Office of National Intelligence Act 2018

The Prime Minister must make rules (the privacy rules) regulating:

the collection of information mentioned in paragraph 7(1)(g), to the extent that information is personal information about an Australian citizen or permanent resident; and

the communication, handling and retention by ONI of intelligence information that is personal information about an Australian citizen or permanent resident.

ONI must not, except in accordance with the privacy rules:

collect personal information about an Australian citizen or permanent resident under paragraph 7(1)(g); or

communicate intelligence information that is personal information about an Australian citizen or permanent resident.

Personal information about an Australian citizen or permanent resident means information or an opinion about an identified Australian citizen or permanent resident, or an Australian citizen or permanent resident who is reasonably identifiable:

whether the information or opinion is true or not; and

whether the information or opinion is recorded in a material form or not.

Intelligence information means intelligence produced by ONI under paragraph 7(1)(c), (d) or (g).

The Prime Minister may make privacy rules dealing with other matters if the Prime Minister considers it appropriate to do so.

In making the privacy rules, the Prime Minister must have regard to the need to ensure that the privacy of Australian citizens and permanent residents is preserved as far as is consistent with the proper performance by ONI of its functions.

Before making the privacy rules, the Prime Minister must consult with the Director‑General, the Inspector‑General of Intelligence and Security, the Privacy Commissioner and the Attorney‑General, including by providing those persons with a copy of the privacy rules the Prime Minister is proposing to make.

The privacy rules must be published on ONI’s website as soon as practicable after the rules are made, except to the extent that the rules contain information that has a protective security classification.

The Inspector‑General of Intelligence and Security must brief the Parliamentary Joint Committee on Intelligence and Security on the content and effect of the privacy rules if:

the Committee requests the Inspector‑General to do so; or

the privacy rules change.

To avoid doubt, the privacy rules may not do the following:

create an offence or civil penalty;

provide powers of:

arrest or detention; or

entry, search or seizure;

impose a tax;

set an amount to be appropriated from the Consolidated Revenue Fund under an appropriation in this Act;

directly amend the text of this Act.

Privacy rules made under this section are not legislative instruments.