Australian Communications Authority Draft Industry Standard
Telecommunications (Use of Integrated Public Number Database) Industry Standard 2005
Submission by the Australian Privacy Foundation
July 2005

Openness

Please note that we not only have no objection to this submission being made public but strongly urge ACMA to publish all submissions (except where submitters have made a good case for confidentiality).  Openness is an important objective, and the following statement in your consultation paper not only provides an appropriate basis for publication, but also gives rise to a presumption and expectation:

“The ACA will treat all submissions as public submissions (or non-confidential information).  Parties claiming confidentiality should provide reasons supporting their claim, either in the space provided in the cover sheet or on a separate paper.  Please note all submissions provided will be subject to the Freedom of Information Act 1982 and may have to be released under that Act.”
The Australian Privacy Foundation

The Australian Privacy Foundation is the main non-governmental organisation dedicated to protecting the privacy rights of Australians. The Foundation aims to focus public attention on emerging issues which pose a threat to the freedom and privacy of Australians. The Foundation has led the fight to defend the right of individuals to control their personal information and to be free of excessive intrusions. The Foundation uses the Australian Privacy Charter as a benchmark against which laws, regulations and privacy invasive initiatives can be assessed.  For information about the Foundation and the Charter, see www.privacy.org.au 
I note that the Foundation has been represented for several years on the ACIF Working Committees responsible for Codes of Practice and Guidelines on privacy issues including the IPND Code (C555: 2002) which led to this Discussion Paper (the Working Committee is now meeting again to review the Code in light of the draft Standard); the Code on Protection of Personal Information (C523: 2001) and Calling Number Display (C 522: 2003). We are therefore very familiar with previous discussion of these issues.

General comments
Standard welcome but complementary action required

The IPND is established by law as a consolidated database for specific purposes – to provide a resource for emergency service and law enforcement use, and for the provision of directory services. ACMA has set out to ensure that directory information is not used for other purposes, outside the limits set by Part 13 of the Telecommunications Act 1997, but has dealt with only part of the problem.

We welcome ACMA’s proposed Standard as an important first step in dealing with this issue, but urge  ACMA to not only issue the Standard as soon as possible, but also to issue a complementary Standard to apply to the directory activities of individual carriers and CSPs, including Telstra’s Sensis subsidiary. 

However effective the controls on IPND data, the practical effect for individuals is undermined by the ability of individual carriers to use the same information that they provide to the IPND in ways that would not be possible if it was sourced from the IPND.  This is particularly significant in relation to Telstra, which does not source the directories produced by its Sensis subsidiary (including the White Pages) from the IPND and is therefore effectively exempt from the controls in the draft Standard.

Similarly, any end-users making use of Sensis directory information, including anyone producing directories from information obtained from Sensis (to the extent that Sensis allow this contractually) escape from the controls in the Standard.  This means that a Standard which purports to deal with the use of telecommunications directory information does not in fact deal at all with the customer contact data in the largest and most commonly used directory in Australia.

Only when there are binding rules in place for all directory information will ACMA’s objectives be met. (We note also that until the same rules apply to all directories there is an important equity/competition issue.  We urge ACMA to ascertain the ACCC view of this outcome.)

We do not fully understand the reasons why ACMA has drafted the ‘Section of the Industry ‘ Determination which accompanies the draft Standard in such a limited way as to exclude Sensis and end users of Sensis products from the definition of the ‘public number data’ section of the telecommunication industry, to which the Standard applies.   The assertion in the consultation paper that “Sensis is deemed to be beyond the scope of the IPND Code and the IPND Standard” is not supported or persuasive.  Just because the Standard has been occasioned by the failure of the existing IPND Code it does not in our view follow that it has to limit itself to the same scope. However, while we remain of the view that a wider definition of the ‘section of the industry’ would remedy the scope problem, we would not now wish to see a delay in the making of the more limited Standard, provided it is followed quickly by a complementary Standard.

We acknowledge that Industry Standards  on their own, within the context of the existing Telecommunications law, can only go so far in addressing the policy issues around the use of telecommunications customer contact data.  We welcomed the invitation in the 2004 Discussion Paper to comment on this jurisdictional limitation, and in our May 2004 submission suggested a range of options including recommendations for legislative amendments and an integrated approach involving not only telecommunications law but also privacy and other laws, to address the ‘downstream’ use of telecommunications customer information by organizations outside the telecommunications industry.

