Telecommunications (Listed Infringement Notice Provisions) Amendment Declaration 2022 (No. 1)

EXPLANATORY STATEMENT

Approved by the Australian Communications and Media Authority

Telecommunications Act 1997

Telecommunications (Listed Infringement Notice Provisions) Amendment Declaration 2022 (No.1)

Authority

The Australian Communications and Media Authority (the ACMA) has made the Telecommunications (Listed Infringement Notice Provisions) Amendment Declaration 2022 (No. 1) (the instrument) under subsection 572E(7) of the Telecommunications Act 1997 (the Act) and subsection 33(3) of the Acts Interpretation Act 1901 (the AIA).

Subsection 572E(7) of the Act provides that the ACMA may, by legislative instrument, declare that a specified provision of:

• the Act;
• a declaration in force under section 63 of the Act; or
• a determination in force under section 99 of the Act;

is a listed infringement notice provision for the purposes of section 572E of the Act. 

Section 572E allows the ACMA to give an infringement notice in relation to a contravention of a civil penalty provision. Sections 68 and 101 of the Act require carriers and carriage service providers (CSPs) to comply with licence conditions and service provider rules, respectively, and include civil penalty provisions that apply to a carrier or CSP that contravenes another provision of the Act. Subsections 572E(5) and (6) provide that an infringement notice may only be given in relation to a contravention of section 68 or 101 of the Act if the other provision contravened is listed in a legislative instrument made under subsection 572E(7) of the Act, and has been so listed for at least three months before the alleged contravening conduct takes place.

Subsection 33(3) of the AIA relevantly provides that where an Act confers a power to make a legislative instrument, the power shall be construed as including a power exercisable in the like manner and subject to the like conditions (if any) to repeal, rescind, revoke, amend, or vary any such instrument.

A provision-by-provision description of the instrument is set out in the notes at Attachment A.

The instrument is a disallowable legislative instrument for the purposes of the Legislation Act 2003 (the LA).

Purpose and operation of the instrument

The instrument amends the Telecommunications (Listed Infringement Notice Provisions) Declaration 2022 (the Declaration) to include specified provisions from two determinations made under section 99 of the Act:

• the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 (the Customer ID Determination), and
• the Telecommunications Service Provider (International Mobile Roaming) Determination 2019 (the IMR Determination).

Details of the new provisions are at Attachment B.

Listed infringement notice provisions

In selecting appropriate provisions to be listed, the ACMA consulted with the Department of Infrastructure, Transport, Regional Development, Communications and the Arts (the Department) and the Attorney General’s Department (the AGD) and gave consideration to the relevant criteria drawn from the Guide to Framing Commonwealth Offences, Civil Penalties and Enforcement Powers 2011 (the Guide) which provides that infringement notices may be appropriate:

• for strict or absolute liability offences/civil penalties;
• where the physical elements of an offence/contravention are clear cut—for example, breaches do not involve significant forensic enquiry or subjective elements such as state of mind or fault;
• for relatively minor offences/contraventions;
• where there has been a high number of contraventions; or
• where a penalty must be imposed immediately to be effective.

The ACMA considers that each of the identified provisions in the instrument are suitable for enforcement via the infringement notice regime because the physical elements of the contraventions are considered to be clear cut, and compliance is readily ascertainable.

The new provisions to be included in the instrument are discussed below:

Provisions of the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022

The Customer ID Determination is made under section 99 of the Act and sets out service provider rules relating to the requirements that CSPs must follow before undertaking high-risk customer transactions, as defined in subsection 6(1) of the Customer ID Determination.

Examples of a high-risk customer transaction for the purposes of the Customer ID Determination include:

• requests for a SIM swap;
• transferring a telecommunications service from being a post-paid carriage service to a pre-paid carriage service;
• activating a telecommunications service where the customer is overseas;
• transferring a title (also known as change of ownership);
• blocking an International Mobile Equipment Identity or a Permanent Equipment Identifier;
• purchasing an additional mobile communications device; or
• adding an additional carriage service to an account.

Identity authentication for high-risk customer transactions

Section 8 of the Customer ID Determination provides that a CSP must use one of the identity authentication processes outlined at sections 9, 10 or 11 prior to undertaking the first high-risk customer transaction in the course of a high-risk customer interaction to confirm the requesting person is the customer, or their authorised representative, for the service.

Section 8 is subject to section 12, which applies where a person is authorised by the customer, or by a court or tribunal or any other body legally empowered to represent customers, to act on behalf of the customer, other than an authorised representative – defined as an “unlisted authorised representative” in subsection 6(1) of the Customer ID Determination.

Notifications

Subsections 10(5) and 11(4) provide that a CSP must send a notification to a customer, or the customer’s authorised representative (the relevant person), prior to or immediately after undertaking a high-risk transaction.

