Part 5Protection of communications

## Part 3—Service provider determinations ### Division 3.1—Preliminary #### 3.1 Purpose of Part This Part specifies the matters that a service provider determination, made under subsection 99(1) of the Act, may relate to. ### Division 3.2—Prepaid mobile carriage services #### 3.2 Prepaid mobile carriage services (1) This regulation applies to the supply of prepaid mobile carriage services. (2) A carriage service is a prepaid mobile carriage service if: (a) the payment (if any) for using the service is made before the service is used; and (b) no service provider or other person gives the customer an account for the service after the customer has used it; and (c) the service is not a fixed‑line carriage service. (3) The ACMA may make a service provider determination that applies to a carriage service provider in relation to the following matters: (a) verifying the identity of a customer who the carriage service provider supplies with the carriage service, including by doing any of the following: (i) obtaining from the customer the minimum amount of information that is reasonably necessary to identify the customer; (ii) using the national Document Verification Service, or a similar service, to check whether a document produced by the customer as evidence of identity is authentic, accurate and up‑to‑date; (iii) finding out what other carriage services (if any) the customer has; (b) obtaining from the customer information about what the customer proposes to use the carriage service for (such as residential, business, government or charitable use); (c) recording and keeping: (i) information that is obtained under paragraph (a), including the type of document produced as evidence of identity, but not including the identifying number of a government document; and (ii) information that is obtained under paragraph (b); and (iii) information that the carriage service provider possesses about the supply of the carriage service to the customer (such as any public number issued in connection with the carriage service and the name of the carriage service provider); (d) destroying information that is recorded under paragraph (c) if the destruction is reasonable, including destruction when the information is no longer required by the carriage service provider; (e) preventing the use of a carriage service if: (i) a customer fails to verify his or her identity, including by giving false or misleading information; or (ii) an authorised law enforcement officer gives the carriage service provider a written request to prevent a person using a carriage service that states that action is necessary for a purpose mentioned in subsection 313(3) or (4) of the Act; (f) advising customers of the effect of the determination. > Note: Examples for subregulation (3) > Note: A determination may be made about any of the following: > Note: (a) the ways in which a customer’s identity may be verified, such as using the national Document Verification Service or a similar service; > Note: (b) the procedures to be followed when verifying a customer’s identity; > Note: (c) the forms of identification that are acceptable; > Note: (d) when a customer’s identity is to be verified; > Note: (e) the information that is to be recorded, such as the customer’s date of birth; > Note: (f) how and when the information is to be recorded; > Note: (g) how long the recorded information is to be kept for. (4) In this regulation: > authorised law enforcement officer means an authorised officer of a criminal law‑enforcement agency within the meaning of the Telecommunications (Interception and Access) Act 1979. > fixed‑line carriage service means: (a) a carriage service that is supplied using a line to premises occupied or used by an end‑user; or (b) a service that facilitates the supply of a carriage service covered by paragraph (a). > identifying number of a government document: (a) means the unique identifying number of a document that is issued by the Commonwealth or a State or Territory (such as a driver licence, Medicare card or passport); but (b) does not include: (i) a receipt number or transaction number (such as a transaction number issued by the national Document Verification Service); or (ii) an Australian Business Number, Australian Company Number or Australian Registered Body Number. ### Division 3.3—Premium services #### 3.12 Service provider determination for premium services (1) The ACA may make a determination setting out rules that apply to service providers in relation to the supply of any of the following services (a premium service): (a) a carriage service or content service using a number with a prefix starting with ‘190’; (b) a carriage service used to supply: (i) a content service; or (ii) another service by way of a voice call (including a call that involves a recorded or synthetic voice); using a number that includes an international access code; (c) another carriage service or content service determined in writing by the Minister for this paragraph. (2) A determination mentioned in paragraph (1)(c) is a disallowable instrument for section 46A of the Acts Interpretation Act 1901. (3) The ACA’s determination may deal with any of the following matters: (a) the terms and conditions on which premium services are offered or supplied; (b) the liability of a customer in respect of the supply of premium services; (c) the limitation of the liability of a customer in respect of the supply of premium services; (d) the obligation of a service provider to notify customers about matters relating to premium services; (e) the advertising of premium services; (f) restrictions on access to premium services, or on access to a particular number used in the supply of premium services supplied using the carriage service provider’s service; (g) the barring of calls to premium services, or of calls to a particular number used in the supply of premium services supplied using the carriage service provider’s service; (h) the establishment of a registration scheme for service providers that are involved in the supply of premium services; (i) the obligations of a carriage service provider in respect of premium services supplied using the carriage service provider’s service; (j) the prohibition or restriction of the imposition or collection of charges relating to the supply of carriage services or other services used in the supply of premium services; (k) the issue of bills or accounts relating to the supply of carriage services or other services used in the supply of premium services; (l) a matter relating to the supply of premium services used to access an Internet service; (m) any other matter that the ACA considers necessary or convenient to: (i) protect the interests of customers and other consumers in relation to the supply of premium services; or (ii) give effect to a matter specified in paragraphs (a) to (l). (4) The ACA’s determination may provide that a requirement in the determination does not apply to a carriage service provider if the carriage service provider establishes: (a) that it did not know that it was contravening the requirement; and (b) that it could not, with reasonable diligence, have ascertained that it was contravening the requirement. ### Division 3.4—Fixed or mobile voice or data carriage services #### 3.13 Fixed or mobile voice or data carriage services (1) This regulation applies to the supply of the following carriage services: (a) a standard telephone service; (b) a public mobile telecommunications service; (c) a carriage service that enables customers to access the internet. (2) The ACMA may make a service provider determination setting out rules that apply to service providers in