The ACA has declined so far to take up any of these options, and has limited itself to a very narrow scope for the Industry Standard, accepting all the constraints of the existing telecommunications law, which necessarily limits severely the ability of the Standard to address the overall policy objective, which we repeat should be:

“to ensure that uses of telecommunications customer information are in accordance with the reasonable expectations of the customers and to the maximum extent possible in accordance with their express preferences.”

We suggested in our submission on the Discussion Paper that the sensible foundation of public policy in relation to this issue, consistent with privacy law, would be to clearly mandate an ‘opt-in’ system whereby all telecommunications customers are asked if they wish their details (and what details) to be included in public number directories, having first been fully informed as to the implications in terms of potential uses.

We noted in 2004 that an opt-in system would be consistent with the approach already taken by the government to regulation of unsolicited commercial email or Spam.  While we have some criticisms of the Spam Act 2003 regime (particularly the exemptions), the principle of opt-in is sound.  While unsolicited phone calls may not be as economically damaging as Spam (although junk faxes can be); they are, we suggest, just as annoying to many people, and deserve the same presumption of privacy.

We note that your consultation paper flags informed consent and listed/unlisted options as fundamental issues that may need to be addressed to achieve the overall objectives.  We submit that it has always been clear that they must be addressed.  The 2004 Discussion Paper raised expectations that have not now been met.  We urge ACMA to confront this issue head on and make recommendations to government for the other changes that are so obviously required.  We take the opportunity of this submission to repeat our analysis of the problem and the potential solutions, and urge ACMA to address them with a sense of urgency.

To the extent that the draft standard can deal with part of the problem, and also provide a valuable benchmark for rules that need to apply more generally, it needs considerable work to clarify concepts and ensure consistency with other instruments.  It also needs to ensure that it does not inadvertently authorise a much wider dissemination of sensitive information about silent line and suppressed address customers than is actually necessary.  We deal with these con cerns in our specific comments below.

ACMA also needs to make clear its intentions in relation to enforcement.  There is no point in having a tough Standard if either the enforcement mechanisms are not available or if ACMA does not have both the resources and the commitment to monitor and enforce the Standard. 

It is also clear that there is a serious conflict of interest in Telstra being the contracted IPND Manager and we urge ACMA to recommend an alternative arrangement as a matter of urgency.

Relationship between the Standard and the ACIF Code

We urge ACMA to resist pressure from industry stakeholders to defer to a revised ACIF IPND Code.  A Standard should be preferable to even a registered and therefore binding Code as a basis for the use of IPND information, although we are concerned about the apparently weaker enforcement provisions (see below under ‘Enforcement’).  

On the assumption that you can re-assure us that a Standard can be enforced as easily as a Code, then duplication of provisions in the Standard and the Code should be avoided as it will only lead to confusion.  It is unfortunate that the ACIF working committee has commenced a review of the Code before the Standard is finalised. In our view the Standard should be determined first and the Code can then be revised to deal with the detail of operational processes.  We do however acknowledge the importance of consistency and clarity of terminology and the Standard could usefully adopt some of the terms and definitions used in the existing Code and IPND Data  Industry Guideline – specific suggestions are made below.

Specific comments on the draft Standard

It remains unclear as to whether the Standard regulates only the use of ‘customer contact information’ (whether derived from the IPND or other sources) or regulates public number directories in their entirety, including whatever other information they contain.  It is similarly unclear whether the intention (and effect) is to deal only with the production of directories by data users or to regulate the supply of all information from the IPND to approved data users.

This confusion stems partly from the fact that while the Standard appears to be primarily addressing the use of IPND data for directory purposes, it still also attempts to set out the parameters for all uses of IPND data.

One major source of difficulty is that the draft Standard seeks to achieve its primary purpose (to control the end use of directory data) partly by limiting the provision of information to the IPND.  Given that the IPND serves other important public policy objectives – such as emergency services and assistance to law enforcement agencies, as well as the provision of directory services – this approach is misconceived.  Provision of information to the IPND needs to be regulated with all users and uses in mind, whereas use of the IPND for directory services should be a specific sub-set with its own requirements and limitations.

