The regulation directly affects several categories of persons and entities. The most immediate impact is on compellable persons under Schedule 2 who may be served with an order under s 58(1) of the Act to produce specified offender information. These 30 categories include government agencies and officials (DPP, Corrective Services, Police, Crime Commission, Parole Authority, department secretaries, health agencies, Youth Justice, Children’s Guardian, transport and education departments), private entities (financial institutions, carriage service providers, internet service providers, private health facility licensees, public hospitals), and individuals (associates, family members, medical practitioners, employers, relevant officials of educational institutions, religious institutions, clubs and associations). For a private individual such as a family member or former employer, being served with an information order means a legal obligation to produce documents they may hold, such as letters, emails, financial records, or employment records. Failure to comply could attract penalties under the parent Act (not specified in the regulation itself, but likely contempt or an offence).

Eligible offenders are the subjects of the information gathering and risk assessment process. Their personal information (medical, psychological, financial, educational, employment, religious beliefs, social media activity, correspondence) can be compelled from third parties without their consent. While the offender is not directly compelled to provide information themselves, the regulation facilitates an extensive data collection about them from a wide network of contacts and institutions.

Terrorism intelligence authorities (s 6) are empowered to share intelligence information with the Attorney General and the court, presumably under existing statutory gates. The regulation does not itself grant new powers; it merely designates them for the purposes of the Act’s intelligence handling provisions.

Relevant experts (s 7) are those who may be appointed to assess risk. The regulation broadens the pool beyond clinical psychologists to include experts in terrorist group dynamics and those trained in specific risk assessment tools like VERA 2R. This could include academics, former intelligence officers, or security consultants. They face no direct obligations under this regulation but may be engaged as independent experts in proceedings.

Independent third party representatives (s 8) must meet strict qualifications: judicial or quasi judicial experience, understanding of intelligence handling laws, and Commonwealth security clearance if required. This creates a very limited pool of eligible persons, likely retired judges or senior lawyers with security clearances. They must avoid conflicts of interest, which may be challenging if they have previously acted for the state in terrorism cases.

Financial institutions and carriage/internet service providers face compliance burdens. They must search their records for pre existing documents of the prescribed kinds (e.g., telephone usage records, financial transaction records) and produce them on receipt of an order. The cost of searching and retrieving these documents, particularly for small institutions, is borne by the entity. The regulation does not provide for compensation or cost recovery.

Employers and educational institutions may be compelled to produce employment and educational records, including behaviour reports. This could include sensitive disciplinary information or performance reviews.

Associates and family members are uniquely burdened because they are compellable persons and their own correspondence or financial information about the offender may be demanded. This raises privacy concerns and potential for coercion where the associate shares the same household. The only condition that protects non public persons is s 4(1)(c): if the person is not a public authority or public official, the Attorney General must be satisfied that the eligible offender could pose an unacceptable risk of committing a future serious terrorism offence. This is a threshold condition but it is subjective and based on the Attorney General’s satisfaction, not a court finding at the point of service.

The central duty created by the regulation arises under s 4: when the Attorney General is satisfied that a person is a compellable person and that the information is required for use in determining whether to make a declaration or order under the Act, or in proceedings under the Act, the Attorney General may serve an order under s 58(1) of the Act. For non public persons, the Attorney General must also be satisfied that the eligible offender could pose an unacceptable risk of committing a future serious terrorism offence. The regulation does not specify the form of the order, the time limit for compliance, or any right to object. Those matters are presumably in the parent Act or the rules of court, which are not reproduced here.

The duty only extends to pre existing documents (s 5(a)). This means the compellable person is not required to create new reports, summaries, or analyses. They must produce documents that already exist of the kinds listed in Schedule 3. This is an important limitation that reduces the burden compared to a requirement to compile new information. However, the list is broad enough to cover most records an institution or individual is likely to hold about the offender: medical records, school reports, employment files, phone records, bank statements, club membership lists, correspondence, books, internet postings.