Subsection 12(4) provides that a CSP must send a notification to the relevant person, prior to or immediately after undertaking a high-risk transaction initiated by an unlisted authorised representative in relation to the customer’s telecommunications service.

A notification sent under subsection 10(5), 11(4) or 12(4) must inform the relevant person that a high-risk transaction has been initiated, and what they can do if they did not initiate the transaction.

Reversal or remediation of unauthorised high-risk customer interactions

Section 9 of the Customer ID Determination sets out the multi-factor authentication identity requirements. This includes the option to use a unique verification code or secure hyperlink to confirm that the requesting person is the customer or authorised representative for the service. Sub-subparagraph 9(3)(c)(ii)(C) provides that a CSP must notify the relevant person in the message in which the unique verification code or secure hyperlink is sent, what they can do if they did not authorise the high-risk interaction.

This is similar to the requirement in subsections 10(5), 11(4) and 12(4) that the notification sent under those provisions must include what the relevant person can do if they did not initiate the transaction.

Paragraphs 9(5)(a), 10(8)(a) and 11(7)(a) provide that a CSP must reverse or remediate any completed high-risk customer transaction if the relevant person did not initiate the transaction and takes the action referred to in sub-subparagraph 9(3)(c)(ii)(C) or subsections 10(5) and 11(4), respectively.

Paragraphs 9(5)(b), 10(8)(b) and 11(7)(b) provide that where a high-risk transaction has not yet been undertaken, a CSP must not undertake any high-risk customer transaction if the relevant person did not initiate the transaction and takes the action referred to in sub-subparagraph 9(3)(c)(ii)(C) or subsections 10(5) and 11(4), respectively.

Fraud mitigation protections for customers at risk of fraud

Section 13 is intended to ensure that a carriage service provider has fraud mitigation protections and systems in place.

Subsection 13(1) provides that a CSP must have systems in place to identify customers that are at risk of fraud in relation to their telecommunications service and provide those customers with fraud mitigation protections.

Subsection 13(2) provides that a CSP must, in response to a reasonable request made by a customer who believes they are at risk of fraud, offer the customer fraud mitigation protections.

Publication of information

Section 14 provides that a CSP must publish information on its website advising customers that identity authentication processes will be used, and that if a customer suspects their telecommunications service or account has been subject to fraud they should immediately report the activity to their CSP and financial services provider.

No fee for a message or notification

Section 15 provides that a CSP must not charge a fee to a customer, or a customer’s authorised representative, for a message or notification sent for the purposes of the Customer ID Determination, except where a customer or their authorised representative uses a telecommunications service to initiate a high-risk customer transaction that is not associated with the customer’s account.

Record-keeping

Section 16 provides that a CSP must keep records that are sufficient to demonstrate its compliance with Parts 2, 3, 4 and 5 of the Customer ID Determination, for a minimum of one year. A CSP must also retain records specified at subsections 11(3) and 12(3) for a minimum of one year.

Subsection 11(3) provides that a CSP must keep a record of the details of any high-risk customer interactions initiated by a person in vulnerable circumstances, including the identity authentication process used to confirm that the requesting person is the customer or the customer’s authorised representative, the basis on which the employee or agent of the provider reasonably believed that the requesting person was a person in vulnerable circumstances and any material or supporting evidence provided by the requesting person.

Subsection 12(3) provides that a CSP must keep a record of the details of any high-risk customer transactions initiated by an unlisted authorised representative, including the basis on which the employee or agent of the provider was satisfied that the requesting person is an unlisted authorised representative and any material or supporting evidence provided by the requesting person.

Provisions of the Telecommunications Service Provider (International Mobile Roaming) Determination 2019

The IMR Determination requires that consumers be notified of activation of IMR services and maximum IMR charges, and be able to monitor, track and where necessary alter (including stopping) their use of IMR services when overseas to better manage their spending.  

Customers to be offered a preferred method of communication option

Subsections 7(1) and 7(2) require CSPs to have and offer for selection, respectively, SMS, and one other method suitable for devices that do not support SMS, available as a customer’s preferred communication method for receiving notifications about their IMR service.

Subsection 7(6) requires CSPs to inform customers if charges may apply to their preferred method of communication.

Subsection 7(7) requires CSPs to communicate notifications about the IMR service to the customer using the customer’s preferred method of communication, unless otherwise specified.

Subsection 7(8) requires that, if a customer does not choose a preferred method of communication, the CSPs must communicate to the customer using SMS, or one of the other methods of communication suitable for devices that do not support SMS, as if a customer has selected that method.

Mobile network operators to send information about supply of an IMR service

Subsection 8(2) requires that, within 10 minutes of the customer activating the IMR service, the CSP must send a message to the customer advising them of the information specified in that subsection.

