Mr. Dale Sunderland:

Any kind of processing and collection of data falls under data protection laws. In the context of data for purposes in the criminal justice sphere, they fall under the law enforcement directive. Retention periods and the security of data all need to be very clearly established. I will highlight the importance again of what we would see as the code of practice under this Bill. The draft heads are very clear in what needs to be considered. The Bill refers to the purposes for which the technology will be used and provides that a data protection impact assessment is mandatory. The Senator may be aware that regardless of the type of processing, the data protection impact assessment requires that a very detailed work-through of all the elements of the data processing is done including the data captured and how they are captured, the purpose of the data, for how long they will be retained and how they will be retained. All of these matters will be worked through in detail. That is a mandatory statutory obligation under the proposed Bill. We would expect that all of those matters should be thoroughly addressed in the specific context for which the data are to be collected and the purpose for which they are collected. I hope this answers the Senator's question.