EXPLANATORY STATEMENT
TELECOMMUNICATIONS (INTEGRATED PUBLIC NUMBER
DATABASE SCHEME – CONDITIONS FOR AUTHORISATON)
DETERMINATION 2007 (NO. 1)
Issued by the authority of the Minister for Communications, Information Technology and the Arts (the Minister)
The Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1) (the Determination) sets out the conditions upon which authorisations for access to personal information contained in the Integrated Public Number Database (IPND) may be granted by the Australian Communications and Media Authority (ACMA) under the IPND scheme.
The IPND is an industry-wide database of all public telephone numbers (both listed and unlisted) and associated customer information including name and address information. It also includes information such as whether the number or address is to be listed in a public number directory and whether the number is used for residential, business, government or charitable purposes. The IPND is established and maintained by Telstra Corporation Limited (Telstra) as a condition of its carrier licence. All carriage service providers who supply carriage services to customers who have public numbers are obliged to provide customer information to Telstra for inclusion in the IPND.
Proposed section 295A of the Telecommunications Act 1997 (the Telecommunications Act), to be inserted by item 9 of Schedule 1 to the Telecommunications Amendment (Integrated Public Number Database) Act 2006 (the IPND Act), requires ACMA to establish an IPND scheme for the granting of authorisations that will permit certain persons to use and disclose protected communications information. The amendments in the IPND Act are a response to allegations of IPND information being directly used for purposes that are not authorised by the Telecommunications Act, such as marketing and debt collection.
The amendments amend the Telecommunications Act to:
- insert a definition of public number directory (PND) into the Telecommunications Act;
- permit access to information in the IPND for research purposes the Minister considers to be in the public interest, as set out in a legislative instrument;
- give ACMA a gatekeeper role in granting authorisations to access information in the IPND for the publication and maintenance of telephone directories and the conduct of permitted research; and
- introduce criminal offences and penalties for breaching a condition of authorisation and for unauthorised disclosure and use of IPND information.
The IPND scheme is established in a legislative instrument, the Telecommunications Integrated Public Number Database Scheme 2007, which will come into operation on 15 May 2007 when Schedule 1 to the IPND Act is proclaimed to commence. The scheme requires persons seeking access to information in the IPND for the purposes of publishing and maintaining a public number directory or conducting research the Minister considers to be in the public interest (as set out in the Telecommunications (Integrated Public Number Database – Permitted Research Purposes) Instrument 2007 (No. 1)), to apply to ACMA for an authorisation before access to IPND information may be granted.
The amendments to the Telecommunications Act also permit the Minister to place mandatory conditions on authorisations granted under the IPND scheme. This instrument making power enables the Minister to specify conditions that will further protect the privacy of information contained in the IPND. Breach of a condition of authorisation will be a criminal offence. ACMA will also be able to issue formal warnings in relation to breaches of conditions, and written directions to comply with a condition of authorisation. Failure to comply with a written direction is a breach of a civil penalty provision for which Part 31 of the Telecommunications Act provides pecuniary penalties.
Regulation Impact Statement
The Office of Best Practice Regulation has advised that a Regulation Impact Statement (RIS) is not required on the basis that a RIS was prepared and cleared by the Office of Best Practice Regulation prior to introduction of the Telecommunications Amendment (Integrated Public Number Database) Bill 2006 (now the IPND Act). It is the IPND Act which provides the legislative basis for the Determination.
Consultation
The Determination has been drafted in consultation with ACMA, the Office of the Privacy Commissioner and the Attorney-General’s Department, in response to commitments made by the Minister during passage of the IPND Act. Individual consultations with current registered IPND users and other interested persons were conducted between 19 January 2007 and 7 February 2007.
A draft of the Determination was released for public comment on 7 February 2007. The consultation period closed on 5 March 2007. Seven submissions were received through this process. ACMA also undertook consultation on the draft IPND scheme Instrument from 29 January to 2 March 2007. ACMA received 13 submissions.
Feedback on the draft Determination was taken into account when finalising the Determination.
Legislative basis
The Determination is made under:
- section 4 of the Acts Interpretation Act 1901, which allows the Determination to be made before Schedule 1 to the IPND Act is proclaimed; and
- proposed section 295P of the Telecommunications Act, to be inserted by item 9 of Schedule 1 to the IPND Act.
Proposed subsection 295P(1) provides that the Minister may, by legislative instrument, do either or both of the following:
- determine that all authorisations under the IPND scheme are granted subject to specified conditions;
- determine that a specified kind of authorisation under the IPND scheme is granted subject to specified conditions.