relation to a customer’s interests as regards the supply of the services. > Note: Examples > Note: 1 Rules about advertising, marketing or promoting services. > Note: 2 Rules about notifying a potential or existing customer about: (a) the types of services that are available; or (b) the terms on which the services are available, including the price of the services. > Note: 3 Rules about enabling a customer to monitor the amount of charges that the customer is accumulating for the services provided. > Note: 4 Rules about disconnecting a customer’s services. > Note: 5 Rules about dealing with a customer’s complaint about services. ### Division 3.5—Telecommunications industry #### 3.14 Information relating to telecommunications industry The ACMA may make a determination that specifies: (a) information in relation to the telecommunications industry that a carriage service provider must publish or distribute; and (b) the way in which the carriage service provider must distribute or publish that information. ## Part 4—Industry codes and industry standards #### 4.1 Industry codes—application of section 115 of the Act (1) The rule in subsection 115(1) of the Act does not apply to an industry code to the extent to which compliance with the code is likely: (a) to have the indirect effect of requiring a telecommunications network or a facility to have particular design features that relate to: (i) interference between telecommunications systems that are operated using the unconditioned local loop service; or (ii) the health and safety of a person operating or working on a telecommunications network or a facility that incorporates, or is used with, the unconditioned local loop service; or (iii) the integrity of a telecommunications network or a facility that incorporates, or is used with, the unconditioned local loop service; or (b) to have the direct or indirect effect of requiring a telecommunications network or a facility to meet performance requirements that relate to: (i) interference between telecommunications systems that are operated using the unconditioned local loop service; or (ii) the health and safety of a person operating or working on a telecommunications network or a facility that incorporates, or is used with, the unconditioned local loop service; or (iii) the integrity of a telecommunications network or a facility that incorporates, or is used with, the unconditioned local loop service. (2) In subregulation (1): > unconditioned local loop service means the service declared by the ACCC, on 4 August 1999 under subsection 152AL(3) of the Trade Practices Act 1974, to be a declared service for the purposes of Part XIC of that Act. > Note: The Trade Practices Act 1974 was renamed as the Competition and Consumer Act 2010 by the Trade Practices Amendment (Australian Consumer Law) Act (No. 2) 2010. #### 4.2 Industry codes and industry standards—next‑generation broadband services and interference between certain services (1) The rule in subsection 115(1) of the Act does not apply to an industry code or an industry standard to the extent to which compliance with the code or standard is likely to have the indirect effect of requiring customer equipment, customer cabling, a telecommunications network or a facility to have particular design features that relate to: (a) interference between telecommunications systems being operated to supply any of the following: (i) next‑generation broadband services; (ii) legacy services; (iii) any other carriage services supplied over twisted pair cables; or (b) the health and safety of a person operating or working on customer equipment, customer cabling, a telecommunications network or a facility that incorporates, or is used with, a next‑generation broadband service; or (c) the integrity of customer equipment, customer cabling, a telecommunications network or a facility that incorporates, or is used with, a next‑generation broadband service. > Note: For paragraph (a), an industry code or industry standard may, for example, have the indirect effect of requiring a facility to have particular design features that relate to interference between telecommunications systems being operated to supply competing next‑generation broadband services that use the same cable bundle. (2) The rule in subsection 115(1) of the Act does not apply to an industry code or an industry standard to the extent to which compliance with the code or standard is likely to have the direct or indirect effect of requiring customer equipment, customer cabling, a telecommunications network or a facility to meet performance requirements that relate to: (a) interference between telecommunications systems being operated to supply any of the following: (i) next‑generation broadband services; (ii) legacy services; (iii) any other carriage services supplied over twisted pair cables; or (b) the health and safety of a person operating or working on customer equipment, customer cabling, a telecommunications network or a facility that incorporates, or is used with, a next‑generation broadband service; or (c) the integrity of customer equipment, customer cabling, a telecommunications network or a facility that incorporates, or is used with, a next‑generation broadband service. > Note: For paragraph (a), an industry code or industry standard may, for example, have the direct or indirect effect of requiring a facility to meet performance requirements that relate to interference between telecommunications systems being operated to supply competing next‑generation broadband services that use the same cable bundle. (3) A legacy service is one of the following services: (a) PSTN (public switched telephone network); (b) ADSL (asymmetric digital subscriber line); (c) ADSL2; (d) ADSL2+; (e) SHDSL (single pair high‑speed digital subscriber line); (f) ISDN (integrated services digital network); (g) another service (other than VDSL (very high‑speed digital subscriber line)) covered by the Communications Alliance Industry Code C559:2012 “Unconditioned Local Loop Service (ULLS) Network Deployment”, as registered by the ACMA on 16 May 2012. (4) A next‑generation broadband service is one of the following services: (a) VDSL; (b) VDSL2; (c) VDSL2 with vectoring; (d) G.fast; (e) a service that uses a successor technology to any other next‑generation broadband service. ## Part 5—Protection of communications ### Division 5.1—Specified circumstances #### 5.1A Disclosure of information to National Relay Service provider (Act s 292(1)) (1) For subsection 292(1) of the Act, the following circumstances apply to a disclosure or use of information or a document: (a) the disclosure must be made by or on behalf of a carrier or carriage service provider; (b) the disclosure must be made to the NRS provider; (c) the information or document must relate the use of the National Relay Service by a person (the third person); (d) the disclosure must be made for a purpose of, or must be connected with, the supply, or proposed supply, of the National Relay Service to the third person by the NRS provider. (2) In this regulation: > National Relay Service has the meaning given by section 94 of the Telecommunications (Consumer Protection and Service Standards) Act 1999. > NRS provider has the meaning given by section 94 of the Telecommunications (Consumer Protection and Service Standards) Act 1999. #### 5.2 Disclosure of information by emergency call persons—research about emergency service numbers (Act s 292(3)) (1) For subsection 292(3) of the Act, the following circumstances apply to a disclosure or use of information or a document: (a) the disclosure must be made by an emergency call person; (b) the disclosure must be made to a person (the