Knowledge of person concerned

72.79 Section 289(1)(b)(i) of the Telecommunications Act provides that the use or disclosure by a person of information or a document is permitted if the information or document relates to the affairs or personal particulars (including any unlisted telephone number or any address) of another person, and the other person is reasonably likely to have been aware or made aware that information or a document of that kind is usually disclosed, or used, as the case requires, in the circumstances concerned.

72.80 NPP 2.1(a) contains a similar exception where an individual would reasonably expect an organisation to use or disclose the information for a purpose (the secondary purpose) other than the primary purpose of collection.^[70] NPP 2, however, contains the added protection that the secondary purpose must be related to the primary purpose of collection and, if the personal information is sensitive information, directly related to the primary purpose of collection.

72.81 One stakeholder has noted that s 289(1)(b)(i) and NPP 2.1(a) offer very different levels of protection, and submitted that either the Privacy Act or Telecommunications Act should be amended to require businesses in the telecommunications sector to comply with NPP 2.1(a) in relation to use and disclosure for secondary purposes. It also noted that the existing protection under s 289(1)(b)(i) in relation to use and disclosure for the primary purpose should not be removed or made any weaker.^[71]

72.82 In DP 72, the ALRC proposed that s 289(1)(b)(i) of the Telecommunications Act should be amended to provide that a use or disclosure by a person of information or a document is permitted if the information or document relates to the affairs or personal particulars (including any unlisted telephone number or any address) of another person; and the other person has consented to the use or disclosure; or if the use or disclosure is for a purpose other than the primary purpose for which the information was collected (the secondary purpose):

• the secondary purpose is related to the primary purpose and, if the information or document is sensitive information (within the meaning of the Privacy Act), the secondary purpose is directly related to the primary purpose of collection; and

• the other person would reasonably expect the person to use or disclose the information.^[72]

Submissions and consultations

72.83 A number of stakeholders supported the proposal.^[73] The Australian Federal Police, however, submitted that the proposal unnecessarily narrows the exception.^[74] The Australian Privacy Foundation submitted that the second limb of the proposal is too broad. The Foundation noted that what is a ‘reasonable expectation’ in the telecommunications context is difficult to determine. It submitted that privacy protection should rest on a presumption that only uses and disclosures ‘necessary’ for the provision of a telecommunications service are permitted without consent, unless one of the other exceptions apply.^[75]

72.84 One stakeholder questioned the relevance of ‘collection’ in a telecommunications context; and the feasibility of a ‘secondary purpose’ test, noting that most individuals have little knowledge about how telecommunication networks operate so they would not be able to know what was a primary purpose of collection.^[76]

72.85 The stakeholder also noted that the proposal would require telecommunications service providers to obtain consent for the use and disclosure of information for the primary purpose of collection, and questioned whether this was the ALRC’s intent. She also submitted that the proposal would be a significant improvement on the existing exception if the intent was that:

• a use or disclosure for a primary purpose required either consent or that the other person would reasonably expect the person to use or disclose the information; and

• a use or disclosure for a related secondary purpose required either consent or the same requirements as existing NPP 2.1(a).^[77]

72.86 The stakeholder doubted, however, whether such a proposal would provide an appropriate level of protection for all types of information, including mobile phone location information and unlisted and other blocked calling numbers. She submitted that Part 13 should be amended to insert new provisions specifying the circumstances and conditions under which a new category of ‘specially protected information’ (for example, mobile phone location information, calling number information) may be used or disclosed. She submitted that the exception under s 289(1)(b)(i) should state that it does not apply to ‘specially protected information’.^[78]

72.87 She also noted that regulators have issued conflicting advice on whether the exception under s 289(1)(b)(i) may be relied on when other exceptions do not apply—such as s 291, which relates to the business needs of other carriers or carriage service providers. In her view, s 291 alone permits the use and disclosure of information to other carriers and carriage service providers. She submitted that s 289(1)(b)(i) should state that it does not apply to disclosures made to a carrier or a carriage service provider (unless consent to the particular disclosure has been obtained).^[79]

ALRC’s view

72.88 In Chapter 25, the ALRC considers various reformulations of the ‘reasonable expectation’ exception, but suggests that the current exception under NPP 2 provides the appropriate level of protection for an individual’s personal information. The term ‘reasonable expectation’ imports an objective test of what a hypothetical reasonable individual would expect in the relevant circumstances. This condition is an important, but not particularly onerous, protection against the misuse of an individual’s personal information.

72.89 An individual is more likely reasonably to expect the use or disclosure of their information or a document if the use or disclosure is related, or in the case of ‘sensitive information’ directly related, to the primary purpose for which the information or document came to a telecommunications service provider’s knowledge or into its possession.^[80] This requirement is appropriate in the telecommunications context.

72.90 Part 13 does not refer to ‘sensitive information’, but would regulate the use and disclosure of ‘sensitive information’ as defined under the Privacy Act. Section 289(1)(b)(i) has the potential to permit the use and disclosure of information in a broad range of circumstances. The exception under s 289(1)(b)(i) should be confined, therefore, by aligning it with the level of protection afforded to such information under the Privacy Act. This will ensure that ‘sensitive information’ obtained during the supply of a telecommunications service receives the same level of protection it would have under the Privacy Act.

72.91 The exception under s 289(1)(b)(i) operates to allow the use and disclosure of information that otherwise may not be permitted under other exceptions. This exception, however, should not be given a broad interpretation. To be related, the secondary purpose must be something that arises in the context of the primary purpose for which the information or document came to a telecommunications service provider’s knowledge or into its possession. If the information is sensitive information the use or disclosure must be directly related to the primary purpose. This means that there must be a stronger connection between the use or disclosure and the primary purpose for which the information or document came to the person’s knowledge or into the person’s possession. Further, the test for what an individual would ‘reasonably expect’ would be applied from the point of view of what an individual with no special knowledge of the telecommunications industry or activity involved would expect.^[81]

72.92 While there may be merit in the amendment of s 289 to provide that it does not apply to information such as unlisted numbers and other calling number information, and location information, the ALRC received only one submission on this issue. This issue should be considered as part of the review of the Telecommunications Act recommended in Chapter 71. This issue of unlisted numbers and calling number information is discussed below.

72.93 In Chapter 73, the ALRC recommends that ACMA, in consultation with relevant stakeholders, should develop and publish guidance relating to the exceptions under Part 13 of the Telecommunications Act. This guidance should set out examples of when s 289(i)(b)(i) may be relied on.