This Declaration is the Restricted Access Systems Declaration 2007.

This Declaration commences on the commencement of Parts 1 and 2 of Schedule 1 to the Communications Legislation Amendment (Content Services) Act 2007.

3 Definitions

(1) In this Declaration:

Act means the Broadcasting Services Act 1992.

age restricted content means either or both of the following:

(a) MA 15+ content;

(b) R 18+ content.

applicant means a person who makes a request for access to age restricted content under paragraph 6 (1) (a) or subsections 11 (1) or (2).

(2) In this Declaration, the following expressions have the same meaning as in Schedule 7 to the Act:

 access‑control system

 designated content/hosting service provider

 MA 15+ content

 R 18+ content

 restricted access system

 service.

4 Purpose of Declaration

(1) Under subclause 14 (1) of Schedule 7 to the Act, ACMA may, by legislative instrument, declare that a specified access‑control system is a restricted access system in relation to content for the purposes of Schedule 7 to the Act.

(2) This Declaration declares specified access‑control systems to be restricted access systems in relation to content for the purposes of Schedule 7 to the Act.

Part 2 MA 15+ content

5 Minimum requirements of access‑control system — MA 15+ content

(1) For subclause 14 (1) of Schedule 7 to the Act, an access‑control system is specified in relation to MA 15+ content if it:

(a) requires an application for access to MA 15+ content, as described in section 6; and

(b) provides warnings and safety information for MA 15+ content, as required by section 7; and

(d) includes the quality assurance measures for MA 15+ content mentioned in section 9.

(2) A specified access‑control system is declared to be a restricted access system for MA 15+ content.

6 Applying for access to MA 15+ content

(1) The access‑control system must require an applicant who seeks access to MA 15+ content:

(a) to apply for access; and

(b) to provide a declaration that the applicant is at least 15 years of age.

(2) The application must be made:

(a) in writing; or

(b) in electronic form; or

(3) The declaration must be provided:

(a) in writing; or

(b) in electronic form.

7 Provision of warnings

For each application for access under section 6, the access‑control system must provide to an applicant:

(a) a warning about the nature of MA 15+ content; and

(b) safety information about how a parent or guardian may control access to MA 15+ content by persons under 15 years of age.

8 Limiting access

(1) Subject to subsections (2) and (3), the access‑control system must not provide access to MA 15+ content unless the access‑control system:

(a) has verified that, at the time the applicant applies for access to the content, the applicant has complied with section 6; and

(b) has provided the warning and safety information described in section 7.

(2) The access‑control system may allow an applicant access to MA 15+ content if the applicant has been provided with a Personal Identification Number, or another means of limiting access by other persons to the content, that allows the access‑control system to verify that:

(a) the applicant has previously complied with section 6; and

(b) the access‑control system has previously provided the applicant with the warning and safety information described in section 7.

(3) The access‑control system may allow an applicant access to MA 15+ content if:

(a) the applicant has previously submitted to:

(i) the designated content/hosting service provider providing the content; or

(ii) a person acting on behalf of the designated content/hosting service provider providing the content;

a declaration that the applicant is at least 15 years of age, whether or not the declaration was made in relation to an application for access to MA 15+ content; and

(b) on the first occasion on which the person applies for access to MA 15+ content, the access‑control system has provided the person with the warning and safety information described in section 7.

(4) For subsection (3):

providing the content includes providing, hosting or providing a link to content.

9 Quality assurance measures

The access‑control system must include measures that will be taken to remove, without delay, an applicant’s access to MA 15+ content if the applicant has been given access in contravention of section 8.

Part 3 R 18+ content

10 Minimum requirements of access‑control system — R 18+ content

(1) For subclause 14 (1) of Schedule 7 to the Act, an access‑control system is specified in relation to R 18+ content and MA 15+ content if it:

(a) requires an application for access to R 18+ content, as described in section 11; and

(b) provides warnings and safety information for R 18+ content, as required by section 12; and

(d) limits access to:

(i) R 18+ content; or

(ii) R 18+ content and MA 15+ content;

as required by section 14; and

(e) includes a risk analysis, as required by section 15; and

(f) includes quality assurance measures for R 18+ content, as required by section 16; and

(g) meets the record keeping requirements for R 18+ content mentioned in section 17.

(2) A specified access‑control system is declared to be a restricted access system for R 18+ content or for MA 15+ content and R 18+ content.

11 Applying for access to R 18+ content

(1) The access‑control system must require an applicant who seeks access to R 18+ content to apply for access.

