Public Order (Protection of Persons and Property) Regulations 2019

The Regulations organise around a few core legal concepts, which appear repeatedly and define scope, procedure and discretion.

• Authorised officer and investigatory authority. The instrument adopts the definitions of “authorised officer” and “investigatory authority” from Part IIA of the Act (reg 5). It prescribes two investigatory authorities to which Part IIA and the Regulations apply: the Australian Criminal Intelligence Commission and the National Anti‑Corruption Commissioner (reg 6). The identity and duties of an authorised officer are therefore governed partly by the Act and partly by the Regulations. The Regulations rely on the Act for substantive powers (ss 13C and 13D) but add procedural constraints.
• Identity card. The Regulations define the minimum content of an identity card for a non‑constable authorised officer: it must state the holder is an authorised officer for the purposes of Part IIA, include a recent photograph, and state the office held by the issuer (reg 5). The card is the documentary means of verifying status for non‑constables when exercising powers under sections 13C and 13D (reg 8). The identity card is an administrative control: it is required, and must be returned when an officer ceases to hold authorisation (reg 13).
• Preconditions to exercising powers. The instrument frames Division 2 specifically as for the purposes of subsections 13C(1) and 13D(1) of the Act (reg 7). It imposes an “if practicable” obligation: before exercising a power under section 13C or 13D in relation to a person, an authorised officer must, if practicable, tell the person that the officer is authorised and show ID appropriate to whether the officer is a constable (police ID) or not (identity card) (reg 8). For frisk searches under section 13D, the officer must, if practicable, explain the procedure and the effect of specified subsections of the Act (reg 9). The “if practicable” qualification introduces a feasibility threshold rather than an absolute obligation.
• Dealing with information obtained under section 13C. Division 3 sets out who may receive information supplied in response to a requirement under Part IIA. An authorised officer may disclose such information to a Police Force (reg 11(1)). The ACIC’s authorised officers may disclose to the Chief Executive Officer of the Commission (reg 11(2)); the National Anti‑Corruption Commissioner’s authorised officers may disclose to the Commissioner (reg 11(3)). However, the Regulations limit each of these paths by adding a reasonableness threshold: disclosure under any of the permitted paths is only allowed where the authorised officer reasonably believes the disclosure is necessary in the interests of security (reg 11(4)). This provides a legal constraint on dissemination, while leaving the assessment to the officer’s reasonable belief.
• Electronic recording. The instrument expressly permits information obtained under section 13C to be recorded electronically (reg 12). The permission is permissive rather than mandatory and does not set retention, access or security rules.
• Returning identity cards. Reg 13 creates a duty on persons who cease to be authorised officers to return their identity cards “as soon as practicable” either to the issuer or, if unavailable, to another person authorised by the investigatory authority to receive it. The duty is administrative; the Regulation sets neither an exact timeframe nor a sanction.
• Transitional application. Reg 14 confirms that Division 3 (dealing with information) applies to information given in response to a Part IIA requirement whether the information was given before, on or after the instrument’s commencement. This is an explicit temporal rule making Division 3 retrospective and prospective in relation to existing information holdings.

These concepts structure the instrument as a modest set of procedural rules layered over the substantive powers in Part IIA of the Act. The Regulations do not re‑write the Act’s powers; instead they prescribe who is captured (reg 6), what identification is acceptable (reg 5, reg 8), how certain powers should be announced or explained (regs 8-9), how information may be handled and shared (regs 11-12), and the administrative hygiene of identity cards (reg 13). All these concepts are expressed as duties or permissions linked to the Act by the instrument’s authority under section 13H (reg 3).

The Regulations create obligations and permissions for a narrow set of actors and affect a wider set of incidental parties by operation of those obligations.

Primary state actors affected

• Authorised officers for investigatory authorities. The regulations impose several express duties on authorised officers: to identify themselves and show ID before exercising powers under sections 13C or 13D, to explain frisk search procedure and specified legal effects before conducting a frisk search (where practicable), to disclose information only in specified circumstances, to record information electronically if they choose to, and to return identity cards on cessation (regs 8-13). The operative language is directed at “an authorised officer for an investigatory authority” (regs 8-13).
• The Australian Criminal Intelligence Commission and the National Anti‑Corruption Commissioner. These investigatory authorities are prescribed in reg 6 and therefore the agencies must operationalise the Regulations for their officers. For the ACIC and the National Anti‑Corruption Commissioner, the Regulations also create internal disclosure paths: ACIC officers may disclose information obtained under s 13C to the CE of the Commission (reg 11(2)); the National Anti‑Corruption Commissioner’s officers may disclose to the Commissioner (reg 11(3)). The agencies are responsible for issuing identity cards (reg 5) and arranging authorised recipients for returning cards (reg 13).
• Police Force members acting as authorised officers. Where an authorised officer is a constable, reg 8 requires the officer to show police identification before exercising powers under ss 13C or 13D. Police forces are both recipients of disclosure (reg 11(1)) and potential sources of authorised officers.

