Part 2—Security standards for smart devices

:::box The rules may provide mandatory security standards for products that can directly or indirectly connect to the internet (called relevant connectable products) that will be acquired in Australia in specified circumstances.

If the rules provide a security standard for a product:

• (a) manufacturers must manufacture the product in compliance with the requirements of the security standard if they are aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in the specified circumstances; and
• (b) those manufacturers must also comply with any other obligations relating to the product in the security standard (for example, obligations to publish information about the product); and
• (c) if the product does not comply it must not be supplied in Australia if the supplier is aware, or could reasonably be expected to be aware, that the products will be acquired in Australia in those specified circumstances; and
• (d) those suppliers must supply the product in Australia accompanied by a statement of compliance.

A compliance notice, a stop notice and a recall notice may be given for non‑compliance with obligations in this Part. Internal review may be sought for a decision to issue a notice.

An independent audit of a product may be undertaken to determine compliance with the requirements of a security standard or requirements for the statement of compliance. The Secretary may request the manufacturer or supplier to provide the product, the statement of compliance or both for the purposes of the audit. :::

• (1) This Part applies to a relevant connectable product that is:
• (a) manufactured on or after the commencement of this Part; or
• (b) supplied (other than as second hand goods) on or after the commencement of this Part.
• (2) A relevant connectable product is a product that:
• (a) is an internet‑connectable product or a network‑connectable product; and
• (b) is not exempted under the rules.
• (3) For the purposes of paragraph (2)(b), the rules may specify that:
• (a) classes of products are exempted; or
• (b) particular products are exempted.
• (4) An internet‑connectable product is a product that is capable of connecting to the internet using a communication protocol that forms part of the internet protocol suite to send and receive data over the internet.
• (5) A network‑connectable product is a product that:
• (a) is capable of both sending and receiving data by means of a transmission involving electrical or electromagnetic energy; and
• (b) is not an internet‑connectable product; and
• (c) meets the condition in subsection (6) or (7).
• (6) A product meets the condition in this subsection if it is capable of connecting directly to an internet‑connectable product by means of a communication protocol that forms part of the internet protocol suite.
• (7) Subject to subsections (8) and (9), a product meets the condition in this subsection if:
• (a) it is capable of connecting directly to 2 or more products at the same time by means of a communication protocol that does not form part of the internet protocol suite; and
• (b) it is capable of connecting directly to an internet‑connectable product by means of such a communication protocol (whether or not at the same time as it connects to any other product).
• (8) A product consisting of a wire or cable that is used merely to connect the product to another product does not meet the condition in subsection (7).
• (9) If:
• (a) two or more products are designed to be used together for the purposes of facilitating the use of a computer (within the ordinary meaning of that expression); and
• (b) at least one of the products (the linking product) is capable of connecting directly to an internet‑connectable product (whether the computer or some other product) by means of a communication protocol that does not form part of the internet protocol suite; and
• (c) each of the products (the input products) that is not a linking product is capable of connecting directly to the linking product, or, if there is more than one linking product, to each linking product:
  • (i) wirelessly; and
  • (ii) by means of a communication protocol that does not form part of the internet protocol suite;

each of the input products meets the condition in subsection (7).

• (10) For the purposes of subsections (4) to (9), a product is not prevented from being regarded as connecting directly to another product merely because the connection involves the use of a wire or cable.

• (1) The rules may make provision for, or in relation to, security standards for specified classes of relevant connectable products that will be acquired in Australia in specified circumstances.
• (2) Without limiting subsection (1) a class of relevant connectable products specified for the purposes of that subsection may consist of a particular relevant connectable product or of all relevant connectable products.
• (3) Despite subsection 14(2) of the Legislation Act 2003, the rules may make provision in relation to a matter by applying, adopting or incorporating, with or without modification, any matter contained in an instrument or other writing as in force or existing from time to time.

Manufacturer must comply

• (1) An entity must manufacture a relevant connectable product in compliance with the requirements of the security standard for a class of relevant connectable product that will be acquired in Australia in specified circumstances if:
• (a) the product is included in that class; and
• (b) the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in those circumstances.
• (2) The entity must comply with any other requirements of the security standard that apply to the manufacturer of a product included in that class.
• (3) An entity must not supply a product in Australia that was not manufactured in compliance with the requirements of the security standard for a class of relevant connectable product that will be acquired in Australia in specified circumstances if:
• (a) the product is included in that class; and
• (b) the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in those circumstances.
• (4) The entity must comply with any other requirements of the security standard that apply to the supplier of a product included in that class.