researcher) who is engaged by the ACA to conduct research, of a kind specified by the ACA, into the way in which emergency service numbers are dialled or used; (c) the disclosure must be made solely for the purpose of allowing the researcher to conduct the research; (d) the ACA and the researcher must have agreed that: (i) the research for which the researcher is engaged is to be finished not later than 12 months after the researcher starts the research; and (ii) the researcher will not disclose or use any information or document that is disclosed to the researcher except for the purpose of conducting the research. (2) Subregulation (1) does not authorise the disclosure or use of information or a document more than 12 months after the researcher starts the research. > Note: The effect of this regulation is that section 278 of the Act will not prohibit a disclosure or use of information or a document in the circumstances specified in the regulation. #### 5.3 Disclosure of information—assistance to Royal Commission into Building and Construction Industry (Act s 292) (1) For subsection 292(1) of the Act, the following circumstances apply to a disclosure or use of information or a document: (a) the disclosure is made by an eligible person; (b) the disclosure is made to the Royal Commission into the Building and Construction Industry, created by Letters Patent dated 29 August 2001; (c) the disclosure is made solely for the purposes of the Royal Commission. > Note: The effect of this subregulation is that section 276 of the Act will not prohibit a disclosure or use of information or a document in the circumstances specified in the subregulation. (2) For subsection 292(2) of the Act, the following circumstances apply to a disclosure or use of information or a document: (a) the disclosure is made by an eligible number‑database person; (b) the disclosure is made to the Royal Commission into the Building and Construction Industry, created by Letters Patent dated 29 August 2001; (c) the disclosure is made solely for the purposes of the Royal Commission. > Note: The effect of this subregulation is that section 277 of the Act will not prohibit a disclosure or use of information or a document in the circumstances specified in the subregulation. (3) For subsection 292(3) of the Act, the following circumstances apply to a disclosure or use of information or a document: (a) the disclosure is made by an emergency call person; (b) the disclosure is made to the Royal Commission into the Building and Construction Industry, created by Letters Patent dated 29 August 2001; (c) the disclosure is made solely for the purposes of the Royal Commission. > Note: The effect of this subregulation is that section 278 of the Act will not prohibit a disclosure or use of information or a document in the circumstances specified in the subregulation. #### 5.4 Disclosure of information—assistance to Royal Commission into whether there has been any corrupt or criminal conduct by Western Australian police officers (1) For subsection 292(1) of the Act, the following circumstances apply to a disclosure or use of information or a document: (a) the disclosure is made by an eligible person; (b) the disclosure is made to the Royal Commission created under section 5 of the Royal Commissions Act 1968 (WA) by instrument of Commission dated 12 December 2001; (c) the disclosure is made solely for the purposes of the Royal Commission. > Note: The effect of this subregulation is that section 276 of the Act will not prohibit a disclosure or use of information or a document in the circumstances specified in the subregulation. (2) For subsection 292(2) of the Act, the following circumstances apply to a disclosure or use of information or a document: (a) the disclosure is made by an eligible number‑database person; (b) the disclosure is made to the Royal Commission created under section 5 of the Royal Commissions Act 1968 (WA) by instrument of Commission dated 12 December 2001; (c) the disclosure is made solely for the purposes of the Royal Commission. > Note: The effect of this subregulation is that section 277 of the Act will not prohibit a disclosure or use of information or a document in the circumstances specified in the subregulation. (3) For subsection 292(3) of the Act, the following circumstances apply to a disclosure or use of information or a document: (a) the disclosure is made by an emergency call person; (b) the disclosure is made to the Royal Commission created under section 5 of the Royal Commissions Act 1968 (WA) by instrument of Commission dated 12 December 2001; (c) the disclosure is made solely for the purposes of the Royal Commission. > Note: The effect of this subregulation is that section 278 of the Act will not prohibit the disclosure or use of information or a document in the circumstances specified in the subregulation. #### 5.6 Disclosure of information—unlisted mobile number information For the purposes of subsection 292(1) of the Act, the following circumstances apply to a disclosure of information or a document: (a) the disclosure is made by Telstra to an authorised research entity; (b) the information is, or the document consists of, authorised unlisted mobile number information. ### Division 5.2—Research authorisations #### Subdivision 5.2.1—Introduction #### 5.7 Simplified outline of this Division Telstra can only disclose unlisted mobile number information to an authorised research entity (regulation 5.6). An authorised research entity is a person covered by a research authorisation granted by the ACMA under this Division. A research authorisation may cover more than one authorised research entity. Before the research authorisation is granted, the ACMA must be satisfied, among other things, that each research entity sought to be authorised will use the unlisted mobile number information for certain kinds of research. The research authorisation starts on the first day Telstra provides unlisted mobile number information to an authorised research entity and ends at the end of the period specified in the authorisation (which can be no longer than 12 months). An authorised research entity must comply with the conditions set out in Subdivision 5.2.3 and any further conditions specified by the ACMA. Failure to comply with these conditions may lead to the authorised research entity being removed from the authorisation by the ACMA and will be considered by the ACMA if the entity is specified in an application for another research authorisation. A contravention of a condition is an offence (see regulation 5.36). After a research authorisation comes to an end, or if a research entity is removed from an authorisation, an authorised research entity must comply with the requirements of regulations 5.30 and 5.31 in relation to the unlisted mobile number information and research information the entity has received. Failure to comply with this regulation will be considered by the ACMA if the entity is specified in an application for another research authorisation. A contravention of regulation 5.30 or 5.31 is an offence (see regulation 5.36). #### Subdivision 5.2.2—Application for, and grant of, research authorisations #### 5.8 Applying for research authorisations (1) A person may apply to the ACMA for a research authorisation to cover that person and any other persons specified in the application. (2) The applicant for the authorisation, and each other person to be covered by the authorisation, is a research entity. (3) The application must: (a) be in writing; and (b) be in a form approved, in writing, by the ACMA; and (c) specify: (i) each research entity to be covered by the authorisation; and (ii) the kind or kinds of unlisted