National Security Legislation Amendment (Comprehensive Review and Other Measures No. 3) Act 2024

(24 of 2024)

An Act to amend the law relating to national security and intelligence services, and for related purposes

[Assented to 21 May 2024]

The Parliament of Australia enacts:

1   Short title

This Act is the National Security Legislation Amendment (Comprehensive Review and Other Measures No. 3) Act 2024.

2   Commencement

 

(1) Each provision of this Act specified in column 1 of the table commences, or is taken to have commenced, in accordance with column 2 of the table. Any other statement in column 2 has effect according to its terms.

Note: This table relates only to the provisions of this Act as originally enacted. It will not be amended to deal with any later amendments of this Act.

      

(2) Any information in column 3 of the table is not part of this Act. Information may be inserted in this column, or information in it may be edited, in any published version of this Act.

3   Schedules

Legislation that is specified in a Schedule to this Act is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this Act has effect according to its terms.

Schedule 1   Security assessments

Part 1   Prescribed administrative action

Division 1   Decisions relating to parole, firearm licences and security guard licences

Australian Security Intelligence Organisation Act 1979

1   Subsection 35(1) (after paragraph (f) of the definition of prescribed administrative action)

Insert:

; or (g) the exercise of any power, or the performance of any function, in relation to any of the following decisions under a law ofthe Commonwealth, a State or a Territory:

(i) a decision about whether to release a person from prison on parole or on licence;

(ii) a decision otherwise relating to the release of a person on parole or on licence (including a decision in relation to conditions or supervision);

(iii) a decision about whether to revoke a parole order or a licence mentioned in subparagraph (i); or

(h) the exercise of any power, or the performance of any function, in relation to any of the following decisions under a law of a State or Territory:

(i) a decision about whether to issue a firearms licence or a licence to work as a security guard to a person or otherwise relating to the issue of such a licence (including in relation to conditions);

(ii) a decision about whether to revoke a licence mentioned in subparagraph (i).

2   Subsection 39(1)

Omit "subsection (2)", substitute "subsections (2) and (3)".

3   At the end of section 39

Add:

(3) Subsection (1) does not prevent a Commonwealth agency from taking prescribed administrative action within the meaning of paragraph (h) of the definition of prescribed administrative action in subsection 35(1) on the basis of a communication made under subsection 18(3) or 19A(4) to a staff member of the Commonwealth agency.

4   At the end of section 40

Add:

(3) However, subsection (2) does not prevent the communication of information under subsection 18(3) or 19A(4) which the Organisation knows is intended or likely to be used by a State or an authority of a State in considering prescribed administrative action within the meaning of paragraph (h) of the definition of prescribed administrative action in subsection 35(1).

5   Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Division apply in relation to a communication made by the Organisation on or after the commencement of this item.

Division 2   Regulations to prescribe actions as prescribed administrative action

Australian Security Intelligence Organisation Act 1979

6   Subsection 35(1) (after paragraph (h) of the definition of prescribed administrative action)

Insert:

; or (i) subject to subsection 36AA(1), another action prescribed by the regulations for the purposes of this paragraph.

7   After section 35

Insert:

36AA Prescribing actions as prescribed administrative action

(1) Regulations made for the purposes of paragraph (i) of the definition of prescribed administrative action in subsection 35(1) (the relevant regulations ) may prescribe an action if:

(a) the action is likely to affect a person's liberty or livelihood; and

(b) matters relating to security would be a primary consideration in deciding whether to take the action.

(2) The Committee on Intelligence and Security must:

(a) review the relevant regulations as soon as possible after they are made; and

(b) report the Committee's comments and recommendations to each House of the Parliament before the end of the applicable disallowance period for that House.

(3) If the Committee's report on a review of the relevant regulations is tabled in a House of the Parliament:

(a) during the applicable disallowance period for that House; and

(b) on or after the eighth sitting day of the applicable disallowance period;

then Part 2 of Chapter 3 of the Legislation Act 2003 has effect, in relation to the relevant regulations and that House, as if each period of 15 sitting days referred to in that Part were extended in accordance with the following table.

Extension of applicable disallowance period

(4) The applicable disallowance period for a House of the Parliament means the period of 15 sitting days of that House after the relevant regulations, or a copy of the relevant regulations, were laid before that House in accordance with section 38 of the Legislation Act 2003.

8   At the end of section 95

Add:

Note: Regulations made for the purposes of paragraph (i) of the definition of prescribed administrative action in subsection 35(1) are subject to an extended disallowance period (see section 36AA).

Part 2   Security assessments and preliminary communications

Division 1   Decisions under the Foreign Acquisitions and Takeovers Act 1975

Australian Security Intelligence Organisation Act 1979

9   Subsection 35(1) (definition of prescribed administrative action)

Before "means", insert ", subject to subsections (1A) and (2),".

10   Subsection 35(1) (at the end of the note to the definition of prescribed administrative action)

Add "A decision made under the Foreign Acquisitions and Takeovers Act 1975 or the regulations under that Act is also not prescribed administrative action (see subsection (1A)).".

11   After subsection 35(1)

Insert:

(1A) A decision made under the Foreign Acquisitions and Takeovers Act 1975 or the regulations under that Act is not prescribed administrative action.

12   Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Division apply in relation to a communication made by the Organisation on or after the commencement of this item.

Division 2   Clarification of effect of definitions on certain security assessments

Australian Security Intelligence Organisation Act 1979

13   Subsection 36(1)

Before "subsections", insert "section 35 and".

14   At the end of section 36

Add:

(3) This section does not, by implication, affect the interpretation of any other provision of this Part.

Division 3   Preliminary communications to States

Australian Security Intelligence Organisation Act 1979

15   Paragraph 17(1)(ca)

After "security assessments", insert "and make preliminary communications".

16   Paragraph 17(1)(ca)

Omit "paragraph 40(1)(b)", substitute "paragraphs 40(1)(b) and (1A)(a)".

17   Section 40 (heading)

After " Assessments ", insert " and preliminary communications ".

