Telecommunications Amendment (Integrated Public Number Database) Bill 2006

Submission by the Australian Privacy Foundation 
www.privacy.org.au 
November 2006 

Fundamental flaw
The Bill purports to address the very real privacy concerns surrounding the use of public number telephone directories, well canvassed by ACMA in its consultation process over the last three years.

The Australian Privacy Foundation supports the objective of more clearly defining, and controlling, permitted uses of directory information.  

Regrettably, the Bill will be ineffective in meeting this objective, as it is restricted to controlling directories sourced from the Integrated Public Number Database (IPND).  Other directories, including the dominant White and Yellow Pages published by Telstra’s Sensis subsidiary, are not sourced from the IPND and therefore escape from the control of the legislation.  This means that Sensis, and other directory producers not using IPND data, will remain free to make their directories available for purposes and in formats prohibited, for good reasons, where IPND data is used, including with the provision of  highly intrusive ‘reverse search’ capability.  While Sensis does not currently offer reverse search functionality, it is aggressively marketing other services which would be prohibited if the same data was sourced from the IPND.

This issue was raised prominently by many submissions to ACMA.  The failure of the government to address it not only renders the entire scheme ineffective in terms of protection for consumers, but is also fundamentally unfair and anti-competitive, allowing an uneven playing field to remain in the highly competitive directories marketplace. 

If the scheme of the Bill was to be extended to all public number directories, whether sourced from the IPND or not, then it would be a powerful tool for consumer privacy, albeit with some other flaws, detailed below.   While covering all directory producers might require legislative changes beyond the Telecommunications Act, there is no apparent reason why that Act cannot regulate the activities of all directory producers who are also carriage service providers. 

The balance of our comments are addressed to the detail of the regime, but are all subject to the caveat that partial regulation, of IPND sourced directories alone, will be ineffective in meeting the avowed objective of the legislation.

Detailed comments
Authorisation scheme
We welcome the introduction of a scheme of authorisation where ACMA, rather than the IPND Manager (currently Telstra) assesses and decides on applications for access to IPND data.  While Telstra appears to have operated as IPND Manager with independence and integrity, the potential for, and perception of, conflict of interest is unacceptable.  See below for related views on ‘ownership’ and control of the IPND.

Definition of Public Number Directory
The Bill defines ‘public number directory’ and lists permitted content – with provision for the Minister to add additional specifications. 

Subject to our concerns about the definition only capturing IPND sourced directories, the definition seems appropriate.   We support the clear statement that a ‘public number directory’ need not contain addresses.

However, we note that the Explanatory Memorandum fails to mention that the Licence Condition 10 only requires CSPs to provide, and the IPND Manager to record. ‘whether the number is used for business, government, charitable or private purposes where practicable’.  This is an important qualification as it means that customers are free to not specify if they so choose, and it is essential that this element of choice is not lost in any new provisions.

Authorised purposes
The Bill aims to prevent use of IPND sourced data for purposes such as marketing, data cleansing and appending, debt collection, identity verification and credit checking, which are considered to be beyond the reasonable expectations of individuals whose personal details are required by law (for public interest reasons) to be included in the IPND. 

We support the clear articulation of the ‘underlying purpose of a directory’ being ‘ to assist communication between end users of carriage services’.  However, we do not think that relying on the definition of ‘public number directory’ is satisfactory.  The prohibition of the ’unwelcome’ uses is intended to be achieved indirectly by relying on them not being covered by the permitted purpose of ‘publication and maintenance of a public number directory’. In our view, the regulatory scheme relies too heavily on what the EM calls the ‘sense of [the] ordinary meaning’ of public number directory.  We do not believe there is a clear consensus as to this ‘ordinary meaning’, which is one of the reasons why the IPND Code review was not making progress and why the matter has been taken out of industry hands, firstly by ACMA with its draft Standard and now in this legislation. 

We note that no change is proposed to the provisions of the Telecommunications Act relating to directory assistance services, which are defined so as to prevent such services offering reverse search functionality.

We note that it is intended to allow, by Regulation, directory producers to add specified additional information to the data obtained from the IPND in relation to qualifying entities.  To the extent that this would not be about natural persons, and therefore not ‘personal information’, no privacy issue arises, although proprietors of qualifying entities may not necessarily welcome this concession. 

Reverse search prohibition
We welcome the intention to retain a prohibition on reverse-search functionality but question whether this is best achieved by incorporating it in the definition of a ‘public number directory’.  This is a clumsy approach – it would be far better in our view to prohibit the use by directory number producers of public number directory data for the purposes of providing reverse searching capability.  

As we have already noted, the fact that the reverse search prohibition is contained in the definition of ‘public number directory’ also means that it only applies to directories sourced from the IPND, and therefore does not apply to Telstra’s Sensis subsidiary.  While Sensis has to date respected the principle of ‘no reverse search’ there is no guarantee that it will do so in future, especially once Telstra is under majority private ownership. 

