Re: "Notify security agencies of any changes…"
It's a government agency, not some local store. The reporting requirement will be spelled out as to format and frequency and will not be discretionary. Also, there might be no requirement on the government's part to actually look at the data. My experience with US government entities (none with Australian, though) is that they thrive on collecting data, so killing them with kindness will have the opposite of the intended result.
Biting the hand that feeds IT
