Telecommunications Integrated Public Number Database Scheme 2017

EXPLANATORY STATEMENT

Approved by the Australian Communications and Media Authority

Telecommunications Act 1997

Telecommunications Integrated Public Number Database Scheme 2017

Authority

The Australian Communications and Media Authority (the ACMA) has made the Telecommunications Integrated Public Number Database Scheme 2017 (the instrument) under section 295A of the Telecommunications Act 1997 (the Act).

Under section 295A of the Act, the ACMA must make a scheme for the granting of authorisations to access the integrated public number database (IPND) for the purposes of paragraph 285(1A)(d) of the Act.  Those purposes are the publication and maintenance of a public number directory and the conduct of research of a kind specified in a legislative instrument, by the Minister, where the Minister is satisfied that the kind of research is in the public interest.

The Telecommunications Integrated Public Number Database Scheme 2007 is due to ‘sunset’ (i.e. be automatically repealed) on 1 April 2017, under Part 6 of the Legislation Act 2003 (the LA).  Following review, and consultation as described below, the ACMA formed the view that most of the provisions contained within the Telecommunications Integrated Public Number Database Scheme 2007 were operating effectively and efficiently, and continued to form a necessary and useful part of the legislative framework.  The instrument largely replicates the Telecommunications Integrated Public Number Database Scheme 2007, although the provisions relating to research authorisations have been amended to facilitate research industry management of access to IPND information and to allow the ACMA to grant a research authorisation on an ongoing basis.  These changes are supplemented by strict conditions on the uses which the holder of the research authorisation may make of that information.

Purpose and operation of the instrument

Part 13 of the Act sets out a regime for protecting the confidentiality of certain information about the customers of carriage service providers, including information held in the IPND. 

The IPND is an industry wide centralised database containing records of all Australian telephone numbers and associated customer details. The information in the IPND includes customer names, addresses, phone numbers, whether the service is fixed or mobile, and whether the service is listed or unlisted. The IPND was established and is maintained by Telstra in accordance with a condition of its carrier licence under the Carrier Licence Conditions (Telstra Corporation Limited) Declaration 1997.

Under the Act, the ability of Telstra, as the IPND Manager, to disclose information to another person in order for that person to publish and maintain a directory of public numbers or to conduct research of a kind that has been specified by the Minister, is conditional upon that person holding an authorisation that has been granted by the ACMA to receive the IPND information.  The Telecommunications Integrated Public Number Database Scheme 2007 was introduced in 2007 to address concerns that IPND information was being used for purposes not authorised under the Act, such as marketing, data cleansing and debt collection.

In accordance with section 295B of the Act, the instrument makes provision for and in relation to the following matters:

(a)    the making of applications for authorisations;

(b)    the assessment of applications;

(c)    the period for which authorisations are to be in force;

(d)    the notification of decisions under the scheme; and

(e)    the requirement for applicants for an authorisation to specify the purpose for which the authorisation is sought.

The instrument also imposes conditions on the grant of an authorisation in accordance with section 295F of the Act.  

Section 285 of the Act limits the IPND data available under the instrument to listed numbers, which generally do not include mobile numbers.

The instrument is supported by a range of ministerial instruments made under Part 13 of the Act, which the ACMA is to have regard to in its consideration of whether to grant authorisations under the instrument.  The instruments specify:

>     the criteria that the ACMA is required to consider in deciding authorisation applications under the scheme;[1]

>     the conditions that apply to all IPND authorisations or to particular kinds of IPND authorisations;[2]

>     the requirements that have to be met in order to satisfy the definition of a public number directory;[3]

>     additional information that can be included in a public number directory;[4] and

>     the types of research permitted under the scheme.  Those are:

>              research, or the compilation or analysis of statistics, relevant to public health, including epidemiological research, where the research is not conducted for a primarily commercial purpose;

>              research regarding an electoral matter conducted by a registered political party, a political representative, a candidate in an election for Parliament or a local government authority or a person on behalf of such a party, representative or candidate, where the research is not conducted for a primarily commercial purpose; and

>              research conducted by or on behalf of the Commonwealth, a Commonwealth authority or other prescribed agency which will contribute to the development of public policy, where the research is not conducted for a primarily commercial purpose.[5]

Under the Telecommunications Integrated Public Number Database Scheme 2007 the ACMA granted seven authorisations enabling access to the IPND by a public number directory publisher for the purposes of the publication and maintenance of a public number directory.  The ACMA also granted two authorisations granting access to the IPND for specified research purposes (research authorisations).  The two research authorisations are no longer current.  Transitional provisions contained at Part 6 of the instrument will mean that public number directory publishers who hold a current authorisation under the Telecommunications Integrated Public Number Database Scheme 2007 will continue to hold those authorisations as if those authorisations had been granted under the instrument.  Those authorisation holders will be required to continue to comply with obligations under the instrument, the Act and related instruments, including those specified by the Minister.

A provision-by-provision description of the instrument is set out in the notes at Attachment A.

The instrument is a legislative instrument for the purposes of the LA. 

Documents incorporated by reference

This instrument incorporates the following Acts and legislative instruments (including by the adoption of definitions), or otherwise refers to them:

• the Australian Communications and Media Authority Act 2005;
• the Australian Information Commissioner Act 2010;
• the Do Not Call Register Act 2006;
• the Privacy Act 1988;
• the Spam Act 2003;
• the Telecommunications Act 1997;
• the Telecommunications Integrated Public Number Database Scheme 2007;
• the Telecommunications (Integrated Public Number Database Scheme—Conditions for Authorisations) Determination 2007 (No. 1);
• the Telecommunications (Integrated Public Number Database Scheme—Criteria for Deciding Authorisation Applications) Instrument 2007 (No. 1);
• the Telecommunications (Integrated Public Number Database—Permitted Research Purposes) Instrument 2007 (No. 1);
• the Telecommunications (Integrated Public Number Database—Public Number Directory Requirements) Instrument 2007 (No. 1); and
• the Telecommunications (Integrated Public Number Database—Public Number Directory Additional Information) Instrument 2007 (No. 1).

The Acts and legislative instruments listed above may be obtained from the Federal Register of Legislation (http://www.legislation.gov.au).  The Acts listed above are incorporated as in force from time to time, in accordance with section 10 of the Acts Interpretation Act 1901 and subsection 13(1) of the LA. The legislative instruments listed above are incorporated as in force from time to time, in accordance with section 1.5 of the instrument and subsection 14(1) of the LA.

Consultation

Before the instrument was made, the ACMA was satisfied that consultation was undertaken to the extent appropriate and reasonably practicable, in accordance with section 17 of the LA. 

The ACMA consulted with industry stakeholders and the general public on the making of the instrument. Between 19 December 2016 and 31 January 2017, the ACMA conducted a public consultation process inviting submissions on the proposed changes through the release of a draft instrument and a consultation paper on the ACMA’s website.

As required under section 295M of the Act, the ACMA also consulted the Information Commissioner and Secretary of the Attorney-General’s Department on the proposed instrument. The ACMA also consulted the Department of Communications and the Arts (the Department), the IPND Manager and the Research Industry Council of Australia. 

The consultation paper outlined the following proposed changes to improve the operation of the scheme:

• allowing the ACMA to grant individual researchers and representative bodies for researchers with ongoing access to IPND information, subject to requirements such as completion of a privacy impact assessment;
• facilitating the management of applications from researchers to a research entity that has been granted an authorisation to access IPND information on an ongoing basis, in controlled circumstances;

• making minor changes to simplify and improve the administration of the scheme.

The proposed changes take into account recommendations made by the Department following its review into the effectiveness of, and continued need for, the IPND in April 2015.[6]

The consultation paper also explained the sunsetting process and the ACMA’s preliminary view that most of the provisions in the Telecommunications Integrated Public Number Database Scheme 2007 are operating efficiently and effectively but changes could be made to improve access to the IPND to assist researchers to produce quality research that will be of benefit to the public.

The ACMA received 7 submissions from representatives of the research industry and telecommunications industry, a peak consumer representative body and other interested parties. The ACMA considered all relevant issues raised when making the instrument.

The key issues to emerge from the consultation process were matters related to the further protection of privacy as part of the proposed changes. In response to those submissions, the ACMA made further amendments to the instrument in consultation with relevant parties and in line with the intent of policy and legislative requirements. The subsequent changes incorporate additional appropriate privacy safeguards and stronger governance arrangements to mitigate privacy risks.

Regulatory impact assessment

A preliminary assessment of the proposal to make the instrument was conducted by the Office of Best Practice Regulation (OBPR), based on information provided by the ACMA, for the purposes of determining whether a Regulation Impact Statement (RIS) would be required.  OBPR advised that a RIS would not be required because the instrument was expected to have a minor and machinery regulatory impact (exemption number 21271).

Statement of compatibility with human rights

Subsection 9(1) of the Human Rights (Parliamentary Scrutiny) Act 2011 requires the rule-maker in relation to a legislative instrument to which section 42 (disallowance) of the LA applies to cause a statement of compatibility to be prepared in respect of that legislative instrument. 

