Surveillance Devices Regulations 2017

"Record" (reg 3): The regulations define "record" in deliberate and bounded terms. A record includes warrant applications and warrants themselves, emergency authority applications and authorities, and "any information or material (other than a notification or alert automatically generated by the surveillance device) derived from the use of a surveillance device under a warrant or authority issued under the Act" (r 3). The exclusion of "a notification or alert automatically generated by the surveillance device" is an explicit carve‑out , those automated notifications are not captured within the definition of record for the purposes of the regulations. Copies of any item in these categories are also records.

"Records authority" (reg 3): For organisational responsibility the regulations name a records authority for each class of records: (a) Commissioner of Police for SA Police records; (b) Independent Commissioner Against Corruption for ICAC records; (c) Chief Executive Officer of the ACC for ACC records. These are the entities that must ensure secure storage (r 4), maintain the records register (r 5), authorise removal/copying/destruction and bear the accountability for entries and authorisations.

Records register and unique identifier (rr 5-7): Each records authority must keep a records register. Each record must have a unique identifier so it can be linked to entries in the register (r 5(3)). Entries required include type of record, date first stored (r 5(4)), access logs (r 6), copying logs including unique identifier for each copy and who made it (r 7), and destruction entries including method and time (r 8(2)). There is an express note that a copy, once made, itself becomes a record (r 7(1) note).

Security and authorised removal (r 4): Records must be stored securely at all times except when used in connection with a purpose authorised by the Act or these regulations (r 4(1)). The records authority may authorise removal only for specified purposes: providing access, making a copy or destroying the record (r 4(2)).

Destruction criteria and authorisation (r 8): The records authority may authorise destruction only if satisfied the record is no longer required for the purposes of a relevant action, investigation, or otherwise required by law, and that it should be destroyed (r 8(1)(a)-(b)). The authorisation must be recorded with reasons, date/time, method and the person performing the destruction (r 8(2)).

Offences specific to record handling (r 9): The regulations create specific unauthorised conduct offences relating to records. They make it an offence to make/amend/delete an entry in the register, remove a record from storage, provide access, copy, or destroy a record unless authorised by the records authority, with a maximum penalty of $5,000 (r 9).

Prescribed exemptions (Part 3): The regulations prescribe specific operational circumstances where installation, use or maintenance of surveillance devices will be treated as lawful under the Act. Examples include:

• Department for Infrastructure and Transport officers, CBS authorised officers and SafeWork SA inspectors may wear listening or optical devices for enforcement/compliance purposes if the device is worn, not concealed and the officer advises any person they are intentionally recording and are wearing the device (r 10A(1)(a), (f), (g)).

• Registrar of Motor Vehicles tests and driver training activities may be recorded by relevant persons subject to Registrar directions (r 10A(1)(b)-(e)).

• The Minister responsible for the Highways Act 1926 may install tracking devices to measure transport system performance provided the information is de‑identified (r 11).

• The installation/use/maintenance of data surveillance devices by ASIO, ASIS or ASD is prescribed (r 11A).

Communication exemptions for licensed investigation agents (r 12): The regulations set who may receive information or material from licensed investigation agents and in what circumstances communications are permitted (clients, employers, legal representatives, medical practitioners, other licensed agents engaged by the same employer or client, officers of investigating agencies for relevant investigations/actions/proceedings, and "reasonable" communications to assist the agent with an investigation).

Reporting and delegation (rr 13-14): Chief officers of investigating agencies must include in ministerial reports the number of occasions police officers used surveillance devices during undercover operations other than those authorised under the Criminal Investigation (Covert Operations) Act 2009 (r 13). Regulation 14 prescribes classes of senior officers within the Independent Commissioner Against Corruption for purposes of delegation (Deputy Commissioner and examiners appointed under the ICAC Act).

Transitional and revocation mechanisms (Sch 1-2): The regulations revoke the old Listening and Surveillance Devices Regulations 2003 and provide that existing records books and authorisations continue as part of the new regime (Sch 1). Schedule 2 preserves application of the former Act for specified continuing complaints and investigations tied to the Independent Commissioner amendments (Sch 2 cl 1).

Together, these concepts create an administrative framework that turns the Act’s general duties and exemptions into concrete, auditable processes and narrowly framed operational carve‑outs.

The regulations identify both institutional owners of obligations and classes of individuals whose conduct is regulated or made permissible in particular contexts.

Records authorities and investigating agencies

• Commissioner of Police (SA Police), as records authority for SA Police records (r 3). The Commissioner must ensure secure storage (r 4), maintain the records register (r 5) and authorise removals, copies and destruction (r 4(2), r 8(1)).
• Independent Commissioner Against Corruption, as records authority for ICAC records (r 3). The Independent Commissioner is also affected by r 14, which prescribes classes of senior officers for delegation under the Act.
• Chief Executive Officer of the ACC, as records authority for ACC records (r 3).
• Chief officers of investigating agencies generally, because r 13 requires them to include a prescribed statistic in ministerial reports under s 30 of the Act.

