This section applies if, at any time, the responsible entity for a critical telecommunications asset prescribed by the rules for the purposes of this subsection becomes aware that the implementation of a change, or proposed change, by the entity to:
a telecommunications service; or
a telecommunications system;
is likely to have a material adverse effect on the entity’s capacity to comply with its obligation under subsection 30EB(2), to the extent that subsection applies for the purposes of security and the asset.
Note 1: For specification by class, see subsection 13(3) of the Legislation Act 2003.
Note 2: See section 30EE for the kinds of changes covered by this Division.
As soon as reasonably practicable after becoming aware that the change, or proposed change, is likely to have a material adverse effect as mentioned in subsection (1), the responsible entity for the critical telecommunications asset must:
notify the Secretary, in writing, of the change, or of the entity’s intention to implement the proposed change; and
specify the asset in the notification; and
include in the notification a description of the change or proposed change; and
in relation to the change or proposed change—include in the notification any other information of a kind prescribed by the rules for the purposes of this paragraph.
Civil penalty: 300 penalty units.
Information of a kind prescribed by the rules for the purposes of paragraph (2)(d) must be information that relates to changes, or proposed changes, to telecommunications services or telecommunications systems.
If:
the responsible entity for a critical telecommunications asset gives a notification under subsection (2) in relation to a change or proposed change; and
the Secretary considers that further information is required for the Secretary to assess whether, in relation to the change or proposed change, there is a risk to the asset that would be prejudicial to security;
the Secretary may, by written notice given to the entity, require the entity to give the Secretary specified further information by the end of:
44 business days after the day the notice is given; or
such longer period as the Secretary allows.
The Secretary must give any notice under subsection (4) by the end of 22 business days after the day the Secretary receives the notification under subsection (2).
If the Secretary:
gives a notice to the entity under subsection (4) in relation to specified further information; and
considers that information additional to the specified further information is required for the Secretary to make the assessment mentioned in paragraph (4)(b);
the Secretary may give the entity a further notice under subsection (4) in relation to the additional further information. Subsection (5) does not apply to the further notice.
The responsible entity for a critical telecommunications asset must comply with a notice given to the entity under subsection (4).
Note: If the entity is not a legal person, see Division 2 of Part 7.
Civil penalty: 150 penalty units.
An entity is not excused from giving information under subsection (7) on the ground that the information might tend to incriminate the entity or expose the entity to a penalty.
However, in the case of an individual:
the information given; or
giving the information; or
any information, document or thing obtained as a direct or indirect consequence of giving the information;
is not admissible in evidence against the individual:
in criminal proceedings other than proceedings for an offence against section 137.1 or 137.2 of the Criminal Code that relates to this Act; or
in civil proceedings other than proceedings for recovery of a penalty in relation to a contravention of subsection (7) of this section.