Public Interest Monitor Regulations 2023

The Regulations are structured around a small set of operational concepts that determine what parties must do, how, and when. The central concepts are notification, secure delivery, written receipt, the document register and security procedures.

• Notification: The Regulations spell out when a PIM must be notified and the minimum information the notification must contain. For a typical application the key notification rule is reg 7: notification “as soon as practicable” after the applicant decides to make the application, by telephone for remote applications and by email or hand delivery otherwise, and including the application’s unique identifying number, the type of application, the issuing authority, the manner of application (written or telephone) and an estimate of when the PIM will receive a copy of the application and affidavit (reg 7(a)-(c)). Other notification rules tailored to specific primary Act provisions appear throughout (for example regs 10A-10E for police detention decisions and periodic reviews under the Terrorism (Community Protection) Act 2003; reg 22 for resumed hearings).

• Secure delivery and permitted methods: The Regulations define “secure delivery” and list permitted delivery methods. “Secure delivery” expressly includes double-sealed envelopes, secure couriers, delivery by Victoria Police personnel, secure attachments to emails, or “other secure electronic means” (reg 5). The “double-sealed envelope” concept requires an inner envelope marked with a security classification and an outer sealed envelope (reg 5). The permitted method varies by context: telephone notification is required for remote applications (reg 7(b)(i)), secure delivery is required for the delivery of application copies, supporting affidavits and further information in many circumstances (reg 13(2), reg 17(2), reg 15(1)-(2)).

• Written receipt: The instrument mandates a very specific written receipt standard. The definition of “written receipt” in reg 5 requires that the receipt specify the unique identifying number, the type of notification or documents received and the regulation under which delivery was made, the date received, and if other documents were included, a list of those documents. Multiple regulations require the PIM to give such written receipts “as soon as practicable” on receipt of notifications or documents (see regs 10E, 14, 16, 18, 21, 23, 25, 27).

• Document register and storage: The Principal PIM must keep a register of all documents received in relation to each relevant application, police detention decision and periodic review; the register must record current location of those documents, dates when hard copy documents are returned, and the date by which electronic documents delivered by secure attachment are “dealt with” under reg 31(2)(b) (reg 29). PIMs must store all documents containing law enforcement data in a secure place accessible only to authorised persons when not in use (reg 30). These are concrete record-keeping and physical/IT-security obligations.

• Information security procedures: The Principal Public Interest Monitor must develop a suite of written procedures covering an information security policy, access control, monitoring access, protection of security-classified law enforcement data, risk management policy, incident reporting/escalation and continuous improvement processes for information security incidents (reg 28(1)(a)-(g)). The Regulations also define “information security event”, “information security incident”, and “security classified law enforcement data” for operational clarity (reg 28(2)).

• Return and disposal of documents: Reg 31 requires that hard copies be returned “as soon as practicable” after the application has been determined, and prescribes options for documents delivered electronically: ensure no copy retained, destroy the document, or if neither is practicable, retain the document in secure form. Reg 32 sets reporting obligations to confirm that documents have been returned.

• Contingency for PIM unavailability: The Rules acknowledge that a PIM may not be “reasonably able to be contacted” and prescribe specific circumstances that qualify as unavailability (reg 19(2) and reg 20(1)) and the notifications and documentary requirements if proceedings go ahead without a PIM present (reg 19(3)-(6), reg 20(2)-(5)).

• Linkage to primary Acts: Many procedures are tied to particular statutory triggers in other Acts; reg 6 lists the precise provisions to which Part 2 applies and other regs identify the exact cross-references. The PIM’s procedural role is thus scaffolded on the obligations in those other statutes.

These main concepts translate into concrete operational mechanics: applicants and police must consult and notify, PIMs must maintain secure environments and receipts, and both sides must follow specified delivery methods. The Regulations construct an auditable paper and electronic trail around sensitive law enforcement materials and PIM engagement.

The Regulations allocate duties and information flows across a defined set of actors. The principal affected groups are:

• Public Interest Monitor(s) and the Principal Public Interest Monitor: The Regulations impose operational duties on PIMs and a set of systemic obligations on the Principal PIM. PIMs must acknowledge notifications with written receipts (see definition of “written receipt” in reg 5 and the repeated receipt obligations in regs 10E, 14, 16, 18, 21, 23, 25, 27). PIMs must store law enforcement data securely (reg 30) and abide by the handling and return/destruction rules in reg 31. The Principal PIM must develop and maintain detailed information security, access control and incident management procedures (reg 28(1)) and maintain the document register required by reg 29.