The statement of compatibility set out in Attachment B has been prepared to meet that requirement.

Attachment A

Notes to the Telecommunications Integrated Public Number Database Scheme 2017

Part 1–Preliminary

Section 1.1 Name

This section provides for the instrument to be cited as the Telecommunications Integrated Public Number Database Scheme 2017 (the scheme).

Section 1.2 Commencement

This section provides for the scheme to commence on the later of:

• the day after the scheme is registered on the Federal Register of Legislation;
• the day on which the Telecommunications Integrated Public Number Database Scheme 2007 (F2007L00813) is repealed. 

The Telecommunications Integrated Public Number Database Scheme 2007 is due to be automatically repealed by section 50 of the Legislation Act 2003 on 1 April 2017.

Both of the events mentioned in the section must occur before the scheme commences.

Section 1.3 Authority

This section identifies the provision that authorises the making of the scheme, namely section 295A of the Telecommunications Act 1997 (the Act).

Section 1.4 Definitions

This section defines a number of key terms used throughout the scheme. 

A number of other expressions used in the scheme are defined in the Act.

Section 1.5 References to other instruments

This section provides that in the scheme, unless the contrary intention appears:

• a reference to any other legislative instrument is a reference to that other legislative instrument as in force from time to time; and
• a reference to any other kind of instrument is a reference to that other instrument as in force from time to time.

Part 2–Application of the scheme

Section 2.1 Application

This section sets the scope of the scheme by providing that it applies to a person seeking to be granted an authorisation for the purposes of paragraph 285(1A)(d) of the Act and to a holder of an authorisation for those purposes.

An authorisation is granted under the scheme to permit the use and disclosure of certain information (customer data) originating from the integrated public number database (the IPND) relating to the listed telephone numbers (public numbers) of persons who are supplied with carriage services (customers) or their businesses.  The permission to use and disclose customer data does not extend to information relating to unlisted public numbers. 

An authorisation permits the use and disclosure of customer data for purposes connected with:

• the publication and maintenance of a public number directory (PND); or
• the conduct of research of a kind specified by the Minister in a legislative instrument under subsection 285(3) of the Act (research).[7]

Section 2.2 Object of the scheme

This section identifies the object of the scheme which is to provide for:

• the grant of authorisations for the purposes of paragraph 285(1A)(d) of the Act;
• the imposition of conditions on the grant of authorisations in accordance with section 295F of the Act; and
• the variation and revocation of authorisations in accordance with section 295G of the Act.

Part 3–Authorisation to use and disclose customer data–public number directory publishers

Part 3 sets out the application and assessment processes for the grant of authorisations to use and disclose customer data to publish and maintain a PND, the duration of such authorisations, how the duration may be extended and the conditions to which the authorisations are subject.

There are two kinds of authorisations granted under Part 3, namely provisional authorisations and final authorisations.

A person who wishes to use and disclose customer data to publish and maintain a PND must first apply to the ACMA for the grant of a provisional authorisation, providing details of the proposed PND to be developed. If a provisional authorisation is granted, the holder of the authorisation must make arrangements with the person who for the time being maintains the IPND (the IPND Manager) to access a restricted version of customer data (provisional IPND data source) for use in developing a sample PND. 

If the holder of the provisional authorisation wishes to continue to use and disclose customer data to publish and maintain a PND, the holder must apply to the ACMA for the grant of a final authorisation (by giving access to the sample PND developed) before the provisional authorisation ends. The ACMA will consider the sample PND developed by the holder of the provisional authorisation as part of the assessment process for the grant of a final authorisation.   

The holder of a final authorisation may make arrangements with the IPND Manager for the ongoing supply of customer data (which is not as limited as a provisional IPND data source and includes regular updates) to publish and maintain a PND.

The holder of a provisional authorisation or a final authorisation is treated in the scheme as being a public number directory publisher.

Division 1 Application of Part 3

Section 3.1 Application

This section provides that Part 3 applies to a person seeking to be granted an authorisation to use and disclose customer data to publish and maintain a PND, and to a public number directory publisher.

Division 2 Provisional authorisation

Subdivision A  Application for provisional authorisation

Section 3.2 Making an application

This section sets out the process for making an application for the grant of a provisional authorisation.

The section imposes the following application requirements:

• The application must be made to the ACMA using the form approved by the ACMA which is available on its website at www.acma.gov.au (subsections (1) and (2)).
• The application must be accompanied by any applicable charge fixed by a determination under section 60 of the Australian Communications and Media Authority Act 2005 (the ACMA Act) (paragraph (3)(a)).
• The application must also be accompanied by a completed privacy impact assessment using the form approved by the ACMA which is available on its website (paragraph (3)(b)).[8]  

Section 3.3 Decision on application

This section enables the ACMA to ask an applicant in writing to give it further information about an application for the grant of a provisional authorisation (subsection (1)). The section requires the applicant to give the information to the ACMA within 90 days and provides that the ACMA may treat the application as withdrawn if the information is not received within 90 days (subsections (2) and (3)).

The section provides that the ACMA must, unless the application is withdrawn, decide whether to grant a provisional authorisation (subsection (4)). 

The section requires the ACMA to grant a provisional authorisation if it:

• has applied the criteria specified by the Minister in a legislative instrument under subsection 295N(1) of the Act;[9]
• has had regard to any other matters the ACMA considers relevant;
• is reasonably satisfied that the applicant has demonstrated that the proposed PND will satisfy the requirements of the definition of public number directory in subsection 285(2) of the Act, as modified by any legislative instrument that the Minister may make under subsection 285(4), (5) or (6) of the Act;[10] and
• is reasonably satisfied that the applicant is likely to comply with the other relevant requirements (subsection (5)).  

The section provides that the ACMA must, as soon as practicable after making its decision, notify the applicant in writing of the decision and (for a refusal to grant a provisional authorisation) the reasons for the decision (paragraph (6)(a)).

The section provides that for a decision to grant a provisional authorisation, the ACMA must also notify the IPND Manager in writing of the decision as soon as practicable after making the decision (paragraph (6)(b)), and give the applicant (who is treated in the scheme as being a public number directory publisher) written confirmation of that notification as soon as practicable after it has occurred (subsection (7)).[11]

Section 3.4 Duration of provisional authorisation

This section provides that a provisional authorisation starts on the day on which the IPND Manager supplies the provisional IPND data source to the public number directory publisher and has effect for a period of 90 days.

It is expected that this is sufficient time for the public number directory publisher to develop a sample PND and to demonstrate that the type of directory the publisher intends to develop under a final authorisation will satisfy the requirements of the definition of public number directory in subsection 285(2) the Act, as modified by any legislative instrument that the Minister may make under subsection 285(4), (5) or (6) of the Act, and that the publisher is likely to comply with the other relevant requirements.

The duration of a provisional authorisation may be extended in accordance with Subdivision B and subsection 3.9(3), and may be ended earlier in accordance with Part 5.  

Section 3.5 Conditions to which provisional authorisation is subject

This section sets out the conditions to which a provisional authorisation is subject under the scheme (subsection (1)).

The conditions are as follows:

• The public number directory publisher must:

• make arrangements with the IPND Manager for the supply of a provisional IPND data source as soon as practicable after receiving written confirmation from the ACMA that the IPND Manager has been notified of the decision to grant a provisional authorisation; and
• notify the ACMA in writing of the date on which the publisher receives the provisional IPND data source within 10 business days[12] after the start of the provisional authorisation (subsection (2)).

• The public number directory publisher must develop a sample PND within a period of 90 days starting on the day on which the provisional authorisation starts (subsection (3)).
• The public number directory publisher must not publish a sample PND (subsection (4)).  The publisher will, however, be able to use the architecture of a sample PND that it has developed as the basis for a PND that the publisher may publish if the ACMA grants a final authorisation.
• The public number directory publisher must not disclose information held in a provisional IPND data source or a sample PND to any person other than the ACMA or the publisher’s personnel, unless the disclosure is authorised or required by or under law (subsection (5)).
• The public number directory publisher must not use the customer data in a provisional IPND data source for any purpose other than the development of a sample PND (subsection (6)).
• The ACMA may specify in writing other conditions to which the authorisation is subject (paragraph (7)(a)). The ACMA may also vary or remove any condition so specified (paragraph (7)(b)). The ACMA must notify the public number directory publisher in writing of any specified condition, or of any variation or removal of such a condition, as soon as practicable and before the condition, or the variation or removal, is expressed to take effect (paragraph (7)(c)).  The ACMA must also notify the IPND Manager in writing of any specified condition, or of any variation or removal of such a condition, that is relevant to its role as IPND Manager (paragraph (7)(d)).[13]
• The public number directory publisher must comply with the relevant requirements, which are:

• the requirements of the Act and of any legislative instruments made under the Act (including the scheme) that apply to the publisher; and
• any conditions of the authorisation (see subsection (8) and the definition of relevant requirements in section 1.4 of the scheme).[14]

• The public number directory publisher must take all reasonable steps to ensure that any person who is one of its personnel:

• is made aware of the publisher’s obligations to meet the relevant requirements;
• cooperates with the publisher in meeting those requirements; and
• notifies the publisher in writing as soon as practicable after becoming aware that the person has done, or omitted to do, something that would have breached such a requirement if the person had been a public number directory publisher (subsection (9)).

