Australian Communications Authority Discussion Paper: Regulatory Issues associated with provision of Voice Services using Internet Protocol in Australia
Paper at http://www.aca.gov.au/aca_home/issues_for_comment/discussion/ACA_VoIP_DP.pdf 

Submission by the Australian Privacy Foundation
January 2005

The Australian Privacy Foundation
The Australian Privacy Foundation is the main non-governmental organisation dedicated to protecting the privacy rights of Australians. The Foundation aims to focus public attention on emerging issues which pose a threat to the freedom and privacy of Australians. The Foundation has led the fight to defend the right of individuals to control their personal information and to be free of excessive intrusions. The Foundation uses the Australian Privacy Charter as a benchmark against which laws, regulations and privacy invasive initiatives can be assessed.  For information about the Foundation and the Charter, see www.privacy.org.au 
I note that the Foundation has been represented for several years on the ACIF Working Committees responsible for Codes of Practice and Guidelines on privacy issues including the IPND Code (C555: 2002); the Code on Protection of Personal Information (C523: 2001) and Calling Number Display (C 522: 2003). We are therefore very familiar with previous discussion of telecommunications regulatory issues, and have made submissions to previous AComA consultations, including use of customer information in directories, Enum and mobile location.

Overview
We welcome the ACA’s initiative in consulting on the implications of VOIP. 

However, the discussion paper makes the familiar mistake of dealing with privacy separately from other key interrelated issues such as interception, numbering and emergency call services.  Privacy expressly only rates half a chapter of the discussion paper (10.1) and this is a limited and superficial treatment, confined to identifying the privacy obligations under both the Telecommunications and Privacy Acts, and inviting comment.  There is a suggestion that the introduction of VOIP services will not affect the operation of the statutory privacy obligations.

We are disappointed that the paper does not contain a more sophisticated analysis of the privacy implications of VOIP, which are likely to arise primarily from regulatory responses to the challenge that VOIP poses in the other areas such as location information, interception and law enforcement, emergency calls, numbering and directories.  In other words, privacy is an overarching concern which can only be assessed fully in the context of other implications.

As a general approach, we do not think that there should be a presumption in favour of the current regulatory environment for traditional telecommunications being applied to VOIP.  Each requirement should be considered on its merits.  But we do consider that this would lead to a presumption that there should be no less privacy protection for communications via VOIP than for traditional telecoms, and hopefully more.

Detailed comment
From a privacy perspective, the key principles underlying all aspects of VOIP should be that only the minimum amount of personal information necessary for provision of the service, and for directly related matters such as billing, should be collected, and for that information to be stored for as short a time as possible.  These principles are clearly in tension with some other objectives, but should not be lost sight of even where compromises are appropriate.

Numbering

We can see no need for the numbers used for VOIP to indicate anything about the caller’s location, given that charging will presumably be independent of distance.  The nature of internet use is that many users will be accessing services from a variety of locations, and location should be irrelevant to ISPs, carriers or other third parties.   Allocation of geographic number ranges would therefore be potentially misleading and lead to actions based on false assumptions of location.  We therefore favour the use of location independent numbers for VOIP services.

If there are, as we suspect and explore further below, some distinctive privacy implications that arise from VOIP, then there it would be an advantage for the number to also specifically indicate that the party concerned was using VOIP.  The caller (or called party) could then adjust their behaviour (eg: whether they take the call, or what they reveal) in light of the privacy characteristics of VOIP calls.  This is consistent with the discussion at 5.2.2(d) of the AComA paper.
Quality
We note that there is a specific privacy principle (NPP3) that supports a general requirement for quality, when dealing with personal information (including the content of communications). In other less regulated industries consumers could use the NPP 3 to challenge quality of service where there was an element of personal information involved.  
Emergency Services

There should be no automatic presumption that it is necessary for ESOs to be able to access information about either the identity or the location of a person making a call by VOIP. The user of a VOIP telecoms service is not necessarily the ‘subscriber’ (this characteristic is shared with traditional services), so the value of subscriber info to ESO’s has to be questioned.  In order to provide ESOs with accurate information as to the location of a VOIP user, ISPs and carriers would have to monitor users and their ‘log-on’ location to a much finer degree than is required for service delivery, billing etc.  

Requiring VOIP service providers to provide ESOs with CLI, as suggested in section 8.3 of the AComA paper, would also be a major intrusion into the privacy of telecommunications users.  AComA should be aware of the representative complaint by the Electronic Frontiers Australia (EFA) against several carriers for supplying CLI, including for silent line subscribers, to ISPs.  The AComA found some aspects of this practice to be unlawful, and the matter is also currently under investigation by the Privacy Commissioner as a potential breach of the Privacy Act 1988.  We can see no reason why many VOIP service providers would need access to the CLI of callers using dial up connections in the first place. To the extent that some VOIP service providers may need CLI for billing in their capacity as carriage service providers, they will be required to enable the caller to block provision of their calling number the same as for standard telephone and mobile services.  An automatic block on further transmission of CLI would apply to calls from silent lines. 