Proposed subsection 295P(2) provides that an authorisation under the IPND scheme is granted subject to any condition specified in an instrument under section 295P that is applicable to that authorisation.
The Determination is a legislative instrument for the purposes of the Legislative Instruments Act 2003 (see section 5 of that Act). The Determination must therefore be registered on the Federal Register of Legislative Instruments, tabled in Parliament and is subject to Parliamentary disallowance.
NOTES ON CLAUSES
Clause 1 ‑ Name of instrument
Clause 1 provides that the name of the Determination is the Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1).
Clause 2 ‑ Commencement
Clause 2 provides that the Determination commences on the same day as Schedule 1 to the IPND Act.
The Act provides for Schedule 1 to commence on a day to be fixed by Proclamation, provided that day is within the period of 6 months from the day the Bill received Royal Assent. However, if Schedule 1 is not proclaimed within the 6 month period, then Schedule 1 will commence on the first day after the end of the 6 month period. The Bill received Royal Assent on 8 December 2006.
It is proposed that Schedule 1 will be proclaimed to commence on 15 May 2007. The reason for a delayed commencement of Schedule 1 is to allow time for the making of the legislative instruments provided for in the IPND Act, particularly the instruments establishing the IPND scheme, including this Determination.
Clause 3 ‑ Definitions
Clause 3 defines the terms and concepts used in the Determination.
Clause 4 – Transborder data flows
The conditions at subclauses 4(1) and 4(2) apply to all holders of authorisations granted under the IPND scheme.
Subclause 4(1)
Subclause 4(1) restricts the circumstances in which holders of authorisations may transfer IPND information to foreign countries. Subclause 4(1) provides that the only circumstances under which IPND information may be transferred to a foreign country are where:
- the holder of the authorisation reasonably believes that the recipient is subject to a law, binding scheme or contract which upholds principles for fair handling of the information that are substantially similar to the National Privacy Principles; or
- the holder of the authorisation has made contractual arrangements to ensure that the IPND information will not be held, used or disclosed by the recipient inconsistently with the National Privacy Principles.
The condition seeks to protect the privacy of personal information sourced from the IPND by preventing it from being transferred to a country that does not have the same level of privacy protection for personal information as that provided in Australia.
Alternatively, if the IPND information is to be transferred to a country with lower privacy protections than those prevailing in Australia, the authorisation holder must put in place contractual arrangements with the information recipient in that country to ensure that IPND information is protected to the standard provided for in the National Privacy Principles.
National Privacy Principle 9 (NPP 9) is the accepted standard in relation to restrictions on transferring personal information outside of Australia. However, NPP 9 contains some very broad exemptions which would not effectively prevent the transfer of IPND information outside of Australia without appropriate protections. Subclause 4(1) in the Determination is therefore a more restrictive version of NPP 9.
The Determination has been drafted to ensure that temporary offshoring of IPND information, for example where a document is emailed between two points in Australia but travels overseas on the way to its destination because of Internet routing, is not captured by theses provisions (see subclause 3(2) of the Determination).
Subclause 4(2)
Subclause 4(2) requires holders of authorisations who transfer IPND information to a foreign country to remain legally responsible for any use or disclosure of that information by the recipient that is inconsistent with the National Privacy Principles. This condition seeks to overcome the jurisdictional issues involved in enforcing Australian privacy law overseas. The condition will have the effect of enabling individuals to seek redress from, and ACMA to take action against, the Australian-based holder of the authorisation should the IPND information be used or disclosed inappropriately outside of Australia.
Clause 5 – Safeguarding protected information
The condition in clause 5 applies to all holders of authorisations granted under the IPND scheme.
Clause 5 requires authorisation holders to take reasonable steps to protect and secure the IPND information, and personal information related to the IPND information, they hold from misuse or loss, and from unauthorised access, modification, use or disclosure. This condition is based on National Privacy Principle 4.1.
The phrase ‘personal information related to the protected information’ (ie IPND information) is intended to include sensitive information such as the political opinions or health information pertaining to an individual.
Clause 6 – Addressing breaches of security
The condition in clause 6 applies to all holders of authorisations granted under the IPND scheme.
Clause 6 requires an authorisation holder to notify ACMA and the IPND Manager (currently Telstra) as soon as practicable after the authorisation holder becomes aware of a substantive or systemic breach of security that could reasonably be regarded as having an adverse impact on the integrity and confidentiality of IPND information. This condition also requires the authorisation holder to take reasonable steps to minimise the effects of the breach.
This condition is based on a similar requirement in the C555:2007 Integrated Public Number Database (IPND) Industry Code.