18   After subsection 40(1)

Insert:

(1A) It is also a function of the Organisation to make a preliminary communication, pending the furnishing of a security assessment by the Organisation, to:

(a) a State or an authority of a State; or

(b) a Commonwealth agency for transmission to a State or an authority of a State;

if the Director-General, or a person authorised by the Director-General under subsection (4), is satisfied that the requirements of security make it necessary as a matter of urgency for the State or authority to take the action referred to in subsection (1B).

(1B) For the purposes of subsection (1A), the action is any of the following:

(a) action of a temporary nature to prevent:

(i) access by a person to any information or place access to which is controlled or limited on security grounds; or

(ii) a person from performing an activity in relation to, or involving, a thing (other than information or a place), if the person's ability to perform that activity is controlled or limited on security grounds;

(b) action that is of a temporary nature and of a kind referred to in paragraph (g) or (h) of the definition of prescribed administrative action in subsection 35(1);

(c) action that is of a temporary nature and is of a kind:

(i) referred to in paragraph (i) of the definition of prescribed administrative action in subsection 35(1); and

(ii) prescribed by the regulations for the purposes of this subparagraph.

19   Subsection 40(2)

Omit "shall not", substitute "must not, other than in the form of an assessment or in accordance with subsection (1A)".

20   Paragraphs 40(2)(a) and (b)

Omit "otherwise than in the form of an assessment".

21   At the end of section 40

Add:

(4) The Director-General may, in writing, authorise a person for the purposes of subsection (1A) if the person is an ASIO employee, or an ASIO affiliate, who holds, or is acting in, a position in the Organisation that is equivalent to or higher than a position occupied by an SES employee.

22   Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Division apply in relation to a communication made by the Organisation after the commencement of this item.

Division 4   Temporary actions by Commonwealth agencies

Australian Security Intelligence Organisation Act 1979

23   Subsection 39(1)

Omit "and (3)", substitute ", (3) and (4)".

24   At the end of section 39

Add:

(4) Subsection (1) does not prevent a Commonwealth agency from taking action that is of a temporary nature and is:

(a) of a kind referred to in paragraph (g) or (h) of the definition of prescribed administrative action in subsection 35(1); or

(b) of a kind:

(i) referred to in paragraph (i) of the definition of prescribed administrative action in subsection 35(1); and

(ii) prescribed by the regulations for the purposes of this subparagraph;

if, on the basis of a preliminary communication by the Organisation, the Commonwealth agency is satisfied that the requirements of security make it necessary to take that action as a matter of urgency pending the furnishing of an assessment by the Organisation.

25   Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Division apply in relation to a communication made by the Organisation after the commencement of this item.

Part 3   Delayed security assessments

Australian Security Intelligence Organisation Act 1979

26   Subsection 35(1)

Insert:

delayed security assessment has the meaning given by subsection 41(1).

27   Subsection 36(1)

Omit "section 35", substitute "sections 35, 41 and 42".

28   At the end of Division 2 of Part IV

Add:

41 Notification of delayed security assessment

Notification of delayed security assessment

(1) If a security assessment is not furnished under this Part within 12 months after the Organisation starts to prepare the assessment (the delayed security assessment ), the Director-General must cause the Inspector-General of Intelligence and Security to be notified of the delayed security assessment.

Note: A protocol made under subsection 42(1) must specify when the Organisation is taken to have started to prepare a security assessment, which may be specified differently for different classes of security assessments (see subsections 42(3) and (4)).

(2) The notification must:

(a) be made within the period specified, for the purposes of subparagraph 42(3)(b)(i), in the protocol made under subsection 42(1), as in force from time to time; and

(b) include the information specified in that protocol for the purposes of subparagraph 42(3)(b)(ii); and

(c) comply with any other requirements specified in the protocol for the purposes of paragraph 42(3)(d).

Exceptions to requirement to notify

(3) However, subsection (1) does not apply if:

(a) the Organisation has been notified that the security assessment is no longer required; or

(b) the Organisation initiated the preparation of the security assessment without a request for the assessment being made by another Commonwealth agency, a State or an authority of a State.

Application of this section

(4) This section applies to a security assessment that the Organisation starts to prepare on or after the commencement of this section.

42 Protocol for dealing with delayed security assessments

Requirement to make protocol

(1) The Director-General must make a written protocol for dealing with delayed security assessments.

Note 1: For variation of a protocol, see subsection 33(3) of the Acts Interpretation Act 1901.

Note 2: A protocol made under this subsection may be combined with a protocol made under subsection 82GB(1) (protocol for dealing with delayed security clearance decisions and delayed security clearance suitability assessments).

(2) The Director-General must consult with the Inspector-General of Intelligence and Security before making a protocol under subsection (1).

(3) The protocol:

(a) must specify when the Organisation is taken to have started to prepare a security assessment; and

(b) must specify the following in relation to the notification of a delayed security assessment under section 41:

(i) the period within which the notification must be made;

(ii) the information to be included in the notification; and

(c) must deal with steps to be taken by the Organisation in relation to the delayed security assessment after the notification referred to in paragraph (b) is made; and

(d) may specify other requirements, or deal with any other matters, that:

(i) relate to a delayed security assessment or the notification of the assessment under section 41; and

(ii) the Director-General considers appropriate.

(4) Without limiting subsection (1), the protocol may provide differently for different classes of security assessments.

(5) A protocol made under subsection (1) is not a legislative instrument.

Requirement to comply with protocol

(6) The Organisation must, in relation to a delayed security assessment to which subsection 41(1) applies, comply with a protocol made under subsection (1) of this section, as in force from time to time.

Schedule 2   Protecting identities and information

Part 1   Cover employment

Australian Security Intelligence Organisation Act 1979

1   Subsection 16(1)

Omit "The", substitute "Subject to subsection 92C(8), the".

2   At the end of Part V

Add:

92B Cover employment for ASIO employees and ASIO affiliates

(1) A person who is an ASIO employee or ASIO affiliate, or a former ASIO employee or former ASIO affiliate, may identify an authority of the Commonwealth as that person's employer or place of work, in relation to a period during which the person is or was an ASIO employee or ASIO affiliate, in accordance with a determination made by the Director-General under subsection 92C(1).

(2) Subsection (1) applies despite any other law of the Commonwealth, a State or a Territory (whether passed or made before, on or after the commencement of this section), including such other law that is expressed to apply despite any other law.