• Law enforcement applicants and agencies: This includes the law enforcement agency making an application, authorised police officers and nominated senior police officers under the Terrorism (Community Protection) Act 2003, and members of Victoria Police personnel. They are required to notify PIMs under many circumstances (Part 2, Part 2A, Part 3, Part 5, Part 6). For police detention decisions and periodic reviews under the Terrorism (Community Protection) Act 2003 the Regulations require consultation with the authorised or nominated senior police officer and set the allowed delivery methods (regs 10A-10E). Law enforcement bears the cost of preparing and securely delivering materials, consulting with PIMs and of complying with notification content rules (for example reg 7(c)).

• Issuing authorities and courts: The “issuing authority” is defined for various applications and includes the Supreme Court for a range of orders and judges or magistrates for other warrants (reg 5). Issuing authorities are recipients in the procedural chain,the Regulations require that applicants inform PIMs of lodgements, hearings and outcomes before or after the issuing authority acts (see regs 8, 19(4)(a)-(b), 26). The issuing authority is required to receive notifications and, in one place, the PIM must give an issuing authority a written receipt following a notification under reg 26 (reg 27).

• Applicants for and respondents to surveillance-related and terrorism-related orders: Persons and agencies seeking surveillance device warrants, telecommunications interception warrants, coercive powers orders, covert search warrants, preventative detention orders, prohibited contact orders and related instruments are affected because the Regulations prescribe how they must liaise with PIMs (reg 6 lists which primary Act provisions the Regulations apply to; reg 5 defines the types of applications linked to issuing authorities).

• Courts, especially the Supreme Court: The Regulations require applicants to notify PIMs about scheduling of hearings and resumed hearings and require applicants to provide copies of discontinuance notices filed with the Supreme Court (regs 8, 22, 24). Courts may be required to be part of the chain insofar as documents filed with courts trigger PIM obligations.

• Defence practitioners, recipients of disclosure and third parties: The Regulations do not directly confer rights on third parties; however, they affect how PIMs receive and handle law enforcement data that may be used in proceedings. Because the PIM’s role is to test the sufficiency of law enforcement material in certain hearings, the defence and other parties will be indirectly affected by whether the PIM was consulted or the extent of PIM submissions (see regs 19-20 on proceeding without a PIM).

• Secure couriers and IT administrators: The Regulations’ emphasis on secure delivery, double-sealed envelopes, secure attachments and “other secure electronic means” creates demand for secure couriers and IT/infosec systems. Organisations that provide secure courier services or manage secure email attachments will be engaged in compliance.

• Administrators of records within the PIM office: The register (reg 29) and storage/return obligations (regs 30-31) assign administrative duties and potential record-keeping costs to the Principal PIM’s staff.

The distribution of obligations is asymmetric. Law enforcement agencies must prepare and deliver material in a secure way and, in certain terrorism-related contexts, consult before making police detention decisions (reg 10A). PIMs have relatively heavy ongoing administrative and security responsibilities , receipts, registers, secure storage, and policy development (regs 10E, 14, 16, 18, 21, 28-31). The Regulations place explicit procedural constraints on both sides of the interaction and create an auditable trail intended to ensure PIM access, but they leave decision-making about the grant or revocation of warrants and orders with issuing authorities as defined in reg 5.

The Regulations impose detailed, primarily procedural duties on applicants, authorised police officers, nominated senior police officers, and Public Interest Monitors. They create a set of access and confirmation rights for PIMs (for example the right to receive notifications, copies of applications and supporting affidavits, and further information requested by issuing authorities). Key duties and rights are as follows, with the regulating provisions cited.

Duties of applicants and law enforcement bodies

• Notify as soon as practicable: Applicants must notify PIMs “as soon as practicable” after deciding to make an application (reg 7(a)). This timing standard recurs across the instrument (see regs 7, 13(2)(a), 19(3)(a), 22(1)(a), 24(1)(a)).

• Method of notification and delivery: The method depends on the application type. Remote applications require telephone notification (reg 7(b)(i)). Other notifications use email or hand delivery (reg 7(b)(ii)). Delivery of copies of applications and supporting affidavits to PIMs must be by secure delivery (reg 13(2)(b)). For police detention decisions and periodic reviews, notification must be by double-sealed envelope, secure courier, email or hand delivery by Victoria Police personnel, and must follow consultation with the PIM (regs 10A-10C).

• Content of notifications: A notification of an application must include the application’s unique identifying number, the type of application, the issuing authority, whether the application is to be made in writing or by telephone, and an estimate of when the PIM will be given a copy of the application and supporting affidavit (reg 7(c)). Variations for periodic reviews and detention decisions add specific items such as the date/time of the periodic review, the date/time the PIM will be given access to documents, and the date/time the maximum period of detention will be reached (reg 10B(b)).

