Australia's data retention laws are being exploited by more than 80 non-law enforcement agencies across all levels of government, the telco peak body says.
More than four years after the government passed laws requiring telcos to retain customer metadata for at least two years, the Communications Alliance, which represents big players like Telstra and Optus, has warned important elements of the legislation are being circumvented.
While 22 law enforcement and security agencies have access to metadata under the laws introduced more recently, more than 80 other agencies have used powers under different legislation to access the information they know telcos are holding.
From the Clean Energy Regulator, local councils and anti-dumping groups to the Veterinary Surgeons Board of WA, the list of government bodies asking for metadata is long and varied.
According to the Communications Alliance the data is sought to investigate traffic offences, unlawful removal of trees and rubbish dumping, not just the serious crimes for which the laws were said to be necessary.
"The RSPCA, the Environment Protection Authority and state coroners are other examples of entities that have managed to subvert the intended scope of the legislation," the Alliance told a parliamentary committee reviewing the implementation of the laws.
"Not only is the circumvention of the [data retention] regime by entities outside the 'authorised 22' a serious and persistent phenomenon; it is a problem that continues to grow in magnitude."
Safeguards and processes required to protect privacy and ensure law enforcement agencies act properly don't apply to the other agencies, creating a system where data is accessed without proper oversight, the Communications Alliance said.
"This loophole for accessing sensitive telecommunications data ought to be closed through an amendment of s280 of the Telco Act," the submission said.
The Communications Alliance also took aim at the Department of Home Affairs for failing to report on access to metadata in a timely fashion as required by law, pointing out that industry complies with onerous reporting obligations to government.
"We wish to record our dismay and objection to the fact that for the past two reporting periods (the periods during which the new DR Regime was in force) it took 13 and a half months from the end of the relevant financial year to table these important reports in the House of Representatives."
The report covering the 2017-18 year has still not been published.