• If the public number directory publisher becomes aware that:

• it has breached a relevant requirement; or
• a person who is one of its personnel has done, or omitted to do, something that would have breached such a requirement if the person had been a public number directory publisher;

the publisher must, as soon as practicable, notify the ACMA in writing of the issue and take all reasonable steps to minimise the effects of the issue (subsection (10)).

Subdivision B  Application for extension of duration of provisional authorisation

Section 3.6 Making an application

This section provides that a public number directory publisher may apply to the ACMA to extend the duration of a provisional authorisation if the publisher is unable to complete a sample PND before the end of the authorisation for a reason beyond the publisher’s control (subsection (1)).

The section imposes the following application requirements:

• The application must be made before the provisional authorisation ends (paragraph (2)(a)).
• The application must be made using the form approved by the ACMA which is available on its website at www.acma.gov.au (paragraph (2)(b)).

The section provides that if:

• a public number directory publisher applies to the ACMA to extend the duration of a provisional authorisation; and
• immediately before the authorisation is due to end, the application is not withdrawn and the ACMA has not made a decision whether to extend the duration;

the duration is taken to be extended until:

• if the ACMA asks the publisher to give it further information about the application and the information is not received within 10 business days – the tenth business day; or
• the day on which the ACMA makes a decision whether to extend the duration (subsection (3)).

Section 3.7 Decision on application

This section enables the ACMA to ask an applicant in writing to give it further information about an application for an extension of the duration of a provisional authorisation (subsection (1)). The section requires the applicant to give the information to the ACMA within 10 business days and provides that the ACMA may treat the application as withdrawn if the information is not received within 10 business days (subsections (2) and (3)).

The section provides that the ACMA must, unless the application is withdrawn, decide whether to extend the duration of the provisional authorisation:

• as soon as practicable after receiving the application; or
• if the ACMA has asked for further information – as soon as practicable after receiving the information (subsection (4)). 

The section requires the ACMA to extend the duration of the provisional authorisation if it is satisfied that the reason why a sample PND is unable to be completed before the end of the authorisation is beyond the public number directory publisher’s control and that the publisher has complied, and is likely to continue to comply, with the relevant requirements (subsection (5)).

If the ACMA extends the duration of the provisional authorisation, the section requires the ACMA to decide the period of the extension (being a period of not more than 90 days) (paragraph (6)(a)).

The section makes clear that the ACMA is not obliged to extend the duration for any period requested by the public number directory publisher (paragraph (6)(b)).

The section provides that the ACMA must, as soon as practicable after making its decision, notify the public number directory publisher in writing of the decision and (for a refusal to extend the duration or a decision to extend the duration for a period other than a period requested by the publisher) the reasons for the decision (paragraph (7)(a)).

The section provides that for a decision to extend the duration, the ACMA must also notify the IPND Manager in writing of the decision as soon as practicable after making the decision (paragraph (7)(b)).[15]

Section 3.8 Start of extended duration of provisional authorisation

This section provides that an extension of the duration of a provisional authorisation starts on the later of:

• the day after the day on which the ACMA makes the decision to extend the duration; and
• the day after the day on which the authorisation would have ended if there had been no extension.

Division 3 Final authorisation

Subdivision A Application for final authorisation

Section 3.9 Making an application

This section sets out the process for making an application for the grant of a final authorisation.

The section imposes the following application requirements:

• The application may be made by a public number directory publisher that has only been granted a provisional authorisation and wishes to continue to use and disclose customer data to publish and maintain a PND (subsection (1)).
• The application must be made before the provisional authorisation ends and by giving the ACMA access to the sample PND developed by the publisher (subsection (2)).

The section provides that if:

• a public number directory publisher applies to the ACMA for the grant of a final authorisation; and
• immediately before the provisional authorisation is due to end, the application is not withdrawn and the ACMA has not made a decision whether to grant a final authorisation;

the duration of the provisional authorisation is taken to be extended until:

• if the ACMA asks the publisher to give it further information about the application and the information is not received within 10 business days – the tenth business day; or
• the day on which the ACMA makes a decision whether to grant a final authorisation (subsection (3)).

Section 3.10 Decision on application

This section enables the ACMA to ask public number directory publisher in writing to give it further information about an application for a final authorisation (subsection (1)). The section requires the public number directory publisher to give the information to the ACMA within 10 business days and provides that the ACMA may treat the application as withdrawn if the information is not received within 10 business days (subsections (2) and (3)).

The section provides that the ACMA must, unless the application is withdrawn, decide whether to grant a final authorisation:

• as soon as practicable after receiving the application; or
• if the ACMA has asked for further information – as soon as practicable after receiving the information (subsection (4)). 

The section requires the ACMA to grant a final authorisation if it:

• has applied the criteria specified by the Minister in a legislative instrument under subsection 295N(1) of the Act;
• has had regard to any other matters the ACMA considers relevant;
• is reasonably satisfied that the public number directory publisher has demonstrated that the sample PND will satisfy the requirements of the definition of public number directory in subsection 285(2) of the Act, as modified by any legislative instrument that the Minister may make under subsection 285(4), (5) or (6) of the Act;
• is reasonably satisfied that the publisher is likely to comply with the other relevant requirements (subsection (5)).  

The section provides that the ACMA must, as soon as practicable after making its decision, notify the public number directory publisher in writing of the decision and (for a refusal to grant a final authorisation) the reasons for the decision (paragraph (6)(a)).

The section provides that for a decision to grant a final authorisation, the ACMA must also notify the IPND Manager in writing of the decision as soon as practicable after making the decision (paragraph (6)(b)), and give the public number directory publisher written confirmation of that notification as soon as practicable after it has occurred (subsection (7)).[16]

Section 3.11 Start of final authorisation

This section provides that a final authorisation starts on the day on which the IPND Manager first supplies customer data to the public number directory publisher after making arrangements for that supply.

A final authorisation has effect on an ongoing basis unless it ends in accordance with Part 5.  

Section 3.12 Conditions to which final authorisation is subject

This section sets out the conditions to which a final authorisation is subject under the scheme (subsection (1)).

The conditions are as follows:

• The public number directory publisher must:

• make arrangements with the IPND Manager for the supply of customer data as soon as practicable after receiving written confirmation from the ACMA that the IPND Manager has been notified of the decision to grant a final authorisation; and
• notify the ACMA in writing of the date on which the publisher first receives the customer data within 10 business days after the start of the final authorisation (subsection (2)).