Exception

• (5) However, to the extent that a requirement in the security standard does not relate to any of the matters in subsection (6), an entity is not required to comply with subsections (1) to (4) if the entity is not:
• (a) an entity that is a corporation to which paragraph 51(xx) of the Constitution applies; or
• (b) an entity that is undertaking activities in the course of, or in relation to, trade or commerce with other countries, among the States, between Territories or between a Territory and a State.
• (6) The matters are the following:
• (a) the direct, or indirect, connection of the relevant connectable product to, a telegraphic, telephonic or other like service within the meaning of paragraph 51(v) of the Constitution (including, for example, connection to the internet);
• (b) the direct, or indirect, use by the relevant connectable product of such a service (including, for example, use of the internet);
• (c) measures that would protect the relevant connectable product from an attack effected by means of such a service (including, for example, by means of the internet).

Manufacturer must provide statement of compliance

• (1) An entity that manufactures a relevant connectable product must provide, for the supply of the product in Australia, a statement of compliance with the security standard for a class of relevant connectable product that will be acquired in Australia in specified circumstances if:
• (a) the product is included in that class; and
• (b) the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in those circumstances.
• (2) The entity must retain a copy of the statement of compliance for the period specified in the rules for that class of statements.

Supplier must supply the product with statement of compliance

• (3) An entity that supplies a relevant connectable product in Australia must supply the product with a statement of compliance with the security standard for a class of relevant connectable product that will be acquired in Australia in specified circumstances if:
• (a) the product is included in that class; and
• (b) the entity is aware, or could reasonably be expected to be aware, that the product will be acquired in Australia in those circumstances.
• (4) The entity must retain a copy of the statement of compliance for the period specified in the rules for that class of statements.

Requirements for statement of compliance

• (5) The statement of compliance with the security standard under subsection (1) or (2) must meet the requirements provided by the rules for that class of statements.

Matters relating to the rule making powers

• (6) Without limiting subsection (2), (4) or (5) a class of statements may consist of a statement for a particular relevant connectable product or a particular security standard or all relevant connectable products or all security standards.

• (1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a compliance notice if the Secretary:
• (a) is reasonably satisfied that the entity is not complying with the obligation; or
• (b) is aware of information that suggests that the entity may not be complying with the obligation.
• (2) The compliance notice must:
• (a) set out the name of the entity to which the notice is given; and
• (b) set out brief details of the non‑compliance or possible non‑compliance; and
• (c) specify action within the entity’s control that the entity must take in order to address the non‑compliance or possible non‑compliance; and
• (d) specify a reasonable period within which the entity must take the specified action; and
• (e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action; and
• (f) explain what may happen if the entity does not comply with the notice; and
• (g) explain how the entity may seek review of the decision to issue the notice; and
• (h) set out any other matters prescribed by the rules.
• (3) Before giving the notice to the entity, the Secretary must:
• (a) notify the entity that the Secretary intends to give the notice to the entity; and
• (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
• (4) Only one compliance notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance, or possible non‑compliance, with an obligation under section 15 or 16.

• (1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a stop notice if:
• (a) the entity has been given a compliance notice under section 17 in relation to the non‑compliance with the obligation; and
• (b) the Secretary is reasonably satisfied that:
  • (i) the entity has not complied with the compliance notice; or
  • (ii) actions taken by the entity to rectify non‑compliance with the obligation (whether in accordance with the compliance notice or otherwise) are inadequate to rectify the non‑compliance.
• (2) The stop notice must:
• (a) set out the name of the entity to which the notice is given; and
• (b) set out brief details of the non‑compliance; and
• (c) specify action within the entity’s control that the entity must take, or refrain from taking, in order to address the non‑compliance; and
• (d) specify a reasonable period within which the entity must take the specified action or refrain from taking the specified action; and
• (e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action or refrained from taking the specified action; and
• (f) explain what may happen if the entity does not comply with the notice; and
• (g) explain how the entity may seek review of the decision to issue the notice; and
• (h) set out any other matters prescribed by the rules.
• (3) Before giving the notice to the entity, the Secretary must:
• (a) notify the entity that the Secretary intends to give the notice to the entity; and
• (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
• (4) Only one stop notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance with an obligation under section 15 or 16.

• (1) The Secretary may give an entity that must comply with an obligation under section 15 or 16 a recall notice if:
• (a) the entity has been given a stop notice under section 18 in relation to the non‑compliance with the obligation; and
• (b) the Secretary is reasonably satisfied that:
  • (i) the entity has not complied with the stop notice; or
  • (ii) actions taken by the entity to rectify the non‑compliance with the obligation (whether in accordance with the compliance notice or otherwise) are inadequate to rectify the non‑compliance.
• (2) The recall notice must:
• (a) set out the name of the entity to which the notice is given; and
• (b) set out brief details of the non‑compliance; and
• (c) specify action that the entity must take to do any or all of the following:
  • (i) ensure, to the extent within the entity’s control, the product is not acquired in Australia;
  • (ii) ensure, to the extent within the entity’s control, that the product is not supplied to suppliers for supply in Australia;
  • (iii) arrange for the return, within a specified reasonable period, of the product to the entity, or if the entity is not the manufacturer of the product, the manufacturer of the product; and
• (d) specify a reasonable period within which the entity must take the specified action; and
• (e) if the Secretary considers it appropriate—specify a reasonable period within which the entity must provide the Secretary with evidence that the entity has taken the specified action; and
• (f) explain what may happen if the entity does not comply with the notice; and
• (g) explain how the entity may seek review of the decision to issue the notice; and
• (h) set out any other matters prescribed by the rules.
• (3) Before giving the notice to the entity, the Secretary must:
• (a) notify the entity that the Secretary intends to give the notice to the entity; and
• (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
• (4) Only one recall notice may be given to an entity in relation to a particular instance of the entity’s non‑compliance with an obligation under section 15 or 16.