The independent third party representative has a duty under s 8(2) to take reasonable steps to avoid any conflicts of interest, real or apparent, in connection with exercising their functions. This is an ongoing duty, not just at appointment. If a conflict arises after appointment, they may need to recuse themselves.

There is no explicit right to refuse to comply with an information order in the regulation. For associates and family members, the only protection is the Attorney General’s precondition in s 4(1)(c), but that is a condition on the Attorney General, not a defence for the recipient. If an order is served that does not meet the conditions, the recipient could presumably challenge it in judicial review proceedings, but the regulation does not create a statutory right of objection.

The regulation does not address how compellable persons are to be served or whether they can apply to vary or set aside an order. The parent Act likely contains such provisions, but they are not included here. Reading the regulation alone, a compellable person has a duty to produce but no clear mechanism to contest the scope or relevance of the order.

The regulation itself does not create penalties. It is a subordinate instrument that prescribes circumstances and definitions for the parent Act. Any penalty for failing to comply with an information order under s 58(1) of the Act would be found in the Terrorism (High Risk Offenders) Act 2017, not in this regulation. The regulation does not refer to any specific penalty provision. Similarly, the enforcement of orders is a matter for the Supreme Court, which has jurisdiction under the parent Act. The only enforcement related provision is s 9 (repeal and savings), which ensures continuity but does not impose sanctions.

However, practitioners should be aware that non compliance with a s 58(1) order could potentially constitute contempt of the Supreme Court if the order was made by the court, or an offence under the parent Act. The regulation simply makes the order possible by prescribing the circumstances. The absence of penalty provisions in the regulation does not mean non compliance carries no consequences; those consequences are in the Act itself.

For independent third party representatives, failure to avoid conflicts of interest (s 8(2)) could lead to removal by the court or potentially make the proceedings vulnerable to challenge. The regulation does not specify a penalty for breach of that duty, but it may be enforceable by the court as an implied condition of appointment.

The regulation explicitly cross references numerous NSW and Commonwealth statutes. The dictionary adopts definitions from the Independent Commission Against Corruption Act 1988 for public authority and public official. The definition of terrorism offence and serious terrorism offence in s 7(2) imports the Commonwealth Crimes Act 1914 definitions, meaning the regulation relies on Commonwealth criminal law for the underlying offences. Relevant experts must know about the VERA 2R tool or other tools developed specifically to assess terrorism offence risk on release into the community, which may be tools developed by Commonwealth or interstate agencies.

The prescribed terrorism intelligence authorities (s 6) include bodies established under NSW legislation (ICAC Act 1988, LECC Act 2016, Crimes (Administration of Sentences) Act 1999) and the NSW Crime Commission (statutory authority under its own Act). This means information sharing between these bodies and the Attorney General is authorised for the purposes of the Terrorism (High Risk Offenders) Act, but other laws may restrict how that information can be used (e.g., secrecy provisions under each agency’s enabling Act). The regulation does not override those restrictions; it merely designates the bodies. The court’s power to appoint an independent third party representative (s 8) relies on the person understanding requirements under both NSW and Commonwealth law about accessing, storing, handling and destroying terrorism intelligence. This includes potentially the National Security Information (Criminal and Civil Proceedings) Act 2004 (Cth) and the NSW Terrorism (High Risk Offenders) Act itself.

The regulation’s repeal of the 2018 regulation (s 9(1)) and the savings provision (s 9(2)) mean that any order, appointment or other action taken under the old regulation continues in effect. This avoids disruption to ongoing proceedings. The note in s 2 reminds that the old regulation would have been repealed automatically on 1 September 2024 by the Subordinate Legislation Act 1989, s 10(2). The new regulation therefore prevents a gap in the regulatory framework.

Financial institutions are defined by reference to the Banking Act 1959 (Cth) and the APRA Act 1998 (Cth). Carriage service providers and internet service providers are defined by reference to the Telecommunications Act 1997 (Cth). This ensures consistency with Commonwealth regulatory categories but means that small providers not falling within those definitions are not compellable under this head (though they may be compellable under other heads, such as a relevant official of a club or association).