• The public number directory publisher must not use the customer data for any purpose other than the publication and maintenance of a PND (subsection (3)).
• The public number directory publisher must publish a PND within a period of 90 days starting on the day on which the final authorisation starts (subsection (4)).
• The public number directory publisher must, within 10 business days after publishing a PND, notify the ACMA in writing that the PND has been published, give the ACMA details of how the PND can be obtained and provide the ACMA with access to the PND (subsection (5)).
• The public number directory publisher must ensure that each PND that it publishes is made generally available to members of the public (subsection (6)). 
• The public number directory publisher must provide the ACMA with further access to any PNDs that it has published if the ACMA asks the publisher in writing for such access (subsection (7)).
• If a customer informs the public number directory publisher that the customer wants the customer’s listed number to become an unlisted number, the publisher must advise the customer to contact the customer’s carriage service provider (subsection (8)).  This recognises that it is the obligation of the carriage service provider, under Part 4 of Schedule 2 to the Act, to give the IPND Manager information for the IPND in relation to their customers.
• If the IPND Manager informs the public number directory publisher that a listed number has become an unlisted number in the IPND, the publisher:
  • must, within 2 business days after being notified, amend any PNDs that it publishes and maintains online, or in another streaming format, to remove all customer data related to the number;
  • must not, after being notified, make available online, or in another streaming electronic format, a PND containing or otherwise disclosing any of the customer data relating to the number;
  • must not, after being notified, release or arrange to be released any document or database containing any of the customer data relating to the number;
  • must, within 10 business days after being notified, destroy securely all of the customer data in its possession relating to the number (subsection (9)).
• The public number directory publisher must not contact a customer who has an unlisted number in the IPND unless the publisher has a pre-existing business relationship with the customer that relates to a PND that it publishes (subsection (10)).  An example of a pre-existing relationship is a paid listing in a PND that the public number directory publisher publishes. 
• The public number directory publisher must update each PND that it publishes and maintains in a hard copy format, or on a disk or in another recorded format, at least annually (subsection (11)).
• The public number directory publisher must update each PND that it publishes and maintains online, or in another streaming electronic format, at least monthly (subsection (12)).  This is in addition to the obligation imposed on the public number directory publisher to amend any PND that it publishes and maintains online, or in another streaming electronic format, to remove all of the customer data relating to a number that has become an unlisted number. 
• If a customer advises the public number directory publisher that the customer’s information in a PND that it publishes is incorrect, the publisher must, within 10 business days after being advised, correct the information in any PNDs that it publishes and maintains online, or in another streaming electronic format, and in the customer data in its possession, and tell the customer to contact the customer’s carriage service provider to ensure that the information is correctly entered into the IPND (subsection (13)).  This is particularly important as the accuracy of customer data is critical for other IPND data users, such as users for the purposes of emergency services and law enforcement.  The public number directory publisher is expected to take reasonable steps to verify the identity of the party providing the advice.
• The public number directory publisher must have internal dispute resolution procedures for dealing with inquiries or complaints from customers about the use or disclosure of their information in any PND that it publishes (subsection (14)).
• If a customer makes a complaint to the public number directory publisher about the use or disclosure of the customer’s information in a PND that it publishes, the publisher must:
  • inform the customer that if the customer is dissatisfied with the way in which the complaint is handled, the customer may make a complaint to:
    • in a case where the customer is an individual whose complaint involves an act or practice that may be an interference with the privacy of the individual –the Information Commissioner; and
    • in any other case – the ACMA;
  • give the customer information about how to contact the Information Commissioner and the ACMA; and
  • provide reasonable assistance to the Information Commissioner or the ACMA if requested to do so in relation to such a complaint (subsection (15)). 
• The public number directory publisher must have technical systems to receive customer data in accordance with any technical method specified by the IPND Manager (subsection (16)). The technical method or methods may be changed from time to time. This is important to ensure that the protection and security of the customer data is not compromised.
• A public number directory publisher must not publish a directory address that is a suppressed address entry (subsection (17)). This ensures that a customer’s request not to identify the customer’s address is complied with. 
• The ACMA may specify in writing other conditions to which the authorisation is subject (paragraph (18)(a)). The ACMA may also vary or remove any condition so specified (paragraph (18)(b)). The ACMA must notify the public number directory publisher in writing of any specified condition, or of any variation or removal of such a condition, as soon as practicable and before the condition, or the variation or removal, is expressed to take effect (paragraph (18)(c)).  The ACMA must also notify the IPND Manager in writing of any specified condition, or of any variation or removal of such a condition, that is relevant to its role as IPND Manager (paragraph (18)(d)).[17]
• The public number directory publisher must comply with the relevant requirements, which are:

• the requirements of the Act and of any legislative instruments made under the Act (including the scheme) that apply to the publisher; and
• any conditions of the authorisation (see subsection (19) and the definition of relevant requirements in section 1.4 of the scheme).

• The public number directory publisher must take all reasonable steps to ensure that any person who is one of its personnel:

• is made aware of the publisher’s obligations to meet the relevant requirements;
• cooperates with the publisher in meeting those requirements; and
• notifies the publisher in writing as soon as practicable after becoming aware that the person has done, or omitted to do, something that would have breached such a requirement if the person had been a public number directory publisher (subsection (20)).

• If the public number directory publisher becomes aware that:

• it has breached a relevant requirement; or
• a person who is one of its personnel has done, or omitted to do, something that would have breached such a requirement if the person had been a public number directory publisher;

the publisher must, as soon as practicable, notify the ACMA in writing of the issue and take all reasonable steps to minimise the effects of the issue (subsection (21)).

Subdivision B Application for extension of period for publishing PND

Section 3.13 Making an application

This section provides that a public number directory publisher that has been granted a final authorisation may apply to the ACMA to extend the period in which to publish a PND if the PND is unable to be published within the period for a reason beyond the publisher’s control (subsection (1)).

The section imposes the following application requirements:

• The application must be made within a period of 90 days starting on the day on which the final authorisation starts (paragraph (2)(a)).
• The application must be made using the form approved by the ACMA which is available on its website at www.acma.gov.au (paragraph (2)(b)).

The section provides that if:

• a public number directory publisher applies to the ACMA to extend the period in which to publish a PND; and
• immediately before the period is due to end, the application is not withdrawn and the ACMA has not made a decision whether to extend the period;

the period is taken to be extended until:

• if the ACMA asks the publisher to give it further information about the application and the information is not received within 10 business days – the tenth business day; or
• the day on which the ACMA makes a decision whether to extend the period (subsection (3)).

Section 3.14 Decision on application

This section enables the ACMA to ask a public number directory publisher in writing to give it further information about an application for an extension of the period in which to publish a PND (subsection (1)). The section requires the public number directory publisher to give the information to the ACMA within 10 business days and provides that the ACMA may treat the application as withdrawn if the information is not received within 10 business days (subsections (2) and (3)).

The section provides that the ACMA must, unless the application is withdrawn, decide whether to extend the period in which to publish a PND:

• as soon as practicable after receiving the application; or
• if the ACMA has asked for further information – as soon as practicable after receiving the information (subsection (4)). 

The section requires the ACMA to extend the period in which to publish a PND if it is satisfied that the reason why the PND is unable to be published within the period is beyond the public number directory publisher’s control and that the publisher has complied, and is likely to continue to comply, with the relevant requirements (subsection (5)).

If the ACMA extends the period in which to publish a PND, the section requires the ACMA to decide the period of the extension (being a period of not more than 90 days) (paragraph (6)(a)). The section makes clear that the ACMA is not obliged to extend the duration for any period requested by the public number directory publisher (paragraph (6)(b)).

The section provides that the ACMA must, as soon as practicable after making its decision, notify the public number directory publisher in writing of the decision and (for a refusal to extend the period or a decision to extend the duration for a period other than a period requested by the publisher) the reasons for the decision (paragraph (7)(a)).

The section provides that for a decision to extend the period, the ACMA must also notify the IPND Manager in writing of the decision as soon as practicable after making the decision (paragraph (7)(b)).[18]

Section 3.15 Start of extended period in which to publish PND

This section provides that an extension of the period in which to publish a PND starts on the later of:

• the day after the day on which the ACMA makes the decision to extend the period; and
• the day after the day on which the period would have ended if there had been no extension.

Part 4–Authorisation to use and disclose customer data–research entities

Part 4 sets out the application and assessment processes for the grant of authorisations to use and disclose customer data to conduct research, the duration of such authorisations, how the duration may be extended and the conditions to which the authorisations are subject.  

An authorisation granted under Part 4 is a research authorisation.

A person seeking a research authorisation may be a researcher who wishes to use and disclose customer data to conduct research, or a representative body[19] which wishes to use and disclose to its members[20] customer data to conduct research.

A person who holds a research authorisation is treated in the scheme as being a research entity and may make arrangements with the IPND Manager for the supply of customer data to conduct research. 

A research entity who is a representative body is a research representative body.  A research representative body is only allowed to disclose to its members the public number of a customer or a customer’s business, and the postcode and the State or Territory in the directory address of the customer or business.  A research representative body is also subject to additional requirements to protect the privacy and security of customer data disclosed to its members.      

Division 1 Application of Part 4

Section 4.1 Application

This section provides that Part 4 applies to a person seeking to be granted an authorisation to use and disclose customer data for purposes connected with the conduct of research, and to a research entity.

Division 2 Research authorisation

Subdivision A Application for research authorisation

Section 4.2 Making an application

This section sets out the process for making an application for the grant of a research authorisation.

The section imposes the following application requirements:

• The application must be made to the ACMA using the form approved by the ACMA which is available on its website at www.acma.gov.au (subsection (1) and paragraph (2)(a)).
• The application must include the following information:
  • whether the applicant is a representative body;
  • the kind or kinds of research proposed to be conducted;
  • the fields of customer data that are sought and the reasons for seeking each of these fields;
  • if an authorisation is being sought on an ongoing basis or for a finite period;[21] and
  • if the authorisation is being sought for a finite period, the length of the period (paragraphs (2)(b) to (f)).
• If the application is made by a research representative body, the application must not specify the name of a customer or a customer’s business as a field of customer data that is sought (subsection (3)).
• The application must be accompanied by any applicable charge fixed by a determination under section 60 of the ACMA Act (paragraph (4)(a)).
• The application must also be accompanied by a completed privacy impact assessment using the form approved by the ACMA which is available on its website (paragraph (4)(b)). 

Section 4.3 Decision on application

This section enables the ACMA to ask an applicant in writing to give it further information about an application for the grant of a research authorisation (subsection (1)). The section requires the applicant to give the information to the ACMA within 90 days and provides that the ACMA may treat the application as withdrawn if the information is not received within 90 days (subsections (2) and (3)).

The section provides that the ACMA must, unless the application is withdrawn, decide whether to grant a research authorisation (subsection (4)). 