mobile number information being sought; and (iii) the kind or kinds of research for which the unlisted mobile number information is sought and the reasons why that information is sought; and (d) be accompanied by: (i) the charge (if any) for the application fixed by a determination under section 60 of the Australian Communications and Media Authority Act 2005; and (ii) a completed privacy impact assessment in the form approved, in writing, by the ACMA. #### 5.9 ACMA may request further information (1) The ACMA may, in writing, request a research entity specified in an application for a research authorisation to give it further information within 90 days after the request is made. (2) The request must state the effect of subregulation (3). (3) If the entity does not provide the information within 90 days, the ACMA may treat the application as if it did not specify the entity. #### 5.10 ACMA may consult Before granting a research authorisation, the ACMA may consult any person or body the ACMA considers appropriate. #### 5.11 Research authorisations Grant of research authorisation (1) On an application for a research authorisation in accordance with regulation 5.8, the ACMA must grant the authorisation if the ACMA is reasonably satisfied that: (a) the kind or kinds of research proposed to be covered by the authorisation is permitted research; and (b) each research entity will comply with the conditions of the authorisation (including any additional conditions specified by the ACMA under subregulation 5.12(4)); and (c) regulations 5.30 and 5.31 will be complied with by each research entity if the authorisation ends or the entity is removed from the authorisation. > Note: If the ACMA decides not to grant the authorisation, a research entity, or any other person affected by the decision, may request the ACMA to reconsider its decision (see regulation 5.32). Matters to consider in granting research authorisation (2) In determining whether a research entity will comply with the conditions of the authorisation, the ACMA must have regard to the following: (a) the practices, procedures, processes and systems the entity has in place, or intends to put in place, to comply with the conditions of the authorisation; (b) if the entity has previously been covered by a research authorisation—the extent to which the entity has complied with, or is complying with, the conditions of that authorisation; (c) if the entity has been granted an IPND Scheme authorisation—the extent to which the entity has complied with, or is complying with, the conditions of that authorisation; (d) the extent to which the entity’s collection, use and disclosure of personal information has complied with, or is consistent with, the Privacy Act 1988 (whether or not that Act applies to the entity). (3) In determining whether paragraph (1)(c) is satisfied, if the research entity has previously been covered by a research authorisation, the ACMA must have regard to the extent to which the entity complied with regulation 5.30 or 5.31 after that authorisation ended or the entity was removed from that authorisation. (4) Subregulations (2) and (3) do not limit the matters that the ACMA may have regard to. Deemed refusal to grant research authorisation (5) For the purposes of Subdivision 5.2.6 (review of decisions), if the ACMA does not make a decision on the application under subregulation (1) within the period covered by subregulation (6), the ACMA is taken to have decided not to grant the authorisation. (6) The period covered by this subregulation is the period that ends at the later of: (a) 90 days after receiving the application; or (b) if the ACMA has, within those 90 days, given any research entity a written request for further information under subregulation 5.9(1)—90 days after the end of the period for compliance with the last request made under that subregulation. #### 5.12 Content of research authorisations (1) A research authorisation must be granted in writing. (2) The authorisation must specify the following: (a) each research entity (an authorised research entity) covered by the authorisation; (b) the kind or kinds of permitted research to which the authorisation applies; (c) the kind or kinds of unlisted mobile number information that may be disclosed to an authorised research entity. (3) The authorisation must specify a period that the authorisation is in effect which: (a) starts on the day Telstra first discloses authorised unlisted mobile number information to an authorised research entity covered by the authorisation; and (b) ends no later than 12 months afterwards. (4) The authorisation may specify conditions additional to those specified in Subdivision 5.2.3 to which the authorisation is subject. > Note 1: If the ACMA specifies an additional condition under this subregulation, an authorised research entity, and any other person affected by the decision, may request the ACMA to reconsider its decision (see regulation 5.32). > Note 2: Before granting a research authorisation, the ACMA may consult any person or body about any additional conditions to be specified under subregulation (4) (see regulation 5.10). #### 5.13 Notice relating to research authorisations (1) If the ACMA grants a research authorisation, the ACMA must, as soon as is reasonably practicable, give each authorised research entity, and Telstra, a copy of the authorisation. (2) If: (a) the ACMA grants a research authorisation; and (b) the authorisation specifies an additional condition to which the authorisation is subject; the ACMA must, as soon as is reasonably practicable, give written notice to each authorised research entity stating that the entity, and any other person affected by the decision, may request the ACMA to reconsider the decision under regulation 5.32. (3) As soon as reasonably practicable after the ACMA decides not to grant a research authorisation, the ACMA must give written notice to each research entity specified in the application for the authorisation stating: (a) that the authorisation has not been granted; and (b) the reasons for not granting the authorisation; and (c) that the entity, and any other person affected by the decision, may request the ACMA to reconsider the decision under regulation 5.32. > Note 1: See also section 27A of the Administrative Appeals Tribunal Act 1975. > Note 2: A research entity is taken not to be specified in an application if the entity does not provide the ACMA with further information within 90 days after the ACMA requests that information: see regulation 5.9. #### 5.14 Period of research authorisations A research authorisation has effect during the period specified in the authorisation, subject otherwise to these Regulations. #### Subdivision 5.2.3—Authorisation conditions #### 5.15 Authorisation conditions A research authorisation is subject to: (a) the conditions specified in this Subdivision; and (b) any additional conditions specified by the ACMA under subregulation 5.12(4) or regulation 5.26. #### 5.16 Receipt of authorised unlisted mobile number information (1) If an authorised research entity covered by the authorisation receives authorised unlisted mobile number information from Telstra, the entity must give written notice to the following within 10 business days after receiving the information: (a) the ACMA; (b) each other authorised research entity covered by the authorisation. (2) Subregulation (1) does not apply if the entity has previously received a notice in relation to that information under that subregulation from another authorised research entity covered by the authorisation. #### 5.17 Use and disclosure of authorised unlisted mobile number information (1) An authorised research