Religious institutions are defined by reference to the Marriage Act 1961 (Cth), s 26 (recognised denominations). This may exclude smaller or unregistered religious groups, potentially limiting the compellable scope. However, the definition also includes any body, organisation or office within a recognised denomination, which broadens it to include local congregations or charities.

The regulation was made and commenced on the date of publication on the NSW legislation website (s 2). It repeals and replaces the Terrorism (High Risk Offenders) Regulation 2018, which would have been repealed on 1 September 2024 by operation of the Subordinate Legislation Act 1989, s 10(2). The 2018 regulation had a statutory sunset date, and this 2024 regulation is a routine remake. The savings provision (s 9(2)) ensures that acts, matters or things done under the 2018 regulation continue to have effect under this regulation. There are no other amendments noted in the text; the regulation itself is a new instrument without a history of amendments. Practitioners should check whether the parent Act (Terrorism (High Risk Offenders) Act 2017) has been amended in ways that affect how this regulation operates, but that is not part of this instrument’s amendment history.

The regulation itself has not been the subject of litigation; it is a recently made instrument. However, the parent Act (Terrorism (High Risk Offenders) Act 2017) has been considered by the NSW Court of Appeal and the High Court in cases concerning preventive detention and supervision of terrorist offenders. For example, in State of New South Wales v Kamm [2021] NSWCA 43, the court dealt with the Act’s extended supervision orders and the standard of proof. None of that case law is mentioned in or directly relevant to the regulation, which is purely procedural. The regulation could be challenged in future on grounds such as ultra vires (if the prescribed circumstances exceed what the parent Act allows) or on human rights grounds (e.g., privacy, compulsory production from family members). As of the regulation’s commencement, no such challenges are recorded in the text provided.

Several features of the regulation deserve careful attention. First, the definition of associate in Schedule 1 is very broad: “a person, other than a family member, with whom the offender has, or formerly had, a personal or business relationship.” This could include a former neighbour, a co worker from 20 years ago, a member of an online forum, or a former business partner. There is no requirement that the relationship be current, close, or significant. Similarly, family member includes step parents, step siblings, step children, and former spouses and former de facto partners. That means an ex spouse who has had no contact with the offender for years remains compellable and may be required to hand over correspondence or financial records.

Second, the compellable person list includes “an employer or former employer of the eligible offender” (item 27). This obliges any past employer, regardless of how long ago the employment ended, to search their records and produce pre existing documents about the offender. For small businesses, this compliance burden could be significant, particularly if the employer no longer retains those records and must locate them from archives.

Third, carriage service providers and internet service providers are compellable as separate entities, not just as holders of logs. An ISP could be required to produce records of all data usage and call charges for the offender (Schedule 3, item 6) and also material posted on the internet (item 15). This could include IP address logs, subscriber information, and content of posts if held in pre existing documents.

Fourth, the condition in s 4(1)(c) only applies when the compellable person is not a public authority or public official. If the person is a public official (as defined broadly by the ICAC Act), the Attorney General does not need to be satisfied that the eligible offender poses an unacceptable risk. This means government employees, including police officers, teachers, and health workers, can be compelled to produce information even if the risk threshold is not met. The definition of public official in the ICAC Act is very wide, potentially including any employee of a public authority.

Fifth, the relevant expert definition includes knowledge about the formation and operation of terrorist groups, including ideology, financing and training. This is not limited to academic experts; a former intelligence operative, a journalist who has studied extremist groups, or a community leader could qualify. The absence of a requirement for formal qualifications may increase the pool but also raises questions about consistency of risk assessment.