Persons who interact with investigatory authority premises

• Visitors, interviewees, contractors and members of the public entering these agencies’ premises. The Regulations affect how these persons will be informed and treated when certain investigatory powers are exercised. Before an officer exercises a power under s 13C or s 13D in relation to a person, the officer must, if practicable, tell the person they are an authorised officer and show ID (reg 8). For frisk searches, the officer must explain the procedure and specified effects of s 13D (reg 9). These obligations shape the immediate interaction between a private individual and state agents.
• People who provide information under a Part IIA requirement. Division 3 concerns information obtained under s 13C; it prescribes disclosure paths and conditions (reg 11), and permits electronic recording (reg 12). Where an individual provides information in response to a requirement, that information may be recorded electronically and, subject to the “necessary in the interests of security” threshold, disclosed to a Police Force or specified internal recipients (regs 11-12). Reg 14 applies Division 3 to information provided before commencement, so people who previously provided information may find it subject to these rules.

Organisations that may be indirectly affected

• Businesses and third parties that supply information under compulsion or in the course of investigations at these agencies. The Regulations do not change the existence of powers in the Act but change handling and disclosure practices for information obtained under s 13C by allowing electronic recording (reg 12) and limited disclosure (reg 11). These rules can affect confidentiality expectations and operational risk for businesses compelled or requested to attend investigatory authority premises.
• Data custodians and records managers. The permission to record information electronically (reg 12) creates a requirement to implement recordkeeping, retention and security practices, even though the Regulations do not specify these. Entities must anticipate interaction with privacy and records laws when implementing electronic recording.

Who is not affected by the Regulations

• Investigatory authorities not listed in reg 6. The instrument expressly states that Part IIA and Part 2 of the Regulations apply only to the investigatory authorities mentioned in section 6 (reg 5 note, reg 6). That limits this instrument’s direct application to the ACIC and the National Anti‑Corruption Commissioner. Other Commonwealth or state investigatory bodies are not captured by these Regulations unless separately prescribed under the Act.

In short, the Regulations primarily affect the prescribed investigatory authorities and their authorised officers, and secondarily affect people who interact with those officers or whose information is collected under Part IIA. The administrative consequences for investigatory authorities include issuing identity cards per reg 5, training officers on pre‑exercise identification and frisk search explanation obligations (regs 8-9), establishing disclosure decision‑making processes constrained by the “necessary in the interests of security” threshold (reg 11(4)), and managing electronic records (reg 12) and identity‑card returns (reg 13). Reg 14 extends Division 3 to past information, so records managers and counsel will need to consider retrospective application when assessing existing holdings.

The Regulations set out a compact set of duties for authorised officers and administrative duties for investigatory authorities, and create permissive rights primarily in the form of authorised disclosure and electronic recording. The key duties and permissions are as follows, with the relevant regulation cited.

Duties imposed on authorised officers

• Pre‑exercise identification: Before exercising a power under s 13C or s 13D in relation to a person, an authorised officer must, if practicable, tell the person that the officer is an authorised officer for the purposes of Part IIA and, depending on whether the officer is a constable, show police identification or, if not a constable, show the officer’s identity card (reg 8). This is a positive communicative duty tied to the practical feasibility of doing so.
• Pre‑search explanation for frisk searches: Prior to conducting a frisk search under s 13D, an authorised officer must, if practicable, tell the person about the procedure for the frisk search and the effect of subsections 13D(4), (5) and (7) of the Act (reg 9). The content of those subsections is in the Act; the Regulation imposes the duty to communicate their effect.
• Return of identity cards: A person who ceases to be an authorised officer and holds an identity card must give the card as soon as practicable to (a) the person who issued it or (b) if that person is unavailable, another person authorised by the investigatory authority to receive the card (reg 13). This is an administrative return obligation.