entity must not make a record of, or use, authorised unlisted mobile number information unless it is for the purposes of authorised research under the authorisation. (2) An authorised research entity must not disclose authorised unlisted mobile number information unless authorised, or required to do so, by or under: (a) subregulation (3) or (4); or (b) any other law that applies to the entity. (3) The entity may disclose, for the purposes of authorised research under the authorisation, authorised unlisted mobile number information to: (a) the entity’s research employees; or (b) any other authorised research entities covered by the authorisation. (4) The entity must disclose authorised unlisted mobile number information to the ACMA if the ACMA requests the information. #### 5.18 Covered by the Privacy Act (1) An authorised research entity must be covered by the Privacy Act while the authorisation covers the entity. > Note: For the meaning of covered by the Privacy Act, see regulation 1.7. (2) Subregulation (1) does not apply if the entity is a registered political party. #### 5.19 Compliance with the Privacy Act (1) If an authorised research entity collects, uses or discloses personal information about an individual for the purposes of authorised research under the authorisation, the entity must not do an act, or engage in a practice, that breaches: (a) an Australian Privacy Principle in relation to personal information about the individual; or (b) a registered APP code that binds the entity in relation to personal information about the individual. (2) Subregulation (1) applies regardless of whether: (a) the entity is a registered political party; or (b) the act or practice of the entity is exempt under section 7C of the Privacy Act 1988 (which provides that certain political acts and practices are exempt). #### 5.20 Contacting persons for authorised research Making contact (1) An authorised research entity may contact a person, using authorised unlisted mobile number information, only by calling the person. > Note: Example: The authorised research entity must not contact the person by text message. (2) If an authorised research entity uses authorised unlisted mobile number information to call a person (the contacted person) for the purposes of authorised research under the authorisation, the entity must, during the call: (a) tell the person: (i) the entity’s name; and (ii) the purpose of the research; and (iii) how the entity obtained the mobile number used to call the person; and (iv) how the entity proposes to use research information relating to the person; and (v) that the use of the number by the entity is authorised by the ACMA for the purposes of the research; and (vi) if asked by the person—how the person can access any personal information about the person held by the entity; and (b) ask the person whether the person gives consent for the use and disclosure of the research information relating to the person in the research; and (c) tell the person that the person may withdraw any consent so given at any time during the call; and (d) give the person any other information that is required by law (for example, under the Privacy Act 1988); and (e) comply with all applicable laws relating to unsolicited contact with another person. > Note: For the purposes of paragraph (e), applicable laws relating to unsolicited contact with another person include the following: (a) the Privacy Act 1988; (b) the Spam Act 2003; (c) the Do Not Call Register Act 2006. Contacted person does not consent to use and disclosure of research information (3) If the contacted person informs the authorised research entity during the call that the person does not consent, or withdraws consent, to the use and disclosure of research information relating to the person, the entity: (a) must not make a record of, use, or disclose any research information the entity has relating to the person; and (b) must not use the authorised unlisted mobile number information relating to the person; and (c) as soon as reasonably practicable: (i) must take all reasonable steps to destroy any research information the entity has relating to the person within 10 business days after the person informs the entity that the person does not consent, or has withdrawn consent; and (ii) must give written notice to any other authorised research entity covered by the same authorisation that authorised unlisted mobile number information relating to the contacted person must not be used. (4) If an authorised research entity is notified that authorised unlisted mobile number information in relation to the contacted person must not be used, the entity must not use the authorised unlisted mobile number information. Internal dispute procedures (5) The entity must have internal dispute resolution procedures enabling it to deal with inquiries or complaints from a contacted person about its use or disclosure of any research information relating to the person. (6) If a contacted person makes a complaint to the entity about the use or disclosure of any research information relating to the person, the entity must: (a) inform the contacted person that if the person is dissatisfied with the way in which the complaint is handled, the person may make a complaint to the ACMA; and (b) give the contacted person information about how to contact the ACMA; and (c) provide reasonable assistance to the ACMA in relation to any such complaint if requested by the ACMA to do so. #### 5.21 Disclosure of research information (1) An authorised research entity must not disclose research information relating to a contacted person unless authorised, or required to do so, by or under: (a) subregulation (2) or (3); or (b) any other law that applies to the entity. > Note: See regulation 5.31 in relation to the recording, use or disclosure of research information after the authorisation ends or the entity is removed from the authorisation. (2) The entity may disclose research information relating to a contacted person to the entity’s research employees. (3) The entity may disclose research information relating to a contacted person if: (a) the information is de‑identified; and (b) the information does not include the person’s public number. (4) This regulation is subject to subregulation 5.20(3). > Note: Subregulation 5.20(3) provides that an authorised research entity must not record, use or disclose research information relating to a contacted person if the person does not consent, or withdraws consent, to the use and disclosure of that information. #### 5.22 Technical system for receiving authorised unlisted mobile number information An authorised research entity must have technical systems to receive authorised unlisted mobile number information in accordance with any technical method specified by Telstra. #### 5.23 Compliance with the Act An authorised research entity must comply with any requirements imposed on the entity by the Act and any legislative instrument made under the Act. #### 5.24 Employees of the authorised research entity An authorised research entity must take all reasonable steps to ensure that each research employee of the entity: (a) is made aware of the conditions of the authorisation (including any additional conditions specified by the ACMA under subregulation 5.12(4) or regulation 5.26); and (b) cooperates with the entity in complying with those conditions; and (c) notifies the entity in writing as soon as reasonably practicable after the research employee becomes aware of an act or omission that would result in a contravention of a condition. #### 5.25 Contravention of authorisation conditions (1) An authorised research entity must give written notice to