We welcome the objects stated in clause 5.  While (b) and (c) restate obligations that already apply under the Privacy Act to larger businesses, they ensure that the same standards will apply to smaller organizations that are exempt from the Privacy Act. 

In respect of object (d), we would argue that the Standard does not really deliver this, in that the fees charged by some CSPs for silent lines puts a barrier in the exercise of choice (see below).

We suggest that the Standard actually goes beyond the objects (a) to (d) and aims to ensure that directory information is handled in accordance with reasonable customer expectations.  If lawfulness (a) and compliance with the NPPs (b) were enough to ensure this, there would be no need for the Standard.
Definitions and terminology

Customer data and sub-sets of it.

While we welcome the adoption of our suggested term ‘customer contact information’, it is clear from discussions in the ACIF IPND Working Committee that this needs more work, both to precisely identify the relevant data and to ensure consistency with related terms used in the IPND Code, the Licence Condition and the Telecommunications Act 1997.

In the comments which follow, references to the term ‘customer contact information’ should be applied to whatever new term is used.

It would be helpful to clarify the meaning of ‘if practicable’ in item (f) of the specification of ‘customer data’ in the Licence Condition (subclause 10.4).  We assume this to encompass ‘if available’ since many customers may not choose to specify whether their line is being used for domestic or business purposes.  We request that ACMA puts beyond doubt that the current wording does not imply a mandatory requirement either for customers to specify, or for CSPs to make an assumption.  Any assumption by CSPs’ of a ‘default’ label would arguably be a breach of the relevant National Privacy Principles.  We note that the ACIF IPND Data Guideline specifies a usage code N for ‘not known’, but that the current IPND Code defines Residential Number as ‘any … number [not] tagged as business government or charity’.

‘Customer contact information’ includes ‘directory name’ and ‘directory address’.  The definitions of these terms refer to consent which we argue is misleading in the context of default listing for fixed line numbers (see discussion of Listed and Unlisted below). The definition of directory address is also different from that adopted in the ACIF IPND Data Guideline – the latter is more accurate, although it may not capture the complexity of the issue.  These terms need to be thought through in the context of the various names and addresses which a customer may legitimately give to a CSP, and the various needs to these in the IPND.

Open and restricted data users

The use of the term ‘data users’ as part of the new section of the industry, and comprising only users approved by the IPND Manager, will create confusion given the common public understanding that any user of directory data, particularly the marketers who are creating the problem, are ‘data users’ in their eyes.  We urge ACMA to find another term to replace ‘data users’ in the Standard and Determination.

The concept of ‘restricted data user’ seems clear enough and goes to the primary objective of the Standard – to regulate directory services, although the previous term ‘public number directory producers’ was more meaningful, and should perhaps be retained, although distinguished from ‘directory assistance providers’ (these two groups together covering everyone who would be a restricted data user?).  Your Guide to the Standard makes this distinction.

It is less clear who is expected to be an ‘open data user’, and why.  Is it expected, for example, that all law enforcement agencies will have to apply for approval as open data users (even though they have a statutory right of access to the information)?  If this is the case, it would perhaps be uneccessary to apply all of the reporting requirements – in this respect it may be desirable to distinguish ‘enforcement agencies’ from ‘commercial users’.

If it is considered necessary to cover all lawful access in the list of open data user uses, then we suggest it may be wise to add ‘relevant complaint handling’ (e.g. by the TIO or Privacy Commissioner) to the list in Clause 12.  Alternatively, an exception for uses with the consent of the customer, could be added, but this has the potential to be abused (e.g. by bundled consents which the Privacy Commissioner is concerned about).

Public number directory

If this term survives, we do not think that the definition should include the qualifications and conditions contained in (a)-(d).  It should have its Plain English meaning, with the limitations being introduced in another way.

Location dependent services

We note that the draft Standard uses a different definition of ‘location dependent carriage service’ from that in the Licence Condition, where it means ‘a carriage service that depends
for its provision on the availability of information about the street address of the caller.’  The Licence Condition definition is clearly too limited to cover the full range of services being referred to (street address is often irrelevant – it is any geographic location that matters).  But so too is the proposed variation, in that it is limited to services that ‘route … calls to a particular location’.  It is important that this definition adequately covers all potential services which rely on the location of the caller – we suggest that the first part of the definition should suffice, which would make it equivalent to the Licence Condition definition if ‘street address’ there was replaced with ‘geographic location’.

