Document ID: chunk:federal_register_of_legislation:F2024L00711:reg:36:p1
Version: federal_register_of_legislation:F2024L00711
Segment Type: reg
Provision Reference: reg 36 (pt 1/2)
Character Range: 69923–72798

36  Commissioner may require compliance reports
 (1) This section applies to the following:
 (a) a pre-assessed relevant electronic service;
 (b) a Tier 1 relevant electronic service.
 (2) The Commissioner may, by written notice to the provider of a service, require the provider to give the Commissioner a report (a compliance report) for the most recent calendar year before the date of the notice (the reporting period).
 (3) A compliance report under subsection (2) must include the following:
 (a) the average number of monthly active users of the service in Australia during the reporting period, and how that number was worked out;
 (b) for a Tier 1 relevant electronic service—details of the most recent risk assessment for the service, including about the plan and methodology required by subsection 8(1);
 (c) for a pre-assessed relevant electronic service—a description of the service's functionalities and features during the reporting period and an explanation why the service is properly characterised as the relevant kind of service;
 (d) details of the steps that the provider took during the reporting period to comply with the requirements of this Part;
 (e) an explanation why the steps taken as mentioned in paragraph (d) were appropriate, having regard, among other things, to the features of the service during the reporting period;
 (f) a statement of the extent to which it was not, during the reporting period, technically feasible or reasonably practicable for the provider to detect or remove class 1A material or class 1B material from the service, and why;
 (g) each of the following:
 (i) the amount of child sexual exploitation material and pro-terror material (identified material) that the provider identified in relation to the services during the reporting period;
 (ii) how the identified material was identified as child sexual exploitation material or pro-terror material;
 (iii) details of the action that the provider took in respect of the identified material;
 (h) the number of complaints made to the provider about the provider's compliance with this industry standard during the reporting period.
Note: For subparagraph (g)(ii), examples of methods for identifying material include end-user reports and use of hashing technologies.
 (4) The report must provide justification for the conclusions in the report.
 (5) The Commissioner may, by notice to the provider, require the compliance report to be in a specified form. The provider must comply with the requirement.
 (6) A compliance report may relate to 2 or more services.
 (7) If information required to be included in a compliance report has otherwise been given to the Commissioner, the provider may refer to the report or notification by which it was given instead of repeating it in the compliance report.
 (8) A compliance report must be given to the Commissioner within