Source: https://www.legislation.gov.au/Details/C2006B00169/Explanatory%20Memorandum/Text
Timestamp: 2020-04-01 23:40:56
Document Index: 777291189

Matched Legal Cases: ['art 13', 'art 13', 'art 13', 'art 13', 'art 13', 'art 13', 'art 13', 'art 13', 'art 6', 'art 13', 'art 31', 'art 13', 'art 13', 'art 13', 'art 4', 'art 13', 'art 13', 'art 3', 'art 13', 'art 13', 'art 4', 'art 13']

C2006B00169
Senator the Hon. Helen Coonan)
The Telecommunications Amendment (Integrated Public Number Database) Bill 2006 amends the Telecommunications Act 1997 (Telecommunications Act) to provide for information contained in the integrated public number database (IPND) to be used in connection with the conduct of research that is considered to be in the public interest, whilst at the same time providing additional safeguards to ensure that IPND information is only disclosed and used for the purposes specified in Part 13 of the Telecommunications Act.
The IPND is an industry-wide database of all residential and business phone numbers (both listed and unlisted) and associated customer information, including name and address information. The IPND was established and is maintained by Telstra as a condition of its carrier licence. All carriage service providers who supply carriage services to customers who have public numbers are obliged to provide to Telstra such information as it reasonably requires in connection with the fulfilment of its obligation to maintain the IPND. Under its carrier licence conditions, Telstra is required to ensure that the IPND includes, for each public number of a customer of a carriage service provider, certain information such as the name and address of the customer and whether the number is used for business, government, charitable or private purposes.
Section 276 of the Telecommunications Act effectively prohibits an ‘eligible person’ from disclosing or using particular information that has come into its possession in connection with their business as a carrier, carriage service provider or contractor or in the course of the person’s duties as an employee of such a person. This includes information relating to the affairs or personal particulars of another person, including a person’s name, phone number and address (including listed and unlisted numbers and addresses). An ‘eligible person’ is a carrier, a carriage service provider, a telecommunications contractor or an employee of one of these. Prohibitions in similar terms to that in section 276 apply in sections 277 and 278 of the Telecommunications Act to ‘eligible number-database persons’ as defined in section 472 (there are currently no such persons as no determination under subsection 472(1) is in force) and emergency call persons.
Under the Bill, the ability of Telstra to disclose IPND information to another person in order for that person to publish and maintain a directory of public numbers or to conduct research of a kind that has been specified by the Minister, would be conditional upon the person holding an authorisation granted by the Australian Communications and Media Authority (ACMA) to receive the IPND information. ACMA would be required to have regard to criteria specified by the Minister when considering an authorisation application and would be able to grant an authorisation subject to conditions. The Minister would also be able to specify, in a legislative instrument, conditions that apply to all authorisations or particular kinds of authorisations. Criminal offences would apply if an authorised person were to use or disclose IPND information for a purpose other than the purpose for which the IPND information was disclosed or if the person fails to comply with a condition of an authorisation.
The Bill would define the term ‘public number directory’ in order to address concerns, first raised by the former Australian Communications Authority in its 2004 paper ‘Who’s Got Your Number: Regulating the Use of Telecommunications Customer Information’, about possible misuse of IPND information by persons with existing access to IPND information ostensibly for the purpose of the publication or maintenance of a public number directory. The definition would specify exhaustively the kind of information a record may contain to be considered a public number directory for the purposes of the Telecommunications Act. In addition, the Minister would have the ability to specify, by legislative instrument, further requirements to be met in order to satisfy the definition of public number directory.
The insertion of a definition of public number directory into the Telecommunications Act is intended to prevent IPND information being used directly to produce records or databases which are used for such purposes as marketing, data cleansing and appending, debt collection, identity verification and credit checking and to limit the extent to which records which are public number directories (within the meaning of the definition in the Bill) are readily able to be used for such purposes.
Disclosure and use of IPND information for these purposes goes beyond the purposes specified or contemplated within Part 13 of the Telecommunications Act, as records prepared for these purposes will generally fall outside the ordinary meaning of ‘directory of public numbers’.
Use of IPND information for these purposes is considered inappropriate on privacy grounds as consumers of telecommunications services are unlikely to be aware of, or to have consented to, the use of their personal information for purposes beyond the existing public interest uses currently permitted by the Telecommunications Act such as emergency services and law enforcement. The Bill is intended to clarify that the use of IPND information for the purpose of producing a public number directory should be limited to the production of genuine telephone directories (whether these are in electronic (including online) or hardcopy form).
The Bill would also amend section 285 of the Act to refer to the publication and maintenance of a public number directory. This is to make clear that maintenance of a public number directory should be linked to a public number directory that has been published.
The Bill would introduce a new exception to the prohibitions in sections 276, 277 and 278 that would allow IPND information to be disclosed for specified research purposes that are in the public interest. These would be specified by the Minister in a legislative instrument. The legislative instrument would list specific types of research that the Minister considers to be in the public interest (possible examples might be health and medical research). The intention of permitting disclosure and use of IPND information for specified research purposes is to recognise the value of the IPND as an accurate and up-to-date source of information that may assist researchers produce quality research that will be of benefit to the public.
The Bill would give ACMA a ‘gatekeeper’ role in deciding applications for authorisations to receive IPND information by public number directory producers and researchers. This is to ensure that the proposed use of IPND information would fall within the specified purposes under section 285 before the IPND information could be disclosed. This is intended as an additional safeguard for preventing misuse of IPND information by both public number directory producers and researchers.
Where the Privacy Act 1988 applies to a person who discloses or uses IPND information, the disclosure or use of IPND information will not breach the Privacy Act so long as the disclosure or use occurs in accordance with sections 285 and 299A of Part 13 of the Telecommunications Act. That is, the disclosure or use will be authorised by law for the purposes of the Privacy Act (see section 303B of the Telecommunications Act). However, Part 13 of the Telecommunications Act is not intended to affect the concurrent application of the Privacy Act (see section 303C of the Telecommunications Act).
The Bill is not expected to have a significant financial impact on Commonwealth expenditure or revenue.
ACMA will have the ability to recover expenses incurred by ACMA under the integrated public number database scheme, once established, by way of a determination made under section 60 of the Australian Communications and Media Authority Act 2005.
ACMA may seek additional Budget funding to assist it to establish the IPND scheme.
IPND Access regime
The current regime under the Telecommunications Act 1997 (the Act) whereby users can obtain access to data held in the Integrated Public Number Database (IPND) is under pressure to balance the privacy of personal information in the database with the desire to make information in the IPND available for some public interest purposes. In particular, the Australian Communications and Media Authority (ACMA) has proposed making a binding industry standard to more tightly protect personal information in the IPND in relation to its use to produce directories of public numbers and provide directory assistance services. In contrast, research organisations seek access to IPND data to assist in the conduct of their research. Law enforcement, national security and emergency service organisations want to maintain their current level of access to the IPND.
The IPND
The IPND is an industry-wide database of all residential and business phone numbers, both listed and unlisted, and associated customer information, including name and address information. The IPND was established, and is maintained, by Telstra (as the IPND Manager) as a condition of its carrier licence (see clause 10 of the Carrier Licence Conditions (Telstra Corporation Limited) Declaration 1997. Carriage service providers update data in the IPND daily.
Access to the IPND is governed by Part 13 of the Telecommunications Act 1997 (the Act) and the ‘Integrated Public Number Database (IPND) Data provider, Data User and IPND Manager’ Code (the Code) developed by the Australian Communications Industry Forum (ACIF). Division 2 of Part 13 of the Act provides general prohibitions on the disclosure and use of people’s personal information provided to carriage service providers unless it is authorised by an exception in Division 3 of Part 13 of the Act.
The existing exceptions contained in the Act enable IPND data to be used by certain organisations including carriage service providers, law enforcement agencies, national security agencies, emergency services organisations, the Australian Competition and Consumer Commission, the Australian Communications and Media Authority (ACMA) and the Telecommunications Industry Ombudsman; or for certain purposes including the provision of directory assistance services and the publication or maintenance of a directory of public numbers. The Code is intended to reflect these requirements and clarify the rights and obligations of data providers, data users and the IPND Manager regarding the input, use, disclosure and storage of IPND customer data. The IPND Manager currently approves applications to access data in the IPND.