Discretionary duties and limitations

• Disclosure subject to “reasonable belief” and “interests of security”: Under reg 11(1)-(3) authorised officers are permitted to disclose information obtained under s 13C to a Police Force, to the ACIC CEO (for ACIC officers), or to the National Anti‑Corruption Commissioner (for that agency’s officers). Each disclosure route is constrained by reg 11(4), which permits disclosure only where the authorised officer reasonably believes it is necessary in the interests of security. That inserts an officer‑level reasonableness test and a substantive normative criterion (“interests of security”) as a limiting condition on permitted disclosures. The Regulation therefore creates a conditional permission rather than an unfettered right to disclose.
• “If practicable” qualifiers: Regs 8 and 9 qualify duties with “if practicable”, which means the duty is not absolute and is dependent on operational feasibility or circumstances. The Regulations do not define “practicable”, leaving that to ordinary legal interpretation and operational judgement.

Permissive rights/permissions for authorised officers and investigatory authorities

• Permission to disclose to specified recipients: Reg 11(1)-(3) create explicit disclosure destinations (Police Force, ACIC CEO, National Anti‑Corruption Commissioner) where the officer reasonably believes disclosure is necessary in the interests of security. The permission is explicitly constrained by reg 11(4).
• Permission to record electronically: Reg 12 permits information obtained under s 13C to be recorded electronically. The permission does not mandate electronic recording nor set technical or retention standards; it simply authorises that form of recording.

Administrative duties on investigatory authorities

• Issuance and recovery of identity cards: The definition in reg 5 sets minimum contents for an identity card of an authorised officer, and reg 13 imposes the duty on persons who cease to be authorised officers to return identity cards to the issuer or another authorised recipient. Investigatory authorities must implement issuance and recovery processes.
• Scope duty: Reg 6 prescribes which investigatory authorities are subject to the Regulations; the agencies themselves must observe that the Regulations apply to their operations.

Rights of persons who are subjects of powers

• Right to information about the officer’s status and frisk search procedure “if practicable”: The Regulations create an entitlement for persons subject to exercises of s 13C or s 13D powers to be told the officer’s status and, in the case of frisk searches, to be told the procedure and effects of certain subsections (regs 8-9). The entitlement is limited by the “if practicable” standard.
• No statutory right of non‑disclosure created. The Regulations do not create any new entitlement to non‑disclosure or to prevent authorised officers from disclosing information in circumstances permitted by reg 11; rather they impose limits on permissible disclosure.

Notable absences

• No penalty or enforcement regime in the Regulations themselves. The instrument does not create specific criminal penalties or civil sanctions for failure to comply with the duties set out (no fine or offence provisions appear in regs 5-14). Enforcement will therefore depend on the Act or other legal avenues, and on administrative and employment consequences within investigatory authorities.
• No recordkeeping standards for electronic recording. Reg 12 permits electronic recording but does not specify retention periods, access controls, encryption or privacy safeguards. Those practical requirements must be met by other laws, policy instruments or internal procedures.

In sum, the Regulations impose concrete procedural duties on authorised officers (identification, explanation, return of ID cards), create constrained permissions for information handling (limited disclosure and electronic recording), and leave several operational details to agency policies and broader legal regimes. The recurring legal standards that determine how duties will be applied are “if practicable” and the authorised officer’s “reasonable belief” that disclosure is “necessary in the interests of security” (regs 8-11).

The Regulations are procedural and permissive in tone and do not themselves establish criminal offences, monetary penalties or an express enforcement mechanism. The instrument contains no provision imposing a sanction for non‑observance of the duties laid out in regs 5-14. That absence is material for practitioners because it indicates the Regulations create administrative duties and constrained permissions without parallel statutory penalties.