92C Cover employment - determining a specified authority of the Commonwealth

Determining specified authority of the Commonwealth

(1) Subject to subsection (5), the Director-General may, in writing, determine one or more specified authorities of the Commonwealth, within the meaning of paragraphs (a), (aa), (b) and (c) of the definition of authority of the Commonwealth in section 4, that may be identified as the employer or place of work of ASIO employees, ASIO affiliates, former ASIO employees or former ASIO affiliates.

Note: For variation and revocation of an instrument, see subsection 33(3) of the Acts Interpretation Act 1901.

(2) Without limiting subsection (1), a determination under that subsection may do either or both of the following:

(a) determine a specified authority of the Commonwealth in relation to a specified class of ASIO employees, ASIO affiliates, former ASIO employees or former ASIO affiliates;

(b) specify limitations or restrictions in relation to the identification of a specified authority of the Commonwealth as the employer or place of work of ASIO employees, ASIO affiliates, former ASIO employees or former ASIO affiliates.

(3) To avoid doubt, and without limiting subsection (1) or (2), if a determination under subsection (1) determines a specified authority of the Commonwealth in relation to a class of ASIO employees, ASIO affiliates, former ASIO employers or former ASIO affiliates holding, occupying or performing the duties of a specified office or position, the class includes such an office or position that comes into existence after the determination is made.

(4) Subsection (3) does not, by implication, affect the interpretation of any other provision of this Act.

(5) The Director-General must not determine a specified authority of the Commonwealth under subsection (1) unless the head of that authority has agreed, in writing, to the authority being so determined.

(6) To avoid doubt, the Chief of the Defence Force (within the meaning of the Defence Act 1903) is the head of the Defence Force for the purposes of subsection (5).

Note: The Defence Force is an authority of the Commonwealth: see paragraph (b) of the definition of authority of the Commonwealth in section 4.

(7) The following are not legislative instruments:

(a) a determination under subsection (1);

(b) an agreement under subsection (5).

Delegation

(8) The Director-General may, in writing, delegate the Director-General's powers or duties under this section to an ASIO employee, or an ASIO affiliate, who holds or is acting in a position in the Organisation that is equivalent to or higher than a position occupied by an SES employee with a classification of SES Band 3.

(9) In exercising powers or discharging duties under a delegation under subsection (8), the delegate must comply with any written direction given by the Director-General to the delegate.

92D Protection from criminal liability - third parties

(1) If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if:

(a) the person is a staff member of any authority of the Commonwealth; and

(b) the thing is done in the course of the person exercising or performing the person's powers, functions or duties as such a staff member; and

(c) the thing is done to facilitate an ASIO employee or ASIO affiliate, or a former ASIO employee or former ASIO affiliate, (the ASIO person ) to identify an authority of the Commonwealth as the ASIO person's employer or place of work in relation to a period for the purposes of subsection 92B(1), in accordance with a determination under subsection 92C(1); and

(d) doing the thing would not be an offence if the authority of the Commonwealth referred to in paragraph (c) were the ASIO person's employer or place of work for the period mentioned in that paragraph.

(2) If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if:

(a) the thing is done in the performance of the functions attaching to the person's professional capacity; and

(b) the thing is done to facilitate an ASIO employee or ASIO affiliate, or a former ASIO employee or former ASIO affiliate, (the ASIO person ) to identify an authority of the Commonwealth as the ASIO person's employer or place of work in relation to a period for the purposes of subsection 92B(1), in accordance with a determination under subsection 92C(1); and

(c) doing the thing would not be an offence if the authority of the Commonwealth referred to in paragraph (b) were the ASIO person's employer or place of work for the period mentioned in that paragraph.

Intelligence Services Act 2001

3   Subsection 3(1) (definition of staff member)

Before "means", insert ", subject to subsection 41AC(3),".

4   Subsection 27(1)

Omit "The", substitute "Subject to subsection 41AB(8), the".

5   After section 41

Insert:

41AA Cover employment for ASIS and ASD staff members

(1) A person who is a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, may identify a Commonwealth authority as that person's employer or place of work, in relation to a period during which the person is or was a staff member of that agency, in accordance with a determination made by the relevant agency head under subsection 41AB(1).

(2) Subsection (1) applies despite any other law of the Commonwealth, a State or a Territory (whether passed or made before, on or after the commencement of this section), including such other law that is expressed to apply despite any other law.

41AB Cover employment - determining a specified Commonwealth authority

Determining specified Commonwealth authority

(1) Subject to subsection (5), the agency head of ASIS or ASD may, in writing, determine one or more specified Commonwealth authorities, within the meaning of paragraphs (a), (b), (c) and (d) of the definition of Commonwealth authority in subsection 3(1), that may be identified as theemployer or place of work of staff members or former staff members of that agency.

Note: For variation and revocation of an instrument, see subsection 33(3) of the Acts Interpretation Act 1901.

(2) Without limiting subsection (1), a determination under that subsection may do either or both of the following:

(a) determine a specified Commonwealth authority in relation to a specified class of staff members or former staff members of the agency;

(b) specify limitations or restrictions in relation to the identification of a specified Commonwealth authority as theemployer or place of work of staff members or former staff members of the agency.

(3) To avoid doubt, and without limiting subsection (1) or (2), if a determination under subsection (1) determines a specified Commonwealth authority in relation to a class of staff members or former staff members of the agency holding, occupying or performing the duties of a specified office or position, the class includes such an office or position that comes into existence after the determination is made.

(4) Subsection (3) does not, by implication, affect the interpretation of any other provision of this Act.

(5) The agency head must not determine a specified Commonwealth authority under subsection (1) unless the head of that authority has agreed, in writing, to the authority being so determined.

(6) To avoid doubt, the Chief of the Defence Force (within the meaning of the Defence Act 1903) is the head of the Defence Force for the purposes of subsection (5).

Note: The Defence Force is a Commonwealth authority: see paragraph (c) of the definition of Commonwealth authority in subsection 3(1).

(7) The following are not legislative instruments:

(a) a determination under subsection (1);

(b) an agreement under subsection (5).

Delegation

(8) The agency head of ASIS or ASD may, in writing, delegate the agency head's powers or duties under this section to a staff member of that agencywho holds or is acting in a position in the agency that is equivalent to or higher than a position occupied by an SES employee with a classification of SES Band 3.

