p o s t:	G P O   B o x   1 1 9 6  
	S y d n e y   N S W   2 0 0 1
e m a i l:	m a i l @ p r i v a c y . o r g . a u
w e b : 	w w w . p r i v a c y . o r g . a u	

Holly Raiche
Project Manager, Consumer Codes
ACIF Ltd
PO Box 444
MILSONS POINT NSW 1565

11 November 2005

Dear Holly

Re: DR ACIF C525:2005; HANDLING OF LIFE THREATENING AND UNWELCOME CALLS

Thank you for the opportunity to comment on this draft Code.  

As you are aware, this is one Code to which, despite the obvious privacy implications, APF has never been directly involved as a member of the relevant Working Committee.  This has been due to our limited resources, but it does not indicate a lack of interest.

We welcome the availability of guidance for carriers and CSPs on this important area of operations.
Terminology

We are a little surprised that the Code still uses the word ‘calls’ to apply to a range of telecommunications including SMS/MMS.  Given the increasing number of non voice and non real-time communications, which users would increasingly not refer to as ‘calls’, we would have expected a more technology-neutral term such as ‘communications’.

Proportionality of response

Our main concern is to ensure a proportionate response to the different categories of life threatening and unwelcome calls (LT&UC).  Clearly the extent to which a calling party (A party)’s privacy can reasonably be infringed will be very different in a genuinely life-threatening situation than in a situation of nuisance calls – particularly if the nuisance is inadvertent or non-offensive.  

The principle of proportionality which underlies privacy principles – including the Privacy Act NPPs, should be the starting point for this Code.  We recognise that a clear distinction has been made between life threatening calls covered by s.287 and menacing, harassing or offensive calls covered by Section 474.17 of the Criminal Code Act 1995.  

However, we are concerned that there is not a sufficiently clear distinction between the latter category and other unwelcome calls, which may require a different level of response.  For instance, the definition of unwelcome call in s.2.2 appears to include calls which may be unintentional, “for example, a repeated call from an incorrectly programmed facsimile service or message bank service.” as a type of ‘menacing, harassing or offensive call’.  

We do not believe that Parliament can have intended the provisions of the Criminal Code to apply to this type of ‘unwelcome’ call and we therefore suggest that there should be at least a third category of unwelcome call being those that are not intentionally ‘menacing, harassing or offensive’ but which nevertheless cause inconvenience or even distress, and which justify some action by C/CSPs. 

One sub-set of this third category, with which the Code does not adequately deal is  unwelcome direct marketing calls, which probably constitutes the single largest sub-set.  The boxed note under 3.3.5 makes the point that there are other avenues for pursuing complaints about telemarketing, but we suggest that this distinction is made more clearly and earlier in the Code.

We do not know to what extent enforcement of the Spam Act involves ‘call tracing’.  To the extent that it does, we would expect the experience of ACMA to be relevant to the handling of LT&UC.

It is not clear to us why action is only triggered by ‘a pattern’ of unwelcome calls, which has a fairly precise definition.  We would have expected some flexibility as a single highly offensive call may justify some action. (The boxed note after 3.3.4 recognises the variable nature of unwelcome calls).

Privacy expectations – CLI & Silent lines

The box at 3.1 should make reference to the need to comply with the Privacy Act as well as with Part 13 of the TA – the relationship is complex and although the Part 13 restrictions generally ‘trump’ NPP2, there are some respects in which the NPPs may impose additional obligations.  This is implicitly recognised in the box after 3.3.19, which does mention the Privacy Act, but which seems out of place, and also does not adequately address the issue of CLI blocking, especially where it applies by virtue of a ‘silent line’.

Privacy considerations as they have been defined in Australian law only come into play when in relation to parties who are individual natural persons.  Where either the aggrieved B-party or the ‘accused’ A-party is an organisation, measures to investigate and respond to reported LT&UC do not need to consider the privacy implications in relation to that organisation.  However, since at least one of the parties will often be an individual, it may be more convenient to adopt a single set of processes, based on the considerations that will apply in such cases. 

We suggest that the starting point for consideration of privacy issues should be that the investigation of LT&UC should generally not involve the disclosure of identifying information about the ‘natural person’ complainant  (the B-party) to the alleged perpetrator of the LT&UC (the A-party) unless and until this becomes necessary for the resolution of the complaint.  Similarly, the identity of the A-party, where it is not already obvious, should not normally be disclosed to the B-party, again unless it becomes necessary.  

While disclosure in one or both directions often will be necessary – particularly in the case of life-threatening calls – it will not always be so, particularly in the case of unwelcome calls where a warning may well result in cessation of the behaviour.  We are particularly conscious of the potential for further harassment, not only by means of telecommunications, if alleged makers of unwelcome calls are given the identity of complainants, and vice versa.  We accept that at some point a natural justice issue comes into play, but we do not believe that the Code should automatically assume that disclosure of CLI or other details relating to a party needs to be a part of the response mechanism.

We note the positive references in the Code to Malicious Call Trace (MCT) technology (e.g. box after 3.3.11), and the definition explains that this is a customer activated facility.  Such a facility would help to strike an appropriate balance in this area.  A lot of excellent work on this solution was carried out by Robin Whittle in the 1990s (see http://www.firstpr.com.au/issues/mct/  )  As I understand it, B-parties who received unwelcome calls would dial a particular code which would result in flagging of the incident, and capture of the A-party CLI if it was not already retained.  A record of all calls perceived by the B-party as unwelcome would be created, without disclosure of any personal information, unless and until a repeated pattern of calls led to a specific complaint, which could then be investigated.   Such a facility would reduce both the threshold for B-parties making complaints about unwelcome calls, and the cost to C/CSPs of dealing with such complaints.  It is not clear if MCT as referred to in the draft Code fully incorporates all of the features of the Whittle model.  We would have expected the Code to have more to say about MCT as an obvious approach to balancing privacy concerns of one or both parties with resolution of LT&UC complaints. 

Because we have not been involved in the development of this Code and its predecessor it is difficult for us to judge how well these issues have been dealt with, and whether the preferred privacy safeguards are compatible in practice with the needs of any investigation into, and resolution of, LT&UC.  We would however expect the Code to be clearer in explaining how privacy concerns have been addressed. 

For further information about this submission, please contact:

Nigel Waters, Board Member and Policy Coordinator
Australian Privacy Foundation
Phone: 02 4981 0828 and 0407 230342
E-mail: nigelwaters@iprimus.com.au