CHAIR —Welcome. ASIC has lodged a submission with the committee which we have numbered 13. Do you need to make any amendments or alterations to that submission?

Ms Macaulay —No.

CHAIR —I will ask you to make an opening statement and at the end of that we will go to questions from members of the committee.

Ms Macaulay —Thank you for the opportunity for us to appear before this committee. In our opening statement there are two aspects that we would like to raise. The first is to give an outline of ASIC’s role and the use to which it puts emails in its investigative and enforcement work, and the second is to outline some issues with the drafting of the current amendment bill.

As you are aware, ASIC is an independent Commonwealth agency. It regulates corporations and it is the disclosure and consumer protection regulator for financial markets and financial products. ASIC considers the use of emails and voicemail is even more common in this area that it regulates than in the wider community. For example, the legal or illegal sale of many financial products takes place using email over the internet. Providers of financial services use email to correspond with their clients and with suppliers of financial products. Officers of a corporation are also frequent users of emails within the corporation and to their advisers. In fact, email has replaced many other forms of communication.

Whereas previously it was a hard-copy document, a letter or a memorandum, it is now an electronic copy document. That exposes a fundamental concern we have with the policy behind this amendment in relation to emails. Given the prevalence of emails and the way that they have overtaken physical forms of documents, we are not clear about why they should be treated differently to a hard-copy document. This is the effect that this bill has. Examples of situations where email would be central to the sorts of misconduct that ASIC may investigate include a suspected wrongdoer sending to another person a spreadsheet by email which contains evidence of funds which have been raised through illegal fundraising or a person may receive an email soliciting moneys to invest in an illegal investment scheme. It may well be that the correspondence by email is the only evidence available to assist us in investigating the misconduct that we are responsible for regulating.

Our regulatory powers cover a wide ambit not only in terms of subject matter but also in the way they operate. We have criminal, civil penalty, civil and administrative remedies available to us. We use all of that those, and we use them very often in combination. Of course, we consult with the Commonwealth Director of Public Prosecutions before charges are laid, and they pursue the prosecutions. We do our own civil penalty and our own civil proceedings. We also do a lot of administrative proceedings, particularly in relation to regulating management of corporations and financial advisers.

We have extensive powers to serve notices to obtain material, both physical and electronic material. We also make use of search warrants under the Crimes Act where that is necessary and we have a search warrant power in the ASIC Act, which is available where we have served a notice and the notice has not been responded to. The notices that we serve are not prospective—that is, they cannot seek material that is not currently in existence; they only seek material which is in existence at the time the notice is served. To this extent, they do not allow access to real-time data—that is, they do not allow access to data as it is being created.

Under the current provisions that are enacted in relation to stored communications, we can access stored communications that are in existence and are held by a carrier which have not been accessed by the recipient or which have been accessed by the recipient but are not in the recipient’s possession. We cannot do that covertly to the extent that we cannot get real-time access to it. It is only to material that is in existence. In some cases the legislation that is contemplated will make the investigation and prosecution of fairly serious contraventions of the financial sector law impossible. That is because of the need to seek a search warrant if we are going to access stored communications held with a carrier. There is a threshold which relates to the ability to obtain a search warrant. In many cases, the provisions of the Corporations Act will not meet that threshold. That will affect our ability to collect evidence of misconduct.

The specific issue we have with the draft bill in its current form is the threshold for obtaining the warrant—three years or 180 penalty units. We have many examples of provisions throughout the Corporations Act which address serious misconduct which have a lower threshold than that. For example, a person who is disqualified from managing a corporation may be prosecuted if they continue to manage a corporation. That is only a two-year penalty. There is an offence if a director of a listed company fails to disclose a relevant interest. That also falls below the threshold. There is also a range of offences in relation to defective product disclosure documents for financial products. They all fall outside the threshold to obtain a warrant.

Once material has been obtained under a warrant, there is a slightly broader category of material for which it can be used, but it still does not cover a lot of the remedies that we seek. It does not cover any civil remedies that we might seek—injunctions to stop conduct or to freeze assets. It does not cover any administrative proceedings that we might take to exclude financial services providers from the industry. Our civil penalty provisions allow us to seek a combination of three remedies. We will not be allowed to use stored communications warrants material to seek compensatory remedy or a banning remedy for a civil penalty. We anticipate that the legislation intends that we could seek a warrant for a civil pecuniary penalty proceeding. But, as it is currently drafted, the monetary equivalent of a pecuniary penalty does not refer to Commonwealth legislation; it only refers to state or territory legislation, so there is a bit of a gap in that regard, which we assume is inadvertent.

