ACMA Consultation Paper: Disclosure of CLI to 190 Service Providers
Submission by the Australian Privacy Foundation
October 2005
The Australian Privacy Foundation
The Australian Privacy Foundation is the main non-governmental organisation dedicated to protecting the privacy rights of Australians. The Foundation aims to focus public attention on emerging issues which pose a threat to the freedom and privacy of Australians. The Foundation has led the fight to defend the right of individuals to control their personal information and to be free of excessive intrusions. The Foundation uses the Australian Privacy Charter as a benchmark against which laws, regulations and privacy invasive initiatives can be assessed.  For information about the Foundation and the Charter, see www.privacy.org.au 
I note that the Foundation has been represented for several years on the ACIF Working Committees responsible for Codes of Practice and Guidelines on privacy issues including the IPND Code (C555: 2002); the Code on Protection of Personal Information (C523: 2001) and Calling Number Display (C 522: 2003). We are therefore very familiar with previous discussion of these issues.

Introduction

We welcome the opportunity to comment on this Consultation Paper (CP), which deals with an important issue.

We do not understand why the consultation paper has been distributed on an in-confidence basis and that any submission received in response will similarly be treated by ACMA as confidential.  It is the normal practice for consultations on these sorts of issues to be public and for submissions to be published, and we strongly support this transparency, which will unfortunately be lacking in this case.  We hope that any Determinations, other actions or proposals you make as a result of the consultation exercise will be accompanied by a full summary of the various points of view expressed, with an indication of their source.

We recognise the public interest from a consumer protection perspective in addressing the issue of unexpectedly high telecommunication bills.  However, we consider that the paper has failed to canvass a range of alternatives, opting instead for a superficially attractive mechanism which in our view not only seriously undermines legitimate customer expectations but would also in some respects unlawful.  The proposed ACMA Determinations could ensure that is was lawful, but are not acceptable.

We are very surprised, and disappointed, that the CP does not make reference to the ACA Report of investigation of alleged breaches of the Telecommunications Act 1997 and the ACIF C522:2003 Calling Number Display Industry Code, August 2004.  This report dealt with relevant issues in the context of disclosure of blocked CND to ISPs.  While the issue of disclosure to 190 Service Providers (SPs) is somewhat different, there are many similarities.

We note that we did not agree with all of the ACA’s decisions in the 2004 report, and consider that incorrect findings of law were made that are in a number of respects highly relevant to the circumstances of 190 SPs.  We explain this further below.

We note (CP 4.6) that ACMA is uncertain as to whether 190 SPs are Carriage Service Providers (CSPs) under the Act.  This seems to be a fundamental threshold issue. If they are not, then they cannot lawfully obtain CLI from Suppliers (Carriers or CSPs) even for those customers who have not blocked CND.  ACMA appears to believe it could make Determinations to allow 190 SPs the same access as CSPs (leaving aside the issue of whether that allows for the proposed disclosure), but we strongly suggest that this is both undesirable and unnecessary.

We are also surprised that the CP makes no reference to the ACIF draft Code on Credit Management C546, currently out for public consultation, which has expressly addressed the issue of unexpectedly high bills (and which expressly refers to ACMA’s initiatives on premium rate services). 

Clarification of scope

The consultation paper appears to limit itself to consideration of disclosure of CLI to 190 SPs, and does not anticipate disclosure to 190 Content Providers (CPs) .  We seek your confirmation that disclosure of CLI to 190 CPs, either by 190 SPs or directly by suppliers (carriers or CSPs), would be unlawful, and that there is no intention to change the law to allow this.  Clearly the privacy concerns about disclosure would be magnified hugely if disclosure was potentially to thousands of 190 CPs rather than just the 60 190 SPs.

Context

Where CND has been blocked, it is reasonable to assume that the intention of the caller (or of the subscriber in the case of a line bloc) is not to reveal this information.  This ‘choice’ is supported both by the ACIF CND Code of Conduct C522 (required by TA s.113(f)(iv) and mandatory for all CSPs) and by National Privacy Principle 8 (mandatory for all private sector organisations subject to the Privacy Act).

It is important to recognise that this is not a trivial issue – in many cases the reasons for a caller (or subscriber) wishing to block CND relate to personal safety.  This is particularly the case with silent lines, for which CND display is automatically blocked.

The only circumstances in which the individual’s preference can be overridden routinely and automatically is in the provision of CLI with calls to emergency services numbers - 000 and 112.  This is expressly authorised by law (TA s.286), which also means that it complies with the Privacy Act NPP2.

A caller’s number, as recorded by the carrier, may of course be provided, notwithstanding a CND block, in specific cases to law enforcement agencies, subject to appropriate authorities and safeguards, but this is not provision of CLI information.
Proposed disclosure unlawful

We suggest that disclosure of CLI by a 190 CSP to a 190 SP for calls where CND has been blocked would be unlawful in that it would involve breaches both of s.276 of the Telecommunications Act and subsections 5.1.1 and 5.1.8 and 7.1.1 of the ACIF Code (by the CSP) and ss 7.2.2 of the Code (by the 190 SPs if they used the CLI information).