Operational enforcement officers and inspectors

• Officers or agents of the Department for Infrastructure and Transport when installing/using/maintaining listening or optical surveillance devices for enforcing/ensuring compliance with a relevant Act (r 10A(1)(a), (2)). These devices must be worn, not concealed and the officer must advise any person they are intentionally recording (r 10A(1)(a)(i)-(iii)).
• CBS authorised officers for enforcement of specified gambling and liquor Acts (r 10A(1)(f), (3) and r 10A(5) defines CBS authorised officer).
• SafeWork SA inspectors for enforcement under listed Acts (r 10A(1)(g), (4) and r 10A(5) defines SafeWork SA inspector).
• Registrar of Motor Vehicles authorised personnel, instructor licence holders and authorised examiners for recording tests and driver training activities (r 10A(1)(b)-(e)).

Licensed investigation agents and their clients

• Licensed investigation agents are addressed by r 12: the regulations prescribe to whom and under what circumstances they may communicate or publish information or material derived from surveillance devices. The classes include the agent’s clients, employers, their legal representatives and medical practitioners, and other specific circumstances (r 12(1)-(2)).

Commonwealth intelligence agencies

• The Australian Security Intelligence Organisation, Australian Secret Intelligence Service and Australian Signals Directorate are expressly prescribed for the purposes of the data surveillance device exemption in r 11A.

Ministerial and ministerial delegates

• The Minister responsible for the administration of the Highways Act 1926 is given a specific power to install tracking devices to measure transport system performance under r 11(1)(a), subject to de‑identification (r 11(1)(b)).

Members of the public affected by recording

• Persons who are recorded by devices used by enforcement officers (r 10A) are affected because the device must be worn and not concealed, and the officer must advise "any person that they are intentionally recording".

Records and material handlers

• Any person who might make an unauthorised entry in a records register, remove a record from storage, provide access, copy or destroy a record without authorisation risks committing an offence under r 9, punishable by a maximum $5,000 penalty.

Administrative staff and auditors

• Staff responsible for maintaining register entries (r 5(2) requires entries be made by an authorised person and dated) and those conducting audits of stored records will be affected by the detailed records‑keeping and logging obligations.

Organisational interactions with other regimes

• Bodies administering the Acts listed in r 10A(3) and r 10A(4) (for example, Liquor Licensing Act 1997, Work Health and Safety Act 2012) and persons operating under those regimes will be affected to the extent enforcement officers under those Acts are authorised to wear non‑concealed devices and must advise persons being recorded.

Transitional stakeholders

• Holders of authorisations and persons listed in the records book maintained under the revoked regulations (Listening and Surveillance Devices Regulations 2003) are affected by the transitional provisions (Sch 1(2)-(5)), which continue prior records authorisations and books as part of the new registers.

Who pays and who decides

• The records authority (Commissioner, Independent Commissioner, CEO of ACC) bears the administrative cost and decision‑making responsibility for storage, authorisation, destruction and registers (rr 4-8).
• Individual officers and licensed investigation agents bear the operational compliance burden when using devices under the prescribed circumstances (r 10A, r 12). Non‑authorised persons who interfere with records face the legal risk of penalty under r 9.

The regulations therefore affect public sector enforcement bodies and their internal administrative processes, licensed private investigators’ communication practices, specific Commonwealth intelligence agencies, and any person interacting with device-using officers , with costs concentrated on records authorities for administration and on operational officers/agents for compliance with worn/non‑concealed and disclosure obligations.

Duties allocated to records authorities

• Ensure secure storage. Under r 4(1) the records authority must ensure that records are stored securely at all times except while being used for a purpose authorised by the Act or the regulations.
• Authorise removal of records. The records authority may authorise removal from storage only for providing access, copying or destruction (r 4(2)).
• Maintain a records register. R 5(1) imposes a duty to keep and maintain a records register recording the details required in Part 2. Entries must be made by authorised persons and dated (r 5(2)).
• Allocate unique identifiers. Each record must be provided with a unique identifier enabling linking to register entries (r 5(3)).
• Record initial storage details. When first stored, the register must include the unique identifier, type of record, and date first stored (r 5(4)).
• Log access. For each authorised access, the register must record the name (and rank/station if a police officer), contact details, reason for access and the date(s) or period of access (r 6).
• Log copying. If a copy is made, it must be given its own unique identifier and the register must record who made the copy, the identifier, the type, and dates when the copy was made and first stored (r 7(1)-(2)). Note: a copy becomes a record (r 7(1) note).
• Authorise and document destruction. The records authority may authorise destruction only if the record is no longer required for relevant actions/investigations or otherwise required by law and should be destroyed (r 8(1)). The register must record reason, date/time, method and the person carrying out the destruction (r 8(2)).

Duties on officers using devices in prescribed circumstances

• Device must be worn and not concealed. Multiple prescribed circumstances in r 10A mandate that the device is worn and not concealed while in use (r 10A(1)(a)(i)-(ii), r 10A(1)(f)(i)-(ii), r 10A(1)(g)(i)-(ii)).
• Officer must advise persons being recorded. Where devices are used under r 10A(1)(a), (f) and (g), the officer wearing the device must advise "any person that they are intentionally recording by the use of the device that they are wearing the device and that it is being so used" (r 10A(1)(a)(iii), (f)(iii), (g)(iii)). That is an express notification duty to those being recorded.