• Provide documents and further information: If the primary Acts require that a PIM be given a copy of an application or supporting affidavit, the applicant must do so before the hearing and by secure delivery (reg 13(2)). If the issuing authority requests further information, the applicant must notify the PIM before or as soon as practicable after providing that further information, again by secure delivery (reg 17(2)).

• Disclose adverse matters: Where an applicant must disclose adverse matters, the applicant must notify the PIM either by stating the matters in the supporting affidavit or, if no affidavit is filed then, by stating those matters or confirming none are known during the hearing (reg 11(2)).

• Proceeding without a PIM and post-notification: If a PIM is not reasonably contactable, the applicant may proceed but must notify the PIM as soon as practicable after the hearing, specify certain details and attach a transcript if available (reg 19(3)-(4)).

Duties of authorised police officers and nominated senior police officers (Terrorism (Community Protection) Act 2003 contexts)

• Consult and notify: An authorised police officer must consult with a PIM before making a police detention decision and notify the PIM by one of the specified methods (double-sealed envelope by Victoria Police personnel or secure courier, email, or hand delivery) and include a unique identifying number; if the written copy of the decision has not yet been given, the notification must state the date and time the PIM will be given the written record (reg 10A). Similarly, for periodic reviews a nominated senior police officer must consult and notify with detailed scheduling and access information (reg 10B).

• Provide access to documents and confirm delivery: Documents for periodic review must be delivered as soon as practicable but before the review, by secure delivery; PIMs must acknowledge receipt (regs 15(2), 16).

Duties of Public Interest Monitors

• Provide written receipts: A PIM must give a written receipt “as soon as practicable” after being notified under numerous regulations (for example regs 10E, 14, 16, 18, 21(1), 23, 25, 27). The definition of “written receipt” prescribes the receipt’s contents (reg 5).

• Maintain registers and secure storage: The Principal PIM must keep a register (reg 29), PIMs must keep law enforcement data in a secure place accessible only to authorised persons (reg 30) and comply with return and disposal rules (reg 31).

• Information security responsibilities: The Principal PIM must develop written procedures for dealing with law enforcement data, including information security and incident response policies (reg 28(1)).

Rights and entitlements

• Right to be notified and to receive documents: PIMs have the entitlement to be notified of relevant applications, to receive copies of applications, supporting affidavits, further information, written records of police detention decisions, and to be consulted in certain terrorism detention contexts (for example regs 7, 10A-10C, 13, 15, 17).

• Right to receive written receipts: Applicants and police officers are entitled to receive written receipts from PIMs confirming notification or delivery (reg 5 definition of “written receipt”; see also regs 10E, 14, 16, 18, 21(1), 23, 25, 27).

• Right to proceed where PIM not contactable: Applicants and nominated senior police officers may proceed with the application or periodic review where the PIM is not reasonably contactable, but they must comply with post-event notification and provide transcripts or the requested documents by secure delivery (regs 19-20).

Duties as to content accuracy and timeliness

• “As soon as practicable” is the timing standard used throughout for notifications, deliveries and receipts (see multiple regs). The Regulations do not specify precise deadlines in minutes or hours; they instead rely on the “as soon as practicable” standard, which leaves some operational discretion but creates an expectation of prompt action and an auditable trail via receipts and the register.

Taken together, these duties and rights construct a set of administrative obligations and entitlements around sensitive law enforcement materials. The instrument assigns the burden of secure delivery and liaison primarily to the law enforcement applicant, and assigns the burden of storage, registers and information-security frameworks to the PIM office.

The Regulations themselves do not specify monetary fines, criminal penalties or an enforcement regime within the text of the instrument. The Regulations are made under s 21 of the Public Interest Monitor Act 2011 (reg 2), and their force derives from that authorising power. Where the Regulations require a party to do something “as soon as practicable” (for example, to notify, deliver, return documents or provide receipts), the Regulations create administrative obligations that will be relevant to compliance oversight under the Public Interest Monitor Act 2011 and the primary Acts to which the notifications relate. The source text contains no standalone penalty clauses or specified sanctions for non-compliance within the Regulations.

Consequences of non-compliance therefore operate by implication and through the interaction with the primary Acts:

• Procedural irregularity risk: Failure to comply with notification and delivery rules can create a documented procedural irregularity. For example, if an applicant fails to notify a PIM as required by reg 7 or fails to deliver documents by secure delivery as required by reg 13(2), this creates a record that the PIM was not consulted or was deprived of documents. The primary Act provisions requiring PIM involvement may then give rise to judicial scrutiny of whether the issuing authority’s decision was properly informed or whether the PIM’s statutory role was frustrated. The Regulations supply the framework for that scrutiny by specifying what should have occurred.