What this means for enforcement in practice

• Reliance on the Act and administrative controls. Since the Regulations were made under section 13H of the Act (reg 3), enforcement of substantive powers and the legal consequences of exercising or misusing those powers will principally stem from the Act itself and from the investigatory authorities’ employment and internal disciplinary regimes. Where the Act contains offence or sanction provisions for misuse of powers or wrongful disclosures, those provisions (not the Regulations) would be the source of criminal liability. The Regulations do not reproduce or extend penalty provisions; they operate as procedural direction.
• Employment and administrative remedies. Failure to comply with the Regulations (for example, failure to return an identity card, failure to show identification where practicable, or inappropriate disclosure contrary to the reasonable‑belief limit) is likely to trigger administrative, disciplinary or employment consequences within the relevant investigatory authority. The instrument requires investigatory authorities to have mechanisms for issuing and reclaiming identity cards (reg 5, reg 13), and practical enforcement is therefore likely to be internal.
• Judicial and equitable remedies. Where an authorised officer or investigatory authority acts outside the bounds of the Act or in breach of obligations, affected persons could seek judicial remedies under existing statutory or common law avenues (judicial review, damages for breach of statutory duty or privacy torts where available), but such remedies are not created or specified in the Regulations themselves. The Regulations’ silence on penalties means practitioners must look to other statutes, internal policies, and the common law for enforcement options.
• Evidence and admissibility implications. Reg 12 permits electronic recording of information obtained under s 13C. The permissive recording rule may have consequences for evidence management: recorded material could be tendered in later proceedings, subject to the usual admissibility rules. The Regulations do not specify evidentiary or chain‑of‑custody standards; those questions will be resolved under evidence law and agency procedure.
• Oversight and review gaps. The Regulations condition disclosure on an authorised officer’s reasonable belief that disclosure is necessary in the interests of security (reg 11(4)). The instrument does not specify external oversight, reporting or review obligations for such disclosure decisions (for example, notifying an independent oversight body or maintaining disclosure logs). That absence increases reliance on internal processes and independent oversight elsewhere (for example, inspectorates or parliamentary oversight as applicable under other legislation) for detecting and correcting misuse.

Practical implications for counsel and compliance officers

• Document decisions. Because the Regulations rely on officer judgement (notably the “reasonable belief” and “if practicable” standards), investigatory authorities should document key decisions , particularly disclosures under reg 11 , to provide a record if the decision is questioned later.
• Internal sanctions and policy. Agencies will need to provide internal disciplinary and compliance mechanisms that enforce the duties in the Regulations, given the absence of statutory penalties. HR, legal and records branches should have clear policies for identity card issuance and return, for training on pre‑exercise identification and frisk search explanations, and for authorising disclosures.
• Interaction with privacy and records laws. Electronic recording permitted by reg 12 must be implemented with awareness of privacy, data protection and records management obligations under other relevant laws; failure to comply with those regimes could attract penalties not present in the Regulations.

In summary, the Regulations set operational duties and permissions but do not set out penalties or enforcement mechanisms within their text. Enforcement therefore relies on the Act, internal disciplinary regimes, other statutory regimes (privacy, public sector employment law) and ordinary legal remedies.

The Regulations are an instrument made under section 13H of the Public Order (Protection of Persons and Property) Act 1971 (reg 3) and are expressly designed to operate together with Part IIA of that Act. The text of the instrument cross‑refers to several provisions of the Act (ss 13C and 13D, Part IIA generally) and therefore must be read as a regulatory supplement to the Act rather than as a stand‑alone statute. Key points of statutory interaction and areas for legal practitioners to consider are set out below.

Primary statutory relationship with the Act

• Regulatory supplement to Part IIA. The Regulations are expressly for the purposes of subsections 13C(1) and 13D(1) (reg 7) and for section 13H insofar as that section deals with the handling of information obtained under Part IIA (reg 10). They therefore modify the operational exercise of those Act powers by adding pre‑exercise communication duties (regs 8-9) and by prescribing disclosure paths and conditions for information obtained under s 13C (reg 11). The Regulations do not modify the scope of the powers themselves; they regulate how those powers are exercised.
• Cross‑references to sections 13C and 13D. Since the Regulations require explanation of the effect of subsections 13D(4), (5) and (7) (reg 9), those provisions in the Act are directly implicated. Practitioners must therefore consider the combined text of the Act and Regulations when advising on frisk searches and related powers.

Interaction with administrative law and judicial review

• Exercise of administrative discretion. Several provisions turn on the authorised officer’s “reasonable belief” (reg 11(4)) or on what is “practicable” (regs 8-9). Those standards are subject to administrative law review when decisions are amenable to judicial review (for example, where disclosure or failure to identify leads to denial of procedural fairness or other legal wrong). The Regulations themselves do not create supervisory mechanisms; judicial review and statutory oversight remain external constraints.
• Evidence of compliance. Compliance (or lack of it) with the Regulations may be relevant in judicial review or other proceedings to show whether an officer acted lawfully or reasonably. Documentation of decisions and recordings (reg 12) can therefore have evidentiary value.