If an entity fails to comply with a recall notice, the Minister may publish the following information on the Department’s website, or in any other way the Minister considers appropriate:

• (a) the identity of the entity;
• (b) details of the product;
• (c) details of the non‑compliance;
• (d) risks posed by the product relating to the non‑compliance;
• (e) any other matters prescribed by the rules.

Variation

• (1) The Secretary may, by notice in writing given to an entity, vary a compliance notice, stop notice or recall notice given under this Part to the entity if the Secretary is reasonably satisfied that the variation is required:
• (a) in order to rectify an error, defect or ambiguity in the notice; or
• (b) to adequately rectify the non‑compliance, or possible non‑compliance, to which the notice relates.
• (2) Before giving the notice to the entity under subsection (1), the Secretary must:
• (a) notify the entity that the Secretary intends to give the notice to the entity; and
• (b) give the entity a specified period (which must not be shorter than 10 days) to make representations about the giving of the notice.
• (3) A varied compliance notice, stop notice or recall notice has the same effect as the original notice for the purposes of this Part.

Revocation

• (4) The Secretary may, by notice in writing given to an entity, revoke a compliance notice, stop notice or recall notice given under this Part to the entity if the Secretary is no longer satisfied that the grounds for issuing the notice were met.
• (5) If a compliance notice, stop notice or recall notice, relating to non‑compliance or possible non‑compliance by an entity with an obligation, is revoked under subsection (4), no further notices may be issued under this Part in relation to that non‑compliance.

• (1) An entity may apply, in writing, to the Secretary for review (an internal review) of a decision:
• (a) to give the entity a compliance notice under section 17; or
• (b) to give the entity a stop notice under section 18; or
• (c) to give the entity a recall notice under section 19; or
• (d) to vary, under section 21, a notice given to the entity.
• (2) An application for an internal review must be made within 30 days after the day on which the notice was given to the entity.
• (3) The decision‑maker for the internal review is:
• (a) the Secretary; or
• (b) if the Secretary made the decision personally—a person:
  • (i) to whom the power to issue a notice of that kind has been delegated under section 86; and
  • (ii) that was not involved in the making of the Secretary’s decision.
• (4) Within 30 days after the application is received, the decision‑maker must:
• (a) review the decision; and
• (b) affirm, vary or revoke the decision; and
• (c) if the decision is revoked—make such other decision (if any) that the decision‑maker thinks appropriate.
• (5) The decision‑maker for the reviewable decision must, as soon as practicable after making a decision under subsection (4), give the applicant a written statement of the decision‑maker’s reasons for the decision.

• (1) If an entity must comply with an obligation in section 15 or 16 in relation to a relevant connectable product, the Secretary may engage an appropriately qualified and experienced expert to carry out an independent examination of the product to determine either or both of the following:
• (a) whether the product complies with the security standard for the class of relevant connectable product;
• (b) whether the statement of compliance for the product complies with the requirements of section 16.
• (2) The expert may examine the product, for example, by doing any of the following:
• (a) opening any package in which the product is contained;
• (b) operating the product;
• (c) testing or analysing the product, including through the use of electronic equipment;
• (d) if the product contains a record or document—reading the record or document either directly or with the use of an electronic device;
• (e) taking photographs or video recordings of the product.

Request for product and statement of compliance

• (3) For the purposes of the examination, the Secretary may request, by notice in writing, the entity to provide the product, or the statement of compliance for the product, or both.
• (4) The notice must:
• (a) specify the product; and
• (b) if the entity is not the manufacturer—specify the manufacturer of the product (if known); and
• (c) specify a reasonable period within which the entity must provide the notice; and
• (d) specify the period for which the product will be retained for testing; and
• (e) specify the requirements of the security standard that the product will be tested against; and
• (f) explain the kind of testing or analysis that will be done; and
• (g) explain what may happen if:
  • (i) the entity does not comply with the notice; or
  • (ii) the entity does not comply with its obligations in section 15 or 16 in relation to the product; and
• (h) set out any other matters prescribed by the rules.

Compensation

• (5) An entity is entitled to be paid by the Commonwealth reasonable compensation for complying with a request under subsection (3).

This Part has no effect to the extent (if any) that its operation would result in an acquisition of property (within the meaning of paragraph 51(xxxi) of the Constitution) from a person otherwise than on just terms (within the meaning of that paragraph).