the ACMA as soon as reasonably practicable after it becomes aware of a contravention of a condition of the authorisation (including any additional condition specified by the ACMA under subregulation 5.12(4) or regulation 5.26) by: (a) the entity; or (b) any other authorised research entity covered by the same authorisation. (2) An authorised research entity must, as soon as reasonably practicable after it becomes aware of a contravention of a condition of the authorisation, take reasonable steps to minimise the effects of the contravention. (3) To avoid doubt, this regulation is a condition of the authorisation. #### Subdivision 5.2.4—Changes to authorisations #### 5.26 Changes made by the ACMA (1) After a research authorisation is granted, the ACMA may, in writing, with effect from a specified date: (a) specify additional conditions to which the authorisation is subject; or (b) vary or revoke any condition other than a condition specified in Subdivision 5.2.3. Consultation (2) Before taking an action under subregulation (1), the ACMA may consult any person or body the ACMA considers appropriate. Notice to the research entity of changes to authorisation (3) As soon as reasonably practicable after the ACMA takes an action under subregulation (1), the ACMA must give written notice to each authorised research entity covered by the authorisation stating: (a) the action taken; and (b) the reasons for taking the action; and (c) that the entity, and any other person affected by the action, may request the ACMA to reconsider the action taken under regulation 5.32 (except if the action is to revoke a condition). > Note: See also section 27A of the Administrative Appeals Tribunal Act 1975. (4) The notice must be given: (a) as soon as reasonably practicable after the action is taken under subregulation (1); and (b) before the action is expressed to take effect. Notice to Telstra of changes to authorisation (5) The ACMA must, as soon as reasonably practicable, give written notice to Telstra of the action taken under subregulation (1). #### Subdivision 5.2.5—Removal of authorised research entities #### 5.27 Effect of removal An authorised research entity stops being covered by a research authorisation if the entity is removed from the authorisation under this Subdivision. #### 5.28 Removal of authorised research entities—contravention of research authorisation (1) The ACMA may, in accordance with this regulation, remove an authorised research entity from a research authorisation if the ACMA is satisfied that a condition of any research authorisation that covers the entity has been contravened. > Note: The entity removed, or any person who is affected by this decision, may request the ACMA to reconsider its decision (see regulation 5.32). Consultation (2) Before removing the entity, the ACMA may consult any person or body the ACMA considers appropriate. Notice to entity of removal (3) Before removing the entity, the ACMA must: (a) give written notice to the entity: (i) stating that the ACMA proposes to remove the entity from the authorisation; and (ii) inviting the entity to make a submission to the ACMA about the removal within a period specified in the notice; and (b) consider any submission received within the specified period. (4) The specified period must not be shorter than 30 days after the notice is given. Notice of removal (5) As soon as reasonably practicable after the ACMA removes the entity, the ACMA must give written notice to the entity stating: (a) that the entity has been removed from the authorisation; and (b) the reasons for the entity’s removal; and (c) that the entity, and any other person affected by the decision, may request the ACMA to reconsider the decision under regulation 5.32. > Note: See also section 27A of the Administrative Appeals Tribunal Act 1975. (6) As soon as reasonably practicable after the ACMA removes the entity, the ACMA must give written notice of the removal to: (a) any other authorised research entity covered by the authorisation; and (b) Telstra. Further application for authorisation after removal (7) If the ACMA removes an authorised research entity from a research authorisation, an application for a further research authorisation covering the entity cannot be made until after the end of the first‑mentioned research authorisation. #### 5.29 Voluntary removal of authorised research entities (1) If an authorised research entity requests the ACMA in writing to remove the entity from a research authorisation, the ACMA may remove the entity from the authorisation. (2) Without limiting the matters the ACMA may have regard to in deciding whether to remove the entity, the ACMA may have regard to whether the entity has received a notice under subregulation 5.28(3) while the authorisation has been in effect. (3) If the ACMA removes the entity, the ACMA must, as soon as reasonably practicable, give written notice of the removal to the following: (a) the entity; (b) any other authorised research entity covered by the authorisation; (c) Telstra. (4) If the ACMA does not remove the entity, the ACMA must, as soon as reasonably practicable, give written notice to the entity stating: (a) that the entity has not been removed from the authorisation; and (b) the reasons for not removing the entity; and (c) that the entity, and any other person affected by the decision, may request the ACMA to reconsider the decision under regulation 5.32. > Note: See also section 27A of the Administrative Appeals Tribunal Act 1975. #### 5.30 No use or disclosure of authorised unlisted mobile number information by former authorised research entities Purpose of this regulation (1) This regulation is made for the purposes of paragraph 5.11(1)(c). > Note: The ACMA must grant a research authorisation if it is satisfied of the matters set out in subregulation 5.11(1). Scope of this regulation (2) This regulation applies if: (a) an authorised research entity (the former authorised research entity) has received authorised unlisted mobile number information under a research authorisation; and (b) the authorisation ends, or the former authorised research entity is removed from the authorisation. Former authorised research entity must not use information (3) The former authorised research entity: (a) must not make a record of, or use, the information; and (b) must not disclose the information unless authorised, or required to do so, by or under: (i) subregulation (4); or (ii) any other law that applies to the former authorised research entity; and (c) must take all reasonable steps to destroy the information within 10 business days after the authorisation ends or the former authorised research entity is removed from the authorisation (as the case requires). Disclosure to the ACMA (4) The former authorised research entity must disclose the information to the ACMA if the ACMA requests the information. #### 5.31 Use or disclosure of research information after end of research authorisation etc. Purpose of this regulation (1) This regulation is made for the purposes of paragraph 5.11(1)(c). > Note: The ACMA must grant a research authorisation if it is satisfied of the matters set out in subregulation 5.11(1). Research authorisation ends etc. (2) If an authorised research entity has research information relating to a contacted person and the authorisation that covers the entity ends, or the entity is removed under regulation 5.29 from the research authorisation covering the entity, the entity must not: (a) make a record of, or use, the information; or (b) disclose the information; unless the information is de‑identified and does not include the person’s public number. Authorised research entity is involuntarily