The Association of Superannuation Funds of Australia (ASFA) presented their concerns to the Parliamentary Joint Committee on Intelligence and Security, highlighting the necessity for legislative amendments. They advocate for a rule prohibiting regulatory or enforcement measures based on data provided to the NCSC.
In their submission, ASFA emphasized that "there should be an express legislative provision that states that no regulatory or enforcement action can be taken where information on a relevant incident has been provided to the NCSC." The organization notes that although the current legislation apparently safeguards the use of information for punitive actions, regulators could potentially source identical data independently, triggering actions based on that information.
ASFA reiterated their point, stating, "It must be clear in the legislation and explanatory materials that where a disclosure has been made under this Part, no regulatory or enforcement action can be taken, regardless of where or how the information is acquired.” Such clear guidelines, they argue, are essential for maintaining transparency and encouraging more open reporting from funds.
The statement from ASFA also pointed to their unease over suggested legislative changes that expand current regulatory powers, allowing broader capabilities to mandate information sharing under the Privacy Act. This amendment, as per ASFA, might result in unintended sweeping powers.
With this backdrop, ASFA proposed several measures, including:
- A sunset clause for ministerial authorizations concerning information disclosure directions, ensuring they remain specific, limited, and regularly overseen.
- The application of parliamentary scrutiny and disallowance provisions to ministerial authorizations and Secretary-prompted directions, in line with the established protocols of the Legislation Act 2003 (Cth).
- Deliberation on limiting these new powers, suggesting that criteria for their use should be strictly codified.
These recommendations, ASFA believes, will establish a more balanced framework ensuring both national security and the strategic interest of superannuation funds. The apprehension revolves around maintaining a cooperative environment rather than a punitive or overly-risky one if entities are to report cyber incidents efficiently.
As the discourse around cybersecurity evolves, clear precedent and trust between regulatory bodies and super funds could be pivotal in addressing future cyber threats without compromising the interests of either party.
