Privacy protection in telco land is a joke

Stuart Corner
Thursday, 20 January 2011 06:51

Opinion and Analysis

Vodafone has been seriously embarrassed by the leak of customer details, but there seems little prospect of more serious consequences for the company. That needs to change.

Loss of privacy is a precursor to identity theft, and the problem with identity is that, unlike a stolen credit card number, it is not easily replaced; unless you want to change your name. So it should be incumbent upon telcos, and other companies, to provide the highest levels of security around customer data. And there should be serious consequences if that security is breached.

As the Vodafone incident has amply demonstrated neither of those applies. All the reports of Vodafone's security breach suggest that it had implemented a minimal level of security on its customer database and lacked any means of identifying, authenticating and tracking individuals' access and usage.

The situation was succinctly summed up by Electronic Frontiers Australia chairman, Colin Jacobs, interviewed on Channel 10's 7pm Project. "These companies have a legal obligation to protect our data. But that requires time, it requires money, and it requires expertise. And often they don't quite get around to doing it until something like this happens, it all blows up, and they've got a horde of angry customers banging on their door demanding to know what happened to their data."

So what about this legal obligation? There is a mandatory consumer protection code for telecommunications services providers. There are privacy laws. There's the ACMA administering and enforcing code compliance and there's the Privacy Commissioner implementing the Privacy Act. Surely these two wield sticks big enough to ensure that telcos give customer data the care and protection it deserves? Sadly the answer is no, on every count.

According to Elissa Freeman director of policy and campaigns at the Australian Communications Consumers Action Network (ACCAN), "The TCP [Telecommunications Consumer Protection] code does have provisions that require providers to protect the privacy of their customers' billing and personal information so there is a good case that Vodafone has breached the code."

However she says: "This is a great example of how toothless the code is. The ACMA can now investigate Vodafone for a possible breach of the code and can direct Vodafone to comply with the code, but that is about as tough as it gets."

CONTINUED