(9) In exercising powers or discharging duties under a delegation under subsection (8), the delegate must comply with any written direction given by the agency head to the delegate.

41AC Protection from criminal liability - third parties

(1) If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if:

(a) the person is a staff member of any Commonwealth authority (see subsection (3)); and

(b) the thing is done in the course of the person exercising or performing the person's powers, functions or duties as such a staff member; and

(c) the thing is done to facilitate a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, (the ASIS or ASD person ) to identify a Commonwealth authority as the ASIS or ASD person's employer or place of work in relation to a period for the purposes of subsection 41AA(1), in accordance with a determination under subsection 41AB(1); and

(d) doing the thing would not be an offence if the Commonwealth authority referred to in paragraph (c) were the ASIS or ASD person's employer or place of work for the period mentioned in that paragraph.

(2) If a person does something that, apart from this section, would be an offence against a law of the Commonwealth, a State or a Territory, the person is not criminally responsible for the offence if:

(a) the thing is done in the performance of the functions attaching to the person's professional capacity; and

(b) the thing is done to facilitate a staff member of ASIS or ASD, or a former staff member of ASIS or ASD, (the ASIS or ASD person ) to identify a Commonwealth authority as the ASIS or ASD person's employer or place of work in relation to a period for the purposes of subsection 41AA(1), in accordance with a determination under subsection 41AB(1); and

(c) doing the thing would not be an offence if the Commonwealth authority referred to in paragraph (b) were the ASIS or ASD person's employer or place of work for the period mentioned in that paragraph.

(3) For the purposes of paragraphs (1)(a) and (b), a staff member of a Commonwealth authority means:

(a) the head (however described) of the Commonwealth authority, or another person who holds an office or appointment in relation to the Commonwealth authority; and

(b) a person who is otherwise a member of the staff of the Commonwealth authority, whether:

(i) an employee of the Commonwealth authority; or

(ii) a consultant or contractor to the Commonwealth authority; or

(iii) a person who is made available, to perform services for the Commonwealth authority, by another Commonwealth authority, a State authority or other person.

Note: If a person referred to in paragraphs (1)(a) and (b) is a staff member of ASIO or an agency (within the meaning of subsection 3(1)), the definition of staff member in subsection (3) of this section applies for the purposes of those paragraphs rather than the definition of staff member in subsection 3(1).

6   Application of amendments

(1) The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Part apply in relation to a person identifying, on or after the commencement of this item, their employer or place of work in relation to a period, regardless of the following:

(a) whether the person became an ASIO employee or ASIO affiliate before, on or after that commencement;

(b) whether the period occurred, partly or wholly, before, on or after that commencement.

(2) The amendments of the Intelligence Services Act 2001 made by this Part apply in relation to a person identifying, on or after the commencement of this item, their employer or place of work in relation to a period, regardless of the following:

(a) whether the person became a staff member of ASIS or ASD before, on or after that commencement;

(b) whether the period occurred, partly or wholly, before, on or after that commencement.

Part 2   Consolidating secrecy offences

Division 1   Main amendments

Intelligence Services Act 2001

7   Subsection 3(1) (at the end of the definition of staff member)

Add:

; and (c) in relation to DIO - a member of the staff of that part of the Defence Department known as the Defence Intelligence Organisation, whether:

(i) an employee, a consultant or contractor that works in that part of the Defence Department; or

(ii) a person who is made available by another Commonwealth authority, a State authority or other person to perform services for that part of the Defence Department.

8   Section 39 (at the end of the heading)

Add " , AGO, DIO and ASD ".

9   Paragraph 39(1)(a)

Omit "ASIS in connection with its functions or relates to the performance by ASIS", substitute "ASIS, AGO, DIO or ASD (the relevant agency ) in connection with its functions, or relates to the performance by the relevant agency".

10   Paragraph 39(1)(b)

Repeal the paragraph, substitute:

(b) the information or matter has come to the knowledge or into the possession of the person by reason of the person:

(i) being, or having been, a staff member of the relevant agency or an agent of ASIS; or

(ii) having entered into any contract, agreement or arrangement with the relevant agency; or

(iii) having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and

11   Subparagraphs 39(1)(c)(i) and (ii)

Omit "Director-General of ASIS or a staff member", substitute "head of the relevant agency or a staff member of the relevant agency".

12   Subparagraph 39(1)(c)(iii)

Omit "Director-General of ASIS", substitute "head of the relevant agency".

13   Subparagraph 39(1)(c)(iv)

Omit "Director-General of ASIS or of a staff member having the authority of the Director-General of ASIS", substitute "head of the relevant agency or of a staff member of the relevant agency having the authority of the head of the relevant agency".

14   At the end of section 39

Add:

Definitions

(4) In this section:

head of the relevant agency means:

(a) in relation to ASIS, AGO or ASD - the agency head of the agency; or

(b) in relation to DIO - the Director of DIO.

15   Sections 39A to 40B

Repeal the sections.

16   Section 40C (at the end of the heading)

Add " , AGO, DIO and ASD ".

17   Paragraphs 40C(1)(b) and (c)

Repeal the paragraphs, substitute:

(b) the record was acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD (the relevant agency ) in connection with its functions, or relates to the performance by the relevant agency of its functions; and

(c) the record was obtained by the person by reason of the person:

(i) being, or having been, a staff member of the relevant agency or an agent of ASIS; or

(ii) having entered into any contract, agreement or arrangement with the relevant agency; or

(iii) having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and

18   Subparagraph 40C(1)(d)(ii)

Omit "ASIS", substitute "the relevant agency".

19   Subparagraph 40C(1)(d)(iii)

Omit "Director-General of ASIS", substitute "head of the relevant agency".

20   Subparagraph 40C(1)(d)(iv)

Omit "Director-General of ASIS or of a staff member having the authority of the Director-General of ASIS", substitute "head of the relevant agency or of a staff member of the relevant agency having the authority of the head of the relevant agency".

21   At the end of section 40C

Add:

Definitions

(5) In this section:

head of the relevant agency has the same meaning as in section 39.

22   Section 40D (at the end of the heading)

Add " , AGO, DIO and ASD ".