The level of surveillance and privacy intrusion required to apply Emergency Service obligations to VOIP is unacceptable and unnecessary as long as users are educated not to expect the same emergency service response when using VOIP.  Users of VOIP services via dial up connections need to be reminded that only emergency calls made via traditional telephony (fixed and mobile) will result in the automatic transmission of CLI and routing to the appropriate ESO call centre for the broad geographic area (currently via the SMSA indicator codes for mobile calls).

There are many ways of ensuring expectations are realistic, including such simple devices as automatic reminders when logging on or widely available stickers to place on terminal equipment. 

Interception

The introduction of VOIP services will place pressure on the capacity of law enforcement and intelligence services to intercept voice communications.  

The government has already responded to the increased use of non-voice communications by amending the Telecommunications (Interception) Act 1979 (TIA).  Recent amendments have excluded some types of stored communication from the scope of the TIA, significantly lessening the privacy protection for email, SMS and pager messages – a range of powers can be used to gain access rather than the TIA (or ASIO Act) warrants required for access to voice calls.  A new section of the Act gives effect to government assurances that VOIP services will be treated as voice calls and remain subject to the TIA. 

Unless the law is amended, it would appear that the ‘interception capability’ requirements will apply to VOIP services.  We regard this as completely unrealistic and unworkable.  The obligations were designed for application to large and well resourced telecommunications carriers – it is already doubtful if all the of current Carriage Service Providers can comply, and certainly beyond the capacity of the very small VOIP service providers which are likely to emerge in even greater numbers.

We suggest that the issue of interception requirements is deferred pending the outcome of the scheduled review of the TIA during the next twelve months by the Attorney-General’s Department, but that the AComA and/or DoCITA ensures that the implications of VOIP are brought to the attention of that review.

Privacy and other customer obligations

We have already indicated above that we regard the treatment of privacy in this section of the paper to be superficial and incomplete.

It is in our view essential that VOIP service providers should be subject to privacy legislation. Unfortunately with the current small business exemption in the Privacy Act 1988, smaller providers may well escape the application of the NPPs and the enforcement regime of that Act. (The AComA VOIP paper neglects to mention this and implies at section 10.1 that the Privacy Act applies to all participants in the telecommunications industry). 

VOIP service providers will presumably be declared a section of the industry and therefore be subject to Part 13 of the Telecommunications Act 1997, but this deals primarily with non-disclosure and is no substitute for the full range of privacy principles.  

The relationship between the PA and TA is in any case ambiguous and unsatisfactory – a matter which we hope will be addressed by the current Review of the private sector provisions by the Federal Privacy Commissioner.

As we have already explained, ensuring that VOIP service providers were subject to the Privacy Act and Part 13 would still not address all the privacy issues that arise, and we have dealt with some of these under the other headings in this submission.  We suggest that it is particularly important to comprehensively address the privacy of the three types of personal information which will be handled by VOIP service providers:
•	Customer information (identity, contact and financial details)
•	Traffic information (who customers contact, when, for how long)
•	Communications content (in the voice context, the actual conversations or messages)
Each of these needs to be assessed in light of all of the requirements for collection and use; i.e. operational needs, other commercial uses, law enforcement and emergency service requirements, and customer service and complaint processes including external review.  All of these ‘claims’ need to be tested, even if they are currently legal requirements, to ensure that intrusion into privacy is minimised and only proportional to the other interests involved.

This may sound like an attempt to revisit the entire regulatory regime for privacy of telecommunications and to some extent it is that, but only because a review of the status quo is appropriate with every significant new development in communications technology.

Call charging accuracy

Section 11 of the paper addresses issues of billing and call charge accuracy.  As we have already noted under the Quality heading, this is actually a specific instance of a privacy principle at work – in other less regulated industries consumers would have to use the data quality privacy principle (NPP 3) to challenge bills.  The fact that telecommunications billing has always been highly regulated and is covered by a separate ACIF code, and is dealt with separately by the Telecommunications Industry Ombudsman, should not detract from consideration of billing and call charge accuracy as part of the overall privacy assessment.

End.

Correspondence in relation to this submission should be addressed to:
Nigel Waters, Board Member, Australian Privacy Foundation
Contact Details for the APF and Board Members are at:
http://www.privacy.org.au/About/Contacts.html