Providers of ‘location dependent carriage services’ fall under the category of open data users in the draft Standard and are therefore eligible to receive the full set of customer data, including addresses of silent line customers.  We think that further consideration should be given to whether this is necessary or whether they should only receive an appropriate sub-set of the data.  It may be possible to transmit sufficient location information as part of a call to allow the provision of these services, without disclosing addresses.  We would not want to place unnecessary barriers in the way of silent line customers gaining the benefit of location dependent services, but this needs to be balanced against the reasonable privacy and security expectations of those customers.  In relation to this issue, the rules applying to the use of CLI information, including the ACIF CND Code, need to be taken into account.

Listed/Unlisted/Suppressed

There is considerable confusion about the various permutations of listed, unlisted, suppressed, number and entry, and the inconsistent way they are used in the various instruments.  It is essential not to fall into the trap of implying that individuals have consented to listing when it is the default option for many fixed lines and customers have to pay for the privilege of a silent line or suppressed address.  The policy issues are discussed below but the definitions need to be reviewed in light of the position under the legislation and the policy intention.

Other terms

It is unhelpful to expressly define ‘directory assistance services’ as meaning something different from its meaning in s.7 of the TA.  As the intention is to define a more limited sub-set then a new term should be used.

The definition of reverse search function in the draft Standard differs from the relevant restriction in s.285(2) of the TA (which does not use the term but is the underlying limitation).  It is however a better definition for the purposes of Clause 34, and should remain.  A footnote or other reference explaining the connection with s.285(2) would be helpful.

Similar treatment of similar services.

These are the two types of ‘restricted data user’ – ‘public number directories’ and ‘directory assistance services’ (Clause 12(2)) but some of the subsequent provisions of the Standard apply differentially. We can see no reason for the providers of ‘directory assistance services’ to be treated any differently form public number directory producers.  Indeed, if they are not subject to exactly the same rules there is a risk that the controls on published directories could be circumvented by businesses offering the same information through an ‘assistance service’.  In this respect, it is also essential to ensure that the Standard would prevent someone offering directory information through an ‘operator service or operator assistance service’ which are ‘open data users’ subject to fewer controls.  We are sure it is not ACMA’s intention to allow these loopholes but the wording and effect of the Standard need to be ‘watertight’ in this respect.

Coverage of agents/contractors

ACMA needs to ensure that the Standard applies to all agents and contractors handling information on behalf of data providers and data users (and the IPND Manager).  We note clause 6 of the draft Standard which may go some way towards this, but it may also be necessary to include a more specific provisions and to reflect this in the Section of Industry Determination by expressly adding agents/contractors as another part of the ‘Section’.
Role of IPND Manager

So long as Telstra is the IPND Manager, we think it is invidious to give the IPND Manager the function of approving data users.  Given Telstra’s business interests in directories through its Sensis subsidiary, there is a clear conflict of interest.  While there is no suggestion that the IPND Manager has abused the current version of this role, it is simply untenable, especially given the proposed enhanced role.  Either ACMA should take on the approval role or it should be given to another organisation independent of any directory business interests.

Cl.12(1) says the IPND Manager may approve …purposes.  Given that some of the purposes listed for ‘open data users’ are required by law, it does not seem appropriate to suggest that the IPND Manager has any discretion. 

We are also concerned that the Standard relies on the IPND Manager to ‘police’ the use limitations.  Again, there is a particular conflict of interest while Telstra is the IPND Manager, but also more generally we think that ACMA should have a more pro-active role in monitoring and enforcement (see below). 
Fixed and Mobile numbers

There is insufficient recognition in the draft Standard (and underlying instruments) of the difference between fixed line and mobile numbers.  For instance, why is the concept of a service location (included in customer data) relevant to a mobile service?  We note that the IPND Data Guideline includes a requirement for a service address (6.11) but it is not clear on what regulatory requirement this is based.