Duties related to tracking and data surveillance

• De‑identify tracking information. R 11 obliges that information obtained from tracking devices installed by the Minister for the Highways Act 1926 for transport system performance "must be de‑identified so that the information is no longer about an identifiable person, vehicle or thing" (r 11(1)(b)).
• Data surveillance device exemption limited bodies. R 11A prescribes that the data surveillance device exemption under the Act applies where data surveillance devices are installed, used or maintained by or on behalf of ASIO, ASIS or ASD. The regulations therefore recognise a tailored exception for those Commonwealth bodies.

Communication and publication duties and rights for licensed investigation agents

• R 12(1) prescribes classes of recipients to whom a licensed investigation agent may communicate information or material derived from surveillance devices: clients, employers, their legal representatives, and a medical practitioner providing services to those clients or employers.
• R 12(2) prescribes circumstances in which communication is allowed: to another licensed agent employed/engaged by the same employer or client for briefing; to an officer of an investigating agency for the purposes of a relevant investigation or proceeding; and "the reasonable communication of information or material to a person in order to assist the licensed investigation agent with an investigation."

Record-handling prohibitions and penalties

• R 9 criminalises a set of unauthorised acts: making, amending or deleting an entry in the register; removing a record from storage; providing access; copying; or destroying a record, without authorisation from the records authority. Maximum penalty $5,000.

Reporting obligation

• Under r 13 a chief officer of an investigating agency must include in each report to the Minister under s 30(1)(c) of the Act the number of occasions in the reporting period on which a police officer acting in the course of duty used a surveillance device during undercover operations other than those authorised under the Criminal Investigation (Covert Operations) Act 2009. This is a discrete statutory reporting duty.

Delegation classes

• R 14 prescribes which classes of officers and employees of the Independent Commissioner Against Corruption count as a "senior officer" for delegation under s 35(3)(b) of the Act: the Deputy Commissioner appointed under the ICAC Act 2012 and persons appointed by the Commissioner as an examiner under s 14 of the ICAC Act 2012.

Rights and discretions

• Records authority discretion. The records authority has the discretion to authorise removal, copying and destruction (r 4(2), r 8(1)). That discretion is the operational fulcrum for accessing and managing records.
• Exemptions as rights to use devices. Where the regulations prescribe circumstances (r 10A, r 11, r 11A), affected officers or bodies have the right under the regulations to install/use/maintain devices without contravening the Act, subject to the conditions specified.

Administrative safeguards and traceability

• The combined effect of unique identifiers, signed/dated entries and prescribed content for access/copying/destruction entries (rr 5-8) is to require an auditable chain of custody and administrative trace for records derived from surveillance device use.

Together, these duties allocate operational responsibilities to records authorities and conditions on certain operational device uses, create a statutory record-keeping protocol intended to support audit and accountability, and attach a monetary penalty to unauthorised interference with that protocol.

The regulations create a focused enforcement tool and leave broader enforcement architecture to the Act and existing administrative authorities. The instrument contains an express offence and penalty provision and embeds documentary obligations that enable administrative and potentially legal enforcement action.

Statutory offence and penalty

• Regulation 9 establishes the principal enforcement leverage in the regulations. It makes it an offence for a person, unless authorised by the records authority, to:
  • make, amend or delete an entry in a records register;
  • remove a record from storage or cause/allow another person to remove it;
  • provide access to a record or cause/allow another person to provide access;
  • copy a record or cause/allow another person to copy it; or
  • destroy a record or cause/allow another person to destroy it.
• The maximum penalty for these offences is $5,000 (r 9).

Enforcement mechanics in practice

• The regulations themselves do not specify criminal procedure, enforcement agency powers or investigatory mechanisms for prosecuting offences under r 9; those procedural mechanisms rest in the Act and general South Australian criminal or regulatory enforcement processes. What the regulations do is create a clearly specified prohibited conduct closely tied to the register and authorisation mechanics (rr 4-8), which produces documentary evidence for compliance or breach.
• The requirement that register entries be made by an authorised person and dated (r 5(2)) and that access, copying and destruction be logged with prescribed content (rr 6-8) creates an evidentiary trail that an enforcing agency could use to prove unauthorised access or destruction occurred, or to demonstrate a records authority properly authorised the conduct.

Administrative accountability and reporting

• Regulation 13 imposes an explicit reporting obligation on chief officers of investigating agencies to include a particular statistic in reports to the Minister (number of times police officers used surveillance devices during undercover operations not authorised under the Criminal Investigation (Covert Operations) Act 2009). That creates a recurring administrative disclosure requirement that can be used for oversight and scrutiny.

Discretionary authorisations as a regulatory control point

• The records authority’s power to authorise removal, copying or destruction (r 4(2), r 8(1)) is itself an enforcement lever. Properly structured internal authorisation processes, audit trails and manager sign‑offs are necessary to demonstrate that any otherwise proscribed conduct was authorised. Conversely, the absence of a contemporaneous authorisation entry will make it difficult for a person to avail themselves of lawful excuse.

