EXPLANATORY STATEMENT
Prepared by the Australian Communications and Media Authority
Telecommunications Act 1997
Telecommunications Integrated Public Number Database Scheme Amendment 2014 (No.1)
Outline
The Australian Communications and Media Authority (the ACMA) has made the Telecommunications Integrated Public Number Database Scheme Amendment 2014 (No.1) (the Instrument) under section 295L of the Telecommunications Act 1997 (the Act) to vary the Telecommunications Integrated Public Number Database Scheme 2007 (the IPND Scheme).
Subsection 33(3) of the Acts Interpretation Act 1901 (the AIA) provides that where an Act confers a power to make a legislative instrument, the power shall be construed to include a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend or vary any such instrument. Section 295L of the Act confirms that the IPND Scheme may be varied in accordance with subsection 33(3) of the AIA.
The Instrument removes the obligation on public number directory publishers and researchers who have been granted authorisation under the IPND Scheme to access data in the integrated public number database (IPND) to report annually to the ACMA about compliance with the IPND Scheme, and replaces those obligations with exception-based reporting requirements.
Background
The IPND is an industry-wide database containing records of all Australian telephone numbers and associated customer details. The information in the IPND includes customer name, customer address and public phone number of the customer or business. IPND data is protected from disclosure or use under Part 13 of the Act. The IPND is currently managed by Telstra and in that role is referred to as the “IPND Manager”[1].
Section 295A of the Act requires the ACMA to make, by legislative instrument, a scheme for the granting of authorisations for the purposes of paragraph 285(1A)(d) of the Act, that is, the permitted disclosure of information or documents held in the IPND which is otherwise protected from disclosure or use.
In 2007 the ACMA made the IPND Scheme. Under the IPND Scheme prospective public number directory publishers and researchers may apply to the ACMA for authorisation to use and disclose IPND data. The IPND Scheme makes provision for assessment by the ACMA of applications to access IPND data and specifies conditions to which authorisation is subject. Persons authorised under the IPND Scheme are also required to comply with any privacy laws that may be applicable to them.
In addition, an authorisation under the IPND Scheme is subject to the Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1) (the Authorisations Determination) which specifies additional conditions to which authorisations to use and disclose customer data originating from the IPND are subject. An authorisation under the IPND Scheme is subject to the condition in clause 6 of the Authorisations Determination that the holder will notify the ACMA and the IPND Manager, as soon as practicable, of any substantive or systemic breach of security that could reasonably be regarded as having an adverse impact on the integrity and confidentiality of the protected information, and to take reasonable steps to minimise the effects of such a breach.
Previous obligations
Previously, public number directory publishers and researchers (authorised persons) were
required to give the ACMA a report, in a form approved by the ACMA, about their compliance
with the IPND scheme:
(a) each year, on the anniversary of the start of the authorisation (or final authorisation for public number directory publishers); and
(b) not later than 15 working days after the day on which the (final) authorisation ended; and
(c) at another time if the ACMA asked the researcher or publisher, in writing, for a report.
The reports were also required to include a completed privacy impact form.
Operation of the Instrument
The Instrument repeals subsections 3.12(15) and (16) and subsections 4.6(14), (15) and (16) of the IPND Scheme, which related to annual and other reporting obligations by public number directory publishers (subsections 3.12(15) and (16)) and researchers (subsections 4.6(14), (15) and (16)).
In place of these requirements, authorised public number directory publishers and researchers will be obliged to notify the ACMA in writing as soon as practicable after they became aware they have breached a requirement of the IPND Scheme (that is, exception-based reporting), and must also take steps as soon as practicable to minimise the effects of the breach. The ACMA will be able to use exception-based reporting to assist it to prepare reports on compliance with the IPND Scheme to give to the Minister, as required under section 295U of the Act.
The rights of citizens to make complaints about the handling of information by authorised persons, and the ACMA’s ability to investigate IPND Scheme compliance issues, remain unchanged.
Purpose of the Instrument
The purpose of the Instrument is to reduce the regulatory burden on authorised public number directory publishers and researchers by enabling them to report to the ACMA on compliance with the IPND Scheme in a less costly and onerous way than by submitting annual and other compliance reports, while still assuring their compliance with the IPND Scheme. The proposed exception-based reporting will enable the ACMA to continue to maintain a suitable level of scrutiny over compliance by authorised persons with the conditions to which authorisation is subject. It will also lower compliance costs where authorised data users have no compliance issues to report to the ACMA.
It has been the ACMA’s experience that authorised users alert the ACMA to potential issues regarding their compliance with the IPND Scheme. The Instrument formalises existing practice in this regard.
By requiring prompt notification to the ACMA when a breach of the IPND Scheme occurs, the Instrument facilitates a more timely regulatory response than would be the case when relying on annual and post-authorisation reporting requirements.