• Auditable evidence and administrative oversight: The mandatory written receipts, the register (reg 29) and the requirement that the Principal PIM maintain information security procedures (reg 28) establish an auditable trail. Regulators, courts or oversight bodies examining a dispute over compliance will be able to look to whether the receipt was issued (definition in reg 5), whether the register recorded deliveries and returns (reg 29), and whether secure delivery methods were used (reg 5, regs 13, 15, 17). The Regulations therefore increase the capacity to detect and prove non-compliance even though they do not prescribe penalties.

• Interaction with primary Acts and judicial remedies: Where the primary Act conditions require PIM involvement (for example to test the sufficiency of information), failure to adhere to these Regulations could be material to the legality of an order or warrant. Any remedy for such failings would arise under the primary Act or general administrative law, not under these Regulations themselves. The Regulations should therefore be read as procedural standards that inform whether statutory obligations under other Acts have been met.

• Internal accountability for security incidents: Reg 28 requires the Principal PIM to adopt incident reporting and escalation procedures. While the Regulations do not state sanctions for an information security incident, those procedures create a structure within which incidents are identified, escalated and addressed. This produces organisational accountability and potential internal disciplinary or corrective measures.

• No express enforcement agency or inspectorate: The Regulations do not create an inspectorate or give enforcement powers to a named regulator; enforcement, where needed, would rely on existing oversight mechanisms available under the Public Interest Monitor Act 2011, the primary Acts or general administrative or criminal law (if any applicable offences are engaged). The text does not specify referral pathways or penalties.

In short, the instrument codifies mandatory procedural duties and creates audit trails and information-security obligations, but it does not itself create express statutory penalties. The practical enforcement consequence of non-compliance is therefore likely to be reputational, judicial or administrative scrutiny under the relevant primary Act, rather than an immediate fine or regulatory sanction set out within the Regulations.

The Regulations are explicitly designed to operate in close integration with specified primary Acts. They are not freestanding substantive law; rather they prescribe detail for how obligations in those Acts are to be performed. The principal interactions are:

• Public Interest Monitor Act 2011: The Regulations are made under s 21 of the Public Interest Monitor Act 2011 (reg 2). The Regulations implement procedural aspects necessary for PIMs to perform their statutory role under that Act by prescribing notifications, deliveries, receipts, registers and security procedures. The Regulations supply the operational mechanics that the primary Act leaves to subordinate instrument detail.

• Major Crime (Investigative Powers) Act 2004: Multiple regulations apply directly to sections of that Act. For example, reg 6(a) makes Part 2 applicable to s 5(5A) of the Major Crime Act; regs 11 and 24 reference sections 3C and 11(2A) respectively; regs 17 and 26 speak to section 3B(2) and section 12C(ab) of the Major Crime Act. The effect is that procedures for notifying and providing documents to PIMs in relation to coercive powers orders, discontinued orders, revocations and related processes are to be performed as prescribed.

• Surveillance Devices Act 1999: The instrument applies to several provisions of that Act (reg 6(b) applies Part 2 to sections 15(6A), 20C(6A), 21(2A), 28(2A), and regs 11, 13, 26 reference other sections). It also adopts the Surveillance Devices Act’s definition of “remote application” in reg 5(a) to determine when telephone notification is required (reg 5). The Regulations therefore operationalise how PIMs are to be involved in surveillance device warrant processes, including extensions, variations and retrieval warrants.

• Telecommunications (Interception) (State Provisions) Act 1988 and Telecommunications (Interception and Access) Act 1979 (Commonwealth): Reg 6(c) and reg 13(1)(c) attach certain parts to the State Telecommunications Act; reg 5 defines “eligible Judge” and “nominated AAT member” by reference to the Commonwealth Act. The Regulations direct how PIM notifications and documents interact with state-based telecommunications interception procedures, including warrants, renewals and international production orders (reg 5(c)).

• Terrorism (Community Protection) Act 2003: A significant portion of the Regulations interacts with this Act. The instrument applies Part 2 to multiple sections of that Act (reg 6(d)), and Part 2A (regs 10A-10E) was inserted to deal specifically with police detention decisions and periodic reviews under Part 2AA of the Terrorism Act. The Regulations require consultation with authorised police officers or nominated senior police officers and set particularised secure-delivery and notification content requirements (regs 10A-10D). Reg 20 addresses periodic reviews that proceed without PIM participation.

• Overlap in definitions and authority: The Regulations draw definitions and concepts from the above Acts (eg “authorised police officer” as in the Terrorism Act; “member of Victoria Police personnel” as in the Victoria Police Act 2013; “eligible Judge” and “nominated AAT member” as in the Telecommunications (Interception and Access) Act 1979) (reg 5). The “issuing authority” definition (reg 5) maps specific applications to the appropriate judicial actor for the identified primary Acts, which determines which notification pathway and procedural rule applies.