The section requires the ACMA to grant a research authorisation if it:

• has applied the criteria specified by the Minister in a legislative instrument under subsection 295N(1) of the Act;
• has had regard to any other matters the ACMA considers relevant;
• is reasonably satisfied that the applicant has demonstrated that the applicant’s proposed research will satisfy the requirements of the definition of research in section 1.4 of the scheme; and
• is reasonably satisfied that the applicant is likely to comply with the other relevant requirements (subsection (5)).  

The section provides that ACMA must specify in its decision to grant the research authorisation:

• the kind or kinds of research to which the authorisation applies;
• the fields of customer data to which the authorisation applies;
• whether the authorisation will have effect for a finite period or on an ongoing basis; and
• if the authorisation is to have effect for a finite period— the length of the period (paragraph (6)(a)).

The section makes clear that the ACMA is not obliged to grant the research authorisation for any duration requested by the applicant (paragraph (6)(b)).

The section provides that the ACMA must, as soon as practicable after making its decision, notify the applicant in writing of the decision and (for a refusal to grant a research authorisation or a decision to grant the authorisation for a period other than a period requested by the applicant) the reasons for the decision (paragraph (7)(a)).

The section provides that for a decision to grant a research authorisation, the ACMA must also notify the IPND Manager in writing of the decision as soon as practicable after making the decision (paragraph (7)(b)), and give the applicant (who is treated in the scheme as being a research entity) written confirmation of that notification as soon as practicable after it has occurred (subsection (8)).[22]

Section 4.4 Duration of research authorisation

This section provides that a research authorisation starts on the day on which the IPND Manager first supplies customer data to the research entity after making arrangements for that supply (paragraph (a)). The research authorisation has effect for the duration specified by the ACMA in its decision (paragraph (b)).

The duration of a research authorisation that has effect for a finite period may be extended in accordance with Subdivision B.  The duration of a research authorisation that has effect for a finite period or on an ongoing basis may be ended earlier in accordance with Part 5.  

Section 4.5 Conditions to which research authorisation is subject

This section sets out the conditions to which a research authorisation is subject under the scheme (subsection (1)).

The conditions are as follows:

• The research entity must:

• make arrangements with the IPND Manager for the supply of the fields of customer data to which the authorisation applies as soon as practicable after receiving written confirmation from the ACMA that the IPND Manager has been notified of the decision to grant a research authorisation; and
• notify ACMA of the date on which the entity first receives the customer data within 10 business days after the start of the authorisation (subsection (2)).

• The research entity must not disclose the customer data to any person other than the ACMA, the entity’s personnel or (if the entity is a research representative body) its members, unless the disclosure is authorised or required by or under law (subsection (3)).
• If the research entity is a research representative body, the entity must comply with the following:
  • The entity is only permitted to disclose the public number of a customer or a customer’s business, and the postcode and the State or Territory included in the directory address of the customer or business (paragraph (4)(a)).  The entity is allowed to have access to the full directory address of a customer or a customer’s business to create geographical-based samples for its members, but is prohibited from disclosing the full directory address to its members. This condition mitigates potential privacy risks by ensuring that a customer or a customer’s business cannot be identified through the customer data disclosed by the entity to its members.
  • The entity must ensure that, before any disclosure of the customer data to any of its members, it has adequate arrangements in place that meet the requirements of the section and that are legally enforceable as between the entity and its members (required arrangements) (paragraph (4)(b)).
  • The entity must take reasonable steps to ensure that its members comply with the required arrangements (paragraph (4)(c)). 
  • The entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must not disclose the customer data to any person other than the ACMA or the member’s personnel, unless the disclosure is authorised or required by or under law (paragraph (4)(d)).

• The research entity must, for at least the duration of the research authorisation, be:
  • an organisation within the meaning of the Privacy Act 1988; or
  • an entity whose name is entered in the register of small business operators who have chosen to be treated as organisations within the meaning of the Privacy Act 1988 kept by the Information Commissioner in accordance with section 6EA of the Privacy Act 1988 (subsection (5)).

This is to ensure that the Privacy Act 1988 applies to the entity, for at least the duration of the authorisation, in relation to the handling of any personal information.  

• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with the condition mentioned immediately above as if it were a research entity and the duration of the authorisation were the period during which the member has access to the customer data (subsection (6)).  This is to ensure that the Privacy Act 1988 applies to the member, for at least the period during which the member has access to the customer data, in relation to the handling of any personal information.
• The research entity:
  • must not use the customer data for any purpose other than conducting research of a kind to which the authorisation applies; 
  • must not add any other information to the customer data without the express consent of the person to whom the customer data relates; and
  • must make the customer data secure so that only its personnel and (if it is a research representative body) its members have access to the customer data for the purposes of conducting the research (subsection (7)).
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that:
  • the member must not use the customer data for any purpose other than conducting research of a kind to which the authorisation applies; 
  • the member must not add any other information to the customer data without the express consent of the person to whom the customer data relates; and
  • the member must make the customer data secure so that only its personnel have access to the customer data for the purposes of conducting the research (subsection (8)).
• If the research entity contacts a customer, using the customer data, for the purposes of conducting research, the entity must:
  • tell the customer the name of the person or organisation conducting the research, the purpose of the research, that the person or organisation has collected the customer data relating to the customer, how the person or organisation proposes to use the customer data and any other information relating to the customer in the research;
  • tell the customer, if requested, the contact details of the person or organisation conducting the research, the circumstances of the collection of the customer data and how the customer can access personal information about the customer held by the person or organisation;
  • ask the customer for consent to use the customer data and any other information relating to the customer in the research and to have the customer’s details identified in the research, and tell the customer that any consent given may be withdrawn at any time;
  • give the customer any other information that is required by law (for example, under the Privacy Act 1988); and
  • comply with all applicable laws relating to unsolicited contact with another person (for example, the Privacy Act 1988, the Spam Act 2003 and the Do Not Call Register Act 2006) (subsection (9)).
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that:
  • the member is only permitted to use the public number of a customer or a customer’s business, and the postcode and the State or Territory included in the directory address of the customer or business, to contact the customer for the purposes of conducting the research; and
  • the member must, when contacting a customer, using such data, for such purposes, comply with the condition mentioned immediately above as if it were a research entity (subsection (10)).
• If a customer informs the research entity that the customer wants the customer’s listed number to become an unlisted number, the entity must advise the customer to contact the customer’s carriage service provider (subsection (11)).  This recognises that it is the obligation of the carriage service provider, under Part 4 of Schedule 2 to the Act, to give the IPND Manager information for the IPND in relation to their customers.
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that, if a customer informs the member that the customer wants a listed number to become an unlisted number, the member must comply with the condition mentioned immediately above as if it were a research entity (paragraph (13)(a)).
• If the IPND Manager notifies the research entity that a listed number has become an unlisted number in the IPND:
  • the entity must not, after being notified, use any of the customer data to contact the customer who has the number;
  • the entity must, within 10 business days after being notified, destroy securely any customer data or document that it holds that is able to be identified as being associated with that unlisted number;
  • if the entity is a research representative body – the entity must notify each of its members who have access to the customer data relating to the customer that the listed number has become an unlisted number in the IPND as soon as practicable (subsection (12)).
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that, if the member is notified by the entity that a listed number has become an unlisted number in the IPND:
  • the member must not, after being notified, use any of the customer data to contact the customer who has the number;
  • the member must, within 10 business days after being notified, destroy securely any customer data or document that it holds that is able to be identified as being associated with that unlisted number (paragraph (13)(b)).
• If a customer does not consent, or withdraws consent, to the use of the customer data or any other information relating to the customer in the research, the entity must not continue to use or keep any of the customer data or other information that can be identified as being associated with the customer (subsection (14)).
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with the condition mentioned immediately above as if it were a research entity (subsection (15)).
• The research entity must have internal dispute resolution procedures for dealing with inquiries or complaints from customers about its use and disclosure of the customer data relating to the customer (subsection (16)).
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with the condition mentioned immediately above as if it were a research entity (paragraph (18)(a)).
• If a customer makes a complaint to the research entity about the use or disclosure of the customer data or other information relating to the customer, the entity must:
  • inform the customer that if the customer is dissatisfied with the way in which the complaint is handled, the customer may make a complaint to:
    • in the case where the customer is an individual whose complaint involves an act or practice that may be an interference with the privacy of the individual – the Information Commissioner; and
    • in any other case – the ACMA;
  • give the customer information about how to contact the Information Commissioner and the ACMA; and
  • provide reasonable assistance to the Information Commissioner or the ACMA if requested to do so in relation to such a complaint (subsection (17)). 
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that:
  • the member must comply with the condition mentioned immediately above as if it were a research entity; and
  • the member must notify the entity in writing of the nature of any such complaint received as soon as practicable after the complaint is made and the outcome of the complaint as soon as practicable after the complaint has been finalised (paragraph (18)(b)).
• The research entity must not carry out any geographic disaggregation of the research findings below the level of a postcode included in the directory address of a customer or a customer’s business (subsection (19)). This is to ensure that the full directory address of the customer or the business cannot be linked to the research findings. Other types of geographic disaggregation are allowed, subject to obtaining the express consent of a customer where it involves adding information relating to that customer to the customer data.
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with the condition mentioned immediately above as if it were a research entity (subsection (20)).
• If the IPND Manager notifies the research entity of an update to the customer data:
  • the entity must, within 2 business days after being notified, update the customer data in its possession that can be identified as being associated with the customer; and
  • if the entity is a research representative body – the entity must notify each of its members who have access to the customer data of the update as soon as practicable (subsection (21)).
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that if the entity notifies the member of an update to the customer data, the member must, within 2 business days after being notified, update the customer data in its possession that can be identified as being associated with the customer (subsection (22)).
• If a customer advises the research entity that the customer data or any other information relating to the customer is incorrect:
  • the entity must, within 2 business days after being advised, correct the information in its possession that can be identified as being associated with the customer and tell the customer to contact the customer’s carriage service provider to ensure the information is correctly entered in the IPND; 
  • if the entity is a research representative body – the entity must notify each of its members who have access to the customer data that the information is incorrect as soon as practicable (subsection (23)). 

