The Greens and independent senators say the Coalition's metadata retention laws would make public servants both the perpetrators and victims of intrusive information gathering under the new legislation.

Attorney-General George Brandis has argued the laws - requiring telecommunications companies to keep customer's metadata for two years - were needed for national security agencies to stop terrorists.

On Thursday, looking to toughen privacy provisions, Independent senator Nick Xenophon quoted Fairfax journalist Philip Dorling by saying public servants could get in trouble for revealing "how many paper clips Centrelink had".

The senator also referred to former Customs official Allan Kessing who received a nine-month suspended jail sentence in 2007 after it was found he leaked two confidential reports about weaknesses in security at Sydney Airport.

The leak led to a $240 million security upgrade.

In an interview with ABC TV in 2007, Mr Kessing, who still maintains his innocence, said the government's pursuit of him had a wider effect.

"It sends the message - you'd have to be a fool to take a call from the media or anybody else because you'll always find incompetent people able and willing and eager to hide their incompetence by being vindictive," Mr Kessing said.

Senators worked through numerous amendments on Thursday for a bill which the Greens say worked two ways for federal bureaucrats.

It could expose whistleblowing public servants or allow them to unnecessarily spy on Australians for petty reasons.

The Greens have this week argued existing metadata requests showed a massive number had nothing to do with major crimes.

Greens senator Sarah Hanson-Young said instead they related to "petty requests by agencies such as the Australian Taxation Office and the Department of Human Services to track what ordinary Australians - people not suspected of any serious crime - are doing".

"So, why the red flag on national security? Because that, of course, pushes buttons," Senator Hanson-Young said.

"But knowing where a Centrelink recipient is at a particular time when they make a phone call, and knowing who they make it to, is the type of information that we are talking about."

She said under the new legislation, Australia's attorney-general will be able to add agencies to the list of agencies able to access metadata.

"Further, history shows that the data will be hacked and leaked to the internet - there is no way that the government can pretend that they can guarantee that that would not happen - leading to massive privacy breaches.

"The Department of Immigration and Border Protection have been involved in one of their own scandals of breaching privacy of data, when they accidentally released the names, the numbers, the addresses, the ages and the nationalities of over 10,000 asylum seekers here in Australia.

"Who, overwhelmingly, accessed that data? Governments and sources with international IP addresses.

"That put those 10,000 people who were seeking asylum and protection from their own countries at even more risk because it revealed that they were in Australia seeking protection."