Statement of Compatibility with Human Rights
A statement of compatibility with human rights for the purposes of Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011 is set out in Attachment A.
Regulation Impact Statement
The Office of Best Practice Regulation (OBPR) has advised that a Regulation Impact Statement is not required for the Instrument as the changes it makes do not have a more than minor regulatory impact on businesses, community organisations and individuals. The OBPR reference number is ID 16669.
Public consultation
In April 2014, in conjunction with a consultation process undertaken by the Department of Communications (the Department) on potential legislative reforms in communications, the ACMA released a public consultation paper: Proposals for reductions in telecommunications reporting requirements. The paper canvassed five proposals for reductions in industry reporting requirements and consumer information provision obligations in the telecommunications sector.
In relation to the IPND Scheme, the ACMA consulted with current authorised users of the IPND Scheme, the Australian Communications Consumer Action Network (ACCAN), Communications Alliance, the Attorney General’s Department and the Australian Information Commissioner. The Australian Information Commissioner elected not to make a submission but was satisfied that the ACMA met its obligations to consult on the proposal.
Seven submissions to the proposal were received. In general there was broad support for the proposal to replace annual reporting requirements on persons authorised under the IPND Scheme with exception-based reporting.
Description of the provisions in the Instrument
Section 1 - Name of instrument
Section 1 provides that the name of the Instrument is the Telecommunications Integrated Public Number Database Scheme Amendment 2014 (No.1).
Section 2 - Commencement
Section 2 provides that the Instrument commences on the day after it is registered on the Federal Register of Legislative Instruments.
Section 3 - Amendment of the Telecommunications Integrated Public Number Database Scheme 2007
Section 3 provides that Schedule 1 of the Instrument amends the Telecommunications Integrated Public Number Database Scheme 2007.
Schedule 1 – Amendment
Item [1]
Item [1] changes references in the instrument from “ACMA” to “the ACMA”. This is to reflect the current naming convention for the agency.
Item [2]
Item 2 omits subsections 3.12(15) and (16) of the IPND Scheme.
Item [3]
Item [3] adds new subsection 3.12(20) to the IPND Scheme, setting out new exception-based reporting requirements for public number directory publishers who become aware they have breached a requirement of subsection 3.12(19).
Subsection 3.12(19) sets out the requirements with which a public number directory publisher must comply. They include the Act, any relevant instrument under the Act, any conditions specified by the Minister under section 295P of the Act (that is, the Authorisations Determination), the conditions set out in subsections 3.12(2) to (17) of the IPND Scheme, and any conditions specified under subsection 3.12(18) of the IPND Scheme.
If a public number directory publisher becomes aware that it has breached one of the requirements referred to in subsection 3.12(19) it must:
- notify the ACMA in writing of the breach as soon as practicable; and
- take all reasonable steps as soon as practicable to minimise the effects of the breach.
Examples of such breaches include producing a database that is reverse-searchable, selling or providing IPND information to any person for any purpose unless authorised by or under law, failing to publish a public number directory within 90 days after final authorisation starts, and failing to take reasonable steps to protect and secure IPND information.
The provision is triggered when a public number directory publisher ‘becomes aware’ of a breach. This concept encompasses a range of potential situations, including where a complaint is made to a public number directory publisher, or when the public number directory publisher’s own processes disclose an irregularity, or any other circumstance in which the public number directory publisher becomes aware of a breach (for example, on notification by the IPND Manager).
Once a public number directory publisher becomes aware of a breach, it is required to advise the ACMA in writing as soon as practicable. The obligation to notify is limited to notifying the ACMA. It is not necessary for the IPND Manager to be notified, unless there is a substantial or systemic breach of security (in accordance with section 6 of the Authorisations Determination). The ACMA may advise the IPND Manager of any significant compliance issues reported to the ACMA, as appropriate.
A public number directory publisher must also take prompt action to minimise the effects of the breach.
Item [4]
Item [4] omits subsections 4.6(14), (15) and (16) of the IPND Scheme.
Item [5]
Item [5] adds new subsection 4.6(20) to the IPND Scheme setting out new exception-based reporting requirements for researchers who become aware they have breached a requirement of subsection 4.6(19).
New section 4.6(20) stipulates that if a researcher becomes aware that it has breached a requirement referred to in subsection 4.6(19) it must:
- notify the ACMA in writing of the breach as soon as practicable; and
- take all reasonable steps as soon as practicable to minimise the effects of the breach.
Subsection 4.6(19) sets out the requirements with which a researcher must comply. They include the Act, any relevant instrument under the Act, any conditions specified by the Minister under section 295P of the Act (that is, the Authorisations Determination), the conditions specified in subsections 4.6(2) to (17) of the IPND Scheme, and any conditions specified under subsection 4.6(18) of the IPND Scheme.