Privacy, data protection and records laws

• Electronic recording and privacy rules. Reg 12 authorises electronic recording of information obtained under s 13C. This interacts with privacy, data protection and records management regimes (for example, the Privacy Act 1988 and applicable Commonwealth records laws). The Regulations do not set data security, retention, or access controls; agencies must ensure that electronic recordings comply with statutory privacy obligations, information security standards and records retention schedules.
• Cross‑jurisdictional disclosures. Reg 11 permits disclosure to a Police Force and to specified internal recipients where necessary in the interests of security. Such disclosures may engage additional information‑sharing rules or MOUs, including state police legislation or agreements governing inter‑agency cooperation. The Regulations do not displace extraneous disclosure constraints that arise from other legislation or confidentiality arrangements.

Employment, administrative and disciplinary law

• HR implications for identity cards. Reg 13 requires returning identity cards “as soon as practicable” upon ceasing to be an authorised officer. Failure to comply will generally be an employment matter for internal disciplinary processes, rather than a regulatory offence in the instrument itself. Investigatory authorities should align identity card procedures with employment law, property and asset recovery processes.
• Internal governance. The Regulations leave many operational decisions (who issues identity cards, who is “another person authorised by the investigatory authority” to receive returned cards, how to log disclosures) to the agencies’ internal governance frameworks; those frameworks will interact with human resources and public sector employment law.

Criminal law and evidence

• Disclosure to Police Force. Reg 11(1) permits authorised officers to disclose information obtained under s 13C to a Police Force if the officer reasonably believes it is necessary in the interests of security. That disclosure may initiate criminal investigations in which the material becomes part of criminal evidence. The Regulations do not set evidentiary standards but allow material to be passed to entities that have different powers and rules (Police Force investigations), so practitioners should consider admissibility, chain of custody and disclosure obligations under criminal procedure rules.
• Frisk searches. Reg 9 requires explanation of specified subsections of s 13D before a frisk search; how those explanations are given and recorded may be material to later criminal or administrative proceedings.

Other statutory or policy instruments

• Memoranda of understanding and data‑sharing agreements. Because reg 11 contemplates sharing information with Police Forces and internal agency heads, agencies may need MOUs or formal data‑sharing agreements to regulate the practical terms of those exchanges, consistent with privacy and public sector requirements. The Regulations do not supply MOUs; agencies must develop them where necessary.
• Interaction with oversight bodies. The Regulations do not create new independent oversight mechanisms; where oversight exists under other laws (parliamentary committees, inspectorates, privacy commissioners) those bodies may review whether agencies complied with the Regulations in the exercise of their functions.

In summary, the Regulations are an adjunct to Part IIA of the Act and intersect with administrative law, privacy, employment, criminal procedure and records regimes. They create procedural duties and permissive disclosure paths but do not displace other statutory constraints. Practitioners must therefore read the Regulations in context with the Act and other relevant laws and ensure agency policies fill the implementation gaps the Regulations leave open.

The text provided is the Public Order (Protection of Persons and Property) Regulations 2019, made under section 13H of the Public Order (Protection of Persons and Property) Act 1971 (reg 3). The instrument’s internal provisions refer repeatedly to itself as the 2019 instrument. The material supplied does not record any subsequent amendments, schedules of modification, commencement dates apart from reg 14’s reference to “commencement”, or replacement instruments. The Regulations include a transitional provision (reg 14) which applies Division 3 of Part 2 to information given in response to a Part IIA requirement whether given before, on or after commencement; that is an explicit retrospective/prospective application clause for Division 3, but the text of the instrument provided does not state the commencement date.

What can be taken from the instrument as supplied

• Original instrument dated 2019. The instrument identifies itself as the Public Order (Protection of Persons and Property) Regulations 2019 (reg 1 name). That indicates the Regulations were made in 2019; the text supplied does not include dates of making, registration, commencement or any instrument numbers.
• Reg 14 provides transitional application to material obtained before commencement. That is the only explicit temporal amendment‑style or transitional provision in the text supplied; it ensures Division 3 applies to information provided prior to the instrument’s commencement (reg 14). This is a substantive transitional rule, not an amendment history item, but it is the only provision that addresses pre‑existing material.
• No amendment schedule contained in supplied text. The Regulations as provided do not display any later amending regulations, notations of repeal, or consolidating amendments. There are numerous repeated blocks in the supplied text, but those appear to be duplication of the same provisions rather than recorded amendments.