The policy intent for establishment of the IPND
The original policy intent for the establishment of the IPND was to create a centralised, comprehensive database for use by: (a) the telecommunications industry to enable carriage service providers to carry out their business effectively, and (b) a limited number of other organisations with community protection functions (i.e. emergency service, law enforcement and national security agencies).
The policy intent for providing access to the IPND to produce directory products was, in the context of a newly competitive telecommunications industry, so that telephone directories (i.e. the White and Yellow pages) and directory assistance services would continue to contain the numbers of all telephone customers (unless the customer had chosen to be unlisted), not just the numbers of customers of a particular company. It was also thought that a centralised database may encourage competition with Telstra in the provision of public number directories and directory assistance services.
Misuse of IPND data
In recent years, the Government has become aware of reports that personal information held in the IPND, has been used for a range of purposes not authorised by the Act, such as the production of debt collection tools, data cleansing tools and services, identity verification tools and services and marketing databases and marketing lists.
Directory of public numbers
There are currently some inconsistencies between the Act and the Code which may, in some instances, have led to confusion in the way IPND data may be used for the purpose of producing a directory of public numbers. However, ultimately it is the Act that prevails.
One issue is the term ‘directory of public numbers’. While section 285 of the Act uses this term, it is not defined in the Act, and the ACIF Code uses the term ‘public number directory’ instead. It also defines a public number directory very broadly whereas the Act relies on the narrower, ordinary meaning of the term.
The broad definition in the Code has encouraged the production of products by current users of IPND data that are not directories of public numbers, according to the ordinary meaning of the term, and are therefore not authorised by the Act. In some cases these users also produce a directory of public numbers that meets the requirements of the Act and to this extent their activities are authorised.
An additional issue is that these users are using what is essentially a telecommunications industry database to produce commercial products that are not telecommunications related – only carriage service providers currently have access to the IPND to produce commercial products and this is limited.
The policy concern is that these unauthorised uses are inconsistent with the original policy intent for the establishment of the IPND and the exception for the production of directories, are clearly commercial in nature and not related to the provision of telecommunications services, and consumers of telecommunications services are not likely to be aware of, or to have consented to, the use of their personal data in this manner, posing privacy concerns. Further, as these data users are not ‘eligible persons’ for the purposes of Part 13 of the Act, ACMA is unable to take enforcement action against them.
ACMA has been concerned about misuse of IPND data by public number directory producers and directory assistance service providers for a number of years and undertook to develop a binding industry standard to supplement the requirements in the Act regulating the disclosure and use of IPND data by these users. In May 2005 it released a draft industry standard for public comment and received a large number of submissions.
The need to balance stakeholder interests in IPND data
The Government is also aware of the value of the IPND for users as a very up-to-date (updated daily) source of telephone subscribers’ contact information. Most other sources of information are updated less frequently.
Since the inception of the IPND, the demand for access, or increased access, to the IPND has grown considerably from a range of organisations, including the emergency services community, the law enforcement community, the research community, the organisations currently accessing the IPND for the production of directory products and prospective directory producers. The key claims are outlined below.
Access by emergency services organisations
Under the Act, emergency service organisations may access information on the IPND to deal with a matter raised by a call to an emergency service number and they would wish to ensure this access is retained.
Access for national security and law enforcement purposes
The Attorney-General’s Department (AGD) seeks to retain existing levels of access to the IPND for national security and law enforcement purposes.
Access by research organisations
The market and social research community has requested that members of the Association of Market and Social Research Organisations (AMSRO) be permitted to access data on the IPND for the purposes of market and social research activities. In particular, AMSRO seeks access to silent number information[1], reverse-search functionality, and an exemption from any Do Not Call Register. AMSRO is also concerned about the costs of accessing the IPND.
Health and welfare research organisations have also expressed an interest in using data in the IPND to conduct their research.
Access by database producers
Existing users accessing the IPND ostensibly for the purpose of producing directory products want to continue to access the IPND to produce their data products.
Access by prospective users
A number of other organisations have indicated their interest in accessing the IPND to produce public number directories.
To address the problems identified above, the broad policy objective is to clarify the arrangements for access to the IPND. In addition to this, the following policy objectives have been identified:
provide greater protection of the privacy of personal information in the IPND, particularly against misuse for commercial purposes; and
make IPND data available for a limited range of research purposes that are in the public interest.
A number of stakeholders could be affected by changes to the IPND access regime, including the:
emergency services community;
national security and law enforcement community;
IPND Manager;
organisations which currently access the IPND;
prospective users of the IPND for the production of directory products and services;
Four options have been considered to achieve the objectives stated above. Each option has involved balancing privacy considerations with public interest concerns and commercial needs.
1. Make an ACMA industry standard on access to the IPND;
2. Amend the Act to create different levels of access and give ACMA responsibility for deciding access for specific approved purposes;
3. Wait until consideration can be given to the outcomes of the review of the Privacy Act 1988 by the Australian Law Reform Commission;
4. Make regulations permitting access to the IPND for market and social research.
Option A – ACMA standard on IPND access
Under this option, ACMA would develop its proposed industry standard governing the use of data held in the IPND. The proposed standard would clarify the definition of public number directory and establish procedures for the deciding applications for access to the IPND for the production of commercial directory products give ACMA a ‘gatekeeper’ role in deciding applications for access for these purposes.
Under the proposed standard, any organisation seeking access to the IPND would be required to seek access through ACMA, rather than the IPND Manager. ACMA would decide whether a person is a legitimate public number directory producer or provider of directory assistance services and therefore able to access IPND data. Access to unlisted numbers and the production of directories with reverse-search functionality would continue to be prohibited.
The proposed standard would not change the arrangements or basis for access to the IPND for the non-commercial users currently authorised to access IPND data, such as law enforcement and emergency service organisations.
Option B — Amend the Act to create different categories of access and give ACMA responsibility for deciding access for specific approved purposes
Under this approach, the Act would be amended to provide for five categories of access to data in the IPND:
Categories 1-3 would reflect existing arrangements for carriers and carriage service providers (except in relation to accessing the IPND for the production of public number directories where they, like other prospective public number directory producers, would need to apply for an authorisation from ACMA), national security and law enforcement agencies, emergency service organisations and the telecommunications regulators;
Category 4 would tighten existing arrangements for public number directory producers, with the term ‘public number directory’ defined in the Act; and
Category 5 would enable access, for the first time, for specified research purposes that are in the public interest.
Access to data in the IPND would be able to be varied depending on the purpose for which the data is to be used. For example, law enforcement agencies would continue to receive full access, while researchers could receive limited access.
Specifically, the Act would be amended to:
· insert a new definition of ‘public number directory’;
· give ACMA the power to establish a scheme to authorise access to the IPND for specified research purposes that are in the public interest and for the purpose of producing a public number directory within the framework set out in the primary legislation;
· require ACMA to have regard to a number of matters when considering applications for access to the IPND, including criteria required to be specified by the Minister in a legislative instrument;
· provide that the Minister may make a legislative instrument to specify kinds of research purposes to be purposes that are in the public interest and, if required, to preclude any research with a directly commercial purpose from being considered research for public interest purposes under this scheme;
· provide that the Minister may make a legislative instrument to place additional formatting or other requirements on public number directories;
· provide that the Minister may make a legislative instrument adding to the list of qualifying entities in relation to which additional contact information (other than name, address and public number) may be included in a public number directory;
· provide that the Minister may make a legislative instrument specifying the type of information about a qualifying entity that can be contained in a public number directory;
· provide that the Minister may make a legislative instrument specifying mandatory conditions on authorisations;
· provide for a review mechanism to ensure that access to and use of IPND data access is undertaken according to the relevant ACMA authorisation and on any other matter that ACMA considers appropriate;
· provide appropriate offence and penalty provisions that would apply to persons disclosing and using data in the IPND for any purpose other than for the authorised purpose, and to persons breaching a condition of authorisation; and
· provide that decisions of ACMA are reviewable by the Administrative Appeals Tribunal.