Sixth, the independent third party representative must satisfy the Supreme Court that they understand the requirements under NSW and Commonwealth law in relation to accessing, storing, handling and destroying terrorism intelligence. This is a subjective assessment by the court; there are no prescribed standards or training requirements. The person must also, if the court requires, have a Commonwealth security clearance at an appropriate level. That gives the court discretion to waive the clearance requirement, which could be contentious in cases involving highly classified intelligence.

Seventh, the savings provision (s 9(2)) is very broad: “An act, matter or thing that, immediately before the repeal of the [2018] regulation, had effect under that regulation continues to have effect under this regulation.” This could include information orders already served, appointments of experts, or designations of intelligence authorities. It means that the 2024 regulation’s definitions and conditions apply retroactively to pre existing acts. If the new regulation had narrowed the scope of compellable persons or information types, the savings provision would preserve the old regime for those pre existing matters.

For a compellable person who receives an order under s 58(1) of the Act, the first step is to verify that the order is valid on its face. The order must be served by or on behalf of the Attorney General. There is no set form prescribed in this regulation, so the order should reference the Act and the regulation. The compellable person should check whether they fall within Schedule 2. If they are a public authority or public official, no further condition applies. If they are a private person (e.g., a family member, associate, employer, medical practitioner), the Attorney General must have been satisfied that the eligible offender could pose an unacceptable risk of a future serious terrorism offence. The order should state that this precondition has been met, though the regulation does not require it to.

The compellable person is only required to produce pre existing documents of a kind specified in Schedule 3. They are not required to create new documents, summaries, or analyses. They should search their records for the types listed: medical reports, custodial records, parole records, compensation applications, criminal history records, telephone/data usage records, club/association membership records, educational records, employment records, information about religious beliefs/ideologies, financial information, behaviour in custody records, letters/correspondence, publications advocating terrorism, internet/social media posts advocating terrorism, and participation in extremist intervention programs. If the document does not fall within one of these categories, the compellable person may argue it is not covered. However, the categories are very broad (e.g., “letters or correspondence of the eligible offender to an associate or family member” covers any letter, regardless of content). In doubt, legal advice should be sought.

The compellable person must produce the documents within the time specified in the order (not specified in the regulation). Failure to comply could lead to enforcement action under the parent Act. The regulation does not provide a mechanism to contest the order, but the recipient could apply to the Supreme Court for judicial review or to vary the order, though that may be costly.

For independent third party representatives appointed under s 59B of the Act, the regulation imposes a duty to avoid conflicts of interest. Before accepting appointment, the person should disclose any existing connection to the offender, the Attorney General, or any law enforcement agency. They should also ensure they have the capacity to maintain the confidentiality and security of terrorism intelligence, including appropriate physical and electronic storage. If a Commonwealth security clearance is required, the person must obtain it before exercising functions. Ongoing compliance includes monitoring for new conflicts and taking reasonable steps to address them.

For terrorism intelligence authorities listed in s 6, no new obligations arise under the regulation itself. They simply fall within the definition. However, when sharing intelligence with the Attorney General, they must ensure compliance with their own secrecy and privacy obligations under their enabling legislation.

For relevant experts, no compliance steps are mandated by the regulation. The definition merely sets out who can be appointed. An expert should be aware of the scope of their knowledge and whether they meet the criteria: knowledge about high risk offender assessment, knowledge about terrorist groups, or training in VERA 2R or a similar tool. If applying for appointment, they should be prepared to demonstrate this knowledge.

For financial institutions, ISPs, and carriage service providers, the compliance burden includes maintaining records of information orders received and ensuring that document production is limited to pre existing documents of the prescribed kinds. They should also consider whether any other legal obligations (e.g., privacy laws, confidentiality obligations to customers) restrict or condition production. The regulation does not override those obligations; it merely makes the person compellable. The recipient may need to seek a court order to resolve conflict between the information order and other legal duties.

In all cases, seeking legal advice before complying with an information order is prudent, particularly for private individuals and small businesses who may not have in house legal resources. The regulation itself provides no safe harbour or immunity from other legal consequences of disclosure.