specify a period within which an approved intelligent transport system must generate, and send to the Authority, a non‑compliance report after the system detects a non‑compliance with the condition by an IAP vehicle.
(4) If an IAP condition does not specify speed data, it is taken to authorise the use of IAP vehicles on the IAP road at any speed at which a non‑IAP vehicle of the same class could be used on the IAP road.
(5) An IAP condition that specifies speed data does not authorise an IAP vehicle to travel at a speed in excess of a speed limit that applies to vehicles generally.
(6) If an IAP condition does not specify temporal data, it is taken to authorise the use of IAP vehicles on the IAP road at any time at which a non‑IAP vehicle of the same class could be used on the IAP road.
(7) An IAP condition may require an IAP vehicle to be monitored whether or not it uses an IAP road.
Drafting note: In any legislation of a jurisdiction that incorporates this model legislation, a note should be inserted stating where copies of the standard conditions of monitoring can be obtained.
8 Authority may specify IAP conditions
8 Authority may specify IAP conditions
(1) The Authority may specify IAP conditions.
(2) The Authority may combine an IAP condition with a mass, dimension or load restraint concession (within the meaning given by [the relevant provision of the Act corresponding to the Road Transport Reform (Compliance and Enforcement) Act 2003].
(3) An IAP condition not combined with such a concession must be published in …
Drafting note: An IAP condition not included in a mass, dimension or load restraint concession could be published in the Gazette or in some other way—this is to be left up to each jurisdiction.
9 Issue of IAP identifiers
9 Issue of IAP identifiers
(1) The Authority may issue an IAP identifier for an IAP vehicle.
(2) If an IAP identifier is, or becomes, known to a person or entity that has the ability to associate it with a particular individual, the person or entity must treat the identifier as personal information for the purposes of a law relating to privacy.
Part 3 Duties and obligations of operators of vehicles
Part 3—Duties and obligations of operators of vehicles
10 Offence—providing false or misleading information to IAP service provider
10 Offence—providing false or misleading information to IAP service provider
(1) The operator of an IAP vehicle commits an offence if:
(a) the operator gives information to an IAP service provider with which the operator has entered into an IAP agreement; and
(b) the information is relevant to the operation of the vehicle; and
(c) the information:
(i) is false or misleading; or
(ii) omits anything without which the information is false or misleading.
Maximum penalty: $10 000.
Drafting note: The penalty specified for an offence in this Bill is intended to be indicative only, as a general guide to the offence’s perceived seriousness.
(2) Subsection (1) does not apply because of subparagraph (1)(c)(i) if the information was not false or misleading in a material particular.
(3) Subsection (1) does not apply because of subparagraph (1)(c)(ii) if the information omitted did not render the information given false or misleading in a material particular.
(4) Without limiting paragraph (1)(b), information about an IAP condition that applies, or is capable of applying, to a vehicle is relevant to the operation of the vehicle.
(5) The operator of a vehicle commits an offence if:
(a) the operator gives information to an IAP service provider; and
(b) the operator intends that the IAP service provider will enter into an IAP agreement with the operator in reliance on the information; and
(c) the information:
(i) is false or misleading; or
(ii) omits anything without which the information is false or misleading.
Maximum penalty: $10 000.
(6) Subsection (5) does not apply because of subparagraph (5)(c)(i) if the information was not false or misleading in a material particular.
(7) Subsection (5) does not apply because of subparagraph (5)(c)(ii) if the information omitted did not render the information given false or misleading in a material particular.
Drafting note: The fact situation envisaged by subsections (5), (6) and (7) may possibly be covered by a fraud‑type offence in a particular jurisdiction. If so, those subsections can be omitted.
11 Operators’ obligation to tell drivers about collection of personal information and other matters
11 Operators’ obligation to tell drivers about collection of personal information and other matters
(1) The operator of an IAP vehicle must take reasonable steps to tell the vehicle’s driver, before the vehicle begins a journey:
(a) that the vehicle will be monitored by an IAP service provider; and
(b) what information will be collected by the IAP service provider; and
(c) the purposes for which that information is collected; and
(d) the persons and authorities to which information so collected may be disclosed; and
(e) that the collection of the information is authorised by this Act; and
(f) that the driver has the rights of reasonable access to, and of correction of, personal information so collected, and how those rights can be exercised; and
(g) the name and address of the IAP service provider.
Maximum penalty: $10 000.
Note: Driver includes a two‑up driver if he or she is in the vehicle—see the Compliance and Enforcement Model Bill, subsection 6(1) and section 5 of this Act.
(2) The operator of an IAP vehicle must take reasonable steps to tell the vehicle’s driver, before the vehicle begins a journey:
(a) about the driver’s obligation under section 13; and
(b) how the driver can make the reports required by that obligation.
Maximum penalty: $10 000.
Note: Driver includes a two‑up driver if he or she is in the vehicle—see the Compliance and Enforcement Model Bill, subsection 6(1) and section 5 of this Act.
(3) An operator may comply with subsections (1) and (2) by:
(a) placing a notice that gives the required information in a place in the vehicle’s driving cab where it is clearly visible; or
(b) giving the required information to the driver in writing as part of a written contract of employment between the driver and the operator.
(4) The regulations may prescribe:
(a) a form of notice that may be used for the purposes of paragraph (3)(a); and
(b) for paragraph (3)(b), a standard form of words that may be used as part of a written contract of employment.
12 System malfunctions—duties of operators of IAP vehicles
12 System malfunctions—duties of operators of IAP vehicles
(1) If the operator of an IAP vehicle becomes aware that an approved intelligent transport system fitted to the vehicle is malfunctioning, the operator must tell the Authority about the malfunction immediately, in person or by radio, telephone, fax or email.
Maximum penalty: $6 000.
(2) The operator of such a vehicle must keep a written record of reports of such malfunctions, including:
(a) the date, time and type of the malfunction, and the location of the vehicle concerned at the time of the malfunction; and
(b) the date, time, location of the vehicle, type of report, who made the report and who the report was made to.
Maximum penalty: $6 000.
Part 4 Duties of vehicle drivers
Part 4—Duties of vehicle drivers
13 System malfunctions—drivers’ duties
13 System malfunctions—drivers’ duties
(1) If the driver of an IAP vehicle becomes aware that an approved intelligent transport system fitted to the vehicle is malfunctioning, the driver must tell the vehicle’s operator about the malfunction immediately, in person or by radio, telephone, fax or email.
Maximum penalty: $6 000.
(2) The driver of such a vehicle must keep a written record of such reports, including:
(a) the date, time and type of the malfunction, and the location of the vehicle concerned at the time of the malfunction; and
(b) the date and time of the malfunction, the location of the vehicle at the time, the type of report, who made the report and who the report was made to.
Maximum penalty: $6 000.
Part 5 Duties, powers and obligations of IAP service providers
Part 5—Duties, powers and obligations of IAP service providers
14 IAP service providers’ duties in regard to use and disclosure of information
14 IAP service providers’ duties in regard to use and disclosure of information
An IAP service provider must not use or disclose IAP information otherwise than as required or authorised by or under this Act or any other law.
Maximum penalty: $10 000 for a first offence; $20 000 for a second or subsequent offence.
15 IAP service providers’ powers to collect, store, use and disclose IAP
This is an opening excerpt, not the complete document.