Some consequential amendments of existing provisions in other parts of the Act may be necessary to implement elements of the scheme.
Access to data in the IPND under categories 1 – 3 would reflect current arrangements.
In relation to category 4 users, a definition of ‘public number directory’ would be inserted into the Act to address concerns about the illegitimate production of such directories. Producers of public number directories would be required to seek an authorisation from ACMA to access data in the IPND for this purpose. There would also be verification processes to ensure that public number directories are produced for appropriate purposes. Unlisted number information would continue to be unavailable under category 4.
Category 5 would introduce the concept of access for research purposes that are in the public interest. In addition, the Minister would be able to specify that the research must also not be for a directly commercial purpose. This recognises the value of the IPND as an accurate and up-to-date source of information which can be used for non-commercial purposes that are in the public interest, such as health and medical research. Unlisted number information would not be available under Category 5.
ACMA would be given a gatekeeper role in deciding who may access the IPND for a category 4 or 5 purpose. Any person seeking access to, or currently using, IPND data for these purposes would be required to apply to ACMA for authorisation to access the IPND for one or more of the purposes specified.
ACMA would be required to have regard to a range of matters when considering applications for access to the IPND, including the purpose for which access is sought, whether the access seeker is likely to use the customer data for the approved purpose stated in the application, the track record of the user in any previous use of IPND data, and, for specified research purposes, the beneficiary of the research and how the IPND data will be used. This would be specified in a legislative instrument made by the Minister.
Authorisations would specify certain conditions, as set by the Minister through a legislative instrument and by ACMA, for example, that the IPND data not be moved, disclosed, used or stored outside Australia. An authorisation would be revocable and could remain in force for a set period of time or be ongoing.
ACMA would be required to review compliance with conditions of authorisation and any other matter it considers appropriate and report to the Minister on an annual basis to ensure that IPND data is only used by authorised persons for authorised purposes.
New offences and penalties would be introduced into the Act for disclosing and/or using IPND data other than for the authorised purpose and for breaching a condition of authorisation. These offences and penalties would apply specifically to category 4 and 5 users to enable enforcement action to be taken against them. ACMA would also be empowered to issue remedial directions and formal warnings for breaches of conditions of authorisation.
Option C— No change until consideration given to the outcomes of the review of the Privacy Act 1988 by the Australian Law Reform Commission
Under this option, no action would be taken to address the problems identified above until consideration can be given to the outcomes of the Australian Law Reform Commission (ALRC) review of the Privacy Act 1988. Any person seeking access to IPND data would be required to work within the existing legislative and self-regulatory framework While the terms of reference of the review do not include the alignment of the Telecommunications and Privacy Acts, the Attorney-General has advised that the issue could be considered by the ALRC in its review of privacy laws. The ALRC is to report back to the Attorney-General by 31 March 2008.
Option D— Regulations permit access to the IPND for research purposes
Under this option, regulations would be made specifying that IPND data could be used for research purposes, consistent with section 292 of the Act. Section 292 of the Act provides that the prohibitions against the disclosure or use of information or a document do not apply in circumstances that are specified in the regulations.
The advantage of this option is that it does not require any legislative action and gives a government agency a role in determining access to personal information. The disadvantage is that it does not address growing demands on the IPND as a valuable source of information for legitimate purposes such as research in the public interest. Also, there is some uncertainty as to whether ACMA can fully address the issue of misuse of IPND data through such a standard. The key impacts on the major stakeholders affected under this option are outlined below.
Impact on the emergency services community
The emergency services community would be unaffected as ACMA does not intend to vary the arrangements or basis for access to the IPND for these organisations.
Impact on the national security and law enforcement community
The national security and law enforcement community would be unaffected under this option as ACMA does not intend to vary the arrangements or basis for access to the IPND by these organisations.
There would be no impact on the research community. The research community would remain unable to access IPND data. This option is therefore may attract criticism from the research community for failing to address their concerns.
Impact on the IPND Manager
Under this option, the IPND Manager’s role in considering applications from public number directory producers and directory assistance service providers to access the IPND would be clarified. The IPND Manager would only be able to disclose data to a person holding an authorisation from ACMA and then only if it considered the disclosure to be lawful. These arrangements would also reduce the potential for a conflict of interest on the part of the IPND Manager (i.e. under the current arrangements Telstra, as the IPND Manager, is responsible for disclosing IPND data to users seeking to compete with it in the provision of directory products and services).
Impact on ACMA
This option would have a significant impact on ACMA. ACMA would be responsible for considering requests to access the IPND and providing the necessary administrative support for this function. ACMA would also be responsible for enforcing the proposed standard, consistent with Part 6 of the Act.
Impact on organisations which currently access the IPND
Organisations which currently access the IPND for the purposes of producing public number directories and providing directory assistance services would be required to seek access from ACMA within three months of commencement of the standard. The proposed tightening of the definition of public number directory will clearly establish that use of the IPND to produce some products is unlawful and therefore result in some existing users being unable to continue using IPND data to produce these products, with commercial activities being affected as a result.
Impact on organisations currently seeking access for the purpose of producing public number directories or providing directory assistance services
These users would be required to apply to ACMA for an authorisation to access the IPND. If ACMA is satisfied that they are seeking to produce a public number directory that meets the new definition or provide a directory assistance service that meets the existing definition in the Act then an authorisation may be granted. They would then enter into normal contractual arrangements with the IPND Manager.
To the extent that the standard is able to address the issue of misuse of IPND data, the impact on the general public would be a reduction in the misuse of personal information on the IPND, as this data would be made unavailable for the production of unauthorised commercial products. The public is likely to welcome greater protection of personal information in the IPND.
Option A is not preferred.
Option B — Amend the Act to create different levels of access and give ACMA responsibility for deciding access for specific approved purposes
The advantage of this approach is that it would meet the policy objectives outlined above and address the policy issues raised. It would balance the need to protect the privacy of personal information on the IPND, particularly against misuse for commercial gain, with the objective to permit access for legitimate public interest research purposes for which the IPND is a valuable source of up-to-date information. The disadvantage is that a new class of users would have access to IPND data and this would need to be carefully controlled given the history of misuse under the public number directory and directory assistance service exceptions.
The emergency services community would be unaffected under this option.
The national security and law enforcement community would be unaffected under this option.
Impact on the social research community
The research community would be permitted, for the first time, to access the IPND for some specified research purposes that are in the public interest. While access would be subject to an ACMA authorisation and permitted only on specific conditions, the research community would likely welcome this.
Under this option, ACMA would be responsible for deciding applications and authorising access to the IPND. The IPND Manager would only be able to disclose data to a person holding an authorisation from ACMA and then only if it considered the disclosure to be lawful. The new arrangements would clarify the process for accessing data in the IPND and reduce the potential for a conflict of interest on the part of the IPND Manager by giving a key authorisation role to ACMA rather than Telstra.
This option would have a significant impact on ACMA. ACMA would be given new administrative decision-making powers to decide applications for authorisations to access the IPND. It would be required develop a scheme for accepting and processing such applications. It would also be given new powers to enforce compliance with authorisations and to review compliance with conditions of authorisation or any other matter it considers appropriate in relation to the scheme. This option is likely to be supported by ACMA as partially endorsing its proposed approach to the issue. However, it is likely to be concerned about its role in deciding applications for the new research purposes due to its lack of expertise in these areas.
Organisations which currently access the IPND for the purposes of producing public number directories would be required to seek access from ACMA within 28 days of the authorisation scheme becoming operational. The proposed tightening of the definition of public number directory will clearly establish that use of the IPND to produce some products is unlawful and therefore result in some existing users being unable to continue using IPND data for the production of these products, with commercial activities being affected as a result.
Impact on organisations currently seeking access for the purpose of producing public number directories
These users would be required to apply to ACMA for an authorisation to access the IPND. If ACMA is satisfied that they are seeking to produce a public number directory that meets the new definition then an authorisation may be granted. They would then enter into normal contractual arrangements with the IPND Manager.