removed from research authorisation (3) If an authorised research entity has research information relating to a contacted person and the entity is removed under regulation 5.28 from the research authorisation covering the entity, the entity: (a) must not make a record of, or use, the information; and (b) must not disclose the information unless authorised, or required to do so, by or under any law that applies to the entity; and (c) must take all reasonable steps to destroy the information within 10 business days after the entity is removed from the authorisation. #### Subdivision 5.2.6—Review of decisions #### 5.32 Decisions that may be subject to reconsideration by the ACMA (1) A person affected by one of the following decisions, who is dissatisfied with the decision, may request the ACMA to reconsider the decision: (a) a decision not to grant a research authorisation (regulation 5.11); (b) a decision to grant a research authorisation subject to additional conditions (subregulation 5.12(4)); (c) a decision to specify an additional condition after a research authorisation has been granted (subregulation 5.26(1)); (d) a decision to vary an additional condition of an authorisation (subregulation 5.26(1)); (e) a decision to remove an authorised research entity from a research authorisation (regulation 5.28); (f) a decision not to remove an authorised research entity from a research authorisation after receiving a request from the entity to be removed (regulation 5.29). (2) The request: (a) must be in writing; and (b) must be in a form approved, in writing, by the ACMA; and (c) must set out the reasons for the request. (3) The request must be made within 28 days after the decision, or within such longer period as the ACMA allows. #### 5.33 Reconsideration by the ACMA (1) Upon receiving a request under regulation 5.32 to reconsider a decision, the ACMA must: (a) reconsider the decision; and (b) affirm, vary or revoke the decision. (2) Before making a decision on the reconsideration of the decision, the ACMA may consult any person or body the ACMA considers appropriate. (3) The ACMA’s decision on the reconsideration of a decision has effect as if it had been made under the provision under which the original decision was made. (4) The ACMA must give written notice to the person making the request of its decision on the reconsideration, including the reasons for the decision. > Note: Section 27A of the Administrative Appeals Tribunal Act 1975 requires the person to be notified of the person’s review rights. #### 5.34 Deadlines for reconsiderations After receiving a request under regulation 5.32 for the reconsideration of a decision, the ACMA is taken to affirm the original decision 90 days after receiving the request if it does not make a decision on the request under subregulation 5.33(1) before then. #### 5.35 Review by the Administrative Appeals Tribunal Applications may be made to the Administrative Appeals Tribunal for review of a decision mentioned in subregulation 5.32(1) if the ACMA has affirmed or varied the decision under regulation 5.33. #### Subdivision 5.2.7—Offences #### 5.36 Offence of contravening a condition etc. (1) An authorised research entity covered by a research authorisation commits an offence of strict liability if: (a) the entity contravenes a condition of the authorisation; and (b) the condition is not regulation 5.19. Penalty: 10 penalty units. (2) An authorised research entity commits an offence of strict liability if: (a) the entity does an act, or engages in a practice, that contravenes regulation 5.19; and (b) either: (i) the entity is a registered political party; or (ii) the act or practice is exempt under section 7C of the Privacy Act 1988 (which provides that certain political acts and practices are exempt). Penalty: 10 penalty units. (3) A former authorised research entity commits an offence of strict liability if the entity contravenes subregulation 5.30(3) or (4). Penalty: 10 penalty units. (4) A person commits an offence of strict liability if the person contravenes subregulation 5.31(2) or (3). Penalty: 10 penalty units. ## Part 6—Technical regulation #### 6.1 Purpose of Part This Part provides a procedure under which a person who is alleged to have committed an offence against a provision mentioned in section 453A of the Act may, as an alternative to having the matter dealt with by a court, dispose of the matter by paying a monetary penalty (an infringement notice penalty) specified in a notice (an infringement notice) served on the person. #### 6.2 Use of infringement notices If there are reasonable grounds for believing that a person has committed an offence against a provision mentioned in section 453A of the Act, an authorised person may issue an infringement notice for that person. #### 6.3 Contents of infringement notice (1) An infringement notice must be signed by the authorised person who issues it and set out the following information: (a) the name of the authorised person who issues it; (b) the nature of the offence, the provision of the Act containing the offence and when and where the offence is alleged to have been committed; (c) a statement to the effect that, if the person on whom the notice is served does not wish the matter to be dealt with by a court, he or she may pay a penalty of the amount mentioned in section 453A of the Act for the alleged offence within 28 days after service of the notice unless the notice is sooner withdrawn; (d) the maximum penalty that a court could impose for the offence; (e) the amount payable as the infringement notice penalty; (f) where and how the infringement notice penalty may be paid; (g) a statement setting out the procedures under these Regulations for the withdrawal of notices and the consequences of the withdrawal of a notice; (h) a statement setting out the procedures under these Regulations for extending the period within which the penalty must be paid; (i) a statement that, if the person pays the penalty within the period mentioned in the notice or any further period allowed under regulation 6.5 or subregulation 6.6(3), or if the notice is withdrawn after the person has paid the penalty: (i) any liability of the person for the alleged offence is regarded as being discharged; and (ii) no further proceedings may be taken for the alleged offence; and (iii) the person is not to be regarded as having been convicted of the alleged offence. (2) An infringement notice may contain any other matters that the ACA considers relevant. #### 6.4 Service of an infringement notice (1) An authorised person may serve an infringement notice on an individual: (a) by giving it to the individual personally; or (b) by leaving it at, or sending it by post to, the residential or business address of the individual that is last known to the authorised person; or (c) by giving it, at the place of residence or business that is last known to the authorised person, to a person who the authorised person reasonably believes: (i) is over the age of 16 years; and (ii) lives or works at the place. (2) An authorised person may serve an infringement notice on a body corporate: (a) by sending it by post to the head office, registered office, principal office or other postal address of the body corporate; or (b) by giving it, at the head office, registered office, principal office or other place of business of the body corporate, to a person who the authorised person reasonably believes is: (i) over the age of 16 years; and (ii) an officer of, or in the service of, the body corporate. (3) An infringement notice may also be served: (a) by another person acting for an authorised person in the manner mentioned in subregulation (1) or (2); or (b) by an authorised person, or by another person acting for an authorised person, by fax to the fax number last known to the person sending the fax as the number at which the person being served receives fax transmissions. (4) In the absence of evidence to the contrary, a fax transmission is taken to have been given to a person when the transmission is sent to the number mentioned in paragraph (3)(b). (5) An infringement notice must be served not later than 10 months after the alleged commission of the offence. #### 6.5 Extension of time to pay (1) On written application by a person within 28 days after service of an infringement notice on the person, an authorised person may grant, if satisfied that in all the circumstances it is reasonable to do so, a further period of up to 14 days for payment of the infringement notice penalty. (2) The authorised person must: (a) grant or refuse a further period; and (b) give the applicant written notice of the decision; and (c) if the decision is a refusal—mention in the notice the reasons for refusal and the period within which the infringement notice penalty must be paid. (3) The time for payment of the infringement notice penalty is: (a) if a further period is granted—before the end of that period; or (b) if the decision is a refusal—before the later of: (i) the end of 7 days after receiving notice of the refusal; or (ii) the end of the 28‑day period; or (c) in either case, if time for payment is extended under subregulation 6.6(3)—the end of the extended time. #### 6.6 Infringement notice may be withdrawn (1) If an infringement notice has been served on a person, an authorised person may at any time before the end of 28 days after the service of the notice, or any further period granted under regulation 6.5 or subregulation (3), by notice in writing served on the person, withdraw the infringement notice. (2) Before the end of 28 days after service of an infringement notice on a person, the person may give the authorised person, in the manner set out in the infringement notice, material that the person believes ought to be taken into account in relation to the alleged offence. (3) If a person gives the authorised person material under subregulation (2), the authorised person must: (a) extend the time for payment of the penalty to any extent necessary for a decision to be made under paragraph (b); and (b) decide whether to withdraw, or refuse to withdraw, the infringement notice; and (c) give the person written notice of the decision; and (d) if the decision is a refusal—mention in the notice the reasons for refusal. (4) If the authorised person decides to refuse to withdraw the infringement notice, notice of that decision must state that: (a) the person will not be prosecuted for the alleged offence if the amount of the infringement notice penalty is paid before the later of: (i) 28 days after service of the infringement notice; or (ii) 7 days after notice of the decision is given to the person; and (b) if that amount is not so paid, the person may be prosecuted for the alleged offence. (5) In making a decision, the authorised person must consider: (a) the material given under subregulation (2), unless the authorised person thinks that the material does not include any grounds for deciding whether or not to withdraw the infringement notice; and (b) the circumstances in which the offence mentioned in the notice is alleged to have been committed; and (c) whether the person has been convicted previously of an offence against the Act; and (d) whether an infringement notice has previously been given to the person for an offence of the same kind as the offence mentioned in the notice; and (e) any other matter the authorised person considers relevant to the decision. > Note: Part VIIC of the Crimes Act 1914 includes provisions that, in certain circumstances, relieve persons from the requirement to disclose spent convictions and require persons aware of such convictions to disregard them. (6) If an infringement notice is withdrawn after a person pays the infringement notice penalty, the authorised person must refund to the person the amount paid. #### 6.7 Payment of penalty if infringement notice not withdrawn If an authorised person refuses to withdraw an infringement notice, the time for payment of the infringement notice penalty is before the later of: (a) 28 days after service of the infringement notice; or (b) 7 days after notice of the decision not to withdraw the infringement notice is given to the person. #### 6.8 Effect of payment of infringement notice penalty If a person who is served with an infringement notice pays the infringement notice penalty in accordance with this Part and the notice is not withdrawn: (a) the person’s liability for the offence is discharged; and (b) no further proceedings may be taken against the person for the offence; and (c) the person is not convicted of the offence. #### 6.9 Payment of penalty by cheque If all or part of the amount of a penalty is paid by cheque, payment is taken not to have been made unless the cheque is honoured upon presentation. #### 6.10 Effect of this Part on institution and prosecution of proceedings (1) Nothing in this Part: (a) requires an infringement notice to be served for an alleged offence; or (b) affects the liability of a person to be prosecuted for an alleged offence if: (i) an infringement notice is not served on the person for the offence; or (ii) an infringement notice is served, and withdrawn; or (c) limits the penalty that may be imposed by a court on a person convicted of an offence; or (d) prevents the issue of more than 1 infringement notice for a person for the same offence. (2) If more than 1 infringement notice is issued for a person for the same offence, regulation 6.8 applies to the person if the person pays the infringement notice penalty for the alleged offence in accordance with any of those notices. #### 6.11 Matter not to be taken into account in determining sentence (1) This regulation applies if a person who is served with an infringement notice: (a) chooses not to pay the infringement notice penalty; and (b) is prosecuted for, and convicted of, the alleged offence mentioned in the infringement notice. (2) In determining the penalty to be imposed, the court must not take into account the fact that the person chose not to pay the infringement notice penalty. #### 6.12 Evidence for hearing (1) At the hearing of a prosecution for an offence mentioned in an infringement notice, each of the following certificates is evidence of the facts stated in the certificate: (a) a certificate signed by an authorised person that states that: (i) the infringement notice was served on the alleged offender; and (ii) the infringement notice penalty was not paid in accordance with this Part; (b) a certificate signed by an authorised person that states that the notice was withdrawn on a day specified in the certificate; (c) a certificate signed by an authorised person that states that: (i) under regulation 6.5, a further period for payment of the infringement notice penalty was or was not refused; and (ii) the infringement notice penalty was not paid in accordance with this Part; (d) a certificate signed by an authorised person that states that: (i) for regulation 6.5, the further time mentioned in the certificate for payment of the infringement notice penalty was or was not granted; and (ii) the infringement notice penalty was not paid in accordance with the infringement penalty notice or within the further time. (2) A certificate that purports to have been signed by an authorised person is taken to have been signed by the authorised person unless the contrary is proved.