Telstra penalised $300,000 for repeat customer safety and privacy failures

Telstra has paid a $306,360 infringement notice issued by the Australian Communications and Media Authority (ACMA) for failing to provide accurate details of thousands of customers to the Integrated Public Number Database (IPND).

The IPND is used by Triple Zero to help locate people in an emergency, for the Emergency Alert Service to warn Australians of emergencies like flood or bushfire, and to assist law enforcement activities.

In 2021, an ACMA investigation found systemic issues with Telstra’s compliance with IPND rules. The ACMA penalised Telstra $2.5 million, finding it had failed to comply with the obligations on nearly 850,000 occasions. In addition, Telstra committed to a significant compliance uplift program of work to ensure future compliance.

In September 2022, Telstra notified the ACMA it had found further issues from the same period through monitoring arrangements put in place as part of its uplift program. ACMA’s investigation found Telstra failed to provide accurate customer information to the IPND on more than 19,000 occasions between October 2010 and August 2022, including around 600 occasions where silent numbers were incorrectly flagged for listing in directory services. Telstra also failed to provide over 200 consumers with a copy of their IPND information within the required time frame.

ACMA Chair Nerida O’Loughlin said that while Telstra has engaged in a compliance uplift program, these new breaches indicate it has more to do.

“Telstra needs to focus on completing the program and making sure it is fully compliant with these rules. The IPND is essential in a crisis when emergency services or police need to contact or locate people in harm’s way.

‘We will keep Telstra focused on fixing these longstanding issues and giving consumers confidence that their data is being accurately recorded,” said Ms O’Loughlin.

In addition to the financial penalty, the ACMA has accepted a court-enforceable undertaking from Telstra that requires an independent review of its IPND compliance uplift and to make further improvements where required. Telstra must also check the accuracy of its IPND data quarterly and report to the ACMA.

If Telstra fails to comply with its obligations or the enforceable undertaking in future, the ACMA can commence proceedings in the Federal Court.

“The ACMA expects all telcos to have and maintain effective processes to meet these critical obligations, especially as we head into the bushfire season in Australia,” Ms O’Loughlin said.

All telcos are required to upload accurate customer details to the IPND for each service using a public number that they provide under the Telecommunications Act and the IPND industry code. Silent numbers must be accurately listed so they are not inadvertently published in directories. Consumers also have a right to request a copy of their IPND record and it must be provided within 20 business days.

/Public Release. View in full here.