• Procedural supplementation rather than alteration: The Regulations do not modify substantive decision-making powers in the primary Acts. They supply methods and information requirements for how notifications, deliveries and security must be handled. For example, the Regulations specify how PIMs are to receive a copy of an application and supporting affidavit the primary Acts require them to see (reg 13(2)), but they do not change the legal tests for issuing warrants or orders.

• Evidentiary and administrative interface: The recurring written-receipt requirement and the register (regs 5, 29) create documentary evidence that will be relevant if a court is called upon to assess whether a PIM received what they needed or whether an issuing authority was properly informed. The Regulations therefore shape the evidentiary record used to resolve disputes under the primary Acts.

• Security obligations and information security law: Reg 28 requires the Principal PIM to develop information-security and incident management procedures. These obligations will intersect with applicable privacy, information-security, and records-management legislation and policies in Victoria and at Commonwealth level, particularly where “security classified law enforcement data” (as defined in reg 28(2)) is handled. The Regulations bind the PIM office to specified internal controls without displacing other applicable legal obligations.

Overall, the Regulations are procedural instruments that sit below and implement primary statutory regimes. They draw definitions from, and attach obligations to, particular provisions in the listed Acts, thereby standardising how PIMs and law enforcement operationalise those primary statutes’ requirements. Compliance with the Regulations therefore forms part of compliance with the primary Acts’ PIM-related provisions.

The Regulations were made by the Governor in Council under s 21 of the Public Interest Monitor Act 2011 on 31 January 2023 and commenced on 4 February 2023 (reg 3 and Endnotes). They revoked the earlier Public Interest Monitor Regulations 2013 and two amending Statutory Rules from 2018 and 2021 (reg 4(a)-(c)). The published instrument is “Version incorporating amendments as at 1 November 2024”. The Endnotes and Table of Amendments identify a single subsequent amendment:

• Public Interest Monitor Amendment Regulations 2024, S.R. No. 119/2024: made 29 October 2024 and commenced 1 November 2024 (Table of Amendments). The 2024 amendment introduced multiple changes scattered through the Regulations; the source marks individual amendments in the text (for example “Reg. 5 def. of issuing authority amended by S.R. No. 119/2024 reg. 5(1)”; “Reg. 6(c) amended by S.R. No. 119/2024 reg. 6”; “Pt 2A (Heading and regs 10A-10E) inserted by S.R. No. 119/2024 reg. 7”; “Reg. 15(2) substituted by S.R. No. 119/2024 reg. 10”; and a series of small edits in regs 17, 20, 32 and definitions).

Documented changes introduced by S.R. No. 119/2024 include:

• Insertion of Part 2A (regs 10A-10E) creating bespoke notification requirements for police detention decisions and periodic reviews under the Terrorism (Community Protection) Act 2003. This Part prescribes consultation requirements and permissible delivery methods (double-sealed envelopes, secure courier, email, hand delivery by Victoria Police personnel) and enumerates the details that must be included in those notifications (regs 10A-10C). This is a substantive procedural addition targeted at the terrorism-detention context.

• Amendments to definitions: the instrument notes multiple edits to the definition section (reg 5). Specific notations show that the definition of “issuing authority” was amended (reg 5(1)), “remote application” (reg 5(2)) was amended, and the definitions of “periodic review” and “police detention decision” were revoked (reg 5(4)), among other small changes. The definition of “written receipt” was amended by S.R. No. 119/2024 reg. 5(3) to add an item ba (the date the PIM received the notification or documents). These edits adjust how trafficking of information and identification are to be performed.

• Substitution and amendment of operational rules: For example, reg 15(2), governing delivery for periodic review documents, was substituted by the 2024 amendment (S.R. No. 119/2024 reg. 10). Reg 17(1)(b) and reg 20(1)(a) and (b) were amended by S.R. No. 119/2024 regs 11 and 12. Reg 32(1)(c) was amended by S.R. No. 119/2024 reg. 13. These changes are procedural refinements aligned with inserting Part 2A and other targeted updates.

• Versioning and incorporation note: The printed version includes a “Version No. 002” remark and the Table of Amendments records the 2024 S.R. No. 119/2024 changes. The Endnotes also note that the Regulations will sunset 10 years after making (31 January 2033), referencing the Subordinate Legislation Act 1994.

No other amendment instruments are recorded in the source. The amendment history is therefore recent and limited in scope: a 2024 amendment package that added Part 2A and adjusted definitions and a handful of procedural rules, reflecting an emphasis on terrorism-detention procedures and stronger identification/receipt requirements.