Mr Inman —Madam Chair, may I reserve the option to make a few comments from an operational perspective before we conclude?

CHAIR —Absolutely.

Mr Inman —Thank you.

Senator LUDWIG —Let me understand the process. Notice to produce is an old power that ASIC had, and a range of other quasi criminal actions. It was originally about gaining record books, types of records, paper based computer printouts and that type of information that was available that you needed to obtain to then assist in a civil case, a prosecution or a quasi criminal case if a sanction applied. You now use modern technology. Where do you stop? If you use a notice to produce, do you currently produce it to the ISP?

Ms Macaulay —That option is available to us under the current legislation.

Senator LUDWIG —You then issue a notice to produce to a particular ISP concerning a corporation or a company that you have a particular interest in and the relevant email addresses of the corporate heads that you might be interested in? There might be Mr Bloggs and so on.

Ms Macaulay —Yes.

Senator LUDWIG —You then go directly to the ISP and ask, ‘Can you provide a printout or a copy or a data disk of all the email traffic that has gone from A to B to C?’ Is that what you do?

Mr Inman —We have done that in the past. The majority of our access to emails, however, comes from access at the user’s end, whether that be a company—

Senator LUDWIG —I was going to come back to that point. I was just exploring this end, then I will come back to that.

Mr Inman —I just wanted to convey a feeling that we have done that in the past, but the majority of our access is at the other end.

Senator LUDWIG —The ISP is not under an obligation to notify the corporation that you are investigating and neither are you with the notice to produce to the ISP?

Ms Macaulay —That is correct.

Senator LUDWIG —In fact, you do not want to notify them, because you might be covertly examining their emails for a breach of the TPA under collusive tendering and whatever?

Ms Macaulay —I would not use the word ‘covertly’.

Senator LUDWIG —If you don’t tell them, what do you call it?

Ms Macaulay —There is nothing to prevent someone disclosing whether or not they have received a notice. We very often serve notices on parties. Our notices require parties who have received a notice to serve the documents that are in their possession and that may well include documents that are third party documents. For example, we routinely serve notices on banks and ask for details about clients of the bank and particular cheques that we may need as evidence of misconduct.

Senator LUDWIG —But when you serve the notice to produce on an ISP in relation to a corporation and individuals, do you then send a copy to the individuals?

Ms Macaulay —No, and we do not when we serve a notice on a bank, either.

Senator LUDWIG —It has to be covert then. Forgive me if I do not understand but if you do not tell the intended recipient—

Ms Macaulay —That is true. There are many instances where we would prefer a third party, whose documents may be held by the recipient of the notice, not to know because if they do know and they understand that we are doing an investigation then they may take action which will affect our investigation.

ACTING CHAIR (Senator Ludwig) —They may take out an injunction—

Ms Macaulay —Yes, there are many different sorts of actions.

ACTING CHAIR —to stop you doing it?

Ms Macaulay —Yes.

ACTING CHAIR —So it is covert—you do not want to tell them? This is not a trick question.

Ms Macaulay —No. The use of the term has certain connotations which we would not agree with.

ACTING CHAIR —But that is what you are doing. If that is what you are doing, why do you have a problem with the term?

Ms Macaulay —There is no prohibition on disclosure of the notice. ‘Covert’ gives a flavour of secrecy.

ACTING CHAIR —Hang on a minute—let us deal with secrecy then.

Ms Macaulay —There is no obligation on someone to keep secret the fact that they have received a notice.

ACTING CHAIR —Are you sure about that?

Ms Macaulay —Yes.

ACTING CHAIR —Under your legislation?

Ms Macaulay —Yes.

ACTING CHAIR —What about other legislation—the telecommunications legislation or the telecommunications interception legislation?

Ms Macaulay —We do not have any powers under the telecommunications interception legislation.

ACTING CHAIR —You do not know whether it prohibits that? I will not explore that. In terms of ‘secret’, though—we can use that term if you are more comfortable with that—you do not tell the intended recipients, so therefore it is secret.

Ms Macaulay —Right enough—we do not tell them. There is no obligation to make it secret.

ACTING CHAIR —No—as far as you are aware.