The prohibition on reverse search should also extend to all other organisations. This would require legislative changes beyond the Telecommunications Act – amendment to the Privacy Act is an obvious solution.
Law enforcement and emergency services access
We note that no change is proposed in relation to access to IPND data by law enforcement and national security agencies and by emergency services.  We take the opportunity however to repeat our strong concern about the exclusion of privacy interests from the ACMA Law Enforcement Advisory Committee – even the Privacy Commissioner has been denied membership.  It is quite unacceptable for discussion about the law enforcement uses of telecommunications data to be taking place entirely between directly interested agencies and industry representatives, without any balancing input putting the case for consumer privacy.
Provision for research
The Bill provides for IPND information (other than about unlisted numbers) to be disclosed for specified research purposes that are in the public interest. These would be specified by the Minister in a legislative instrument.  

It is important to recognise that this would allow research uses, which the government accepts are outside ‘reasonable expectations’  without the consent of the individual concerned.  It follows that there is a strong onus on the government to justify any exceptions on the basis of another clear and, on balance more persuasive public interest.

While we recognise the public interest in some research, it is important that this exception mechanism is not abused.  We seek a guarantee that the Minister could not use her powers to allow research use of IPND data which did not conform to the AMSRO Privacy Code (registered under the Privacy Act 1988 and currently under review).

A key element of the AMSRO Privacy Code is that in ‘genuine’ market or social research, the client of the research does not receive the findings in an identifiable form i.e. opinions are not attributed to identifiable individuals without their express consent. 

Another key element is that genuine market research does not make any attempt to promote goods or services, or to solicit funds.

It is in our view essential that the Bill restricts the Minister’s regulation making power in respect of authorising research uses of IPND data to research that meets these two criteria. 

This would for instance ensure that no exception could be made for political canvassing, which most people would regard as a form of (generally unwelcome) marketing, other than where it conformed to the AMSRO Privacy Code.

Consideration should also be given to regulating research access to the IPND data, to as far as possible providing access to a list of numbers meeting specified criteria, rather than allowing researchers access to entire directories.  Either the IPND Manager or another independent third party could play an intermediary role in providing customised lists of public numbers for one-off research use.

We welcome the assurance that unlisted number information would not be available for research purposes, although there is no reason why researchers should not be allowed to exclude silent numbers from their sample population, subject to appropriate controls.

The Explanatory Memorandum is unhelpful (at page 13) in implicitly recognising some research uses of a commercial nature (which would still be subject to the Do-Not-Call Register Act).  We suggest that the government takes the opportunity of this Bill to re-inforce a clear distinction between ‘genuine’ social or market research (conforming to the AMSRO Code) and any other ‘so-called’ research which would in fact be ‘telemarketing’ under the Do-Not-Call Register Act.

‘Ownership’ and control of the IPND
As we stated in our submission on the ACMA Draft Standard, we believe it is untenable for Telstra to remain the IPND Manager – there is too great a potential for conflict of interest, and the Bill should facilitate the earliest possible transfer to an independent authority or contractor.  The security issues associated with maintaining the IPND, which contains all public numbers including unlisted (silent line) numbers, suggest that it should be under strong public control and not left to a commercial operator.  We would expect the law enforcement and national security agencies, and emergency services, for whom the IPND is a vital resource, to have relevant views about appropriate ownership and control of this component of the national infrastructure.

Monitoring and enforcement
We welcome the proposed offence and penalty provisions and the proposed role for ACMA in auditing the use of IPND data and policing the limits.

We support the Privacy Commissioner’s recommendation that any public number directory producer, however small, be automatically confirmed as subject to the Privacy Act 1988, and not be eligible for the ‘small business organisation’ exemption.  While any such producer would be likely not to qualify for that exemption because of s.6D(4)(c) it would be good to put the matter beyond doubt.

Silent line charging
This Bill provides an excellent opportunity to address a major flaw in the telecommunications regulatory environment concerning silent lines.  This is the ability of Telstra (by far the main issuer of public numbers) to charge for an unlisted (silent) line.

While the Telecommunications Act requires special protection to be afforded to unlisted numbers (e.g. suppression in public number directories and directory assistance services) there is no express obligation on carriers to offer silent lines – it is merely implicit from the protection obligations.  This situation allows Telstra (and potentially other CSPs) to charge for unlisted numbers on the basis that it is a commercial decision.  
 
Responses to complaints by the Foundation to the Privacy Commissioner, Telecommunications Industry Ombudsman (TIO), ACMA and the ACCC have confirmed that charging for unlisted numbers is lawful.  However, both the Privacy Commissioner and the TIO have publicly reported continuing dissatisfaction from consumers about the charges, which have been likened to a ‘protection racket’ – ‘pay us a fee or else we will expose your number to the world’.

As the IPND is the central repository of all public numbers, and is required to record whether each number is unlisted or not, it would seem highly appropriate for the regulatory regime applying to the IPND to prohibit charging for what is in effect a statutory right to a silent line. 

Contact for this submission:
Nigel Waters
Policy Coordinator and Board Member
Australian Privacy Foundation
Phone: 0407 230342  E-mail: mail@privacy.org.au