Home Affairs Minister Peter Dutton has said there are consequences in place for law enforcement agencies using metadata incorrectly, but deferred responsibility for ACT Policing bungles to the ACT government, reigniting a row over oversight of the organisation.
A Commonwealth Ombudsman report released this week revealed ACT Policing had accessed telecommunications data more than 100 times without proper authorisation over a two-week period in 2015, because no one in the organisation was allowed to give such permission.
Asked about the breaches on Wednesday, the Minister brushed off federal responsibility for any sanctions, also referring to the ACT government as a "council".
"The ACT police, as you know, operate under the ACT government, under the local council government here, so that's an issue for the ACT government and that is a contracted arrangement between the AFP and the ACT government," Mr Dutton said.
"And we don't direct those officers, they operate under the ACT law and under the commission of the ACT."
Chief Minister Andrew Barr hit back at the claims, bringing up a long-running request for changes in federal legislation that would allow the soon-to-be formed ACT Integrity Commission to have oversight of ACT Policing.
"We have Peter Dutton, the person directly responsible for the Australian Federal Police and by extension ACT Policing, saying the Commonwealth takes no responsibility for the actions of ACT Policing, while at the same time the Morrison Government refuses to allow the ACT's Integrity Commission to have oversight of the ACT's police.
Mr Barr said it was unlikely the metadata access would be an issue covered by the Integrity Commission, but that it highlighted the issue.
The Commonwealth Ombudsman's annual report into how law enforcement agencies use metadata covering 2016-17 was tabled in parliament this week, also noting the problem of a lack of proper approval existed from March until October 2015.
The report also said that while the Australian Federal Police, of which ACT Policing is a division, self-reported the 116 illegal authorisations in 2015-16, it took until February 2018 to partially quarantine the data, and as late as April 2018 it still wasn't properly quarantined.
The Australian Federal Police told the ombudsman the lack of authorisation happened due to an "administrative oversight".
According to the report, even though the data hadn't been gained legally, it was still being used and communicated, and ACT Policing was seeking legal advice on the use of the affected data.
The ACT's chief police officer Ray Johnson told the ABC police became aware of the illegal access two years later, only after being made aware by the ombudsman.
"[The metadata] was for the business of community policing, from armed robberies to stolen bikes, a range of things involving ACT Policing," he said.
"These are for normal criminal investigations."
The chief police officer said the metadata also related to a missing person case which was still ongoing.
Assistant commissioner Johnson said processes were in place to make sure the illegal access would not happen again.
"We understand these are powers given to police by the community and are entrusted with them, and we desperately don't want to make mistakes with them," he said.
After the federal government introduced laws in 2015 requiring telecommunication companies to retain metadata - information like dates and times of phone calls and text messages as well as some internet data - for at least two years, the Commonwealth Ombudsman has had oversight of agencies' collection and use of such data.
"We will continue to monitor this issue closely with the AFP," the ombudsman's report said, showing the Federal Police outstripped any other agency for illegally accessing data.
WA Police were also found to twice have gained access to information from a journalist after incorrectly applying for a Journalist Information Warrant.
" This occurred due to a lack of awareness by WA Police regarding to whom an application for a Journalist Information Warrant could be made," the report said.
"In response to this issue, WA Police took steps to quarantine all information obtained under the invalid warrants."