The impact on the general public would be a reduction in the misuse of personal information in the IPND, as this data would be made unavailable for the production of unauthorised commercial products. The public is likely to welcome greater protection of personal information in the IPND.
However, personal information in the IPND would become more widely available for some specified research purposes determined by the Minister to be in the public interest, and individuals may be contacted for these purposes. This may attract some criticism from privacy advocates and the general public as customers of telecommunications services may not be aware of, or have consented to, their personal data being used for these purposes. However, they are likely to support ACMA as the appropriate gatekeeper of personal information held in the IPND, rather than continuing the existing practice of the IPND Manager (currently Telstra) granting access to IPND data. The general public may also benefit in the longer term from research activities undertaken using accurate and up-to-date data.
Organisations seeking to use IPND data to contact persons for the purpose of conducting this research by telephone would still be subject to the prohibitions in the Do Not Call scheme, unless the purpose of the research call is non-commercial or the organisation making the call is exempted under that legislation.
Organisations granted an authorisation to access IPND data for any category 4 or 5 purpose would also be subject to the Privacy Act 1988, unless exempted by that Act.
The advantages of this option are that no action need be taken for some time, and a more comprehensive consideration of privacy issues can be undertaken. The disadvantage is that no action would be taken to address the problem of unauthorised use or the issue of access for public interest research identified above until the outcomes of the ALRC review in 2008 are known. This would not address the immediate policy and privacy issues or respond in a timely manner to the needs of the research community.
The impact on all stakeholders is likely to be minimal as all stakeholders would continue to operate within the existing legislative and self-regulatory framework for the short-to-medium term. This is likely to attract criticism from various stakeholders for failing to address the problems identified above. The option also fails to meet the policy objectives stated above in the medium term. ACMA would probably proceed with its Standard in the absence of legislative amendment.
Option C is not preferred.
Option D— Regulations specify access to the IPND permitted for research purposes in the public interest
An advantage of this approach is that regulations could precisely target stakeholder needs for access to the IPND and provide appropriate safeguards in a regulatory instrument that is inherently more flexible than legislative amendment. However, privacy advocates may not be comfortable with this level of flexibility on the grounds of providing insufficient regulatory certainty and opening up access to an inappropriately broad class of potential users. This option would also fail to address the issue of misuse of IPND data identified above.
The research community would be permitted, for the first time, to access the IPND for some specified research purposes that are in the public interest. While access would be subject to appropriate safeguards, the research community would likely welcome this.
The IPND Manager would continue to operate within the existing legislative and self-regulatory framework. The IPND Manager may be concerned about the administrative burden of processing potentially a substantially larger number of applications for access to the IPND under this proposal. The IPND Manager may also be concerned about its potential criminal liability under the Act for disclosing data to these users if they use it for purposes other than research (as the existing offence and penalty provisions would continue to apply to the IPND Manager as the primary discloser of data but not to the data users as they are not ‘eligible persons’ for the purposes of the Act).
The impact on ACMA under this option would be minimal, as it would continue to operate within the existing legislative and self-regulatory framework. This is likely to attract criticism from ACMA as it does not address the problem of misuse identified above. ACMA would probably proceed with its Standard in the absence of legislative amendment.
These organisations would continue to operate within the existing legislative and self-regulatory framework. This is probably the preferred option for these organisations.
These users would be subject to the existing legislative and self-regulatory framework. They would be able to apply for access directly to, and enter into normal contractual arrangements with, the IPND Manager.
The impact on the broader community under this option would be that personal information held in the IPND would be made more widely available for use in a broad range of research activities and individuals may be contacted for these purposes. This is likely to be criticised by privacy advocates and the general public for being an inappropriate relaxation of privacy protections. This option would also fail to address the policy objective of providing greater protection personal information in the IPND, particularly against misuse for commercial purposes.
Option D is not preferred.
Consultations have taken place with ACMA, AGD, the Department of the Prime Minister & Cabinet (PMC) and Office of the Privacy Commissioner (OPC).
ACMA recommends that any approved use of IPND data by commercial users be specified in the Act, and that ACMA be given appropriate jurisdiction and enforcement powers in relation to users of IPND data.
PM&C recommends that the OPC and appropriate areas of AGD be consulted, and that consistency be maintained with key Government policy and legislative developments.
AGD recommends that access to IPND data for law enforcement and national security purposes be retained. AGD is supportive of a penalty regime akin to that in Part 13 of the Act, and seeks an audit requirement on ACMA to verify that IPND data is used appropriately in the context of Category 4 or 5 access. AGD is concerned that any approved purpose under the proposed amendments is consistent with relevant privacy requirements and that appropriate restrictions on the end use of IPND data apply.
The OPC has repeated recommendations it made to ACMA about ACMA’s proposed draft IPND standard. The OPC also recommends that consideration be given to whether the public benefit of increasing access is proportional to the privacy impact of such access, that any changes promote consistency across telecommunications privacy regulation, and that any person granted access be subject to privacy law.
ACMA has previously undertaken two public consultation processes regarding data on the IPND. The views of stakeholders and interested parties were ascertained from submissions to these processes.
On 18 March 2004, ACMA’s predecessor, the Australian Communications Authority (ACA) released a discussion paper entitled “Who’s Got Your Number? Regulating the Use of Telecommunications Customer Information” as the first stage of consultation on a new industry standard for the use of telecommunications customer information. The consultation period closed on 14 May 2004 with 92 submissions received.
On 25 May 2005, the ACA released a draft industry standard for public comment about the protection of customer personal data. The consultation period closed on 1 August 2005 with 51 submissions received. Most of these submissions were not supportive of ACMA’s approach to the issue.
It is recommended that Option B be adopted. Option B would achieve the broad policy objective of clarifying the arrangements for access to the IPND, and the specific policy goals of providing greater protection of the privacy of personal information on the IPND, particularly against misuse for commercial purposes, and making IPND data available for a limited range of research purposes that are in the public interest. No other option meets all of these objectives.
The Bill, when enacted, would commence on a day to be proclaimed but no later than 6 months after the day on which the Bill receives the Royal Assent. Delayed commencement of the Bill will allow time for the making of legislative instruments that will need to commence at the same time as the Bill. These instruments are the legislative instrument made by ACMA setting out the authorisation scheme and the Ministerial instrument specifying the criteria to which ACMA must have regard in making decisions about authorisation applications.
In addition, transitional arrangements would apply to existing public number directory producers and directory assistance service providers with access to the IPND. These users will have 28 days from the time the Bill is enacted and the ACMA scheme commences to apply for an authorisation under the scheme. Their existing access would continue up until ACMA decides the outcome of the application.
While there would be no specific provision in the Bill regarding a statutory review, it is anticipated that there would be a review of the operation of the IPND access regime three years after its implementation.
ACMA Act: Australian Communications and Media Authority Act 2005
AIA: Acts Interpretation Act 1901
Bill: Telecommunications Legislation Amendment (Integrated Public Number Database) Bill 2006
Carrier Licence Conditions: Carrier Licence Conditions (Telstra Corporation Limited) Declaration 1997
IPND information: information or documents relating to information contained in the IPND
IPND scheme: Integrated public number database scheme in force under proposed section 295A
Minister: Minister for Communications, Information Technology and the Arts
Clause 1 provides that the Bill, when enacted, may be cited as the Telecommunications Amendment (Integrated Public Number Database) Act 2006.
Clause 2 of the Bill provides for the commencement of the Act.
Clauses 1 – 3 of the Bill would commence on the day on which the Bill receives Royal Assent.
Schedule 1 to the Bill would commence on a day to be fixed Proclamation. However, if Schedule 1 is not proclaimed to commence within the period of 6 months from the day on which the Bill receives the Royal Assent, then Schedule 1 will commence on that day.