Limitations and gaps in the regulations

• The regulations do not prescribe sanctions other than the monetary penalty in r 9. They do not specify whether breaches attract administrative disciplinary measures, whether some breaches might amount to offences under other statutes (for example, privacy offences under other Acts), or whether internal disciplinary regimes apply; such matters sit outside the text of the regulations.
• The regulations do not set out the investigative process for alleged breaches of register obligations. The Act and general administrative or criminal statutes will provide the procedural enforcement framework, not the regulations themselves.

Implementation risk and evidentiary structure

• The regulations create an evidentiary framework conducive to enforcement because they specify the content and form of records and register entries. That increases the likelihood that breaches are detectable: unauthorised access or destruction will often be evidenced by missing or inconsistent register entries, by the absence of unique identifiers on copies, or by missing destruction entries (r 8(2)).
• Conversely, gaps in administrative practice (for example, failure to date entries as required by r 5(2)) may undermine a records authority’s ability to demonstrate compliance or to establish that a particular action was authorised.

Who enforces and who pays

• Enforcement costs , investigation, audit, training, maintenance of secure storage and registers , fall primarily on the records authorities (Commissioner of Police, Independent Commissioner, CEO of ACC) and the organisations that employ device‑using officers or licensed agents.
• Individuals who perform unauthorised acts in relation to records face the legal risk of a maximum $5,000 penalty, and their employing body may face reputational and operational costs arising from an incident.

In short, the regulations impose a focused statutory offence tied to administrative traceability; they create reporting obligations and vest decision-making discretion with records authorities, but they leave the broader enforcement procedures and potential cross‑statutory liabilities to other laws and internal governance frameworks.

The regulations explicitly reference and interlock with a series of other statutes, and they qualify the interaction between the Surveillance Devices Act 2016 (the Act) and other administrative and statutory regimes in specific ways.

Declared corresponding laws (r 10)

• For the Act’s definition of "corresponding law" (s 3(1) of the Act), regulation 10 declares specific surveillance laws in other Australian jurisdictions to correspond to the Act: Australian Capital Territory, Commonwealth, New South Wales, Northern Territory, Queensland (via Police Powers and Responsibilities Act 2000), Tasmania, Victoria, and Western Australia. The practical effect is to facilitate cooperation, recognition or other cross‑jurisdictional mechanisms in the Act that depend on the concept of "corresponding law" (the Act itself sets out how corresponding laws are used; the regulations supply the list).

Interaction with Motor Vehicles Act 1959 (r 10A)

• Regulation 10A prescribes circumstances tied to recording tests and practical driving examinations under the Motor Vehicles Act 1959 in specified sections (s 80, s 98A(5), s 98A). It expressly conditions the installation/use/maintenance of listening or optical devices by persons recording tests or driver training activities on compliance with any directions of the Registrar of Motor Vehicles regarding audio visual recordings. That creates an operational intersection: devices used in the motor vehicles testing context must also be consistent with Registrar directions under the Motor Vehicles Act 1959.

Interaction with other specific Acts via r 10A(3) and (4)

• Regulation 10A(3) lists Acts considered relevant for the purposes of officers enforcing gambling, liquor and related laws (Associations Incorporation Act 1985; Authorised Betting Operations Act 2000; Casino Act 1997; Gambling Administration Act 2019; Gaming Machines Act 1992; Liquor Licensing Act 1997; Lotteries Act 2019).
• Regulation 10A(4) lists Acts relevant for SafeWork SA inspectors (Employment Agents Registration Act 1993; Explosives Act 1936; Fair Work Act 1994; Long Service Leave Act 1987; Work Health and Safety Act 2012).
• These cross‑references mean that the surveillance-device exemptions for those officers are conditional on the broader statutory powers they exercise under those Acts.

Interaction with the Criminal Investigation (Covert Operations) Act 2009 (r 13)

• Regulation 13 requires the chief officer of an investigating agency to report to the Minister the number of occasions police officers used a surveillance device during undercover operations "other than those authorised under the Criminal Investigation (Covert Operations) Act 2009." This creates an explicit reporting link between surveillance device use under the Act and covert operations authorised under the Criminal Investigation (Covert Operations) Act 2009, distinguishing between two different legal authorisations for undercover or covert activity.

Interaction with Commonwealth intelligence legislation and powers (r 11A)

• Regulation 11A prescribes that installation/use/maintenance of a data surveillance device by or on behalf of ASIO, ASIS or ASD is within the Act’s data surveillance device exemption (s 8(2)(b) of the Act). This explicitly links the SA regime to Commonwealth intelligence agencies, recognising a carve‑out where Commonwealth functions are being performed.

Privacy and de‑identification obligations (r 11)

• R 11 authorises the Minister responsible for the Highways Act 1926 to install tracking devices to measure transport system performance and requires that information obtained "must be de‑identified so that the information is no longer about an identifiable person, vehicle or thing" (r 11(1)(b)). The regulation therefore interacts with privacy expectations and potentially with state or Commonwealth privacy laws by mandating de‑identification as a condition of lawful tracking for transport performance measurement.