The source text contains no case law, no recorded judicial decisions, and no litigation history. The Regulations as published include no references to judicial review decisions or court interpretations. There are no named cases or summaries of litigation in the instrument, its endnotes, or the explanatory details appended to the statutory rule. Users should therefore treat the Regulations as a procedural statutory instrument with no reported judicial construction recorded in this text. Any legal analysis that relies on judicial interpretation will therefore need to search external case law and administrative decisions beyond the Regulations themselves. The Regulations’ provisions will be interpreted in context with the Public Interest Monitor Act 2011 and the primary Acts cited; absent case law in this instrument, dispute resolution and the interpretation of “as soon as practicable”, security obligations, or the adequacy of PIM engagement will be matters for courts or tribunals to address in future litigation.

Several practical and legal “gotchas” arise directly from the Regulations’ drafting and the interplay with the primary Acts. These are operational risks, points of friction, and areas where compliance effort or ambiguity may have material consequences.

• “As soon as practicable” is the dominant timing standard: Many obligations are qualified by “as soon as practicable” (see regs 7(a), 13(2)(a), 15(2)(a), 19(3)(a), 30, 31(2)(a)). That phrase requires prompt action but carries no fixed timeline. In a high-stakes, time-sensitive context such as an urgent warrant or a police detention decision, disagreement about what is reasonably practicable may generate disputes. The Regulations create mechanisms (receipts, registers and audit trails) that will show timing, but parties should not assume there is no exposure to challenge on timeliness.

• Multiple delivery methods with different consequences: The Regulations permit diverse delivery methods,telephone, email, hand delivery, double-sealed envelope, secure courier, secure attachment to email and “other secure electronic means” (reg 5). But specific contexts require specific methods (for example telephone for remote applications, reg 7(b)(i); secure delivery for document provision, reg 13(2); double-sealed envelopes or secure courier for police detention decision notifications in regs 10A-10C). Using a permitted method in one context might not satisfy a different context’s requirement. Cross-checking the applicable Part and the listed primary Act provision is essential.

• Double-sealed envelope and classification labelling: The double-sealed envelope requires the inner envelope to display security classification markings (reg 5). This expects that deliverers will have systems to classify materials appropriately. Agencies that fail to apply protective markings or that misunderstand the double-seal requirement risk non-conformant delivery.

• PIM unavailability mechanics and evidentiary risk: The Regulations allow applicants to proceed where the PIM is not reasonably contactable but require post-event notification with detailed information, and sometimes transcripts or requested documents (reg 19(3)-(4) and reg 20(2)-(3)). Proceeding without a PIM will leave a record that the PIM was not able to participate; that record can be relied upon in subsequent challenge. The Regulations list circumstances that count as PIM unavailability (reg 19(2)). Parties should document attempts to contact the PIM and technical difficulties if they intend to rely on the unavailability pathway.

• Receipt content is prescriptive: The definition of “written receipt” requires the receipt to specify multiple discrete items, including the unique identifying number, type of notification/documents and the regulation under which the notification was made, the date received and a list of attached documents (reg 5). Failure to include these elements may produce inadequate receipts and create disputes as to what was received when.

• Register obligations and operational burden: Reg 29 requires the Principal PIM to keep a register containing detailed metadata (documents received, current location, date hard copies returned, date by which electronically-delivered documents are to be “dealt with” under reg 31(2)(b)). This imposes an ongoing administrative burden and requires systems capable of tracking document lifecycle stages, including deletion or secure retention dates for electronic attachments.

• Electronic document handling may require secure deletion capabilities: Reg 31(2)(b) expects that documents provided as secure attachments to email are either not retained, destroyed, or retained only in secure form. Agencies and PIMs must ensure they have the technical capacity and documented procedures to irreversibly delete copies and to demonstrate the deletion or destruction. The “if not practicable” language provides options but also introduces judgement about practicability that may be contested later.

• Overlapping definitions and cross-jurisdictional elements: The Regulations adopt definitions from Commonwealth and other Victorian Acts (eg “eligible Judge” and “nominated AAT member” from the Commonwealth Telecommunications (Interception and Access) Act 1979; “authorised police officer” from the Terrorism (Community Protection) Act 2003; “member of Victoria Police personnel” from the Victoria Police Act 2013). Parties must map identities and authorities across Acts to determine who has notification duties. Misidentifying the duty-holder risks non-compliance.

• Recent targeted amendments (Part 2A) on detention and periodic review: The 2024 amendments inserted Part 2A (regs 10A-10E) imposing consultation requirements and stricter notification forms for police detention decisions and periodic reviews (reg 10A requires consultation by the authorised police officer with a PIM). Agencies that are unfamiliar with Part 2A may fail to meet the specific consultation and notification format requirements. The changes also revoked some prior definitions (eg “police detention decision” and “periodic review” in reg 5 were revoked by S.R. No. 119/2024 reg. 5(4)), which could affect interpretation if older versions of the instrument are referenced in operational guidance.