Clause 7 – Notification of breaches by others
The condition in clause 7 applies to all holders of authorisations granted under the IPND scheme.
Clause 7 requires the holder of the authorisation to notify ACMA and the IPND Manager as soon as practicable after becoming aware that a person to whom the authorisation holder has disclosed IPND information had contravened any legal restrictions on the use or disclosure of IPND information. This condition is based on a similar requirement in the C555:2007 Integrated Public Number Database (IPND) Industry Code.
Clause 8 – Secure disposal of protected information after use
The condition in clause 8 applies to all holders of authorisations granted under the IPND scheme.
Clause 8 requires IPND information be securely destroyed within 10 working days if the information is no longer needed or where an authorisation ceases or has been revoked. This is intended to ensure that the user of the information only has access to IPND information for as long as it is needed or for as long as the user is authorised to have access to it. Requiring the secure destruction of IPND information will also minimise the risk of unauthorised persons obtaining access to the IPND information after the holder of the authorisation no longer needs, or is no longer authorised to access, the information. This condition is based on National Privacy Principle 4.2.
Clause 9 – Public number directory publishers
Clause 9 specifies conditions of authorisation that apply only to holders of authorisations for the publication and maintenance of a public number directory.
Subclause 9(1)
This subclause recognises that publishers of public number directories may contract out the preparation of the public number directory to another person, and that the conditions relating to use and disclosure of IPND information for the purpose set out in the authorisation should also apply to the other person.
Subclause 9(1) requires that, before the holder of an authorisation can disclose IPND information to a contractor, the holder of the authorisation must have contractual arrangements in place that ensure the contractor neither uses nor discloses IPND information except for the purpose of publishing and maintaining a public number directory. This condition is also intended to prevent public number directory publishers avoiding their obligations under the Act through outsourcing arrangements.
Subclause 9(2)
If an authorisation is granted by ACMA under the IPND scheme, the holder of the authorisation will, subject to entering contractual arrangements with the IPND Manager, be given access to IPND ‘customer data’. Customer data is defined in the IPND scheme as meaning:
(a) for a listed entry, originating from the IPND, about a customer or a
customer’s business:
(i) the public number of the customer or the business;
(ii) the name of the customer or the business;
(iii) the directory finding name of the customer or business (if
relevant);
(iv) the directory address of the customer or business;
(v) if it is known whether the relevant carriage service being
supplied to the customer on the public number is to be used for
government, business, charitable or residential purpose — the
relevant purpose;
(vi) if the customer has been offered a suppressed address entry—
whether the customer has requested that entry;
(b) for a listed entry, originating from the IPND, about a customer or a
customer’s business that becomes an unlisted entry:
(i) the public number of the customer or the business;
(ii) a flag indicating that the entry has become unlisted.
The proposed definition of public number directory to be inserted in the Telecommunications Act by item 6 of Schedule 1 to the IPND Act defines a public number directory as a record containing the public number, name and, optionally, address of a person or body. Additional information may be included in a public number directory in relation to bodies that are qualifying entities as defined by item 7 of Schedule 1 to the IPND Act, but only if the qualifying entity has consented in writing to this additional information being included in the public number directory.
Subclause 9(2) makes it a condition of authorisation that the only customer data (as defined above, that is, originating from the IPND) that may be included in a public number directory that is published and maintained by the holder of the authorisation is the finding name, directory address and public number. This is on the basis that this is the only information the customer would have consented to having included in a public number directory at the time of subscribing to the telecommunications service.
Subclause 9(3)
Subclause 9(3) requires authorisation holders to be the copyright holder in any public number directory produced using IPND information as result of that authorisation, whether the directory is produced by the holder of the authorisation or a contractor. Any public number directory published will also need to include the name and contact details of the directory publisher and a copyright statement concerning the holder’s copyright in the directory.
This condition is intended to act as a disincentive for the on-selling of IPND information directly to other persons who may then use the information to produce their own directory products in which they hold the copyright. It is unlikely the person producing the directory will want the copyright and contact details of another person (i.e. the authorisation holder) in the directory to which they hold copyright.
This condition also assists ACMA in its monitoring and compliance role by easily enabling ACMA to identify the publisher of a particular public number directory.
The condition will also enable customers to easily identify the directory publisher in the event that they wish to contact the publisher or make a complaint about the directory publisher, for example if they wish to correct their entry in the public number directory or where they have an issue with the disclosure or use of their personal information by the directory publisher.
Clause 10 – Researchers
Clause 10 specifies conditions of authorisation that apply only to holders of authorisations to conduct research in the public interest as set out in Telecommunications (Integrated Public Number Database – Permitted Research Purposes) Instrument 2007 (No. 1).