Schedule 1 to the Bill contains amendments to the Telecommunications Act. Delayed commencement of Schedule 1 is proposed to allow adequate time for a number of legislative instruments provided for by the amendments in Schedule 1 to be made before the commencement of the amendments to the Telecommunications Act. For example, the legislative instrument required by proposed section 295A that will set out the scheme for the granting of authorisations permitting persons to use and disclose IPND data (see item 9) will need to be made by ACMA. In addition, the Minister will need to make a legislative instrument to specify criteria to which ACMA must have regard in deciding authorisation applications under the scheme to be formulated by ACMA (see item 9, proposed section 295N). These legislative instruments would commence at the same time as Schedule 1 to the Bill commences and would not commence earlier than that Schedule.
Clause 3 provides that each Act that is specified in a Schedule to the Bill is amended or repealed as set out in that Schedule and any other item in a Schedule has effect according to its terms. There is one Schedule to the Bill which amends the Telecommunications Act.
Item 1 – section 7 (after paragraph (h) of the definition of civil penalty provision)
Section 7 of the Telecommunications Act defines a number of terms referred to throughout that Act, including the term “civil penalty provision”. The definition of civil penalty provision lists all of the provisions in the Telecommunications Act which, if contravened, would allow ACMA to commence proceedings in the Federal Court seeking an order that the person who contravened the provision pay a pecuniary penalty to the Commonwealth (see Part 31 of the Telecommunications Act).
Item 1 would amend the definition of civil penalty provision in section 7 of the Telecommunications Act including a reference to a new civil penalty provision, proposed subsection 295S(3), which would be inserted into the Telecommunications Act by item 9. This penalty provision would apply where there has been a contravention of a direction given by ACMA under proposed subsection 295S(2) in relation to breach of a condition of an authorisation in force under the IPND scheme.
Item 2 – Section 7
Item 2 would insert a new definition of ‘integrated public number database scheme’ in section 7 of the Telecommunications Act. The integrated public number database scheme would be defined to mean the scheme in force under proposed section 295A. Under proposed section 295A, ACMA would be responsible for formulating a scheme, by legislative instrument, for granting authorisations permitting persons to use and disclose IPND information for specified purposes. Proposed Division 3A of Part 13 of the Telecommunications Act would provide for the formulation of the integrated public number database scheme, including the imposition of conditions on the grant of authorisations, and would create an offence in respect of breach of such conditions (see item 9).
Item 3 – Subsection 285(1)
Item 3 would repeal subsection 285(1) of the Telecommunications Act and substitute new proposed subsections 285(1) and (1A). New proposed subsections 285(1) and (1A) would set out the circumstances in which IPND data could be disclosed or used by a person who is subject to the prohibitions in sections 276 and 277 in Part 13 of the Telecommunications Act. Section 276 effectively prohibits an ‘eligible person’ (this is defined as a carrier, a carriage service provider, a telecommunications contractor or an employee of one of these) from disclosing or using particular information that has come into its possession in connection with their business as a carrier, carriage service provider or in the course of the person’s duties as an employee of such a person. The prohibition protects, amongst other things, information or documents relating to communications carried by a carrier or carriage service provider or the affairs or personal particulars of another person. The information protected by Part 13 includes IPND information. Section 277 of the Telecommunications Act provides for a similar prohibition for eligible number-database persons. There are currently no such persons as no determination under subsection 472(1) is in force ( see section 272 of the Telecommunications Act).
The IPND is an industry-wide database of all residential and business phone numbers (including listed and unlisted (of which silent numbers are a subgroup) phone numbers) and associated customer information, including name and address information. The IPND was established and is maintained by Telstra as a condition of its carrier licence (see clause 10 of the Carrier Licence Conditions). All carriage service providers who supply carriage services to end-users who have public numbers are obliged to provide Telstra with such information as it reasonably requires in connection with the fulfillment of its obligation to maintain the IPND (see Part 4 of Schedule 2 to the Telecommunications Act). Clause 10 of the Carrier Licence Conditions requires Telstra to ensure that the IPND includes certain information such as the name and address of an end-user and whether the number is used for business, government, charitable or private purposes.
Division 3 of Part 13 sets out a number of exceptions to the prohibitions on use and disclosure of protected information. Section 285 of the Telecommunications Act is an exception that relates to IPND information. As indicated above, the permitted uses and disclosures set out in proposed subsections 285(1) and (1A) would operate as exceptions to the prohibition in sections 276 and 277.
Proposed subsection 285(1) deals with the permitted use of IPND data by eligible persons, including Telstra. Proposed paragraphs 285(1)(a) and (b) specify the kind of IPND information to which the exception applies – that is, information or documents that relates to information (other than information about an unlisted telephone number) contained in the IPND and which relates to carriage services that are supplied or are intended to be supplied by to another person by a carrier or carriage services provider or which relates to the affairs or personal particulars of an another person (other than an address relating to an unlisted telephone number). If the requirements in paragraphs 285(1)(a) and (b) are met, proposed paragraph 285(1)(c) permits an eligible person to use information of the kind specified in paragraphs (a) and (b) for purposes connected with:
(a) the provision of directory assistance services (by or behalf of a carriage service provider);
(b) the publication and maintenance of a public number directory (see further discussion about this purpose below); or
(c) dealing with the matter or matters raised by a call to an emergency services number.
Proposed subsection 285(1A) deals with the permitted disclosures of IPND information by eligible persons, notably Telstra as the manager of the IPND. Proposed paragraphs 285(1A)(a) and (b) mirror paragraphs 285(1)(a) and (b) in specifying the kind of IPND information to which the disclosure exception applies. If the requirements in paragraphs 285(1A)(a) and (b) are met, proposed paragraphs 285(1A)(c) would permit an eligible person to disclose information of the kind specified in paragraphs (a) and (b) for purposes connected with:
(b) the publication and maintenance of a public number directory (the reference to “the publication and maintenance” is intended to link the purpose of maintenance of a public number directory to a directory that has been published. The reference to ‘publication’ is intended to mean publication to the public generally or to a substantial section of the public (whether or not a fee is charged for the supply of a directory) and not to include the preparation of a directory on request by a particular person. The requirement that a public number directory be published is essential to achieve the underlying purpose of a directory to assist communication between end users of carriage services;
(c) dealing with the matter or matters raised by a call to an emergency services number; or
(d) the conduct of research of a kind specified by the Minister in a legislative instrument made under proposed subsection 285(3) (see item 8).
The effect of paragraph 285(1A)(d) would be that, in addition to the requirements in paragraphs 285(1A)(a) to (c) being satisfied, if the disclosure were for a purpose connected with the publication and maintenance of a public number directory or the conduct of research of a kind specified by the Minister, then the person to whom the information would be disclosed must hold a current authorisation under the IPND scheme permitting that person to use and disclose the relevant IPND information. New Division 3A of Part 13 of the Telecommunications Act would provide for ACMA to develop a scheme for the granting of authorisations (see item 9).
In the case where an eligible person (eg Telstra as IPND manager) proposes to disclose IPND information for purposes connected with the provision of directory assistance services or dealing with matters raised by a call to an emergency services number, the person receiving the information would not need to hold an authorisation in order for the disclosure to be permitted. It would be inappropriate to require a carriage service provider (or someone else acting on behalf of a carriage service provider) who wishes to obtain IPND information in order to satisfy its obligation under Part 3 of Schedule 2 to the Telecommunications Act to provide directory assistance services to apply to ACMA for an authorisation in order to perform a statutory obligation. It would be equally inappropriate to require emergency call operators or other persons who deal with matters relating to emergency calls to apply for authorisations, given the potential importance of such persons being provided with IPND information in emergency situations.
Item 4 – Subsection 285(2)
Item 4 would insert a definition of ‘business’ in subsection 285(2). The term ‘business’ is defined in item 4 to include a venture or concern in trade or commerce, whether or not conducted on a regular, repetitive or continuous basis. The settled legal meaning of ‘carrying on a business’ is to conduct some form of commercial enterprise, systematically or regularly, with a view to a profit: Hyde v Sullivan [1956] SR (NSW) 113. The definition of ‘business’ in item 4 varies the ordinary meaning of ‘business’ so it is clear that, for the purposes of the Bill, it is not necessary to establish that a commercial enterprise is carried on in a regular or continuous manner. It would cover one off commercial enterprises.