Listed and Unlisted Numbers

The draft Standard appears to have accepted an argument that all approved data users need to have full information about customers with unlisted numbers.  This appears to be based on the need to deal with changes in listed/unlisted status.  The consequence of this argument being accepted is that there could be a considerable number of organizations holding the address/location information about unlisted customers.  This will not only be contrary to the reasonable expectations of silent line customers but also means a major increase in the vulnerability of and risk to those customers.

Customers opting for a silent line (unlisted number) or suppressed address listing would in our view have an expectation that their full address details would not be disclosed at all by the CSP.  This expectation needs to be qualified in relation to law enforcement and emergency services, and because of the way the law provides for these public interests, this means routine disclosure to the IPND.  We do not accept however that it is necessary to routinely allow full address details of all silent line or suppressed address customers to be passed from the IPND to restricted data users.

We also question whether it is necessary for restricted data users to retain the public number once a customer has elected for unlisted status. We can see a need for the retention of a record for a public number that has changed from listed to unlisted at least for a period of time, but why does this record need to include the number itself?  Again, the objective should be to reduce the incidence and availability of records of unlisted numbers.

Part of the problem arises from the fact that customers elect to have a silent line (unlisted number) or suppressed address listing for different reasons.  For many customers, it is primarily to reduce the nuisance of direct marketing.  For others it is a deliberate choice of not revealing their geographic location. For a significant minority, it is an important contributor to physical security. The way in which the use and disclosure of unlisted numbers is addressed in the law, Licence Condition, Codes and draft Standard adopts a ‘one size fits all’ approach which does not recognise these different interests.

As we argued in our 2004 submission, the best way of addressing the majority concern about direct marketing is to establish a national do-not-contact list (see below).  This would almost certainly substantially reduce the demand for silent lines and suppressed addresses.

Uses of customer contact information and the role of consent

We believe that the issue of what uses to allow is inseparable from the question of whether customers have any choice as to having their contact details included in the IPND, or in any other source data used by PNDPs.

At present, Telstra – by far the largest contributor of PNCD to the IPND - charges users a fee if they wish to have a ‘silent’ or unlisted number.  We have consistently maintained that this is unconscionable, and suggest that it may also be a breach of National Privacy Principle 1.2 in that it amounts to unfair collection, and of NPP 8 in that it denies individuals a degree of anonymity, unless they pay for the privilege.  It is in short a form of ‘protection racket’ or blackmail, in that individuals are essentially told, “we will make your contact details available publicly unless you pay us not to”.

We are not sure what the practice of the other carriers is in relation to listing, and associated charges, but we submit that all carriers should be required to offer customers a clear choice, with the unlisted option being free of charge, and also being the ‘default’ option if there is any uncertainty about a customer’s preference.  While carriers/PNDPs should be free to charge customers for directory entries, they are unlikely to want to do so as it is in their interests to encourage listing (We note that Telstra appears to be prohibited from charging for a standard entry in the White Pages (Licence Condition 9(3))).  There is even an argument that they should pay the customer for allowing their name to be listed, as it has a commercial value.

We also suggest that its should be mandatory for customers to be offered a suppressed address option which allows them to list their number and general location (such as suburb) but not their full street address. This would facilitate the use of directories to find a number (e.g. by distinguishing between similar name customers), without providing details that could be used for postal or face to face contact.

Some of the uses which the draft Standard has confirmed are proscribed by Part 13 of the TA (such as data-washing) are not inherently objectionable, and many customers may see them as a reasonable extension of the basic directory listing.  It is for instance likely that if customers were consciously opting in to directories, as a way of other people finding them to call, then they would have no objection to organizations which already have their contact details using telecommunications customer contact information to update those records.  However, we agree that while customers are in the position of being listed ‘by default’ unless they ask, and in some cases pay, to be unlisted, then no-one can safely make an assumption about the level of ‘consent’ for any services, and these uses must therefore continue to be prohibited.

We are very concerned that Clause 17 of the draft Standard appears to give regulatory force to the commercial practice (of some CSPs) of listing by default geographic numbers.  We cannot see the rationale for this – as we argue above ACMA should be aiming for the reverse –free unlisted status by default.

Do-not contact lists

While we continue to urge the adoption of an opt-in approach to use of telephone customer contact information, there may still be a role for opt-out or preference lists for people who are prepared to have their details in directories, but only if they are able to exercise some control.  