23   Paragraphs 40D(1)(b) and (c)

Repeal the paragraphs, substitute:

(b) the information or matter was acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD (the relevant agency ) in connection with its functions, or relates to the performance by the relevant agency of its functions; and

(c) the information or matter has come to the knowledge or into the possession of the person by reason of the person:

(i) being, or having been, a staff member of the relevant agency or an agent of ASIS; or

(ii) having entered into any contract, agreement or arrangement with the relevant agency; or

(iii) having been an employee or agent of a person who has entered into a contract, agreement or arrangement with the relevant agency; and

24   Subparagraph 40D(1)(d)(ii)

Omit "ASIS", substitute "the relevant agency".

25   Subparagraph 40D(1)(d)(iii)

Omit "Director-General of ASIS", substitute "head of the relevant agency".

26   Subparagraph 40D(1)(d)(iv)

Omit "Director-General of ASIS or of a staff member having the authority of the Director-General of ASIS", substitute "head of the relevant agency or of a staff member of the relevant agency having the authority of the head of the relevant agency".

27   At the end of section 40D

Add:

Definitions

(5) In this section:

head of the relevant agency has the same meaning as in section 39.

28   Sections 40E to 40M

Repeal the sections.

29   Subsection 41B(3) (definition of information offence provision)

Repeal the definition, substitute:

information offence provision means subsection 39(1), 40C(1) or 40D(1) or paragraph 41(1)(a).

30   Application of amendments

(1) The amendment of section 39, and the repeal of sections 39A, 40 and 40B, of the Intelligence Services Act 2001 made by this Division apply in relation to a communication by a person of any information or matter on or after the commencement of this item, regardless of the following:

(a) whether the information or matter came to the knowledge or into the possession of the person before, on or after that commencement;

(b) if that information or matter had been acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD - whether the information or matter was so acquired or prepared before, on or after that commencement.

(2) The amendment of section 40C, and the repeal of sections 40E, 40G and 40L, of the Intelligence Services Act 2001 made by this Division apply in relation to conduct engaged in by a person in relation to a record on or after the commencement of this item, regardless of the following:

(a) whether the record was obtained by the person before, on or after that commencement;

(b) if that record had been acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD - whether the record was so acquired or prepared before, on or after that commencement.

(3) The amendment of section 40D, and the repeal of sections 40F, 40H and 40M, of the Intelligence Services Act 2001 made by this Division apply in relation to the making of a record of any information or matter by a person on or after the commencement of this item, regardless of the following:

(a) whether the information or matter came to the knowledge or into the possession of the person before, on or after that commencement;

(b) if that information or matter had been acquired or prepared by or on behalf of ASIS, AGO, DIO or ASD - whether the information or matter was so acquired or prepared before, on or after that commencement.

Division 2   Consequential amendments

Privacy Act 1988

31   Subsection 80P(7) (paragraph (c) of the definition of designated secrecy provision)

Omit "39A, 40, 40B to 40H, 40L, 40M", substitute "40C, 40D".

Part 3   Protection from disclosure under Archives Act 1983

Administrative Appeals Tribunal Act 1975

32   Subsection 3(1) (paragraph (b) of the definition of exempt security record)

After "paragraph 33(1)(a) or (b)", insert "or subsection 33(4A) or (4C)".

Archives Act 1983

33   Subsection 3(1)

Insert:

ASIO affiliate has the same meaning as in the Australian Security Intelligence Organisation Act 1979.

ASIO employee has the same meaning as in the Australian Security Intelligence Organisation Act 1979.

34   Paragraphs 29(6)(a) and (7)(a)

After "paragraph 33(1)(a) or (b)", insert "or subsection 33(4A) or (4C)".

35   After subsection 33(4)

Insert:

(4A) For the purposes of this Act, a Commonwealth record is an exempt record if:

(a) it contains information or matter:

(i) that identifies a person as being, or having been, an ASIO employee or an ASIO affiliate; or

(ii) from which the identity of a person referred to in subparagraph (i) could reasonably be inferred, or that could reasonably lead to the identity of such a person being established; and

(b) the information or matter has not been made public by means of broadcasting or reporting proceedings of the Parliament as authorised by the Parliament;

unless the Minister administering section 92 of the Australian Security Intelligence Organisation Act 1979 or the Director-General of Security has consented in writing to the information or matter being made public.

(4B) If:

(a) the consent of the Minister administering section 92 of the Australian Security Intelligence Organisation Act 1979 or the Director-General of Security has been given in relation to information or a matter for the purposes of that section (before, on or after the commencement of this subsection); and

(b) that information or matter is substantially the same as the information or matter referred to in subsection (4A) of this section;

the consent referred to in paragraph (a) of this subsection is taken also to be consent given for the purposes of subsection (4A).

(4C) For the purposes of this Act, a Commonwealth record is an exempt record if:

(a) it contains information or matter:

(i) that identifies a person as being, or having been, a staff member of the Australian Secret Intelligence Service ( ASIS ) (within the meaning of the Intelligence Services Act 2001) or an agent of ASIS; or

(ii) from which the identity of a person referred to in subparagraph (i) could reasonably be inferred, or that could reasonably lead to the identity of such a person being established; and

(b) the information or matter has not been made public by means of broadcasting or reporting proceedings of the Parliament as authorised by the Parliament;

unless the responsible Minister for ASIS (within the meaning of the Intelligence Services Act 2001) or the Director-General of ASIS has consented in writing to the information or matter being made public.

(4D) If:

(a) the consent of the responsible Minister for ASIS (within the meaning of the Intelligence Services Act 2001) or the Director-General of ASIS has been given in relation to information for the purposes of section 41 of that Act (before, on or after the commencement of this subsection); and

(b) that information is substantially the same as the information referred to in subsection (4C) of this section;

the consent referred to in paragraph (a) of this subsection is taken also to be consent given for the purposes of subsection (4C).

36   At the end of section 33

Add:

(6) A reference in this section to:

(a) the Minister administering section 92 of the Australian Security Intelligence Organisation Act 1979; or

(b) the responsible Minister for ASIS (within the meaning of the Intelligence Services Act 2001);

is a reference only to the most senior such Minister.