This is particularly important as the accuracy of customer data is critical for other IPND data users, such as users for the purposes of emergency services and law enforcement.

The entity is expected to take reasonable steps to verify the identity of the party providing the advice.

• If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that:
  • if the entity notifies the member that the customer data or any other information relating to a customer is incorrect, the member must, within 2 business days after being notified, correct the information in its possession that can be identified as being associated with the customer;
  • if a customer advises the member that the customer data or any other information relating to the customer held by the member is incorrect, the member must:
    • within 2 business days after being advised, correct the information in its possession that can be identified as being associated with the customer; and
    • notify the entity in writing that the information is incorrect as soon as practicable (paragraph (24)(a)).

It is anticipated that the required arrangements will note that the member is expected to take reasonable steps to verify the identity of the party providing the advice.

• If a member notifies the research entity that the customer data or any other information relating to a customer is incorrect, the entity must, within 2 business days after being notified, correct the information in its possession that can be identified as being associated with the customer and notify all of its other members who have access to the customer data relating to the customer that the information referred to in the notice is incorrect as soon as practicable (paragraph (24)(b)).
• The research entity must have technical systems to receive customer data in accordance with any technical method specified by the IPND Manager (subsection (25)). The technical method or methods may be changed from time to time. This is important to ensure that the protection and security of the customer data is not compromised.
• The research entity must not use a directory address that is a suppressed address entry (subsection (26)). This ensures that a customer’s request not to identify the customer’s address is complied with. 
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with the condition mentioned immediately above as if it were a research entity (subsection (27)).
• If:
  • the fields of customer data to which the authorisation applies do not include the name of a customer or a customer’s business;  
  • the research entity has become aware that other information has been added to the customer data without the customer’s consent; and
  • as a result of that breach a customer or a customer’s business is identified by name as the customer or the customer’s business to which the customer data relates;

the entity must as soon as practicable destroy the customer data and the other information that has been added to the customer data or take such other steps to ensure that the customer or the customer’s business is no longer identified in that way (subsection (28)).

• If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that if:
  • the member becomes aware that other information has been added to the customer data without the customer’s consent; and
  • as a result of that breach a customer or a customer’s business is identified by name as the customer or the customer’s business to which the customer data relates;

the member must:

• as soon as practicable, destroy the customer data and the other information that has been added to the customer data or take other steps to ensure that the customer or the customer’s business is no longer identified in that way; and
• notify the entity in writing of the breach and the steps taken to ensure that the customer or the customer’s business is no longer identified in that way, as soon as practicable (subsection (29)).

• The research entity is also subject to an additional requirement to notify the ACMA of such a breach and to take all reasonable steps to minimise the effects of the breach as soon as practicable after the entity becomes aware of it (subsection (30)).

• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with the conditions specified by the Minister in a legislative instrument under section 295P of the Act as if the member were a research entity (subsection (31)).
• The ACMA may specify in writing other conditions to which the authorisation is subject (paragraph (32)(a)). The ACMA may also vary or remove any condition so specified (paragraph (32)(b)). The ACMA must notify the research entity in writing of any specified condition, or of any variation or removal of such a condition, as soon as practicable and before the condition, or the variation or removal, is expressed to take effect (paragraph (32)(c)).  The ACMA must also notify the IPND Manager in writing of any specified condition, or of any variation or removal of such a condition, that is relevant to its role as IPND Manager (paragraph (32)(d)).[23]

• The research entity must comply with the relevant requirements, which are:
  • the requirements of the Act and of any legislative instruments made under the Act (including the scheme) that apply to the entity; and
  • any conditions of the authorisation (see subsection (33) and the definition of relevant requirements in section 1.4 of the scheme).
• The research entity must take all reasonable steps to ensure that any person who is one of its personnel:
  • is made aware of the entity’s obligations to meet the relevant requirements;
  • cooperates with the entity in meeting those requirements; and
  • notifies the entity in writing as soon as practicable after becoming aware that the person has done, or omitted to do, something that would have breached such a requirement if the person had been a research entity (subsection (34)).
• If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must notify the entity in writing as soon as practicable after becoming aware that the member has not complied with such arrangements (subsection (35)).
• If:
  • the research entity becomes aware that it has breached a relevant requirement; or
  • a person who is one of its personnel has done, or omitted to do, something that would have breached such a requirement if the person had been a research entity;

the entity must, as soon as practicable, notify the ACMA in writing of the issue and take all reasonable steps to minimise the effects of the issue (subsection (36)).

Subdivision B Application for extension of duration of research authorisation

Section 4.6 Making an application

This section provides that a research entity that has been granted a research authorisation for a finite period may apply to the ACMA to extend the duration of the authorisation if the research to which the authorisation applies is unable to be completed before the end of the authorisation for a reason beyond the entity’s control (subsection (1)).

The section imposes the following application requirements:

• The application must be made before the research authorisation ends (paragraph (2)(a)).
• The application must be made using the form approved by the ACMA which is available on its website at www.acma.gov.au (paragraph (2)(b)).

The section provides that if:

• a research entity applies to the ACMA to extend the duration of a research authorisation; and
• immediately before the authorisation is due to end, the application is not withdrawn and the ACMA has not made a decision whether to extend the duration;

the duration is taken to be extended until:

• if the ACMA asks the research entity to give it further information about the application and the information is not received within 10 business days – the tenth business day; or
• the day on which the ACMA makes a decision whether to extend the duration (subsection (3)).

Section 4.7 Decision on application

This section enables the ACMA to ask an applicant in writing to give it further information about an application for an extension of the duration of a research authorisation (subsection (1)). The section requires the applicant to give the information to the ACMA within 10 business days and provides that the ACMA may treat the application as withdrawn if the information is not received within 10 business days (subsections (2) and (3)).

The section provides that the ACMA must, unless the application is withdrawn, decide whether to extend the duration of a research authorisation:

• as soon as practicable after receiving the application; or
• if the ACMA has asked for further information – as soon as practicable after receiving the information (subsection (4)). 

The section requires the ACMA to extend the duration of the research authorisation if it is satisfied that the reason why the research is unable to be completed before the end of the authorisation is beyond the research entity’s control and that the entity has complied, and is likely to continue to comply, with the relevant requirements (subsection (5)).

If the ACMA extends the duration of the research authorisation, the section requires the ACMA to decide the period of the extension (being a period of not more than a quarter of the initial duration of the authorisation) (paragraph (6)(a)).

The section makes clear that the ACMA is not obliged to extend the duration for any period requested by the research entity (paragraph (6)(b)).

The section provides that the ACMA must, as soon as practicable after making its decision, notify the research entity in writing of the decision and (for a refusal to extend the duration or a decision to extend the duration for a period other than a period requested by the entity) the reasons for the decision (paragraph (7)(a)).[24]

The section provides that for a decision to extend the duration, the ACMA must also notify the IPND Manager in writing of the decision as soon as practicable after making the decision (paragraph (7)(b)).

Section 4.8 Start of extended duration of research authorisation

This section provides that an extension of the duration of a research authorisation starts on the later of:

• the day after the day on which the ACMA makes the decision to extend the duration; and
• the day after the day on which the authorisation would have ended if there had been no extension.

Subdivision C Review of research authorisation that has effect on ongoing basis

Section 4.9 Review at least every 2 years

This section requires the ACMA to undertake a review of a research authorisation that has effect on an ongoing basis at least once every two year period after the start of the authorisation (subsection (1)).

The section provides that the review must consider:

• whether the research authorisation is still required to have effect on an ongoing basis;

• whether each field of customer data to which the authorisation applies is still being (or to be) used and disclosed for purposes connected with the conduct of research of the kind or kinds to which the authorisation applies;
• whether the research entity has appropriate practices, procedures, processes and systems in place to protect the privacy and security of the customer data and to ensure compliance with all other relevant requirements;
• the extent to which the research entity has complied with all relevant requirements; and
• any other matter the ACMA considers relevant (subsection (2)).

