The Association of Superannuation Funds of Australia (ASFA) has presented this viewpoint to a Parliamentary Committee, arguing that such legislative measures are crucial to prevent regulators from acting independently on data voluntarily disclosed by super funds facing cyber breaches.

According to ASFA's submission to the Parliamentary Joint Committee on Intelligence and Security, "there should be an express legislative provision that states that no regulatory or enforcement action can be taken where information on a relevant incident has been provided to the NCSC."

ASFA emphasized that while the existing legislation does not currently allow for this information to be used for enforcement, there are loopholes through which regulators could obtain the same data from other sources and still initiate action.

The organization insists that, "It must be clear in the legislation and explanatory materials that where a disclosure has been made under this Part, no regulatory or enforcement action can be taken, regardless of where or how the information is acquired."

In their commentary, ASFA also highlighted apprehensions about the expanding regulatory powers arising from proposed legislative revisions. These changes permit authorities to demand sensitive information protected under the Privacy Act from specifically targeted entities.

Warning against this widening of authority, ASFA stressed the importance of limits and oversight, suggesting that increased powers could inadvertently lead to privacy infringements and unintended regulatory burdens. The association has thus put forward several recommendations to keep these powers in check:

  • Require Ministerial authorisations for directions from the Secretary to have a defined expiration to ensure they remain focused, limited and undergo consistent oversight.
  • Ensure Ministerial authorisations and directives from the Secretary are put under the scrutiny and disallowance processes as found in the Legislation Act 2003 (Cth).
  • Consider refining these powers further by legislating a detailed set of necessary preconditions to be met prior to their exertion.

This discussion surfaces as the financial sectors brace themselves for a rapidly evolving threat landscape, necessitating a balance between necessary regulatory oversight and preserving operational flexibility and privacy for entities.

Initially reported in Financial Standard, ASFA's stance signifies a push towards securing a collaborative and non-punitive environment to deal with cyber threats, prioritizing information-sharing without the risk of regulatory repercussions.