The term ‘business’ is referred to in the proposed definition of ‘qualifying entity’ (see item 7). A person or body carrying on a business would be a kind of person or body in relation to which information in addition to the person or body’s name, public number(s) and address could be included in a public number directory if the Minister were to make an instrument under proposed subsection 285(4) specifying the additional information that could be included in a public number directory about all qualifying entities or persons or bodies carrying on a business particularly (see items 6 and 8).
Item 5 – Subsection 285(2)
Item 5 would insert a definition of ‘educational institution’ in subsection 285(2). The term ‘educational institution’ is defined to include a pre-school, a school, a college and a university. It is an inclusive definition, and does not preclude the inclusion of other institutions which would come within the ordinary meaning of educational institutions, within this definition. This definition would include both private and public educational institutions. For example it would include Bond University as well as Melbourne University, Catholic high schools and TAFEs.
The term ‘educational institution’ is referred to in the proposed definition of ‘qualifying entity’ (see item 7). An educational institution would be a kind of body in relation to which information in addition to the institution’s name, public number(s) and address could be included in a public number directory if the Minister were to make an instrument under proposed subsection 285(4) specifying the additional information that could be included in a public number directory about all qualifying entities or educational institutions particularly (see items 6 and 8).
Item 6 – Subsection 285(2)
Item 6 would insert a definition of ‘public number directory’ in subsection 285(2). Currently, the Telecommunications Act does not define this term so that it has its ordinary meaning. Under the proposed definition, a record would only be considered to be a public number directory if all of the following requirements were met:
(a) the record would need to contain the names of persons, bodies (or both) and their public numbers. The inclusion of addresses in the record would be irrelevant for the purposes of determining whether a record was a public number directory. The effect of the definition of ‘public number’ is defined in subsection 285(2) means that a record could not contain an unlisted number. Telstra, as the IPND manager, would not be able to disclose information relating to an unlisted number under proposed subsection 285(1A);
(b) the record could not contain any additional information about a person or body that is not a qualifying entity (see item 7);
(c) that record could only contain such additional information about a person or body that is a qualifying entity that is of a kind specified by the Minister in an instrument under proposed subsection 285(4) and which applies to that kind of qualifying entity;
(d) the record must not enable various kinds of reverse searching, namely, searching by a number to locate the name and/or address of an end-user or searching by the whole or part of an address to locate the name and/or public number of an end-user; and
(e) the record would need to satisfy each requirement (if any) specified by the Minister in an instrument under proposed subsection 285(5) (see further item 8).
The proposed insertion of the definition of ‘public number directory’ into section 285 is intended to address concerns that, in some instances where IPND information has been disclosed to a person, the information has been used to produce commercial database products that go beyond the purposes specified in or contemplated by section 285 and which are used for such activities as marketing, debt collection and credit checking. In particular, though not exclusively, the definition is intended to prohibit IPND information being used directly to:
· append telephone numbers to name and/or address information in databases that are not associated with an approved purpose;
· compile, populate and update and verify data in a database unrelated to, or used for any purpose other than an approved purpose; and
· develop, update or verify mailing lists or databases to be used for marketing or telemarketing purposes.
The proposed new definition is also intended to bring the use of IPND data back to the original policy intent, which was for the production of public number directories in the sense of its ordinary meaning.
The intention of allowing the Minister, through a legislative instrument, to specify additional requirements for public number directories is to provide flexibility in a changing technological environment to address emerging as well as existing problems, particularly in relation to electronic (including online) directories, should this prove necessary.
The Minister may specify requirements dealing with the formatting of electronic public number directories (for example, limits on the number of entries that can be copied and pasted from the directory, or limits on the number of entries generated from a single search); encryption requirements on information in electronic public number directories; organisation of information in directories (for example, a requirement that directories only be organised alphabetically by geographic area or alphabetically by type of body or products and services offered (such as restaurants, medical practitioners, plumbers, florists, theatres etc)); or geographic coverage requirements (for example, a requirement that directories cover a minimum geographical area such as a suburb or postcode) and inclusion of all listed numbers for that area.
Restricting the formatting of public number directories would be intended to prevent the production of directories that are readily able to be used for the inappropriate purposes identified above.
Item 7 – Subsection 285(2)
Item 7 would insert a definition of ‘qualifying entity’ in subsection 285(2). The term ‘qualifying entity’ is referred to in the proposed definition of ‘public number directory’ (see item 6). The definition is intended to provide a mechanism, in conjunction with the Minister’s specification of the additional kinds of information under subsection 285(4), for allowing the publication of public number directories using IPND information that contain business and government listings, and other non-residential listings such as those relating to religious or educational institutions, and which listings contain more than the name, public number and possibly the address of a person or body. The Minister’s ability to specify, in a legislative instrument made under proposed subsection 285(6) (see item 8), additional kinds of qualifying entities is intended to ensure that future needs in relation to public number directories can be accommodated.
If a person or body falls within the definition of qualifying entity, and the Minister were to make an instrument under proposed subsection 285(4) specifying the additional information that could be included in a public number directory about all qualifying entities, or the category of qualifying entities that the person or body falls into, then a record could contain information in addition to the person or body’s name, public number(s) and address and still be a public number directory for the purposes of section 285. It is possible that a person or body may fall within more than one category of qualifying entity.
Item 8 –At the end of section 285
Item 8 would insert four new subsections at the end of section 285.
Proposed subsection 285(3) would enable the Minister to specify, in a legislative instrument, the kinds of research for which disclosure of IPND information will be permitted under proposed subparagraph 285(1A)(c)(iv) (see item 3). As indicated in item 3, new proposed subsection 285(1A) would introduce a new exception allowing disclosure and use of IPND information to conduct research of a kind specified in an instrument under proposed new subsection 285(3). The purpose of the amendment in item 8, together with the amendment in item 3, is to enable the value of the IPND as an accurate and up-to-date source of information to be used to assist in the conduct of some kinds of research that will be of benefit to the public. Consistent with this purpose, proposed subsection 285(3) would provide that the Minister would need to be satisfied that a particular kind of research is in the public interest before specifying that kind of research for the purposes of subparagraph 285(1A)(c)(iv).
The ability of the Minister to specify kinds of research that the Minister considers to be in the public interest is intended to provide flexibility to respond to changes over time to kinds of research that are conducted for public benefit. The Minister would be able to specify additional categories of research over time if the Minister considers that access to IPND information for a new kind of research is in the public interest, or make changes to the specified kinds of research (eg the Minister to be able to revoke the specification of a kind of research). The Minister might also specify research of a particular kind (eg health and medical research) that does not have a commercial purpose.
Research that could be specified might include health and medical research. Such research could include surveys of child immunisation, obesity levels in children, research into mental illness, the incidence of, and risk factors for, major diseases such as cancer, diabetes and heart disease and research into the health of specific communities such as the elderly, regional communities and indigenous communities.
Under proposed subsection 285(4) the Minister would be able to specify the kinds of additional information relating to qualifying entities that could be included in a public number directory (see item 6). Under this subsection, the Minister would be able to specify kinds of additional information that apply to all qualifying entities, or kinds of additional information that apply to particular qualifying entities (eg all educational institutions or all charities or charitable institutions, or both).
Item 8 would also insert new proposed subsection 285(5) which would enable the Minister to make a legislative instrument specifying requirements, in addition to those specified in paragraphs (a) to (d) of the definition of ‘public number directory’ in subsection 285(2), which must be satisfied if a record is to be characterised as a ‘public number directory’ (see item 6).
Under proposed subsection 285(6) the Minister would be able to specify persons or bodies, in addition to those listed in the definition of qualifying entity in item 7, to be qualifying entities.
Instruments made by the Minister under proposed subsections 285(3), (4), (5) and (6) are specified to be legislative instruments. This is intended to reflect that instruments made under these subsections would be considered to be legislative for the purposes of section 5 of the LIA. As a result, these instruments would need to be registered on the Federal Register of Legislative Instruments and would be subject to Parliamentary scrutiny and disallowance.