Subclause 10(1)
This subclause recognises that researchers may contract out the preparation of the database of IPND information used to conduct research, or the conduct of the research itself, to another person, and that the conditions applying to the use and disclosure of IPND information for the purpose set out in the authorisation should also apply to that person.
Subclause 10(1) requires that, before the holder of an authorisation can disclose IPND information to a contractor, the holder of the authorisation must have contractual arrangements in place that ensure the contractor neither uses nor discloses IPND information except for the purpose of conducting the kind of research as specified in Telecommunications (Integrated Public Number Database – Permitted Research Purposes) Instrument 2007 (No. 1). This condition is also intended to prevent researchers avoiding their obligations under the Act through outsourcing arrangements.
Subclause 10(2)
Subclause 10(2) makes it a condition of authorisation that the holder of the authorisation must not produce a database from IPND information for research purposes that is reverse-searchable. What constitutes ‘reverse-searchable’ in this condition is based on paragraph (d) of the proposed definition of public number directory to be inserted by item 6 of Schedule 1 to the IPND Act which applies to public number directories, that is, the database must not enable a person who only knows someone’s public number to readily identify their name and/or address or, subject to subclause (3), a person who only knows the whole or part of someone’s address to identify their name and/or public number.
This condition is made on the basis that there is no apparent need for researchers to produce databases that permit searching by number to find a person’s name and/or address for research purposes. There is also a clear concern among members of the public about directories and databases being reverse-searchable.
Subclause 10(3)
Reverse-searchability is a particularly a concern in relation to electronic public number directories that are in the public domain. A reverse-searchable public number directory can be easily used by any member of the public with malicious intent to identify and locate a person. Such uses of public number directories by the general public fall outside of the provisions of the Telecommunications Act and the Privacy Act.
Reverse-searchability appears to be less of a concern when databases will be produced and used by researchers internally. It has been pointed out in public consultation that researchers need to be able to search any database they produce for research purposes by postcode, to find a list of public numbers in that postcode for geographically valid sampling purposes. If this is not permitted, access to the IPND for these users will be ineffective.
Holders of research authorisations will be subject to secondary disclosure and use criminal offences and penalties if they disclose or use IPND information for unauthorised purposes. ACMA has a range of other investigative and enforcement powers which it can use should any concerns be raised about the use of IPND information by researchers.
As a result subclause 10(3) creates an exception to the general prohibition on researchers producing databases that are reverse-searchable, allowing the holder of a research authorisation to produce a database that enables a person to search by postcode to find a list of public numbers, and the associated customer data, from within the postcode.
Subclause 10(4)
If an authorisation is granted by ACMA under the IPND scheme, the holder of the authorisation will, subject to entering contractual arrangements with the IPND Manager, be given access to IPND ‘customer data’. Customer data is defined in the IPND scheme as meaning:
(a) for a listed entry, originating from the IPND, about a customer or a
customer’s business:
(i) the public number of the customer or the business;
(ii) the name of the customer or the business;
(iii) the directory finding name of the customer or business (if
relevant);
(iv) the directory address of the customer or business;
(v) if it is known whether the relevant carriage service being
supplied to the customer on the public number is to be used for
government, business, charitable or residential purpose — the
relevant purpose;
(vi) if the customer has been offered a suppressed address entry—
whether the customer has requested that entry;
(b) for a listed entry, originating from the IPND, about a customer or a
customer’s business that becomes an unlisted entry:
(i) the public number of the customer or the business;
(ii) a flag indicating that the entry has become unlisted.
Subclause 10(4) makes it a condition of authorisation that the only customer data (as defined above, that is, originating from the IPND) that the holder of an authorisation may use to contact a customer for one of the specified research purposes is the finding name, directory address and public number. This condition mirrors the condition placed on public number directory publishers under subclause 9(2) and is made on the same basis, that is, that this is the only information the customer would have consented to having included in a public number directory at the time of subscribing to the telecommunications service. Therefore, it would be reasonable to assume that these are the customer details by which a customer would expect to be contacted by researchers.
Subclause 10(5)
Subclause 10(5) prohibits the holder of an authorisation from selling or providing IPND information to any person for any purpose unless this is authorised by or under law. Authorised by or under law includes by the Telecommunications Act or legislative instruments made under that Act. This condition is based on a similar requirement contained in the C555:2007 Integrated Public Number Database (IPND) Industry Code.
This code binds public number directory publishers but will not apply to holders of research authorisations under the IPND scheme. However, it is considered appropriate that such a requirement also apply to researchers.