Risks in gathering and retaining information via surveillance devices

This year, we inspected how agencies handle and destroy information obtained through a surveillance device or by accessing a person’s computer.

While the Surveillance Devices Act enables a law enforcement agency to gather and use such material to support civil or criminal proceedings, it is incumbent on the agency to destroy this information when it is no longer required for a lawful purpose.

Our August 2023 inspection of the ACIC found significant amounts of information gathered through surveillance devices contained in 2 corporate systems.

This material was unlikely to relate to any civil or criminal proceeding, creating a serious risk of the ACIC retaining this material unlawfully.

We found the ACIC’s advice that it would take up to 7 years to review this material unacceptable.

We recommended the ACIC prioritise and resource reviewing the material and, where necessary, immediately destroy the information in their systems.

The ACIC acknowledged our recommendation and immediately commenced reviewing the holdings and destroying any material it was not permitted to retain.

2024