The arguments are the same as those put forward by the complainants to the ACA in 2003 about disclosure of CLI to ISPs.  ACMA should have access to this material but if not we would be pleased to supply it.

The ACA’s finding in its 2004 Report that the prima facie breaches of the Code are overridden by s 1.1.4 is in our view wrong because the exception provided by s.291(1) of the TA is not a ‘requirement of the legislation’.  As the CP points out (4.3 & 5.1) it merely confers a discretion.  And as the CP confirms (4.4), section.291 clearly allows for disclosures for a much wider range of purposes than those permitted under the CND Code – it is therefore clear that the mandatory CND Code acts to limit the range of  ‘business needs’ for which CLI may be provided.

We further disagree with the ACA’s finding that a ‘business need’ can be accepted by the disclosing CSP on the word of the requesting SP without any exercise of judgement.  In our view a ‘needs’ test is implied by the TA and Code, both for the disclosing CSP and the collecting SP.

For those collecting organisations (in this case the 190 SPs) covered by the Privacy Act, a needs test is also required by the combined effect of National Privacy Principle 1 (only collect information that is necessary for its functions or activities) and NPP 8 (anonymity where lawful and practicable).

Even if the ACA findings in its 2004 report are accepted, there will be some individuals accessing 190 services from the phone line of a third party where the CLI disclosed is not that of a customer of the disclosing supplier – in the equivalent ISP cases, ACA found disclosure to be in breach not only of the Code but also of TA s.276.

We further question whether ACMA has the power to make Determinations which have the effect of contradicting a clear statutory prohibition.

Proposed disclosures unnecessary and undesirable

If there was some way of ensuring that disclosure of CLI as proposed was lawful, there would still seem to be threshold issue as to whether a individual’s express choice to suppress CND should be overridden solely for the objective of ‘protecting’ that individual from high bills.  This seems extremely paternalistic.  Assuming full information is provided to customers about the risks of 190 service use (the suggestions about which we fully support – see below) surely it is a matter of individual choice as to whether the customer continues to suppress CND when using such services.  The availability of an override code to allow CND display for specific calls even on blocked lines provides customers with a reasonable means of enlisting the assistance of the 190 SP.  

Even if a case can be made for disclosure of CLI to 190 SPs on CND blocked calls in some circumstances, and the law was amended to allow it, there is still no need for routine and automatic disclosure of CLI for all calls to all 190 SPs.  The vast majority of such calls, on ACMA’s own evidence, incur no likelihood of overcommitment.  If disclosure of CLI is to be permitted at all, it should only be triggered by some other indicator of large bills.  

If there were multiple 190 CSPs, there might be some difficulty in aggregating all calls (and charges) from a given number, although we would suggest that some empirical evidence would be required to show that any of the problem cases involve calls from the same number via different carriers/CSPs.  However, given that the Paper says that Telstra is the only CSP dealing with 190 SPs, it should be possible for Telstra to set up a trigger that would flag high call charges within a particular period for any one number.  If Telstra as the 190 CSP was to be made responsible for notifying the customer and/or blocking access, this would appear to offer the same protection against unexpectedly high bills as disclosure, without the privacy invasive down-side.

This option does not seem to have been considered.  Neither does a more participative consent based regime under which 190 SPs (and all other intermediaries) would be required to offer customers a range of thresholds/triggers for reporting and/or disclosing CLI for follow-up action.  For example, customers could choose EITHER to be notified by the 190 CSP if total charges for 190 services in a billing period exceeded $x  OR for their CLI to be disclosed if (a lower) threshold was crossed, so that the 190 SP could check if an aggregate threshold had been crossed. (This second option, while not necessary yet, could be useful if more 190 CSPs enter the market). 

Public Awareness

We welcome the emphasis in the CP on the need for customers to be made aware of any disclosure of CLI that does eventuate from the outcome of this process. 

The ACIF Code 7.1.2 requires suppliers to satisfy themselves that parties to whom CLI is disclosed will comply with the limitations on use.  

In case of 190 SPs ACMA is now proposing (CP 5.2 & 5.3) tougher direct regulation in the form of Determinations to achieve this objective – implicitly acknowledging that disclosing CSPs cannot be relied on to impose and police the awareness requirement through contract terms.  We support this approach generally, and would regard it as particularly essential in the event that any disclosure of CLI on calls where CND is blocked is allowed.  Also in this event we would support the suggestion in CP 5.1 and 5.4 that there be an active monitoring and reporting program by ACMA.

If ACMA decides, despite our arguments, to issue Determinations authorising the disclosure of CLI for CND blocked calls by 190 CSPs to 190 SPs, we request a further round of consultation on the details of the safeguards and conditions.

The ACA Fact Sheet on CND – which was updated to clarify disclosure of blocked CLI to ISPs (Decision 12 of the 2004 investigation report), would need to also explain the disclosure to 190 SPs.  We note that the fact sheet as it appears on the web site is undated – this is unhelpful and should be rectified.

End.

For further information, contact:	Nigel Waters
APF Board Member and Policy Co-ordinator
Email: privacy@privacy.org.au