Part 5–End of Authorisations

Part 5 sets out the circumstances in which an authorisation may be ended.   Division 1 of Part 5 applies to provisional authorisations and final authorisations, which are held by public number directory publishers.  Division 2 of Part 5 applies to research authorisations, which are held by research entities.

Division 1 Public number directory publishers

Section 5.1 End of provisional authorisation or final authorisation—revocation

This section provides that the ACMA may, in accordance with the section, revoke an authorisation of a provisional authorisation or final authorisation if it is satisfied that the public number directory publisher who holds the authorisation has breached a condition of the authorisation (subsection (1)).

If the ACMA proposes to revoke a provisional authorisation or final authorisation, the section requires the ACMA to:

• notify the public number directory publisher in writing of the proposal and the ACMA’s reasons for the proposal; and
• invite the publisher to give the ACMA written reasons why the authorisation should not be revoked within a period of at least 30 days specified in the notice (subsection (2)).  

The section requires the ACMA to decide whether to revoke the authorisation, having regard to any reasons given by the public number directory publisher, after the end of the period specified in the notice (paragraph (3)(a)). The ACMA may revoke the authorisation if it is satisfied that the public number directory publisher has breached a condition of the authorisation (paragraph (3)(b)).

The section provides that, if the ACMA revokes the authorisation, the ACMA must, as soon as practicable, notify the person who held the authorisation and the IPND Manager in writing of the revocation (subsection (4)).[25]

Section 5.2 Further application to use and disclose customer data if authorisation is revoked

This section precludes a person whose authorisation has been revoked under section 5.1 from applying for the grant of a provisional authorisation or final authorisation for a period of 90 days starting on the day on which the revocation took effect. This is to ensure that the person has a reasonable amount of time to rectify the issue or issues which led to the revocation and to be able to demonstrate to the ACMA when making any further application that the person is likely to comply with the relevant requirements of the scheme.

Section 5.3 End of final authorisation—other

This section provides that, if a public number directory publisher who holds a final authorisation fails to publish a PND within a period of 90 days starting on the day the authorisation starts, or any extended period granted, the authorisation is taken to have ended immediately after the end of the 90 day period or the extended period (subsection (1)).

The section provides that if a public number directory publisher who holds a final authorisation notifies the ACMA in writing that the authorisation is no longer required, the authorisation is taken to have ended immediately after the end of a period of 10 days, or any longer period specified in the notice, starting on the day the ACMA receives the notice, unless the authorisation happens to end earlier (subsection (2)).

The section provides that the ACMA must, as soon as practicable after becoming aware that an authorisation has ended under the section, notify the IPND Manager in writing of the matter (subsection (3)).

Division 2 Research entities

Section 5.4 End of research authorisation—revocation

This section provides that the ACMA may, in accordance with the section, revoke a research authorisation if it is satisfied that the research entity that holds the authorisation has breached a condition of the authorisation (subsection (1)).

If the ACMA proposes to revoke a research authorisation, the section requires the ACMA to:

• notify the research entity in writing of the proposal and the ACMA’s reasons for the proposal; and
• invite the entity to give the ACMA written reasons why the authorisation should not be revoked within a period of at least 30 days specified in the notice (subsection (2)).  

The section requires the ACMA to decide whether to revoke the authorisation, having regard to any reasons given by the research entity, after the end of the period specified in the notice (paragraph (3)(a)). The ACMA may revoke the authorisation if it is satisfied that the research entity has breached a condition of the authorisation (paragraph (3)(b)).

The section provides that, if the ACMA revokes the authorisation, the ACMA must, as soon as practicable, notify the person who held the authorisation and the IPND Manager in writing of the revocation (subsection (4)).[26]

The section provides that, if the ACMA revokes a research authorisation that was held by a research representative body, the person who held the authorisation must, as soon as practicable after being notified of the revocation, notify each of its members who had access to any customer data under the authorisation of the revocation (subsection (5)).

Section 5.5 Further application to use and disclose customer data if authorisation is revoked

This section precludes a person whose authorisation has been revoked under section 5.4 from applying for the grant of a research authorisation for a period of 90 days starting on the day on which the revocation took effect. This is to ensure that the person has a reasonable amount of time to rectify the issue or issues which led to the revocation and to be able to demonstrate to the ACMA when making any further application that the person is likely to comply with the relevant requirements of the scheme.

Section 5.6 End of research authorisation—other

This section provides that if a research entity that holds a research authorisation notifies the ACMA in writing that the authorisation is no longer required, the authorisation is taken to have ended immediately after the end of a period of 10 days, or any longer period specified in the notice, starting on the day the ACMA receives the notice, unless the authorisation happens to end earlier (subsection (1)).

The section provides that the ACMA must, as soon as practicable after becoming aware that an authorisation has ended under the section, notify the IPND Manager in writing of the matter (subsection (2)). 

The section provides that if an authorisation has ended under the section and the authorisation was held by a research representative body, the person who held the authorisation must, as soon as practicable after becoming aware that the authorisation has ended, notify each of its members who had access to any customer data under the authorisation of the matter (subsection (3)). 

Part 6–Savings and transitional arrangements

Part 6 sets out the savings and transitional arrangements in relation to authorisations that were granted under the Telecommunications Integrated Public Number Database Scheme 2007 (the old scheme) and in force immediately before the commencement of the scheme (the new scheme).

Section 6.1 Application of Part 6

This section provides that Part 6 applies to an authorisation granted to a person (the holder) under subsection 3.10(4) of the old scheme and in force immediately before the commencement of the new scheme (a previous authorisation). 

The only authorisations granted to persons under the old scheme and in force immediately before the commencement of the new scheme were authorisations under subsection 3.10(4) of the old scheme to use and disclose customer data to publish and maintain a PND.

Section 6.2 Previous authorisation continues in force

The section provides that a previous authorisation continues in force immediately after the commencement of the new scheme as if it had been granted to the holder under subsection 3.10(4) of the new scheme and subject to the conditions specified in section 3.12 of the new scheme (subsection (1)).

The section includes an interpretation provision to clarify how the new scheme has effect in relation to a previous authorisation (subsection (2)).

The section makes clear that:

• the holder may apply to the ACMA to extend the period in which to publish a PND in accordance with section 3.13 of the new scheme;
• the previous authorisation may be made subject to other conditions, or have existing conditions varied or removed, in accordance with subsection 3.12(18) of the new scheme; and
• may be ended in accordance with Part 5 of the new scheme (subsection (3)).

Section 6.3 Other matters

This section requires the holder to do certain things that were required to be done under the conditions of the old scheme, but which the holder had not done, immediately before the commencement the new scheme.  Those conditions are referred to in subsection (1). 

The section requires such a thing to be done within the time period required under the condition of the old scheme or (if no time period applies under the condition) within a reasonable time as if the condition had not been repealed (subsections (1) and (2)).  For example, if, immediately before the commencement of the new scheme:

• the holder was required to publish a PND under the condition specified in subsection 3.12(3) of the old scheme (because the previous authorisation had started under section 3.11 of the old scheme);
• the holder had not published a PND; and
• the time period for publishing a PND had not ended (because subsection 3.12(3) of the old scheme required a PND to be published within 90 days and only 10 of those days had expired);

the holder would still be required to publish a PND within that time period, which, at the commencement of the new scheme, would be due to expire in 80 days.

The section provides that anything done by the holder in compliance with subsection (1), in relation to a condition of the old scheme referred to in that subsection, is taken to have been done under, or for the purposes of, the corresponding condition of the new scheme (subsection (3)).  For example, a PND published by the holder in compliance with subsection (1), in relation to the condition specified in subsection 3.12(3) of the old scheme, is taken to have been done under, or for the purposes of, the condition specified in subsection 3.12(4) of the new scheme.

The section provides that anything done by the holder, the ACMA or the IPND Manager under the old scheme before the commencement of the new scheme has effect, on and after the commencement, as if it had been done under, or for the purposes of, the new scheme (subsection (4)).

Attachment B

Statement of compatibility with human rights

Prepared by the Australian Communications and Media Authority under subsection 9(1) of the Human Rights (Parliamentary Scrutiny) Act 2011

Telecommunications Integrated Public Number Database Scheme 2017

Overview of the instrument

Sections 276 and 277 of the Telecommunications Act 1997 (the Act) prohibit the disclosure or use of information obtained by carriers and carriage service providers in the course of providing their services.  The prohibition extends to the disclosure and use of information held in the integrated public number database (IPND), an industry wide database of all residential and business telephone numbers and associated subscriber information. 

Section 285 of the Act contains an exception to the prohibition, and permits disclosure of information from the IPND by Telstra (as the IPND Manager) to a person who holds an authorisation granted by the ACMA to receive IPND information.  The Telecommunications Integrated Public Number Database Scheme 2017 (the instrument) is the scheme under which authorisations may be granted to access information contained in the IPND for the purposes of paragraph 285(1A)(d) of the Act. Those purposes are the publication and maintenance of a public number directory and the conduct of research of a kind specified in a legislative instrument, by the Minister, where the Minister is satisfied that the kind of research is in the public interest (permitted research).