Delegation and the Independent Commissioner Against Corruption (r 14; Sch 2)

• R 14 prescribes which classes of officers at the Independent Commissioner Against Corruption are "senior officers" for the purpose of delegation under s 35(3) of the Act. Schedule 2 preserves the application of the Act as it stood before the Independent Commissioner Against Corruption (CPIPC Recommendations) Amendment Act 2021 for continuing complaints or investigations referred to in that Amendment Act’s schedule. These provisions show the regulations are designed to sit alongside, and accommodate, amendments to the ICAC statutory framework.

Transitional continuity with revoked regulations (Sch 1)

• Schedule 1 revokes the Listening and Surveillance Devices Regulations 2003 but carries forward the records book maintained under the revoked regulations as part of the new records register, and treats existing authorisations under specific revoked regulation provisions as authorisations under the new regulations (Sch 1(2)-(5)). This avoids a regulatory gap on commencement.

Practical cross‑statutory constraints and multiplicity of obligations

• The regulations frequently condition permitted device use on directions or other requirements in the referenced Acts (for example, Registrar directions for motor vehicle testing in r 10A(1)(e)). That means an officer or private person acting under a regulation‑based exemption must ensure compliance with overlapping obligations: the conditions in the regulations and the substantive duties/directions in the other Acts.

In sum, the regulations are not self‑contained: they embed the SA surveillance device regime within a web of state and Commonwealth statutes and administrative instruments. Operational compliance will typically require attention to the Act, the regulations and the other listed Acts and directions (for example, Registrar directions or authorisations under covert operations legislation).

The legislative history section in the regulations documents the instrument’s origins, subsequent variations and revocations. The history shows staged additions and clarifications consistent with evolving operational needs and interlocking statutory changes.

Inception and commencement

• Surveillance Devices Regulations 2017 were made and cited as the Surveillance Devices Regulations 2017 (r 1). The instrument revoked the Listening and Surveillance Devices Regulations 2003 (Sch 1(1)). The principal regulations and variations list shows the initial Gazette entry: 2017 No 328, Gazette 12.12.2017 p4984, with commencement on 18.12.2017.

Notable variations and insertions

• 2020: Regulation 10A was inserted by 264/2020 r 4. The variation commenced on 10.9.2020. Regulation 10A prescribes the circumstances referenced in sections 4(2)(h) and 5(4)(f) of the Act and introduces the operational conditions for enforcement officers and inspectors (wearing the device, not concealing it, advising persons being recorded), and lists the relevant Acts for CBS authorised officers and SafeWork SA inspectors (r 10A(3)-(5)).
• 2021: Regulation 10 was varied by 59/2021 r 4(1), (2) with effect from 27.5.2021 (this was a variation to the list of corresponding laws).
• 2021 (again): Schedule 2 was inserted by 152/2021 r 4 and commenced 7.10.2021. Schedule 2 contains savings and transitional provisions relating to the Independent Commissioner Against Corruption (CPIPC Recommendations) Amendment Act 2021.
• 2024: Regulation 10A(1) was amended by 43/2024 r 3(1) and r 10A(3)-(5) were inserted by 43/2024 r 3(2); this took effect 6.6.2024. Those amendments expanded or clarified the classes of officers and the list of relevant Acts referenced in r 10A.
• 2026: Regulation 11A (data surveillance devices exemption for ASIO, ASIS, ASD) was inserted by 1/2026 r 3, commencing 15.1.2026. This adds an explicit Commonwealth intelligence agency carve‑out to the regulations.

Transitional and revocation provisions

• Schedule 1 effect: the Listening and Surveillance Devices Regulations 2003 were revoked immediately on commencement (Sch 1(1)). Sch 1(2)-(5) provide for transitional treatment of existing records books and authorisations under the revoked regulations to be taken as part of the new records register and authorisations under the new regulations.

Legislative notes and revision

• The notes appended to the legislative history warn that cross‑references to other instruments may not be automatically updated and that earlier versions are listed. The record of principal regulations and variations lists Gazette entries for the principal regulations and subsequent amendments (2017, 2020, 2021, 2024, 2026), and identifies specific provisions varied, inserted or omitted.

Practical implications of amendment chronology

• The insertion of r 10A in 2020 and its amendment in 2024 shows a regulatory focus on specifying which enforcement officers may wear devices and under what conditions. The 2026 insertion of r 11A codifies the data surveillance device exemption for Commonwealth intelligence agencies. Schedule 2 (2021) addresses transitional application of the prior Act to continuing matters arising from an ICAC amendment. These amendments indicate iterative adjustment to operational boundaries and inter‑statutory relations.

For practitioners, the amendment history is relevant for two reasons:

1. Transitional questions: Schedule 1 and 2 create transitional arrangements that preserve prior authorisations and records. When advising on historical records or authorisations that predate a variation, one must check which version of the regulations applied at the time and whether transitional clauses carry them into the current regime (Sch 1(2)-(5); Sch 2 cl 1).
2. Current compliance: The 2024 and 2026 insertions materially affected who can rely on device exemptions and under what conditions (r 10A, r 11A). Advice or internal policies must reference the current text as amended in 2024 and 2026.

The legislative history in the instrument is explicit as to what changed and when; it does not, however, provide a legislative memorandum or explanatory material within the text. For operational or historical disputes, practitioners should check the specific Gazette commencements listed for the exact dates on which provisions took effect.