Practical consequence for users of the instrument

• Confirm current status before advising. Because the text supplied does not include commencement dates or subsequent amendment information, practitioners should verify the current status of the instrument on an official legislation register (for example, the Federal Register of Legislation) to ensure no later amending regulations have altered definitions, added investigatory authorities, changed disclosure paths, or inserted penalty or oversight provisions.
• Pay attention to commencement for retroactivity. Reg 14’s retroactive application of Division 3 to information provided before commencement means counsel should examine records and disclosures made before the Regulations’ start date, once that date is known, because those records may now fall within reg 11 and reg 12’s regime. Without the commencement date in the supplied text, the practical impact cannot be fully assessed.

Because the supplied instrument does not document any amendment history beyond the instrument as made in 2019 and its internal transitional clause, users must consult the authoritative legislative database to confirm whether the instrument has been amended, superseded or repealed since 2019.

The supplied Regulations text contains no mention of litigation, cases, decisions or judicial commentary. There are no internal references to judicial interpretations or statutory appeals. The instrument itself does not cite any cases, nor does it provide precedent or examples.

What this absence signifies for practitioners

• No cases recorded in the instrument. The Regulations make procedural provisions without referencing litigation; they are regulatory in character. The absence of litigation references in the document supplied means that any judicial interpretation of the Regulations (for example, on the meaning of “if practicable”, “reasonable belief”, or “interests of security”) must be sought in external case law and is not provided in the instrument. Practitioners should therefore search contemporary judicial decisions and administrative law reports for any cases that engage with Part IIA of the Act, sections 13C and 13D, and the Regulations’ specific provisions in order to develop litigation‑grade advice.
• Potential for administrative and judicial review. Because the Regulations rely on discretionary standards (reasonable belief) and practicability assessments, they are likely to admit challenge under administrative law where an affected person can demonstrate a decision was unlawful, unreasonable or procedurally unfair. Practitioners should treat the absence of reported litigation in the instrument as an evidence gap rather than as evidence that issues will not litigate.
• Evidence and records. Reg 12 authorises electronic recording of information obtained under s 13C; recorded evidence could be implicated in subsequent litigation. Agencies and counsel should anticipate that state recordkeeping and disclosure decisions may be scrutinised in litigation even if the Regulations themselves have not yet been the subject of reported cases.

Recommended practical step

• Undertake a case law search. Before relying on or advising about key interpretative issues in the Regulations, conduct a targeted search for any litigation engaging with Part IIA of the Act and the 2019 Regulations, including judicial review proceedings, evidence rulings, or supervisory body reports. The absence of litigation in the instrument does not prevent future or existing cases from referencing these Regulations in legal arguments.

In short, there is no litigation history contained within the Regulations as supplied. Practitioners must look beyond this instrument to case law, administrative determinations and agency guidance for interpretative materials and enforcement precedents.

The Regulations are compact but include several drafting choices and silences that generate operational and legal risks. Below are specific “gotchas” practitioners should flag when advising investigatory authorities, authorised officers, or persons who may be subject to Part IIA powers.

1. “If practicable” qualifier creates uncertainty about timing and circumstances (regs 8-9).

• Regs 8 and 9 require identification and explanation “if practicable” before exercising ss 13C/13D powers and before a frisk search. The instrument does not define “practicable”, nor provide examples of when a practibility exception applies. That yields operational latitude for officers but legal uncertainty for persons subject to powers. Agencies should develop and document policies explaining when it will be impracticable to identify or explain, and train officers accordingly. Failure to document can make compliance assessments subjective and defensibility of conduct harder in review or litigation.

2. “Reasonable belief” and “necessary in the interests of security” delegate substantive judgement to officers (reg 11(4)).

• Reg 11(1)-(3) permit disclosure to Police Force or senior agency officers but only where the authorised officer reasonably believes disclosure is necessary in the interests of security. That is a compound standard: it requires both a subjective reasonable belief and an objective necessity test tied to “interests of security”. The Regulation does not define “interests of security” nor require contemporaneous documentation of the belief. In practice this both empowers and exposes officers to challenge if they cannot justify the belief. Agencies should log the rationale for disclosure decisions to create an audit trail.