Subsection 8(5) requires CSPs to send the customer the message referred to in subsection 8(2) each time the customer activates the service in an oversees location or a new overseas location, unless the specified exceptions apply.

Subsection 8(6) specifies that a CSP must not charge a fee for sending the customer a message under subsection 8(2) or 8(3).

Mobile network operators who supply carriage services to another CSP to send information about supply of an IMR service

Section 9 of the IMR Determination applies to a mobile network operator who supplies a carriage service to another CSP (the second provider) and the service is used to supply an IMR service to a customer of the second provider or another CSP that supplies an IMR service to a customer.

Paragraph 9(2)(a) requires that, within 10 minutes of the customer activating the IMR service, the mobile network operator must send the customer the warning message specified in that paragraph. Paragraphs 9(2)(b) and (c) provide that within one hour of the customer activating an IMR service, the mobile network operator must send the second provider notice that the IMR service is being supplied to the customer, the mobile number of the customer and the overseas location in which the IMR service has been activated.

Subsection 9(4) requires the mobile network operator to send the message specified in paragraph 9(2)(a) each time the customer activates an IMR service in an overseas location, unless the message was sent to that customer in the same location within the preceding 14 days.

Subsection 9(5) specifies that the notification in paragraph 9(2)(b), and the information specified in paragraph 9(2)(c), must be sent to the second provider each time the customer activates an IMR service in an overseas location, unless those messages were sent to that customer in the same location within the preceding 14 days.

Mobile virtual network operators to send information about supply of an IMR service

Section 10 applies to a CSP who is a mobile virtual network operator that supplies an IMR service to a customer.

Subsection 10(2) requires the CSP to send a message to the customer advising them of maximum charges and how to decline supply of roaming services, within 10 minutes of receiving information about a customer’s activation of an IMR service in an overseas location.

Subsection 10(5) requires the CSP to send the message referred to in paragraphs 10(2)(a) and (b) to the customer each time the customer activates the IMR service in an overseas location, unless those messages were sent to that customer in the same location within the preceding 14 days.

CSPs to otherwise send maximum charge information

Subsection 11(2) requires the CSP to provide maximum charge information in relation to any overseas location to the customer within 24 hours of receiving a request from the customer.

Prohibition on CSPs charging a fee to send messages to customers

Subsections 9(6), 10(6) and 11(3) prohibit a CSP from charging a fee for sending the messages required under paragraph 9(2)(a), subsections 10(2),10(3) and 11(2).

CSPs to make available methods to decline an IMR service

Subsection 12(1) requires a CSP to make available at least one method by which a customer may decline the continued supply of an IMR service at any time while travelling overseas.

Subsection 12(2) specifies that if a customer declines the continued supply of an IMR service, the CSP must cease the service within 24 hours.

Subsection 12(3) specifies that if a customer calls a particular Australian number to decline the continued supply of an IMR service, the CSP must not charge more than A$1.

Subsection 12(4) specifies that if a customer uses the CSP’s website to decline the continued supply of an IMR service, the CSP must not charge the customer a fee.

Subsection 12(5) specifies that if a customer uses a method other than those listed in subsections (3) and (4) to decline the continued supply of an IMR service, the CSP must not charge the customer a fee of more than A$1.

CSPs to make available spend management tools for an IMR service

Subsection 13(2) requires that a CSP that supplies an IMR service to a customer must make available at least one spend management tool that provides either an estimate of usage in relation to the IMR service, or, if it cannot provide a current usage estimate, advice about the length of the delay and information about current IMR charges or usage that is yet to be billed to the customer.

Subsection 13(5) prohibits a CSP from using a customer’s acceptance of a term of a standard form of agreement, or the default terms and conditions of an included value pack, to allow a customer to decline to receive spend management information related to their use of the IMR service.

Paragraph 13(6)(a) specifies that if a customer declines to receive spend management information related to their use of the IMR service, the CSP must send an acknowledgement to the customer advising them that they may request to receive the notifications again at any time.

Paragraph 13(12)(b) requires that spend management tool(s) must be made available to customers without charge.

Documents incorporated by reference

The instrument amends the Declaration so as to incorporate by reference the following legislative instruments:

• the Customer ID Determination; and
• the IMR Determination.

Those legislative instruments are incorporated as in force from time to time.

Those legislative instruments can be accessed, free of charge, from the Federal Register of Legislation: http://www.legislation.gov.au.

Consultation

Before the instrument was made, the ACMA was satisfied that consultation was undertaken to the extent appropriate and reasonably practicable, in accordance with section 17 of the LA. 

Subsection 572E(8) of the Act sets out requirements for consultation to be undertaken by the ACMA prior to making a declaration under subsection 572E(7). In accordance with the requirements of subsection 572E(8), on 10 June 2022 the ACMA published on its website a consultation paper outlining its proposal to make the instrument, and inviting persons to make submissions to the ACMA about the proposal (consultation 18/2022). Submissions closed on 24 June 2022.