(2) The access‑control system must require an applicant who seeks access to R 18+ content and MA 15+ content to apply for access.

(3) The application must be made:

(a) in writing; or

(b) in electronic form; or

12 Provision of warnings

For each application for access under section 11, the access‑control system must provide to an applicant:

(a) a warning about the nature of R 18+ content; and

(b) safety information about how a parent or guardian may control access to R 18+ content by persons under 18 years of age.

13 Age verification

(1) Unless subsection 14 (2) or (3) applies, the access‑control system must verify that the applicant is at least 18 years of age by:

(a) requiring the applicant to provide evidence that the applicant is at least 18 years of age; and

(b) applying the risk analysis described in section 15.

(2) The evidence of age provided under paragraph (1) (a) must be sufficient to satisfy the risk analysis described in section 15.

14 Limiting access

(1) Subject to subsections (2) and (3), the access‑control system must not provide access to R 18+ content, or to R 18+ content and MA 15+ content, unless the access‑control system:

(a) has verified that, at the time the applicant applies for access to the content, the applicant has complied with section 11; and

(b) has provided the warning and safety information described in section 12; and

(2) The access‑control system may allow an applicant access to R 18+ content, or to R 18+ content and MA 15+ content, if the applicant has been provided with a Personal Identification Number, or another means of limiting access by other persons to the content, that allows the access‑control system to verify that:

(a) the applicant has previously complied with section 11; and

(b) the access‑control system has previously provided the applicant with the warning and safety information described in section 12; and

(c) the access‑control system has previously verified that the applicant is at least 18 years of age, as required by section 13.

(3) The access‑control system may allow an applicant access to R 18+ content, or to R 18+ content and MA 15+ content, if:

(a) the applicant has previously provided to:

(i) the designated content/hosting service provider providing the content; or

(ii) a person acting on behalf of the designated content/hosting service provider providing the content;

evidence that the applicant is at least 18 years of age, whether or not the evidence was provided in relation to an application for access to age restricted content; and

(b) the evidence of age provided under paragraph (3) (a) is sufficient to satisfy the risk analysis described in section 15; and

(c) on the first occasion on which the person applies for access to R 18+ content, or to R 18+ content and MA 15+ content, the access‑control system has provided the person with the warning and safety information described in section 12.

(4) For subsection (3):

providing the content includes providing, hosting or providing a link to content.

15 Risk analysis

(1) The access‑control system must include a risk analysis.

(2) The risk analysis must identify and assess the risk that a kind of evidence of age submitted to the access‑control system could be held or used by:

(a) a person other than the person it purports to identify; or

(b) a person who is younger than the age which the form of evidence attributes to the person being identified.

(3) The risk analysis must also take into account:

(a) the kind of evidence of age provided to the access‑control system; and

(b) the manner in which the evidence of age is received by the access‑control system.

16 Quality assurance measures

The access‑control system must include:

(a) measures that will be taken to remove, without delay, an applicant’s access to R 18+ content, or to R 18+ content and MA 15+ content, if the applicant has been given access in contravention of section 14; and

(b) procedures for conducting periodic internal review of the effectiveness of:

(i) the risk analysis required by section 15; and

(ii) the application of the risk analysis in section 13.

17 Age verification records

(1) The access‑control system must make provision for the keeping of records to demonstrate how the age of the applicant has been verified in relation to each applicant who has been granted access to R 18+ content.

(2) The records must:

(a) be kept in accordance with the National Privacy Principles contained in the Privacy Act 1988; and

(b) be kept for a period of 2 years starting on the day on which the record is made; and

(d) be destroyed as soon as practicable after the end of the period mentioned in paragraph (b), unless subsection (3) applies.

(3) Paragraph (2) (d) does not apply to a record if:

(a) ACMA has required, or given notice that it requires, access to the record for a purpose relating to this Declaration or Schedule 7 to the Act; and

(b) at the end of the period of 2 years mentioned in paragraph (2) (b), ACMA has not advised the designated content/hosting service provider providing the content that ACMA no longer requires access to the record for that purpose.

(4) For subsection (3):

providing the content includes providing, hosting or providing a link to content.

(5) If subsection (3) applies, the record must be destroyed as soon as practicable after the day on which ACMA gives notice, in writing, that ACMA no longer requires access to the record.

(6) For subsection (1), a record is sufficient if it contains information that verifies the matters mentioned in section 13 or subsection 14 (3).