3. Electronic recording allowed, but no technical or retention standards (reg 12).

• Reg 12 permits electronic recording of information obtained under s 13C without specifying security, retention, destruction, access, or disclosure controls. That silence can create compliance gaps with privacy, archives and data security obligations. Agencies must implement complementary policies (encryption, retention schedules, access logs) and ensure compliance with the Privacy Act and records management requirements to avoid statutory breaches.

4. Identity card content and issuer obligations are minimal but operationally binding (reg 5, reg 13).

• The identity card must state the holder is an authorised officer, include a recent photograph, and state the office held by the issuer (reg 5). Reg 13 requires returning cards as soon as practicable when a person ceases to be an authorised officer, to the issuer or an authorised recipient. The Regulations do not specify who may be the issuer, how to authenticate recipients, or sanctions for failure to return cards. Agencies should establish documented processes for issuance, inventories, asset tracking and recovery.

5. Limited scope of the instrument (reg 6): only ACIC and National Anti‑Corruption Commissioner are prescribed.

• The Regulations apply only to investigatory authorities listed in reg 6. If an agency is not prescribed, these Rules do not apply. That can produce different operational regimes across investigatory agencies; practitioners should check whether other instruments or regulations exist for other agencies.

6. Transitional provision extends Division 3 to past information (reg 14).

• Reg 14 applies Division 3 to information given in response to a Part IIA requirement whether given before, on or after commencement. That may change the authorised handling and disclosure of legacy information. Agencies must audit historical records to determine whether any disclosures permitted by reg 11 are applicable and to document prior decisions.

7. No penalty provisions or external oversight mechanism in the Regulations.

• Because the Regulations do not create offences or specify oversight, enforcement is likely to be internal or under other statutory regimes. This absence means that compliance relies on agency processes and other statutory mechanisms (privacy or general criminal/disciplinary provisions), making robust internal policy and documentation essential.

8. Interaction with other laws is not specified.

• The Regulations are silent on how their electronic recording and disclosure permissions interact with the Privacy Act 1988, data breach notification obligations, state police legislation or other confidentiality regimes. Practitioners should not assume the Regulations displace or address these interactions; they must be handled separately.

9. Ambiguity around who counts as “another person authorised by the investigatory authority” to receive returned identity cards (reg 13).

• Reg 13 permits returning cards to the issuer or, if the issuer is unavailable, to “another person authorised by the investigatory authority”. Agencies should designate authorised recipients and communicate them to staff to avoid ambiguity in card returns.

10. Potential evidentiary and chain‑of‑custody issues for electronic recordings.

• Because reg 12 permits electronic recording without specifying chain‑of‑custody, agencies must ensure recorded material is managed in a way that supports admissibility in later proceedings.

Each of these points is grounded in specific provisions of the instrument (regs 5, 6, 8-14). Addressing the gotchas requires policy work that is not supplied in the Regulations themselves: documented practicability criteria, disclosure decision logs, records management protocols, issuance and recovery procedures for identity cards, and integration with privacy and criminal investigation procedures.

For investigatory authorities, authorised officers, compliance officers and counsel, compliance with the Regulations requires a modest programme of policy design, training, documentation and records governance. Below is a practical compliance checklist tied to the Regulations’ provisions.

1. Verify whether the agency is captured (reg 6).

• Confirm whether the investigatory authority is one of the entities prescribed by reg 6 (ACIC; National Anti‑Corruption Commissioner). If not listed, the agency should check if other instruments apply. If listed, the agency must implement the Regulations’ requirements across the relevant premises and staff.

2. Identity card design, issuance and inventory (reg 5, reg 13).

• Design an identity card that complies with reg 5: it must state the holder is an authorised officer for the purposes of Part IIA, include a recent photograph of the officer, and state the office held by the issuer.
• Maintain an issuance log and asset inventory for identity cards. Record issuer, recipient, card number, issue date and status.
• Designate authorised recipients authorised by the investigatory authority to receive returned identity cards in case the issuer is unavailable (reg 13(b)). Record and publicise those authorised recipients.
• Implement a prompt return process for staff who cease to be authorised officers; “as soon as practicable” should be translated into a clear internal timeframe (for example, immediate upon cessation or within a specified number of business days). Document the chosen timeframe and the rationale.