• No express penalties stated here: Because the Regulations contain no express penalties, operational or legal consequences of non-compliance will flow through other statutes, administrative oversight or judicial challenge. Parties should not construe the absence of penalties as absence of risk: procedural noncompliance can materially affect the legal validity of an application or create grounds for review.

• Transcripts and verbal communications: Where information requested by an issuing authority was given verbally and a PIM was not present, the applicant need only provide a written record stating the substance of the information (reg 17(4), reg 19(7)). This reduces the burden of verbatim transcription, but it also creates potential disputes about precision of the record and whether the “substance” meets the PIM’s needs.

• Distinct processes for terrorism-detention and other contexts: The Regulations separate general application notification procedures (Part 2) from specific terrorism-related detention processes (Part 2A). Practitioners should not assume uniform treatment across these contexts; the terrorism pathway has particular consultation and secure delivery expectations.

These “gotchas” are not legal verdicts; they are operational frictions where the Regulations’ prescriptive procedures, timing standards, and documentation requirements create risk for parties who do not design compliant workflows, or who misinterpret the appropriate delivery or notification method for a given statutory context.

This section sets out a practical, source-grounded compliance checklist for both applicants (law enforcement agencies, authorised police officers, nominated senior police officers) and Public Interest Monitors. It maps the Regulations’ key duties into steps and systems to reduce compliance risk.

Applicants and law enforcement agencies: pre-application and application phase

1. Identify the applicable primary Act and issuing authority, and the specific statutory provision that triggers PIM involvement (consult reg 6 and the “issuing authority” definition in reg 5). Document which Part of the Regulations applies.

2. Assign a unique identifying number to each application or police detention decision (the Regulations require a “unique identifying number” for notifications and receipts; reg 5). Ensure the unique ID is included on all communications and in the register.

3. Notification timeline: notify the PIM “as soon as practicable” after you decide to make the application (reg 7(a)). For remote applications, use telephone notification; for non-remote, use email or hand delivery (reg 7(b)). Notifications must include the fields in reg 7(c).

4. Scheduling hearings: unless impracticable, contact the PIM to ascertain availability to attend hearings before applying (reg 8(1)-(2)). Once hearing time is known (unless remote), notify by email or hand delivery the scheduled time, date and place (reg 8(3)).

5. Disclose adverse matters: if you are required to disclose matters adverse to the application ensure these are included in the supporting affidavit, and that the affidavit confirms the matters have been disclosed or that no such matters are known (reg 11(2)(a)). If no supporting affidavit is provided at application, state or confirm these matters during the hearing (reg 11(2)(b)).

6. Deliver application and supporting affidavit: provide a copy to the PIM as soon as practicable and before the hearing, by secure delivery (reg 13(2)(a)-(b) and reg 5 definition of “secure delivery”). Attach the unique identifying number to the documents and the notification (reg 13(3)(a)).

7. Respond to requests for further information from issuing authorities: if the issuing authority requests further information, give the PIM the further information by secure delivery either before giving it to the issuing authority or as soon as practicable after (reg 17(2)). If the requested information was given verbally and the PIM was not present, provide a written record stating the substance (reg 17(4)).

8. Proceeding without PIM: if PIM is not reasonably contactable (document all attempts), you may proceed but must notify the PIM as soon as practicable after the hearing and provide the details and transcript if available (reg 19(3)-(4)). Retain evidence of attempts to contact the PIM to justify reliance on reg 19(2) circumstances.

Specific steps for police detention decisions and periodic reviews (Terrorism (Community Protection) Act 2003)

1. Consultation obligation: consult the PIM prior to notification as required by regs 10A-10B. Ensure consultation is documented.

2. Use prescribed delivery methods: notification must be by double-sealed envelope by Victoria Police personnel, by secure courier, email, or hand delivery by Victoria Police personnel (reg 10A and 10B). If a written copy of the police detention decision is not yet available, include the date/time when the PIM will be given the written record (reg 10A(b)).

3. Periodic review notifications must include the date/time/place of the review, the unique identifying number, date/time the PIM will be given access to documents, and the date/time at which the maximum detention period will be reached (reg 10B(b)).

4. If a periodic review proceeds without the PIM after consultation and reasonable attempts, notify the PIM using the double-sealed envelope, secure courier, email or hand delivery methods listed in reg 20(2), and include the unique identifying number, date/time of the review, and the outcome (reg 20(3)).