Ms Macaulay —I can tell you categorically that there is no legislative prohibition on the recipient of a notice disclosing that notice.

ACTING CHAIR —We will ask the Attorney General’s Department that question later and see what they say. Your objection is that a stored communication regime will mean that you will have to seek a warrant for the information that you are currently able to access. Will it place impediments or difficulties on you? What is the problem that you would perceive?

Ms Macaulay —A warrant is available only in certain circumstances. You need to meet the threshold, that it is either—

ACTING CHAIR —Yes.

Ms Macaulay —And many of the types of misconduct that we pursue will not meet that threshold. That means that we will not be able to access that material during the course of our investigation and that will affect, to a varying degree—depending on what the information is—our investigation and our ability to assess whether or not misconduct has occurred and then our ability to take action if it has occurred.

ACTING CHAIR —In respect of accessing information that the recipient might have—for argument’s sake, on a computer in an office environment; we can use that as an easy one to imagine—you can serve a notice to produce and then ask for the email traffic that is stored on that computer, that is passed over and that is available?

Ms Macaulay —Yes.

ACTING CHAIR —Could you also retrieve and take print-outs or copies of the sent items, drafts and anything else on that machine, in relation to email traffic?

Mr Inman —It all depends on how the machine has been set up. It is possible that there will be nothing on the machine. So we can get either all of that or nothing, depending on how the machine has been set up.

ACTING CHAIR —So if the computer is set up with a send and receive button, can you press that in your investigation, with a notice to produce, and ask them to then download from the carrier that information—the last email traffic that might have come through? I am not too sure how your investigation might operate.

Mr Inman —It depends. We have the ability to require people to provide reasonable assistance. It is arguable whether or not we could use that means to require someone to press the send and receive button. If we have entered the premises under a search warrant, we have the 3E and 3L provisions.

ACTING CHAIR —So you use 3L where you see people taking data away from computers. You use that as a basis. Your notice to produce is a slightly different version of the 3L?

Ms Macaulay —Yes, that is right. We routinely use notices to produce. We literally serve thousands of them every year in different contexts—some are for compliance and surveillance purposes and there are investigative purposes as well. We use search warrants only when we have an apprehension that evidence may be lost. The key thing about our notices is that they apply to books, and that is a defined term in the ASIC Act. It covers electronic material as well as physical material.

Senator LUDWIG —Have you raised those concerns with the A-G’s Department?

Ms Macaulay —Yes, we have.

Senator LUDWIG —What was their response?

Ms Macaulay —They listened to it; they understood it; they have not given us a response yet.

Senator LUDWIG —So we might hear from them this afternoon as to what their response might be.

Ms Macaulay —Yes, you might.

CHAIR —They might be busy talking about other things.

Senator LUDWIG —Yes. Have you asked whether or not they will provide a response to you?

Ms Macaulay —My understanding—and I have not spoken directly to the Attorney-General’s Department, but I am informed by my officers—is that we have not directly asked them that question. We have had a number of discussions with them and we have an expectation that they would respond to the issues that we have raised.

Senator STOTT DESPOJA —I have a general question. I found your introductory remarks in your submission with regard to the impact that the legislation would have on your work quite interesting. Can you further outline and even quantify—and I am not sure if that is possible—what you perceive the impact of this legislation will be on your work and outcomes, particularly in relation to civil and administrative proceedings when it involves those particular forms of remedy? Is it possible for you to explain what you think will happen?

Mr Inman —I can do two things. One is to give a general comment and the other is to give an example of a specific impact.

Senator STOTT DESPOJA —That would be helpful.

—We believe generally that things that we can currently gain access to for a whole range of investigations will be narrowed as a result of this legislation, because there are lots of penalty provisions within the legislation that we administer that are less than the threshold being set at the moment or that are being discussed for the three years or 180 points. Obviously, that removes some tactical advantage from us in our investigations and some practical access. We perceive we will not be able to get certain information as a result of that.