Item 9 – After Division 3 of Part 13
Item 9 would insert a new Division 3A into Part 13 of the Telecommunications Act setting out the framework for the IPND authorisation scheme for disclosure and use of IPND information. This scheme (called the ‘integrated public number database scheme’) will be administered by ACMA.
The proposed amendments in item 3 would restrict the circumstances in which IPND information may be disclosed for the purpose of publishing and maintaining public number directories (as defined in proposed subsection 285(2) – see item 6) or for specified research purposes, by requiring that IPND information may only be disclosed to persons who have been authorised by ACMA.
Proposed section 295A would require ACMA, by legislative instrument, to formulate a scheme (to be called the integrated public number database scheme) for the granting of authorisations for the purposes of paragraph 285(1A)(1)(d). The effect of this paragraph is that before Telstra could disclose IPND information to a person for the purpose of publication and maintenance of a public number directory, or for purposes connected with the conduct of research of a kind specified by the Minister, the requirement that the person hold an authorisation from ACMA would need to be satisfied. The instrument to be made by ACMA would be a legislative instrument. This is intended to reflect that this instrument would be considered to be legislative for the purposes of section 5 of the LIA. As a result, it would need to be registered on the Federal Register of Legislative Instruments and would be subject to Parliamentary scrutiny and disallowance.
The purpose of empowering ACMA to establish the integrated public number database scheme in a legislative instrument is to provide ACMA with the flexibility to develop the practical processes and procedures for receiving, considering and deciding applications for authorisations (including revoking or varying authorisations, imposing conditions on authorisations and undertaking any ongoing monitoring that may be required in relation to the scheme) and to adjust these processes if necessary. ACMA is also empowered to undertake administrative decision-making in relation to the scheme, having regard to the criteria specified by the Minister under proposed section 295N.
Under proposed 295B, the scheme formulated by ACMA would need to make provision for the making of applications for authorisations, the assessment of such applications and the period for which the authorisations are to be in force. Applicants will be required to specify the purpose for which access to the information is sought (ie the publication and maintenance of a public number directory or the conduct of research of a kind falling with the categories (if any) specified by the Minister). The scheme would also need to make provision for decisions made under the scheme to be notified to Telstra, as well as the persons affected by the decision, so that Telstra has a reliable source of information about the persons who hold authorisations and the persons who have ceased to hold authorisations (eg where a decision is made to revoke an authorisation).
Proposed section 295C would allow ACMA, in formulating the scheme to deal with different kinds of authorisation applications in different ways. For example, ACMA might determine that applications for public number directory producers will be subject to a staged authorisation process which includes submission of an example product, on the basis of a provisional or interim authorisation, before a final decision about an authorisation is made. However, such an approach may not be appropriate for research applications.
Proposed section 295D would enable the scheme formulated by ACMA to provide for authorisations to apply to all information contained in the IPND (other than address information relating to unlisted telephone numbers) or to specified information or specified documents relating to IPND information. For example, should some researchers only require access to certain kinds of information held in the IPND (i.e. listed phone numbers and postcodes) in order to undertake the relevant kind of specified research, ACMA would have the discretion to grant an authorisation in respect of that particular kind of information rather than IPND information generally. This will be a matter for ACMA to consider as part of the authorisation process, having regard to the particular circumstances. ACMA may determine that public number directory producers require listed name, address, phone number and type of listing (eg. business, government charity) in order to produce a particular kind of public number directory. ACMA may also determine that public number directory producers may initially only obtain access to a sample of IPND information in order to produce an example product for assessment as part of the authorisation process.
Proposed 295E would allow the scheme formulated by ACMA to make provision for provisional and final authorisations. For example, the scheme might provide for the granting of provisional access (which will enable the applicant to obtain provisional access to a sample of IPND information to develop an example product) prior to a decision about final authorisation.
Proposed section 295F would provide that the scheme may make provision for and in relation to imposing conditions on the grant of authorisations. For example, ACMA could impose a condition requiring persons who hold authorisations to keep records of disclosures of IPND information (and require such persons to ensure that their contractors also keep such records) so that ACMA can use this information as the basis of monitoring compliance with the Telecommunications Act. Proposed new section 295P would also allow the Minister to determine that authorisations, or that specified kinds of authorisations, are granted subject to conditions. A condition imposed by ACMA on an authorisation could not be inconsistent with a condition specified by the Minister which applies to the authorisation.
Proposed section 295G would provide that the scheme may make provision for varying or revoking authorisations, including the imposition of new conditions or the removal of existing conditions.
Proposed sections 295H would make it clear that the power conferred on ACMA to formulate the IPND authorisation scheme includes the power to provide in the scheme for ACMA to make administrative decisions. It is implicit from this that ACMA will make decisions under the scheme. However, this would not affect ACMA’s ability, under the ACMA Act, to delegate its decision-making powers to a Division of ACMA, a member of ACMA or to a staff member of ACMA (see Division 4 of Part 4 of the ACMA Act).
Proposed sections 295J and 295L would provide that the scheme may contain such ancillary or incidental provisions as ACMA considers appropriate (to deal with matters incidental to the scheme) and that the scheme may be varied, but not revoked.
Proposed section 295K makes it clear that the scheme-making power provided for in proposed section 295A, is not limited by the provisions in Division 3A that set out particular matters that the scheme may provide for.
Proposed subsection 295M(1) would require ACMA, before making the IPND scheme under proposed section 295A, to consult with the Privacy Commissioner and the Secretary of the Attorney-General’s Department and have regard to any submissions made by them. ACMA would also be able to consult such other persons as ACMA considers appropriate, and have regard to the submissions of those persons, before making the IPND scheme. Proposed subsection 295M(2) makes it clear that ACMA may, before making a decision under the IPND scheme, consult with such persons as ACMA considers appropriate and have regard to their submissions before making the decision. Examples of persons ACMA may choose to consult, where it considers it appropriate to do so, include the Privacy Commissioner, national security and law enforcement agencies and persons with expertise relating to a specified kind of research. In addition, ACMA has the ability to establish advisory committees under section 58 of the ACMA Act to assist it with the performance of its functions, including its functions in relating to the IPND scheme.
Proposed sections 295N to 295Q are contained in Subdivision B of proposed Division 3A and deal with Ministerial instruments. Under proposed subsection 295N(1), the Minister would be required to make a legislative instrument specifying the criteria that ACMA is required to consider in deciding authorisation applications under the proposed IPND scheme. The Minister would be able to specify different criteria for different kinds of authorisations. Delayed commencement of the amendments in Schedule 1 to the Bill has been provided in clause 3 to allow sufficient time for the Minister to make an instrument specifying criteria which would commence at the same time as the amendments in Schedule 1. Under proposed subsection 295N(3), ACMA would be required, in deciding an authorisation application, to apply the criteria specified by the Minister but ACMA could also have regard to any other matters it considers are relevant.
Under proposed section 295P, the Minister would be able, by legislative instrument, to determine that all authorisations under the IPND scheme are granted subject to specified conditions. The Minister would also be able to determine that a specified kind of authorisation is granted subject to specified conditions. Examples of conditions the Minister may choose to specify include conditions preventing transfer of IPND information outside Australia or conditions requiring the destruction or secure disposal of IPND information once an authorisation ceases. The Privacy Commissioner will be consulted during the development of the legislative instrument regarding privacy-related conditions that may be appropriate.
Proposed section 295Q would enable the Minister to make a legislative instrument, specifying decisions that the IPND scheme provides for ACMA to make which will be subject to merits review. Schedule 4 to the Telecommunications Act contains a list of decisions made under the Telecommunications Act which are subject to reconsideration by ACMA and ultimately review by the AAT. Item 11 would add to this list a number of decisions which would be made under the IPND scheme. The decisions specified are those that will obviously arise under the IPND scheme. However, item 11 also adds to the list in Schedule 4 such decisions relating to the IPND scheme as are specified by the Minister under 295Q to be reviewable. This is to provide for merits review of all decisions that should be subject to reconsideration once the IPND scheme has been formulated by ACMA.
