Telecommunications Act s 306 Law Enforcement Disclosure Record

Records that carriers and carriage service providers must make of disclosures of protected information (Telecommunications Act 1997 (Cth) Part 13, s 276 primary offence) to law enforcement and enforcement agencies: the s 306 record (made within 5 days of the disclosure and kept for 3 years) and the s 306A record for prospective authorisations. A populated record gives the name of the person who disclosed the information, the date of disclosure, the grounds (for example s 280 authorised by law, s 313 assistance), warrant or authorisation details including authorisations under ss 178, 179 or 180 of the Telecommunications (Interception and Access) Act 1979, the authorising officer and date, the requesting agency and request date, the service disclosed and the s 187AA data-set items. The same fields appear in agency authorisation / request notices received by the provider. OAIC guidance, the Acts, ACMA and TIA Act annual report statistics and blank templates are decoys. Overlaps with lawful-interception-warrant, which covers interception and stored communications warrants (TIA Act secrecy) rather than Part 13 disclosure records; a record that cites the TIA Act next to a service number may also fire that classifier.

Type
regex
Engine
boost_regex
Confidence
medium
Confidence justification
Medium: the s 306/306A record fields and TIA Act authorisation sections are specific, but OAIC guidance, carrier compliance manuals and legislation repeat them, and "record of disclosure" is also used for Privacy Act APP 6 notes. Enforce tiers require populated disclosure fields. Agency request and authorisation reference formats vary by agency and are matched only as labelled values containing a digit. 85/75 are heuristic evidence tiers, not measured accuracy; test values are synthetic (service numbers from the ACMA fictitious 0491 570 range).
Jurisdictions
au
Regulations
Telecommunications Act 1997 (Cth), Telecommunications (Interception and Access) Act 1979 (Cth)
Frameworks
PSPF, QGISCF
Data categories
law-enforcement, pii, telecom
Scope
narrow
Risk rating
9
Platform compatibility
Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:(?:section|s\.?)\s?306A?\s+(?:record|register|disclosure)s?|record\s+of\s+(?:the\s+)?disclosure|disclosure\s+(?:record|register)|Part\s+13\s+(?:disclosure|record)s?|(?:section|s\.?)\s?(?:276|280|313)\s+(?:of\s+the\s+)?Telecommunications\s+Act|Telecommunications\s+Act\s+1997|prospective\s+(?:data\s+)?authori[sz]ation|authori[sz]ation\s+under\s+(?:section|s\.?)\s?(?:178|179|180)[AB]?|(?:section|s\.?)\s?(?:178|179|180)[AB]?\s+authori[sz]ation)\b

Corroborative evidence keywords

enforcement agency, criminal law-enforcement agency, police, Australian Federal Police, AFP, QPS, ASIO, TIA Act, 187AA, subscriber details, call charge records

Proximity: 300 characters

Should match

Should not match

Known false positives

References