3. Pre‑exercise procedures and training (regs 7-9).

• Draft a standard operating procedure (SOP) that instructs authorised officers to identify themselves and show appropriate identification before exercising powers under ss 13C and 13D, “if practicable” (reg 8). Define scenarios where the obligation may be impracticable (for example, urgent safety concerns, risk to officer, or where an individual is non‑communicative). Provide examples so officers can apply the “if practicable” test consistently.
• For frisk searches under s 13D, prepare a short script or checklist that explains the frisk search procedure and the effect of subsections 13D(4), (5) and (7) of the Act (reg 9). Include guidance on how to deliver the explanation clearly and document that it was given (for example, via timestamped entry in an interview log).
• Provide training to authorised officers and supervisors on these SOPs to ensure consistent application and an understanding of the “if practicable” threshold.

4. Disclosure decision framework and logging (reg 11).

• Establish a disclosure policy implementing reg 11(1)-(4). The policy should require contemporaneous written justification for any disclosure of information obtained under s 13C to a Police Force or internal recipients (ACIC CEO or National Anti‑Corruption Commissioner), documenting: (a) the information disclosed; (b) the recipient; (c) the officer’s assessment of why disclosure is necessary in the interests of security; and (d) alternative measures considered. The log should include dates and the identity of the decision‑maker.
• Define “interests of security” in agency policy with examples and thresholds to reduce uncertainty, while preserving necessary operational flexibility. Consider requiring senior review for high‑sensitivity disclosures.
• Where disclosure to Police Force is contemplated, consider pre‑existing MOUs or data‑sharing agreements to set practical terms for disclosure and receipt, consistent with privacy obligations.

5. Electronic recording practices (reg 12).

• Implement technical and procedural standards for electronic recording of information obtained under s 13C. This should include: encryption, access controls, retention schedules, secure backups, audit logging, and processes for authorised disclosure and deletion.
• Align recording practices with the Privacy Act 1988 and Commonwealth records‑management rules. If recordings contain personal information, apply relevant privacy impact assessments and data breach protocols.
• Document chain‑of‑custody procedures so recordings can be admissible and verifiable if used in later proceedings.

6. Documentation and audit trail.

• Require officers to create contemporaneous records when exercising powers under ss 13C/13D that capture: identification shown, whether pre‑exercise identification and/or frisk explanation was practicable and given, reasons if not, any electronic recordings made (with file references), and any disclosures made under reg 11 with supporting rationale.
• Conduct periodic audits to ensure compliance and identify training gaps.

7. HR and cessation processes (reg 13).

• Integrate identity card return processes into separation/role change checklists. Ensure line managers check for identity card return as a condition of exit clearance or role change. Authorise recurring checks of identity card inventories.

8. Legal oversight and review.

• Have legal counsel review template disclosure logs and the “interests of security” definition to align with statutory constraints and reduce risk of successful legal challenge. Ensure counsel is involved when disclosures are complex or likely to engage cross‑jurisdictional issues.
• Develop an escalation pathway for disclosures that are novel, sensitive, or likely to be challenged.

9. Transitional audit for historical information (reg 14).

• Because reg 14 applies Division 3 to information given before commencement, run an audit of historical information obtained under Part IIA to decide whether any of those records should be treated under reg 11 and reg 12. For past disclosures, document whether similar criteria were applied, and consider whether notification to oversight bodies is appropriate under other laws. Update retention and disclosure logs for legacy records.

10. Interaction with Privacy and Records regimes.

• Consult privacy officers to map electronic recordings and disclosure practices to the Privacy Act obligations and to data breach notification requirements. Ensure records retention schedules and access controls comply with the Commonwealth Records Act and any relevant agency records policies.

11. Reporting and oversight.

• Although the Regulations do not create an external reporting obligation, consider internal reporting to a compliance unit or inspectorate on disclosures, identity card management and electronic recording incidents. Such internal oversight helps mitigate risk and creates documentary evidence of good governance.

12. Review and update policy.

• Review SOPs and disclosure policies regularly, particularly after any incident, audit finding, or legal change. Maintain version control and a clear update log.

By following this checklist, investigatory authorities and their authorised officers convert the Regulations’ textual duties into practical, auditable procedures that reduce legal and operational risk. The Regulations provide the legal scaffolding; compliance requires filling in the operational details the instrument leaves open, particularly around practicability, reasonableness, and electronic record‑keeping.