Note: A reference to a Minister mentioned in this section may include a reference to a person acting as that Minister (see subsection 19(4) of the Acts Interpretation Act 1901).

37   At the end of subsection 39(1)

Add "or subsection 33(4A) or (4C)".

38   Paragraph 39(2)(b)

After "paragraph 33(1)(a), (b) or (e)", insert "or subsection 33(4A) or (4C)".

Part 4   Protecting the identity of ASIO employees and ASIO affiliates

Division 1   Main amendments

Australian Security Intelligence Organisation Act 1979

39   Section 92

Repeal the section, substitute:

92 Making public the identity of ASIO employees and ASIO affiliates

Offence

(1) A person commits an offence if:

(a) the person makes information public, or causes or permits information to be made public; and

(b) any of the following applies:

(i) the information identifies a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate;

(ii) the information could reasonably lead to establishing the identity of a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate;

(iii) the identity of a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate could reasonably be inferred from the information.

Penalty: Imprisonment for 10 years.

Exceptions

(2) Subsection (1) does not apply to a person making information public, or causing or permitting information to be made public, if the Minister or Director-General has consented in writing to the information being made public.

Note: A defendant bears an evidential burden in relation to the matters in subsection (2) (see subsection 13.3(3) of the Criminal Code).

(3) Subsection (1) does not apply to a person making information public, or causing or permitting information to be made public, if:

(a) the information relates to a person who is a former ASIO employee or former ASIO affiliate; and

(b) the former ASIO employee or former ASIO affiliate has:

(i) consented in writing to the information being made public; or

(ii) caused or authorised the fact that the person is a former ASIO employee or former ASIO affiliate to be made public; and

(c) the person making the information public, or causing or permitting the information to be made public, is not that former ASIO employee or former ASIO affiliate.

Note: A defendant bears an evidential burden in relation to the matters in subsection (3) (see subsection 13.3(3) of the Criminal Code).

Extended geographical jurisdiction

(4) Section 15.4 of the Criminal Code (extended geographical jurisdiction - category D) applies to an offence against subsection (1) of this section.

(5) Subsection (4) does not, by implication, affect the interpretation of any other provision of this Act or another Act.

Attorney-General's involvement in prosecution of offence

(6) A prosecution for an offence against subsection (1) may only be instituted by, or with the consent of, the Attorney-General.

Note: For communication of information about an offence against this section to appropriate authorities, see subsection 18(3).

Minister or Director-General's consent

(7) Consent given under this section is not a legislative instrument.

92A Disclosing the identity of ASIO employees and ASIO affiliates

Offence

(1) A person (the defendant ) commits an offence if:

(a) either:

(i) the defendant discloses information to another person; or

(ii) the defendant engages in conduct that results in information being disclosed to another person; and

(b) any of the following applies:

(i) the information identifies a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate;

(ii) the information could reasonably lead to establishing the identity of a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate;

(iii) the identity of a person as being an ASIO employee, a former ASIO employee, an ASIO affiliate or a former ASIO affiliate could reasonably be inferred from the information; and

(c) any of the following applies:

(i) the defendant intends to endanger the health or safety of a person;

(ii) the defendant intends to prejudice the effective performance of the functions or duties, or the effective exercise of the powers, of the Organisation;

(iii) the defendant knows that the disclosure will endanger the health or safety of a person;

(iv) the defendant knows that the disclosure will prejudice the effective performance of the functions or duties, or the effective exercise of the powers, of the Organisation.

Penalty: Imprisonment for 10 years.

Extended geographical jurisdiction

(2) Section 15.4 of the Criminal Code (extended geographical jurisdiction - category D) applies to an offence against subsection (1) of this section.

(3) Subsection (2) does not, by implication, affect the interpretation of any other provision of this Act or another Act.

Attorney-General's involvement in prosecution of offences

(4) A prosecution for an offence against subsection (1) may only be instituted by, or with the consent of, the Attorney-General.

Note: For communication of information about an offence against this section to appropriate authorities, see subsection 18(3).

40   Application of amendments

(1) Subsection 92(1) of the Australian Security Intelligence Organisation Act 1979, as substituted by this Division, applies to information made public, or caused or permitted to be made public, after the commencement of this Division (whether the information was obtained before, on or after that commencement).

(2) Subsections 92(2) and (3) of the Australian Security Intelligence Organisation Act 1979, as substituted by this Division, apply to information made public, or consents given, before, on or after the commencement of this Division.

(3) Subsection 92A(1) of the Australian Security Intelligence Organisation Act 1979, as inserted by this Division, applies to information disclosed after the commencement of this Division (whether the information was obtained before, on or after that commencement).

Division 2   Consequential amendments

Australian Crime Commission Act 2002

41   Schedule 1 (entry relating to the Australian Security Intelligence Organisation Act 1979)

Omit "and 92", substitute ", 92 and 92A".

Business Names Registration Act 2011

42   Paragraph 62N(3)(a)

Omit "and 92", substitute ", 92 and 92A".

Commonwealth Registers Act 2020

43   Paragraph 18(3)(a)

Omit "and 92", substitute ", 92 and 92A".

Corporations Act 2001

44   Paragraph 1270M(3)(a)

Omit "and 92", substitute ", 92 and 92A".

Criminal Code Act 1995

45   Paragraph 122.5(7)(a) of the Criminal Code

Omit "section 92 of the Australian Security Intelligence Organisation Act 1979 (publication of identity of ASIO employee or ASIO affiliate)", substitute "section 92 of the Australian Security Intelligence Organisation Act 1979 (making public the identity of ASIO employees and ASIO affiliates) or section 92A of that Act (disclosing the identity of ASIO employees and ASIO affiliates)".

Freedom of Information Act 1982

46   Schedule 3 (entry relating to the Australian Security Intelligence Organisation Act 1979)

Omit "and (1A)", substitute "and 92A(1)".

National Consumer Credit Protection Act 2009

47   Paragraph 212N(3)(a)

Omit "and 92", substitute ", 92 and 92A".

Privacy Act 1988

48   Subsection 80P(7) (paragraph (a) of the definition of designated secrecy provision)

Omit "and 92", substitute ", 92 and 92A".