Instruments made by the Minister under proposed subsection 295N(1), 295P or 295Q are specified to be legislative instruments to reflect that these instruments would be considered to be legislative for the purposes of section 5 of the LIA. As a result, these instruments would need to be registered on the Federal Register of Legislative Instruments and would be subject to Parliamentary scrutiny and disallowance.
Proposed sections 295R, 295S and 295T are contained in Subdivision C which deals with enforcing compliance with conditions of authorisations.
Proposed section 295R would create a criminal offence where a person who holds an authorisation does an act or omits to do an act which breaches a condition of the authorisation. A maximum penalty 60 penalty units ($6,600) for a natural person would apply (this would be 300 penalty units ($33,000) in the case of a body corporate). The offence is considered necessary as an appropriate means of ensuring that authorised persons comply with the conditions on which an authorisation has been granted.
Under proposed section 295S, ACMA would have the ability, if it were satisfied that a person has contravened or is contravening a condition of an authorisation given under the IPND scheme, to issue a written direction to the person to ensure that the person complies with the condition in the future. Failure to comply with a direction would be a breach of a civil penalty provision. Proposed subsection 295S(5) makes it clear that a direction given by ACMA under this section is not a legislative instrument. This provision is included to assist readers and is intended to reflect the position under section 5 of the LIA.
Proposed section 295T would provide that ACMA, if it were satisfied that a person has contravened or is contravening a condition of an authorisation given under the IPND scheme, may issue a formal warning to that person.
Proposed section 295U, contained in proposed Subdivision D of Division 3A of Part 13, would require ACMA, at the time it gives the Minister a report under section 57 of the ACMA Act, to provide the Minister with a separate report in relation to specified matters. These matters specified are the compliance with authorisations under the scheme and any other matter relating to the scheme that ACMA considers appropriate. However, ACMA would not be required to include in the report any information that is confidential or which, if disclosed, might prejudice the fair trial of a person. The Minister would need to cause the report to be tabled in each House of Parliament within 15 sitting days of that House after the day on which the Minister receives the report.
Item 10 – After section 299
Item 10 would insert new proposed section 299A after section 299. Proposed section 299A is a provision dealing with secondary disclosure and use of IPND information (ie the ability of a person who had received IPND information from Telstra to disclose or use that information).
Proposed subsection 299A(1) is a provision dealing with secondary use and disclosure of IPND information that has been disclosed under proposed subsection 285(1A) for purposes connected with the publication and maintenance of a public number directory). The effect of proposed subsection 299A(1) is that if IPND information is disclosed to a person for purposes connected with the publication and maintenance of a public number directory, the person must not disclose or use the disclosed IPND information except for that purpose while the person continues to hold a current authorisation under the IPND scheme (see proposed paragraph 299A(1)(c)). Proposed paragraph 299A(1)(d) would prohibit the person from disclosing or using the IPND information, in the event that the person ceases to hold an authorisation under the IPND scheme. Failure to comply with proposed subsection 299A(1) would be a criminal offence with a maximum penalty of 2 years imprisonment for an individual (see section 303 of the Telecommunications Act). (The effect of sections 4AA and 4B of the Crimes Act 1914 is that a court could decide, where a natural person is convicted of this offence, to impose, in lieu of or in addition to the imposition of a penalty of imprisonment, a pecuniary penalty not exceeding $13,200. If a body corporate were convicted of this offence, the court could impose a pecuniary penalty not exceeding $66,000.)
The limitations on disclosure and use of IPND information under proposed subsection 299A(1) will not apply to persons who use or disclose information contained in a published public number directory. Proposed subsection 299A(1) is concerned with the disclosure and use of the underlying IPND information that is used to prepare and maintain a public number directory.
Proposed subsection 299A(2) is a provision dealing with secondary use and disclosure of IPND information that has been disclosed for purposes connected with the conduct of research of a kind specified by the Minister under proposed subsection 285(3). The effect of proposed subsection 299A(2) is that if IPND information is disclosed to a person for purposes connected with the conduct of specified research, the person must not disclose or use the disclosed IPND information except for that purpose while the person continues to hold a current authorisation under the IPND scheme (see proposed paragraph 299A(2)(c)). Proposed paragraph 299A(2)(d) would prohibit the person from disclosing or using the IPND information, in the event that the person ceases to hold an authorisation under the IPND scheme. Failure to comply with proposed subsection 299A(2) would be a criminal offence with a maximum penalty of 2 years imprisonment for an individual (see the discussion above in relation to proposed subsection 299A(1)).
Proposed subsection 299A(3) is a provision that applies to persons to whom IPND information is disclosed, relying on subsection 299A(2), by a person who received the IPND information pursuant to subsection 285(1A). In this sense, subsection 299A(3) deals with all disclosures and uses of IPND information once it has been disclosed beyond the secondary disclosure point. The effect of proposed subsection 299A(3) would be that a person who receives IPND information from a person covered by the secondary disclosure and use limitations in proposed subsection 299A(2) would only be able to disclose or use that information for the purpose of conducting research of the kind for which the disclosing person holds or held an authorisation. In turn, persons who receive such IPND information may only disclose or use that information for that same purpose. Proposed subsection 299A(3) does not prohibit disclosure or use of the relevant IPND information once the person who received the information under subsection 285(1A) ceases to hold an authorisation because it may be very difficult for persons who are several times removed from the person holding the authorisation to know if an authorisation remains in force. However, such persons (eg persons who have been contracted to conduct the research or to whom IPND information has been disclosed to conduct the research) will only be able to disclose or use the IPND information for the purposes of the conduct of research of a kind specified by the Minister and for which an authorisation had been granted to the person who initially received the IPND information. These persons will not be able to use or disclose the IPND information generally. Failure to comply with proposed subsection 299A(3) would be a criminal offence with a maximum penalty of 2 years imprisonment for an individual (see the discussion above in relation to proposed subsection 299A(1)).
Item 11 – After paragraph 1(m) of Schedule 4
Item 11 would insert paragraphs (ma) to (md) in Schedule 4 which contains a list of decisions that are reviewable by ACMA (and ultimately by the AAT). These proposed new reviewable decisions relate to decisions under the integrated public number database scheme to refuse an authorisation, to impose conditions on the grant of an authorisation, to vary or revoke an authorisation and a decision in an instrument under proposed section 295Q (ie other decisions that the Minister specifies (by legislative instrument) as reviewable decisions).
Item 12 – Transitional
Item 12 is a transitional provision that provides for the situation where IPND information has been disclosed to a person prior to the commencement of item 12, but which is a kind of IPND information which will require the recipient to hold an authorisation in order for Telstra, as IPND manager, to disclose such information to the person in the future. The effect of item 12 is that from commencement of item 12 (ie on a date to be proclaimed or by no later than 6 months after the Bill receives the Royal Assent) a person who had received IPND information previously to produce a public number directory will be taken to hold an authorisation for a period of 28 days from the commencement of item 12. During that period, that person will need to make an application to ACMA for an authorisation if the person wishes to receive IPND information for this purpose in the future. If an application is made by the end of the 28 day ‘exemption period’, the deemed authorisation will continue to apply until such time as ACMA makes a decision in relation to the authorisation application. If ACMA decides not to grant an authorisation, the person will no longer be considered to hold an authorisation from the day that ACMA makes its decision. Similarly, a person will no longer be taken to hold an authorisation from that day that ACMA decides to grant an authorisation (the authorisation under the IPND scheme will apply). The reference to ACMA making a decision in item 12 is not intended to include the effect of a person seeking merits review or judicial review of a decision made by ACMA under the IPND scheme.
The purpose of the transitional arrangements is to enable persons currently using IPND information to make arrangements apply for an authorisation within 28 days of the commencement of the transitional provision and to ensure that these persons can continue to receive IPND information until such time as ACMA decides not to grant an authorisation or decides to grant an authorisation to the person.
[1] Currently section 285 of the Act prevents the disclosure of IPND data associated with unlisted (including silent) numbers.