Public Interest Monitor office: receipt, storage, register and security obligations

1. Prepare to issue written receipts that meet the definition in reg 5: receipts must specify the unique identifying number, the type of notification/documents and the regulation under which the notification was made or the documents delivered, the date the PIM received the notification/documents (item ba), and a list of included documents. Make a templated receipt form to ensure consistency and audit readiness (regs 5, 10E, 14, 16, 18, 21).

2. Maintain a document register as required by reg 29. The register must record all documents received in relation to each relevant application, police detention decision and periodic review; the current location of those documents; dates any hard copy documents are returned; and the date by which electronically-received documents are to be “dealt with” under reg 31(2)(b).

3. Implement secure storage for law enforcement data: keep all documents containing law enforcement data in a secure place accessible only to authorised persons when not in use (reg 30). Ensure physical security for hard copies and cryptographic/IT controls for electronic copies.

4. Develop written information-security procedures: the Principal PIM must create an information security policy, access control policy, monitoring procedures, procedures to protect classified data, a risk management policy, incident reporting/escalation/response procedures, and a continual monitoring and improvement process for information security incidents (reg 28(1)(a)-(g)). Document roles, responsibilities and escalation points.

5. Implement incident management and logging: define what constitutes an information security event and incident as per reg 28(2), and ensure logs and monitoring are in place to detect, analyse and remediate events. Maintain an incident-response playbook that aligns with reg 28(1)(f)-(g).

6. Return or destroy documents as required: for hard copies, return as soon as practicable after the application is determined (reg 31(2)(a)). For documents delivered by secure email attachment or other secure electronic means, ensure no copy is retained where practicable, or destroy it, or if neither is practicable, retain it only in secure form (reg 31(2)(b)(i)-(iii)). Record actions taken in the register per reg 29.

7. Confirm returns: when an applicant notifies that they’ve received a document back (reg 32(1)), or when an authorised or nominated senior police officer notifies a PIM after receiving a document (reg 32(2)), ensure those confirmations are recorded and the register updated.

Operational and technical controls

1. Secure delivery capability: ensure the PIM office can receive double-sealed envelopes, accepts secure courier deliveries, receives secure attachments and supports authenticated secure email or other secure electronic channels. Validate delivery chain and custody for double-sealed envelopes and couriers.

2. Email attachment handling: put in place IT controls to prevent automatic retention of secure attachments in multiple locations or cloud caches. Where deletion is required (reg 31(2)(b)(i)-(iii)), maintain provenance logs or deletion certificates.

3. Templates and checklists: build templates for notifications (covering reg 7(c) items), written receipts (reg 5), and checklists for periodic reviews and detention decisions (regs 10A-10C), aligned to unique identifying numbers.

4. Training and role clarity: ensure staff understand which notifications require consultation (eg regs 10A-10B), which require telephone notification for remote applications (reg 7(b)(i)), and the situations that qualify as PIM not contactable (reg 19(2) and reg 20(1)). Train police officers and applicants on double-sealed envelope requirements and protective markings.

5. Audit and compliance regime: schedule periodic audits of the register, receipts and security logs to demonstrate compliance with regs 28-31. Ensure records are available to support any judicial or administrative review.

6. Evidence capture for attempts to contact: maintain contemporaneous logs of telephone calls, emails and couriers to demonstrate attempts to contact a PIM, particularly if a hearing must proceed without a PIM.

Practical checklists mapped to key regs

• Before application: notify PIM as soon as practicable with reg 7(c) fields, telephone if remote (reg 7(b)(i)), or email/hand delivery otherwise (reg 7(b)(ii)). Check PIM availability per reg 8(1).

• Delivery of application and affidavit: provide by secure delivery before hearing (reg 13(2)(a)-(b)) and obtain written receipt (reg 14).

• If issuing authority requests further information: provide to PIM by secure delivery either before or as soon as practicable after giving it to the issuing authority (reg 17(2)-(3)). If verbal, supply a written record of substance if the PIM was not present (reg 17(4)).

• If proceeding without PIM: notify PIM as soon as practicable after the hearing and attach transcript if available (reg 19(3)-(4)). PIM must give written receipt (reg 21).

• For police detention decisions/periodic reviews: consult and notify using methods in regs 10A-10C, include unique identifying number and specified timing details, deliver documents by secure delivery before the periodic review (reg 15(2)) and obtain written receipt (reg 16).

• Post-proceedings: return hard copies as soon as practicable once determined (reg 31(2)(a)). If electronic, delete/destroy or retain only in secure form (reg 31(2)(b)) and update register (reg 29).

By following these steps and documenting each action (notification, method, time-stamp, receipt and register entry), both applicants and PIMs create the audit trail envisaged by the Regulations and place themselves in a stronger position to demonstrate compliance with the procedural requirements underpinning PIM involvement.