Whoever operates do-not-call/fax preference lists, we can see no reason to exempt political parties and charities.  These are often the source of some of the most annoying and persistent approaches and we can see no public interest justification for allowing organizations in either category to ignore clearly expressed customer preferences.  There would however be no in principle objection to a preference scheme which offered a variety of options such as ‘no commercial, but charities OK’.  There would however be obvious difficulties in policing such as distinction and avoiding it being abused.

We also cannot see any justification for time limiting the effect of an ‘opt-out’. It should be assumed that customers would wish any preference to remain in force until they provide a change in that preference.

Other 

Clause 25 requires data providers to advise customers about their ability to request a change to listed/unlisted/suppressed address status (25(e)).  As already noted, such notice will be misleading unless it mentions any charges that may apply.  See also our submission in relation to default status – which has implications for what customers are told (under 25(d)).

Clause 32 paraphrases NPP 4 but omits an important ‘risk’ against which data must be secured – that is ‘misuse’.  The wording from NPP 4 should be used verbatim.

Clause 35 limits the uses that approved data users may make of customer contact information in a public number directory.  As discussed above under ‘Uses’, we are not convinced that all these restrictions are justified by reference to customers’ reasonable expectations, and they would certainly not be justified if customers were given more control (as we have suggested).  There is also a question mark over whether end-users of directories not subject to the Standard will be able to undertake these activities using directory data.  We understand that ADMA is advising its members that this may be the case. We have already mentioned our concerns about the use of Sensis directory data for these prohibited purposes.  If either of these routes to these uses exist, it would seem both pointless and inequitable to prevent approved data users from doing the same.

Once again, this points to the inadequacy of the Standard as a means of addressing the underlying public policy issues.
 
We question whether Clause 40 is consistent with obligations under National Privacy Principle 6.  Data users should certainly explain that customers seeking changes should contact their CSP but in some circumstances it may well be appropriate for the data users to make an immediate change as well.
 
Complaints and Enforcement
It is essential that the Standard be enforced.  One important contributor to compliance is an effective complaints mechanism.

We welcome the requirement in Clause 41 for internal dispute resolution procedures that meet AS 4269-1995.   But ACIF has already issued customized guidance for the telecommunications industry in the form of Code C547:2004 (based on AS 4269).  Given that all data users concerned will be part of the new ‘public number data’ section of the industry, and that the TIO will presumably in due course have jurisdiction, we suggest that the IPND Standard references this rather than the somewhat dated Australian Standard.

For external dispute resolution, we assume that the public number directory ‘section of the industry’ will be subject to the jurisdiction of the Telecommunications Industry Ombudsman (TIO).  It would be helpful if ACMA could confirm this after appropriate consultation with the TIO.

It is unrealistic to rely on complaints alone to ensure compliance with the Standard.  Many breaches of the Standard may not come to the direct notice of customers, or at least not in a way that would clearly lead them to identify the consequences as resulting from a breach and then to complain.  It is essential that someone be responsible for monitoring and auditing compliance,  taking up systemic non-compliance arising from complaints experience, responding to allegations of breaches by public interest groups and the media, and taking enforcement action where breaches are detected.

ACIF has a useful Code compliance role but it is limited, and in any case it is expected that the substantive limits on uses of directory information will no longer be contained in the revised ACIF IPND Code, which will deal only with operational detail.  It therefore falls clearly to ACMA to undertake the primary enforcement role. 

We seek clarification from ACMA as to its proposed enforcement role in relation to the Standard.  We hope that the emphasis will be on pro-active monitoring and on the use of ACMA’s powers, including bringing actions for civil penalties under Part 31 of the TA. 

While s.128 makes any non-compliance with the Standard automatically subject to the civil penalty provisions, there does not appear to be, for Standards, a ‘direction to comply’ provision equivalent to that in s.121 in relation to Codes.  This would seem to be a significant weakness – enforcement of a Standard is only through a fully fledged court action for a breach, whereas for Codes there is the intermediate administrative step of a s.121 direction for specific alleged breaches.  The power to issue warnings (s.129 for Standards, s.122 for Codes) is useful but does not in itself trigger the penalty provisions.

End.

For further information, contact:	Nigel Waters
APF Board Member and Policy Co-ordinator
Email: privacy@privacy.org.au