I can give you a specific example. The example I am about to give is based on our operational experience in the past where we have relied on serving notices or obtaining from intermediaries like an ISP some email traffic. I can imagine a situation where a consumer complains to us about an unsolicited offer that they have received. We look at this and it appears that it has come from someone whom we may have banned previously. However, a single email containing an offer as an attachment would not be sufficient proof for us to do anything other than suspect there may have been a contravention of that banning order. What we would normally do in that situation, because we would know who the person is, is serve them with a notice. We would probably serve them with a notice and ask them to give us a copy of their computer. We would image their computer. I can remember situations that have occurred in the past where, because of the way the computer is set up, we did not find not only an example of the email that was sent but any other emails. There may be only a few remnants of some non-related emails. We examine the individual and we say to them, ‘Can you explain this email?’ They say, ‘I don’t remember sending it.’ Because the contravention of a banning order is less than that threshold, we have no means to test the veracity of the evidence that we have been given. If we could go to the ISP, we could possibly see replies that that individual has had from other prospective investors. That will not be available to us if the bill goes through in its current format.

Ms Macaulay —I just add that we would not as a matter of course go to an ISP as our first port of call to seek to access this sort of material. Normally, we would go to the recipients of the information or the senders of the information in the course of gathering together a whole lot of material which will enable us to understand what the particular transaction or course of conduct involved. The situation that Keith outlined is a situation where that information is not available from these other sources. That is when we would go to an ISP.

Senator STOTT DESPOJA —That is fine. Thank you.

Senator LUDWIG —With regard to the low order of types of offences, are they all pecuniary offences for which you use notices to produce, or can they be non-pecuniary offences?

Ms Macaulay —They can be non-pecuniary. There is a whole range of potential remedies. We might have an investigation that is criminal, and we would use the notice to obtain material for that, or a civil penalty, or an injunctive proceeding or an administrative penalty. We would very often do an investigation which had a combination of things. We may think that there has been an offence committed, but, at the same time, the person holds a financial services licence and we would be considering whether or not they should be banned from the industry. We may also want to know whether or not we need to seek some injunctive action to restrain illegally raised funds.

Senator LUDWIG —If this regime is implemented by the government, how will that impact upon your investigatory work and your ability to be able to oversight corporations and do the work you do? Have you been able to make some assessment of that? You will have one area that you will not be able to access.

Ms Macaulay —Yes, that is correct.

Senator LUDWIG —You will have one area where you will only be able to access under a stored communication warrant.

Ms Macaulay —Yes, and then only in certain circumstances. As I said, the ISPs are not our first port of call. We do not routinely go to them, so it would be a limited number of situations where we would say, ‘Do we need to go to an ISP, and can we meet that threshold for getting a search warrant?’ But I can say that it is a real likelihood that those situations will arise.

Senator LUDWIG —You might want to take this on notice, but I would not mind finding out the number of times in the last 12 months or so that you have accessed ISPs for that type of information, for both pecuniary and non-pecuniary penalties.

Ms Macaulay —Yes.

Senator LUDWIG —It would be helpful, thank you.

CHAIR —It would indeed. Mr Inman, did you want to make any further comments in relation to those operational matters?

Mr Inman —If I may, but only to add a further explanation regarding our reluctance to use these terms ‘covert’ and ‘covertly’. At the moment, the connotation attached to these terms, as they appear in the TI Amendment Bill, relates to covert access in the same way that we would refer to police accessing or tapping a telephone call. Our position is that the impact of this bill is not only going to deal with contemporaneous conversations but it is going to impact upon documents that are emailed, and there may be no text in the email other than, ‘Have you seen this?’ Or there may be nothing, because the offer itself is the document or the document may be an Excel spreadsheet they have seen.

In our world, we are providing notices to third parties, as Louise has said, obtaining thousands of documents over a period of a week. Most of those documents have an element of confidentiality attached to them, and many of them probably fall within the definition of a private record under the Privacy Act. We do have obligations across a whole raft of legislation to protect the confidentiality and the privacy of that. I can think of our own legislation, I can think of the Crimes Act, I can think of the Public Service Act, I can think of the Privacy Act. We deal with those obligations very seriously every day and every week in relation to thousands of documents. That is how we perceive we are operating. We do not notify every affected party in those thousands of documents that we obtain from an intermediary, not because we perceive that we are operating covertly, but because that is how we access information. That is the only additional information I would like to add.

Senator STOTT DESPOJA —I have a very quick query. Have you discussed any of your concerns with the ACCC?

Ms Macaulay —No, we have not, but I have read—

Mr Inman —I think we have, through the AGEC forum.

CHAIR —As there are no further questions, Ms Macaulay and Mr Inman, thank you very much for your attendance and thanks to ASIC for your submission.

[11.25 am]