The regulations as provided do not list any judicial decisions, appeals, or administrative determinations interpreting their provisions. There is no litigation history recorded in the text. That absence has two immediate practical consequences.

First, legal interpretation of ambiguous or novel aspects will depend on general statutory interpretation principles and any relevant decisions under the parent Act or other interlocking legislation, rather than on precedent specifically construing these regulations. The regulations frequently implement delegated administrative detail (for example, the specific register fields in Part 2), and courts have not (per the source text) been recorded as having given guidance on fine‑grained interpretive disputes arising under these regulations.

Second, there are identifiable factual and legal issues that are likely to give rise to disputes and potential litigation or review, even though the instrument itself does not record any such proceedings. Practitioners should be alert to common categories of dispute that these regulations create the factual basis for:

• Authorisation and scope of destruction (r 8): Disputes may arise over whether a records authority properly concluded a record was "no longer required for the purposes of a relevant action or proceeding or relevant investigation or otherwise required by law" (r 8(1)(a)), and whether the record "should be destroyed" (r 8(1)(b)). Those satisfaction requirements are discretionary and may be susceptible to administrative law review if, for example, there is evidence of bad faith, failure to consider relevant considerations, or breach of procedural fairness in contexts where a denial of access to records affects a party's rights.

• Definition of record and automated alerts carve‑out (r 3): The regulations explicitly exclude "a notification or alert automatically generated by the surveillance device" from the definition of record. Disputes could arise about whether particular material alleged to be a "notification or alert" is in fact a record, and whether exclusion from the definition affects obligations under the Act or other statutes.

• De‑identification standard for tracking data (r 11): R 11(1)(b) requires information obtained from tracking devices to be "de‑identified so that the information is no longer about an identifiable person, vehicle or thing." Litigation could engage both the factual question of whether data has been de‑identified and legal standards for de‑identification (for example, the foreseeability of re‑identification), particularly where data are later re‑identified or re‑used in a manner that affects privacy or legal rights.

• Notification obligations under r 10A: The requirement that an officer "advises any person that they are intentionally recording" may be contested in operational scenarios where an alleged notice was given but not documented, or where the scope of "any person" and what constitutes effective notice is disputed.

• Communications by licensed investigation agents (r 12): Disputes may turn on whether a communication was "reasonable" (r 12(2)(c)), whether a recipient was within the prescribed classes (r 12(1)), or whether communication exceeded prescribed boundaries and therefore contravenes the Act.

• Register integrity and r 9 offences: Prosecutions or disciplinary actions for unauthorised tampering with registers will require proof of unauthorised conduct and interpretation of what constitutes proper authorisation by the records authority. Registers themselves will be central evidence in any enforcement or review proceedings.

Absent an internal repository of judicial decisions in the provided text, practitioners must anticipate that disputes will arise in the ordinary course and that the regulations are written to generate a documentary basis for litigation or review. To mitigate legal risk, records authorities should ensure contemporaneous authorisations and register entries, retain copies with unique identifiers and maintain robust destruction logs.

If a particular matter progresses to litigation, the resolution will depend on general statutory interpretation and administrative law principles applied to the regulation’s text and to any relevant facts. Because this instrument does not contain caselaw, specialised briefing and factual record building will be required in any contested matter.

The regulations are detailed but contain specific drafting features and operational traps that practitioners and administrators should note. The following are concrete, source‑grounded "gotchas" that can create compliance exposures or practical difficulties.

1. Narrow definition of "record" excludes automated alerts

• The definition of "record" explicitly excludes "a notification or alert automatically generated by the surveillance device" (r 3). That means such automated alerts fall outside the Part 2 register and destruction regime unless they are transformed into a record in another way. Organisations should not assume every output of a device is a regulated record; automated alerts are excluded unless captured as material or information derivative of a warrant/authority use (r 3). Failure to recognise this boundary may lead to inconsistent treatment of device outputs.

2. Copies become records and require their own unique identifiers

• When a copy is made of a record, the copy itself "becomes a record" and must be assigned its own unique identifier and logged with who made it, the type and dates (r 7(1)-(2)). Operationally, a failure to treat copies as distinct records will breach the regulations. This creates a multiplicative administrative burden where multiple copies proliferate: each must be separately identified and logged.

3. All register entries must be made by an authorised person and dated

• R 5(2) requires that entries be made by a person authorised by the records authority for that purpose and that the date of each entry be noted. If front‑line staff add entries without clear authorisation or fail to date entries, questions will arise as to the validity of authorisation and completeness of the audit trail. Registers therefore require an internal authorisation list and staff training.

4. Removal from storage may only be authorised for limited purposes

• R 4(2) limits authorised removal from storage to providing access, making a copy, or destroying the record. Removing a record for other operational reasons without fresh authorisation risks offending r 9. Records authorities should ensure written procedures authorising any removal and avoiding ad hoc transfers of media.

