Privacy commissioner investigated Optus over data-handling practices
|
Version 0 of 1. Optus has been under investigation for its handling of personal data, Australia’s privacy watchdog has revealed the day after the federal government’s data retention scheme passed. In a release issued on Friday, the Australian privacy commissioner, Timothy Pilgrim, said he had been concerned by Optus’s privacy practices following three privacy-related incidents, and began an investigation into Optus in July 2014. He said he had accepted an enforceable undertaking from Optus that it would seek to enhance its information security through a review. The revelations come just a day after the Senate passed a two-year mandatory data retention law that will see certain types of phone and web records held by telecommunications companies, including Optus. Pilgrim said: “I appreciate the positive way in which Optus worked with our office to address these incidents. I consider that the enforceable undertaking is an appropriate outcome that will ensure Optus takes steps to strengthen its privacy controls and meet its security obligations under the Privacy Act.” Optus has made an undertaking to complete a broad review of its information-handling practices. An enforceable undertaking is a promise made by an organisation that can be enforced by the privacy commissioner through the federal court if it is not appropriately met. It is the first time Pilgrim has exercised these powers. “Organisations and agencies need to take reasonable steps to protect the personal information of customers. If personal information is compromised, I encourage organisations and agencies to notify affected individuals and the OAIC [Office of the Australian Information Commissioner], where there is a real risk of serious harm to an individual. This can assist people to respond to the breach, and mitigate the potential harm,” Pilgrim said. “Data breaches can pose a serious threat to individuals and to the reputation of organisations. For those reasons I recommend that all organisations and agencies develop a data breach response plan, as this will significantly improve their ability to respond to a breach.” David Epstein, the vice-president of corporate and regulatory affairs at Optus, said the company took privacy and security very seriously and had resolved the issues identified, reviewed and enhanced its processes and obtained external audits. “Optus has cooperated with the privacy commissioner and provided an undertaking to obtain an independent external review of its compliance with privacy laws,” Epstein said. “Affected customers were notified in 2014 and we worked with individuals to address their concerns at that time. We will continue to review our processes and systems to prevent future mistakes.” A concern raised about the mandatory data retention is the ability of telecommunications companies to secure far more data on customers’ web and phone activities. While the privacy commissioner will have some oversight of the scheme to ensure providers and government agencies are meeting their obligations under Australian privacy principles, the commissioner’s office remains in an uncertain position. The government announced in the last budget it would abolish the OAIC – which has freedom of information and privacy functions – and has proposed to move the privacy commissioner into the Australian Human Rights Commission. But the president of the Australian Human Rights Commission, Gillian Triggs, has warned that the current proposal would be “unworkable” partly because it would allow the commissioner to sit apart from the commission’s formal structure but still draw from its funding. |