Schedule 3   Authorisations for intelligence activities

Part 1   Sequencing of ministerial authorisations and clarifying references to persons

Intelligence Services Act 2001

1   Subsections 9(1A) and (1AAA)

Repeal the subsections, substitute:

(1A) Before a Minister gives an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(i), (ia), (ib) or (ii) (the relevant subparagraph ), the Minister must also be satisfied that the Australian person, or the class of Australian persons, mentioned in the relevant subparagraph is, or is likely to be, involved in one or more of the following activities:

(a) activities that present a significant risk to the safety of any person (including the Australian person or a member of the class of Australian persons mentioned in the relevant subparagraph);

(b) acting for, or on behalf of, a foreign power;

(c) activities that are, or are likely to be, a threat to security;

(d) activities that pose a risk, or are likely to pose a risk, to the operational security of ASIS;

(e) activities related to the proliferation of weapons of mass destruction or the movement of goods listed from time to time in the Defence and Strategic Goods List (within the meaning of regulation 13E of the Customs (Prohibited Exports) Regulations 1958);

(f) activities related to a contravention, or an alleged contravention, of a UN sanction enforcement law by any person (including the Australian person or a member of the class of Australian persons mentioned in the relevant subparagraph);

(g) committing a serious crime by moving money, goods or people;

(h) committing a serious crime by using or transferring intellectual property;

(i) committing a serious crime by transmitting data or signals by means of guided and/or unguided electromagnetic energy.

Note 1: For serious crime , see section 3.

Note 2: Certain authorisations referred to in this subsection cannot take effect unless the Minister has obtained the agreement of the Attorney-General (see subsection (1AAC)).

(1AAA) Before a Minister gives an authorisation for an activity, or a series of activities, of a kind mentioned in subparagraph 8(1)(a)(iaa), the Minister must also be satisfied that the class of Australian persons mentioned in that subparagraph is, or is likely to be, involved with a listed terrorist organisation.

Note: An authorisation referred to in this subsection cannot take effect unless the Minister has obtained the agreement of the Attorney-General (see subsection (1AAD)).

2   After the heading to subsection 9(1AA)

Insert:

(1AAC) An authorisation referred to in subsection (1A) for an activity, or a series of activities, in relation to an Australian person, or a class of Australian persons, who is, or is likely to be, involved in activities referred to in paragraph (1A)(c) (whether or not the person, or the class of persons, is, or likely to be, involved in activities covered by another paragraph of subsection (1A)) cannot take effect unless and until the Minister has obtained the agreement (orally or in writing, but subject to subsection (1AA)) of the Attorney-General. The agreement may be sought before or after the authorisation is given.

(1AAD) An authorisation referred to in subsection (1AAA) for an activity, or a series of activities, in relation to a class of Australian persons cannot take effect unless and until the Minister has obtained the agreement (orally or in writing, but subject to subsection (1AA)) of the Attorney-General. The agreement may be sought before or after the authorisation is given.

3   Subsection 9(1AA)

Omit "paragraph (1A)(b) or (1AAA)(b)", substitute "subsection (1AAC) or (1AAD)".

4   Paragraph 9(5)(b)

Omit "paragraph (1A)(b) or (1AAA)(b)", substitute "subsection (1AAC) or (1AAD)".

5   Subsection 9(6)

Omit "paragraph (1A)(b) or (1AAA)(b)", substitute "subsection (1AAC) or (1AAD)".

6   Subsection 9A(2) (note)

Repeal the note.

7   Subparagraph 9B(2)(c)(ii)

Omit "serious risk to a person's safety", substitute "significant risk to the safety of any person".

8   Subsection 9B(2) (note)

Repeal the note.

9   Subparagraph 9C(1)(c)(i)

Repeal the subparagraph, substitute:

(i) the authorisation cannot take effect unless and until the agreement of the Attorney-General has been obtained under subsection 9(1AAC);

10   Subsections 9C(2) and (3)

Repeal the subsections, substitute:

Giving authorisation

(2) Despite subsection 9(1AAC) and subject to subsection (3) of this section, the authorisation:

(a) may be given; and

(b) may take effect without the agreement of the Attorney-General having been obtained.

Obtaining the agreement of the Director-General of Security

(3) Before an authorisation is given under section 9A or 9B, the agency head must, unless the agency head is satisfied that the Director-General of Security is not readily available or contactable, obtain the agreement of the Director-General to the authorisation:

(a) being given; and

(b) taking effect without the agreement of the Attorney-General having been obtained.

11   Subsection 9D(2)

Omit ", apart from paragraph 9(1A)(b)".

12   After subsection 9D(3)

Insert:

Agreement of the Attorney-General not required

(3A) Subsection 9(1AAC) does not apply in relation to the authorisation.

13   Paragraph 10AA(3)(a)

Omit "paragraph 9(1A)(b) or (1AAA)(b)", substitute "subsection (1AAC) or (1AAD)".

14   Paragraph 11(2AA)(a)

Omit "a person's safety", substitute "the safety of that person or any other person".

15   Subsection 13B(6)

Omit "paragraph 9(1A)(a)", substitute "subsection 9(1A)".

16   Application of amendments

The amendments made by this Part apply in relation to an authorisation given under Division 1 of Part 2 of the Intelligence Services Act 2001 after the commencement of this Part.

Part 2   References to Attorney-General not to include junior Minister

Australian Security Intelligence Organisation Act 1979

17   After section 4

Insert:

4AA References to the Attorney-General

Despite subsection 19(1) of the Acts Interpretation Act 1901, a reference in this Act to the Attorney-General is a reference only to the Minister with that title.

Note: A reference in this Act to the Attorney-General may include a reference to a person acting as the Attorney-General: see subsection 19(4) of the Acts Interpretation Act 1901.

Telecommunications (Interception and Access) Act 1979

18   After subsection 5(3)

Insert:

(3A) Despite subsection 19(1) of the Acts Interpretation Act 1901, a reference in this Act to the Attorney-General is a reference only to the Minister with that title.

Note: A reference in this Act to the Attorney-General may include a reference to a person acting as the Attorney-General: see subsection 19(4) of the Acts Interpretation Act 1901.

19   Subsection 5(4)

Omit "A reference", substitute "However, a reference".