5. Destruction threshold is fact‑sensitive and must be documented

• R 8(1) authorises destruction only where the records authority is satisfied the record is no longer required for relevant actions, investigations, or is otherwise not required by law, and that it "should be destroyed." The double satisfactions (no longer required and should be destroyed) are subjective. The regulation requires detailed logging of reason, date/time, method and the identity of the person who destroyed the record (r 8(2)). In practice, poor documentation of the satisfaction process will make destruction decisions vulnerable to challenge and potentially to discovery obligations in litigation.

6. Notification requirement for certain device uses is broad

• R 10A imposes an explicit duty on officers (for example, Department for Infrastructure and Transport officers, CBS authorised officers, SafeWork SA inspectors) to advise "any person that they are intentionally recording by the use of the device that they are wearing the device and that it is being so used" (r 10A(1)(a)(iii), (f)(iii), (g)(iii)). "Any person" is broad: it could require advising members of the public, employees, or bystanders. In fast‑moving enforcement contexts, providing that notice to "any person" can be operationally challenging and may create legal ambiguity about sufficiency and timing of notice.

7. De‑identification requirement for tracking data is categorical

• R 11 requires that information obtained from tracking devices used by the Minister responsible for the Highways Act 1926 "must be de‑identified so that the information is no longer about an identifiable person, vehicle or thing" (r 11(1)(b)). The regulation does not describe a de‑identification technique or standard; it simply imposes an outcome. This creates ambiguity about what level of de‑identification satisfies the regulation, and potential disputes if re‑identification occurs downstream.

8. The prescribed exemptions are conditional and subject to other instruments

• R 10A(1)(e) allows instructors and authorised examiners to record driver training and practical tests "provided that the device is not installed, used or maintained contrary to any directions of the Registrar of Motor Vehicles." That means a device use that otherwise meets the regulation can nonetheless be unlawful if Registrar directions forbid it. Practitioners must check subsidiary instruments and administrative directions in addition to the regulations.

9. The communications exemption for licensed investigation agents is limited

• R 12 allows communication to a narrowly defined set of classes and catch‑all "reasonable communication" for assistance with an investigation. The "reasonable communication" standard is fact‑sensitive and unstructured in the text and could be a point of contention if agents share material beyond what clients or investigators expect.

10. Records authority identification is rigid

• The definition of "records authority" (r 3) assigns authority to specific officeholders (Commissioner of Police; Independent Commissioner Against Corruption; CEO of ACC). If records are created by other agencies or cross‑agency operations, clarity is needed on which authority controls the register , particularly in joint operations. The regulations do not provide a cross‑agency conflict resolution mechanism.

11. Transitional continuity can mask legacy compliance issues

• Schedule 1 carries forward records books and authorisations from the revoked regulations into the new register (Sch 1(2)-(5)). That preserves prior authorisations but also preserves any legacy gaps in the way earlier registers were kept. Organisations relying on carried‑forward authorisations should audit the legacy record books for conformity with the new required entries and unique identifiers.

12. Monetary penalty may be modest relative to other liabilities

• The maximum penalty in r 9 is $5,000. In contexts where privacy breaches, re‑identification or data misuse occur, other statutory or civil liabilities (under privacy law, tort, or the Act itself) may result in higher exposures. The presence of a specific $5,000 penalty does not preclude other enforcement or civil consequences.

These "gotchas" are operational realities embedded in the text of the regulations. Practical compliance requires not only drafting register templates and authorisation forms but also training enforcement officers about notification duties, establishing substantive de‑identification policies for tracking data, and reconciling the regulations with related directives and statutory instruments.

The regulations set a procedural architecture that requires both organisational systems and individual behavioural controls. Below is a practical compliance checklist mapped to the regulations’ requirements and wording, suitable for records authorities, investigating agencies, enforcement units and licensed investigation agents.

1. Establish a records authority and delegation list (r 3; r 14)

• Confirm who is the records authority for each category of records: Commissioner of Police, Independent Commissioner Against Corruption, Chief Executive Officer of the ACC (r 3).
• For the Independent Commissioner, ensure the classes of senior officers for delegation reflect r 14: Deputy Commissioner and examiners appointed under the ICAC Act 2012.

2. Secure storage and access protocol (r 4)

• Implement secure physical and digital storage systems that prevent unauthorised access. The records authority must ensure this at all times except while records are being used for authorised purposes (r 4(1)).
• Define formal authorisation procedures for removal from storage limited to the permitted purposes: providing access, making a copy, destroying the record (r 4(2)). Maintain written authorisations or an electronic approval trail for each removal.

3. Implement a records register and unique identifier system (r 5)

• Create a records register template capturing at minimum:
  • Unique identifier for each record (r 5(3)-(4)(a));
  • Type of record (r 5(4)(b)) with examples such as audio visual recording, audio record, transcript (r 5(4) Example);
  • Date first stored (r 5(4)(c));
  • Authorised person making entry and date (r 5(2)).
• Define a unique identifier schema (letters/numbers/combination) that is robust and prevents collisions across storage systems (r 5(3)).

4. Access logging (r 6)

• For every authorised access, log:
  • Name of the person accessing (and if a police officer, rank and station) (r 6(a));
  • Contact details for the person (r 6(b));
  • Reason for access (r 6(c));
  • Date(s) or period of access (r 6(d)).
• Require request and approval forms for access, and reconcile those forms with register entries.