The ACMA received feedback from the Department advising that it supported the proposal.

The AGD also advised that it was generally comfortable with the proposed amendments but suggested the ACMA reconsider the suitability of listing some provisions in accordance with the Guide. The ACMA reviewed provisions proposed for listing and formed the view that subsections 12(2) and 12(7) of the Customer ID Determination should not be listed, as contraventions of these subsections could involve subjective elements and therefore may not be able to be readily determined on a factual, administrative basis.

The AGD also raised a number of other issues for consideration which were outside the scope of the instrument.

The ACMA also received feedback from the Australian Communications Consumer Action Network (ACCAN). ACCAN supported the proposed amendment and raised a number of other issues for consideration which were outside the scope of the instrument.

Regulatory impact assessment

The Office of Best Practice Regulation (OBPR) has considered the matter and formed an opinion that the changes arising from the instrument are unlikely to have more than a minor regulatory impact and therefore no further regulatory impact analysis is required.

The OBPR reference number is OBPR 22-02328. 

Statement of compatibility with human rights

Subsection 9(1) of the Human Rights (Parliamentary Scrutiny) Act 2011 requires the rule-maker in relation to a legislative instrument to which section 42 (disallowance) of the LA applies to cause a statement of compatibility with human rights to be prepared in respect of that legislative instrument. 

The statement of compatibility set out below has been prepared to meet that requirement.

Overview of the instrument

The Telecommunications (Listed Infringement Notice Provisions) Amendment Declaration 2022 (No. 1) (the instrument) is made under subsection 572E(7) of the Telecommunications Act 1997 (the Act).

Section 572E allows the ACMA to give an infringement notice in relation to a contravention of a civil penalty provision. Sections 68 and 101 of the Act require carriers and carriage service providers to comply with licence conditions and service provider rules, respectively, and include civil penalty provisions that apply to a carrier or carriage service provider that contravenes another provision of the Act. Subsections 572E(5) and (6) provide that an infringement notice may only be given in relation to a contravention of section 68 or 101 of the Act if the other provision contravened is listed in a legislative instrument made under subsection 572E(7) of the Act, and has been so listed for at least three months before the alleged contravening conduct takes place.

The purpose of the instrument is to declare provisions from the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 and the Telecommunications Service Provider (International Mobile Roaming) Determination 2019 as ‘listed infringement notice provisions’ for the purposes of section 572E of the Act, thereby enabling the ACMA to give an infringement notice for a contravention of those provisions. The giving of an infringement notice is an alternative to instituting civil penalty provisions in the Federal Court. There is no requirement that a person pay an infringement notice – rather, payment of an infringement notice means that the matter cannot be pursued in the Federal Court. Having a range of enforcement tools available, particularly ones that may avoid the need for lengthy and expensive court proceedings, is considered desirable.

Human rights implications

The ACMA has assessed whether the instrument is compatible with human rights, being the rights and freedoms recognised or declared by the international instruments listed in subsection 3(1) of the Human Rights (Parliamentary Scrutiny) Act 2011 as they apply to Australia. Having considered the likely impact of the instrument and the nature of the applicable rights and freedoms, the ACMA has formed the view that the instrument does not engage any of the applicable rights or freedoms. 

Conclusion

The instrument is compatible with human rights as it does not raise any human rights issues.

Attachment A

Notes to the Telecommunications (Listed Infringement Notice Provisions) Amendment Declaration 2022 (No. 1)

Section 1 - Name

This section provides for the instrument to be cited as the Telecommunications (Listed Infringement Notice Provisions) Amendment Declaration 2022 (No. 1)

Section 2 - Commencement

This section provides for the instrument to commence at the start of the day after the day it is registered on the Federal Register of Legislation. 

The Federal Register of Legislation may be accessed free of charge at www.legislation.gov.au.

Section 3 - Authority

This section identifies the provision of the Act that authorises the making of the instrument, namely subsection 572E(7) of the Telecommunications Act 1997.

Section 4 - Amendments

This section makes the amendments set out in the Schedule.

Schedule 1 - Amendments

Item [1]

Item 1 inserts new items 3 and 4 following item 2 in Schedule 2 to the Telecommunications Service (Listed Infringement Notice Provisions) Declaration 2022. The new item 3 lists a number of sections of the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 and new item 4 lists a number of sections of the Telecommunications Service Provider (International Mobile Roaming) Determination 2019, thereby making those provisions listed infringement notice provisions.

Attachment B

Table 1: New provisions in the Telecommunications (Listed Infringement Notice Provisions) Declaration 2022

Determinations

Telecommunications Service Provider (Customer Identity Authentication) Determination 2022

Telecommunications Service Provider (International Mobile Roaming) Determination 2019