Part 3   Applicant for special intelligence operation authority

Australian Security Intelligence Organisation Act 1979

20   Subsection 35B(1)

Omit ", a senior position-holder or an ASIO employee".

21   Paragraphs 35B(2)(a) and (b)

Omit "the applicant", substitute "the Director-General".

22   Subsection 35B(4)

Omit "the applicant", substitute "the Director-General".

23   Subsection 35F(1)

Omit ", a senior position-holder or an ASIO employee".

24   Paragraphs 35F(2)(a) and (b)

Omit "the applicant", substitute "the Director-General".

25   Subsection 35F(3)

Omit "the applicant", substitute "the Director-General".

26   Application of amendments

The amendments made by this Part apply in relation to an application made under subsection 35B(1) or 35F(1) of the Australian Security Intelligence Organisation Act 1979 on or after the commencement of this Part.

Schedule 4   Security vetting and security clearance related activities

Part 1   Security clearance suitability assessments

Australian Security Intelligence Organisation Act 1979

1   Section 4 (paragraph (b) of the definition of security clearance suitability assessment)

After "security vetting agency", insert "(within the meaning of Part IVA)".

2   At the end of paragraph 16(1C)(b)

Add "that is a prejudicial security clearance suitability assessment (within the meaning of Part IVA)".

3   At the end of subsection 16(1C)

Add:

Note: The Director-General may, under subsection (1B), delegate the power or function under subsection 82D(1) to furnish a security clearance suitability assessment under paragraph 82C(1)(d) that is not a prejudicial security clearance suitability assessment.

4   Application of amendments

The amendments of the Australian Security Intelligence Organisation Act 1979 made by this Part apply in relation to a security clearance suitability assessment furnished on or after the commencement of this item.

Part 2   Delayed assessments and security clearance decisions

Australian Security Intelligence Organisation Act 1979

5   Section 82A

Insert:

delayed security clearance decision has the meaning given by subsection 82GA(1).

delayed security clearance suitability assessment has the meaning given by subsection 82GA(2).

6   Section 82B (after the paragraph beginning "There are some limitations")

Insert:

The Director-General must cause the Inspector-General of Intelligence and Security to be notified of delayed security clearance decisions and delayed security clearance suitability assessments. The Director-General must make a protocol for dealing with such decisions and suitability assessments.

7   At the end of Division 2 of Part IVA

Add:

82GA Notification of delayed security clearance decision or delayed security clearance suitability assessment

Notification of delayed security clearance decision or security clearance suitability assessment

(1) If a security clearance decision is not made under this Part within 12 months after the Organisation starts to consider making the decision (the delayed security clearance decision ), the Director-General must cause the Inspector-General of Intelligence and Security to be notified of the delayed security clearance decision.

Note: A protocol made under subsection 82GB(1) must specify when the Organisation is taken to have started to consider making a security clearance decision, which may be specified differently for different classes of security clearance decisions (see subsections 82GB(3) and (4)).

(2) If a security clearance suitability assessment is not furnished under this Part within 12 months after the Organisation starts to prepare the suitability assessment (the delayed security clearance suitability assessment ), the Director-General must cause the Inspector-General of Intelligence and Security to be notified of the delayed security clearance suitability assessment.

Note: A protocol made under subsection 82GB(1) must specify whenthe Organisation is taken to have started to prepare a security clearance suitability assessment, which may be specified differently for different classes of security clearance suitability assessments (see subsections 82GB(3) and (4)).

(3) A notification under subsection (1) or (2) must:

(a) be made within the period specified, for the purposes of subparagraph 82GB(3)(b)(i), in the protocol made under subsection 82GB(1), as in force from time to time; and

(b) include the information specified in that protocol for the purposes of subparagraph 82GB(3)(b)(ii); and

(c) comply with any other requirements specified in the protocol for the purposes of paragraph 82GB(3)(d).

Exceptions to requirement to notify

(4) However, subsection (1) or (2) does not apply if:

(a) the Organisation has been notified that the security clearance decision or security clearance suitability assessment is no longer required; or

(b) the Organisation initiated the making of the security clearance decision or the preparation of the security clearance suitability assessment without a request for the decision or suitability assessment being made by another Commonwealth agency, a State or an authority of a State.

Application of this section

(5) This section applies to:

(a) a security clearance decision that the Organisation starts to consider making on or after the commencement of this section; and

(b) a security clearance suitability assessment that the Organisation starts to prepare on or after the commencement of this section.

82GB Protocol for dealing with delayed security clearance decisions and delayed security clearance suitability assessments

Requirement to make protocol

(1) The Director-General must make a written protocol for dealing with delayed security clearance decisions and delayed security clearance suitability assessments.

Note 1: For variation of a protocol, see subsection 33(3) of the Acts Interpretation Act 1901.

Note 2: A protocol made under this subsection may be combined with a protocol made under subsection 42(1) (protocol for dealing with delayed security assessments).

(2) The Director-General must consult with the Inspector-General of Intelligence and Security before making a protocol under subsection (1).

(3) The protocol:

(a) must specify the following:

(i) when the Organisation is taken to have started to consider making a security clearance decision;

(ii) when the Organisation is taken to have started to prepare a security clearance suitability assessment; and

(b) must specify the following in relation to the notification under section 82GA of a delayed security clearance decision or delayed security clearance suitability assessment:

(i) the period withinwhich the notification must be made;

(ii) the information to be included in the notification; and

(c) must deal with steps to be taken by the Organisation in relation to the delayed security clearance decision or delayed security clearance suitability assessment after the notification referred to in paragraph (b) is made; and

(d) may specify other requirements, or deal with any other matters, that:

(i) relate to a delayed security clearance decision or delayed security clearance suitability assessment, or the notification of the decision or suitability assessment under section 82GA; and

(ii) the Director-General considers appropriate.

(4) Without limiting subsection (1), the protocol may provide differently for different classes of security clearance decisions or security clearance suitability assessments.

(5) A protocol made under subsection (1) is not a legislative instrument.

Requirement to comply with protocol

(6) The Organisation must, in relation to a delayed security clearance decision or delayed security clearance suitability assessment to which subsection 82GA(1) or (2) applies, comply with a protocol made under subsection (1) of this section, as in force from time to time.