Persons who hold an authorisation under the instrument provide a range of services and products to government, subscribers and the general public that would not be possible – or would be much more difficult to provide – without a system like the IPND.  Authorisations granted under the instrument affect public number directory publishers, research entities and customers of carriage service providers whose IPND information is collected, stored, used and disclosed by authorisation holders under the regulatory arrangements.

Although the instrument largely replicates the Telecommunications Integrated Public Number Database Scheme 2007 which it replaces, the provisions relating to research authorisations have been amended to:

• facilitate research industry management of access to IPND information by enabling the ACMA to authorise a research representative body to disclose limited IPND information (only listed number and corresponding geographic information never more specific than post code) to its members to conduct permitted research provided certain requirements are met; and
• allow the ACMA to grant a research authorisation on an ongoing basis subject to an individual researcher or a representative body for researchers meeting certain requirements.

The instrument facilitates an authorisation holder’s access to IPND information whilst also imposing strict conditions on the authorisation holder’s use of that information.  Those conditions have been drafted in recognition of the sensitive nature of IPND information and aim to balance the impost on privacy associated with the disclosure and use of that information against the public benefit provided by public number directory publishers, as well as against the public interest in enabling researchers to conduct quality research that informs government policy and is in the public interest. 

Human rights implications

The ACMA has assessed whether the instrument is compatible with human rights, being the rights and freedoms recognised or declared by the international instruments listed in subsection 3(1) of the Human Rights (Parliamentary Scrutiny) Act 2011 as they apply to Australia.

Having considered the likely impact of the instrument and the nature of the applicable rights and freedoms, the ACMA has formed the view that the instrument engages the right to privacy in Article 17 of the International Covenant on Civil and Political Rights (the ICCPR).

Right to privacy

Article 17 of the ICCPR provides:
 

1. No one shall be subjected to arbitrary or unlawful interference with his privacy, family, home or correspondence, nor to unlawful attacks on his honour and reputation.
2. Everyone has the right to the protection of the law against such interference or attacks.

Collecting, using, storing, disclosing or publishing personal information amounts to an interference with privacy.  In order for the interference with privacy not to be ‘arbitrary’, any interference with privacy must be in accordance with the provisions, aims and objectives of the ICCPR and should be reasonable in the particular circumstances.  Reasonableness, in this context, incorporates notions of proportionality, appropriateness and necessity. 

Under the instrument, a person who holds an authorisation will gain access to use and disclose personal information.  In comparison to the Telecommunications Integrated Public Number Database Scheme 2007, the instrument makes a potentially greater number of researchers eligible to obtain an authorisation to access personal information contained in the IPND.  As set out above, section 285 of the Act sets out an exception to the prohibition on the disclosure or use of information obtained by carriers and carriage service providers in the course of providing their services.  The exception permits disclosure to, and use by, a person who holds an authorisation granted by the ACMA to receive IPND information.

Both the Act and the instrument contain a number of protections intended to limit the disclosure and use of IPND information.  In particular, criminal offences apply under the Act if an authorised person uses or discloses IPND information for a purpose other than the purpose for which the IPND information was disclosed or if the person fails to comply with a condition of an authorisation.[27]

A number of ministerial instruments which supplement the instrument are also intended to protect personal information contained in IPND information.  For example, the ACMA is required to have regard to criteria specified by the Minister in the Telecommunications (Integrated Public Number Database Scheme – Criteria for Deciding Authorisation Applications) Instrument 2007 (No. 1) when considering an authorisation application.  Amongst these criteria for the ACMA to apply when deciding an application for authorisation is a requirement to consider what processes the applicant has in place, or intends to put in place, to protect the privacy and security of IPND information.[28]

The Minister is also able to, and has specified, in the Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1), conditions that apply to all authorisations or particular kinds of authorisations.  Those conditions include:

• privacy based limitations on the transfer of IPND information overseas;
• requirements to safeguard IPND information including notifying specified breaches of security to the ACMA and to the IPND Manager;
• requirements to securely dispose of IPND information; and
• requiring authorisation holders to ensure that any contractors only use or disclose IPND information for an authorised purpose.

The instrument has also been drafted to include key additional privacy safeguards.  For example, under the instrument all research entities and their members:

• are subject to the Privacy Act 1988 (Privacy Act). If a research entity is not an organisation within the meaning of the Privacy Act, it will be required to opt-in under section 6EA of the Privacy Act to be an entity whose name is entered in the register of small business operators who have chosen to be treated as organisations within the meaning of the Privacy Act; 
• must not add other information or data to IPND customer data without the express consent of the customer, preventing a customer being identified;
• must securely destroy data if a customer has been identified or take steps to ensure that the customer cannot be identified again; and
• are subject to a review by the ACMA every two years in circumstances where a representative body for researchers or an individual researcher holds an ongoing authorisation.

These legal and practical protections ensure that IPND information is used only for strictly prescribed purposes and in defined circumstances.  To the extent that the measures in the instrument limit the right to privacy, they are lawful and non-arbitrary.  The instrument, and the provisions it gives effect to in the Act, are reasonable, proportionate and permissibly limit the right to privacy in Article 17 of the ICCPR. 

Conclusion

The instrument is compatible with human rights.  To the extent that it limits any human rights, those impacts are reasonable, necessary and proportionate. 

[1] Telecommunications (Integrated Public Number Database Scheme – Criteria for Deciding Authorisation Applications) Instrument 2007 (No. 1), made under section 295N of the Act.

[2] Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1), made under section 295P of the Act. 

[3] Telecommunications (Integrated Public Number Database – Public Number Directory Requirements) Instrument 2007 (No. 1), made under subsection 285(5) of the Act.

[4] Telecommunications (Integrated Public Number Database – Public Number Directory Additional Information) Instrument 2007 (No. 1), made under subsection 285(4) of the Act.

[5] Telecommunications (Integrated Public Number Database – Permitted Research Purposes) Instrument 2007 (No. 1), made under subsection 285(3) of the Act.

[6] A copy of the report can be accessed at: www.communications.gov.au/publications/integrated-public-number-database-review-report.

[7] At the commencement of this scheme, the Telecommunications (Integrated Public Number Database – Permitted Research Purposes) Instrument 2007 (No. 1) is the only legislative instrument in force under subsection 285(3) of the Act.

[8]  A privacy impact assessment is a systematic assessment of a project that identifies the impact that the project might have on the privacy of individuals, and sets out recommendations for managing, minimising or eliminating that impact.

[9] At the commencement of the scheme, the Telecommunications (Integrated Public Number Database Scheme – Criteria for Deciding Authorisation Applications) Instrument 2007 (No. 1) is the only legislative instrument in force under subsection 295N(1) of the Act. 

[10] At the commencement of the scheme:

• the Telecommunications (Integrated Public Number Database – Public Number Directory Additional Information) Instrument 2007 (No.1) is the only legislative instrument in force under subsection 285(4) of the Act;
• the Telecommunications (Integrated Public Number Database – Public Number Directory Requirements) Instrument 2007 (No. 1) is the only legislative instrument in force under subsection 285(5) of the Act; and
• there is no legislative instrument in force under subsection 285(6) of the Act.

[11] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[12] Business day is a day that is not a Saturday, a Sunday or a public holiday in the place concerned.

[13] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[14] The conditions of the authorisation are:

• any applicable conditions specified by the Minister in a legislative instrument under section 295P of the Act;
• the applicable conditions specified in this scheme; and
• any applicable conditions specified by the ACMA under a provision of this scheme. 

Section 295R of the Act creates an offence for breaching a condition of an authorisation.

At the commencement of the scheme, the Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1) is the only legislative instrument in force under section 295P of the Act.

[15] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[16] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[17] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[18] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[19]  A representative body is:

• the Association of Market and Social Research Organisations in Australia (AMSRO) Incorporated (VIC A0026832C);
• the Australian Market and Social Research Society Ltd (ACN 002 882 635); or
• any other body that represents the interests of research organisations or professionals, whose membership is limited principally to such organisations or professionals, and that is declared in writing by the ACMA to be a representative body for the purposes of the scheme.

[20]  A member of a representative body is a person who is a member of the body, whose name is entered in the register of members kept in accordance with the constitution of the body, and who uses, or wishes to use, customer data to conduct research.

[21] A research authorisation that has effect on an ongoing basis may be appropriate if customer data is to be supplied continuously or periodically. 

[22] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[23] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[24] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[25] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[26] Part 29 of the Act contains additional requirements in relation to the notification of certain decisions under the scheme.

[27] See section 299A of the Act.

[28] See paragraphs 4(1)(d) and 5(1)(d) of the Telecommunications (Integrated Public Number Database Scheme – Criteria for Deciding Authorisation Applications) Instrument 2007 (No. 1).