Examples of such breaches include: producing a database that is reverse-searchable (outside the limited exception available to researchers), selling or providing IPND information to any person for any purpose unless authorised by or under law, and failing to take reasonable steps to protect and secure IPND information.
The provision is triggered when a researcher becomes aware of a breach. This concept encompasses the types of situations explained above at item [3] in relation to subsection 3.12(20).
Once a researcher ‘becomes aware’ of a breach, it is required to advise the ACMA in writing as soon as practicable. The obligation to notify is limited to notifying the ACMA. It is not necessary for the IPND Manager to be notified, unless there is a substantial or systemic breach of security (in accordance with section 6 of the Authorisations Determination). The ACMA may advise the IPND Manager of any significant compliance issues reported to the ACMA, as appropriate.
A researcher must also take prompt action to minimise the effects of the breach.
Attachment A
Statement of Compatibility with Human Rights
Prepared in accordance with Part 3 of the Human Rights (Parliamentary Scrutiny) Act 2011
Telecommunications Integrated Public Number Database Scheme Amendment 2014 (No.1)
The Telecommunications Integrated Public Number Database Scheme Amendment 2014 (No.1) (the Instrument) is compatible with the human rights and freedoms recognised or declared in the international instruments listed in section 3 of the Human Rights (Parliamentary Scrutiny) Act 2011.
Overview of the Amendment Instrument
The Instrument amends the Telecommunications Integrated Public Number Database Scheme 2007 (the IPND Scheme), which is made under section 295A of the Telecommunications Act 1997.
The Instrument amends the requirements of the IPND Scheme relating to annual and other reporting by persons authorised under that scheme to access information in the integrated public number database (the IPND).
The Instrument replaces the requirements on authorised directory publishers (in subsections 3.12(15) and (16) of the IPND Scheme) and on researchers (in subsections 4.6(14), (15) and (16) of the IPND Scheme) to give the ACMA a number of compliance reports (annually, shortly after an authorisation ends and, if required, upon request) with exception-based reporting. The Instrument effectively formalises existing practice and provides continued transparency of industry compliance with the conditions of authorisation, while lowering costs where authorised data users have no compliance issues to report to the ACMA. It ensures notification to the ACMA in the event a breach of the conditions of authorisation occurs and requires prompt action by the authorised person to minimise the effects of the breach, as well as facilitating a more timely regulatory response than relying on annual and other reporting requirements.
Human rights implications
Right to freedom from arbitrary or unlawful interference with privacy
Article 17 of the International Covenant on Civil and Political Rights (ICCPR) protects the right to freedom from arbitrary or unlawful interference with privacy. This right needs to be considered in the context of the proposed Instrument.
Article 17 of the ICCPR does not set out the reasons for which the protections in it may be limited. However, legislative instruments which consider public order, national security, the protection of public health or the protection of the rights and freedoms of others, might be legitimate reasons for limiting the right to freedom from arbitrary or unlawful interference with privacy.
Part 13 of the Telecommunications Act 1997 is directed to protecting the confidentiality of information which is held by carriage service providers and which relates to:
- the contents of communications that have been carried by carriage service providers;
- the carriage services supplied by carriage service providers; and
- the affairs or personal particulars of other persons.
The disclosure or use of such information is prohibited except in limited circumstances, such as the enforcement of the criminal law and providing emergency warnings.
Part 13 also provides for the ACMA to make an IPND Scheme, which allows for recipients of protected information, authorised by the ACMA, to disclose or use IPND for an authorised purpose. The IPND Scheme enables authorised users to access IPND data, which contains personal customer information. Access to IPND data is strictly governed under the IPND Scheme and these arrangements will not be affected by the changes in the Instrument.
The Instrument amends the requirements of the IPND Scheme relating to annual and other reporting by persons authorised under that scheme to access information in the IPND. To this end, compliance reporting will still exist under the Scheme, but it will be exception-based in place of annual and other reporting. Further, the ACMA’s ability to enforce compliance with the IPND Scheme (including, for example, the power to revoke an authorisation to access IPND data) will be unaffected by the change.
Accordingly, the Instrument does not authorise any unlawful or arbitrary interference with privacy because access to IPND data, and the legislative safeguards inherent in the IPND Scheme will not be changed. The limited circumstances in which information may be disclosed and which may limit the right to freedom from interference with privacy continue to be justified.
Conclusion
In conclusion, the Instrument engages the right to privacy under the ICCPR in a limited way. Protections currently afforded to customer information in the IPND and the ACMA’s ability to enforce compliance with the IPND Scheme will remain. The Instrument is compatible with human rights.
Australian Communications and Media Authority
[1] See clause 10 of the Carrier Licence Conditions (Telstra Corporation Limited) Declaration 1997.