5. Copy control (r 7)

• Treat every copy as a record: assign a unique identifier to each copy (r 7(1)); log who made the copy (including rank/station if a police officer), the copy’s unique identifier, type of the record the copy is, date copy was made and date it was first stored (r 7(2)(a)-(d)).
• Control proliferation of copies through permission workflows. Keep an inventory of copy locations and media types.

6. Destruction policy and audit trail (r 8)

• Adopt a destruction policy that operationalises r 8(1) criteria: before destruction, the records authority must be satisfied the record is no longer required for relevant proceedings or investigations or otherwise required by law, and that it should be destroyed.
• For each destruction, log reason, date/time, method of destruction and the person carrying it out (r 8(2)(a)-(d)). Retain a destruction certificate or similar signed evidence.

7. Prevent unauthorised acts and train staff (r 9)

• Train staff on the prohibitions in r 9 and the $5,000 maximum penalty for unauthorised entries, removals, access, copying or destruction.
• Implement role-based access controls and technical audit logs to detect unauthorised activity. Require written authorisation from the records authority for any action that would otherwise contravene r 9.

8. Operational procedures for device use under prescribed circumstances (r 10A, r 11, r 11A)

• For officers permitted to wear devices under r 10A:
  • Ensure devices are worn and not concealed while in use (r 10A(1)(a)(i)-(ii), (f)(i)-(ii), (g)(i)-(ii)).
  • Implement a standardised script or notice protocol to advise "any person that they are intentionally recording … that they are wearing the device and that it is being so used" (r 10A(1)(a)(iii), (f)(iii), (g)(iii)). Keep logs or body‑cam footage metadata showing the notice was given.
  • Confirm that use of devices is consistent with any relevant Act over which the Department, CBS or SafeWork SA inspectors have enforcement responsibility (r 10A(2)-(4)).
• For tracking devices under r 11:
  • Implement de‑identification processes that ensure information captured is no longer about an identifiable person, vehicle or thing (r 11(1)(b)). Maintain written technical specifications and attestations for de‑identification methods and periodic testing to demonstrate compliance.
• For data surveillance device exemptions (r 11A):
  • Recognise that ASIO, ASIS and ASD are prescribed bodies; in any joint operations or data exchanges with State bodies, document the legal basis for the data surveillance device exemption under the Act.

9. Licensed investigation agents: communication controls (r 12)

• Create guidance for licensed investigation agents on permissible communications per r 12(1)-(2): only to clients, employers, legal representatives, medical practitioners, other licensed agents engaged by the same client/employer for briefing, officers of investigating agencies for relevant investigations/ actions/ proceedings, and reasonable communications to assist investigations.
• Require agents to record the recipient, reason and context in a communication log tied to the records register.

10. Reporting and ministerial returns (r 13)

• Chief officers of investigating agencies must track and report the number of occasions during the reporting period when police officers used surveillance devices in undercover operations other than those authorised under the Criminal Investigation (Covert Operations) Act 2009 (r 13). Ensure the relevant data collection and internal sign‑off for ministerial reports under s 30(1)(c).

11. Audit, retention and legacy records (Sch 1)

• For records books carried forward from the revoked regulations, reconcile historical entries with the new register format and assign unique identifiers to legacy records where necessary (Sch 1(2)).
• Maintain version control and archive prior registers in line with Schedule 1 transitional provisions.

12. Policies, oversight and documentation

• Draft and publish internal policies covering:
  • Who may authorise register entries, access, copying and destruction;
  • How unique identifiers are generated and mapped to physical/digital media;
  • How notices to persons being recorded are to be delivered and documented;
  • De‑identification technical standards for tracking datasets;
  • Rules for sharing with Commonwealth agencies (r 11A) and for cross‑agency operations.
• Conduct regular audits of register integrity and sample checks of destruction logs to detect irregularities.

13. Legal liaison and record retention for litigation risk

• Because destruction decisions are fact‑sensitive and because register completeness is essential to defend allegations of unauthorised access, set up legal hold procedures when litigation, complaint or investigation is reasonably anticipated. Stop destruction and preserve records in full until legal clearance.

14. Training and technical controls

• Implement role‑based IT access controls, tamper‑evident logging, and retention schedules aligned to the register fields.
• Provide training programmes for enforcement officers and licensed investigation agents on notice obligations, device wear/non‑concealment requirements and the limited scope of permitted communications.

15. Periodic review and change management

• Review policies after any legislative changes (note the amendment history entries for 2020, 2021, 2024 and 2026) to ensure continuing compliance with the current version of the regulations. Keep implementation checklists updated to reflect r 10A and r 11A insertions.

This checklist maps directly to the regulations’ text: secure storage and authorisations (r 4), register maintenance and unique identifiers (r 5-7), destruction standards (r 8), penalties for unauthorised acts (r 9), prescribed circumstances for device use (r 10A, r 11, r 11A), communications restrictions for licensed agents (r 12), reporting (r 13), and delegation classes (r 14). Implementation requires administrative systems, technical controls, legal hold capability and staff training to ensure the documentary trail the regulations demand is created and maintained.