Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2017

The instrument defines several key terms that are essential to understanding the obligations it imposes. “Protected information” means information or a document disclosed under subsection 285(1A) of the Telecommunications Act for a purpose covered by either subparagraph 285(1A)(c)(ii) (public number directory purposes) or subparagraph 285(1A)(c)(iv) (research purposes). This is the data that flows from the integrated public number database to authorised persons. The database itself is defined in subsection 285(2) of the Act as the database maintained by the IPND Manager, which contains customer data supplied by carriage service providers. “Customer data” is defined in the IPND Scheme 2017 (a separate instrument) and is not redefined here.

A “public number directory authorisation” is an authorisation under the IPND Scheme permitting the holder to use and disclose protected information for directory publication purposes. A “research authorisation” is the equivalent for research purposes. The distinction is critical because the additional conditions differ between the two categories. The instrument also defines “contractor” as a person performing services for and on behalf of the holder but not as an employee. This means that employees are covered by the holder’s general obligations, but contractors must be separately bound by contractual restrictions.

“Transfer to someone who is in a foreign country” is expansively defined in subsection 4(2): protected information is taken to be transferred when it becomes accessible to the intended recipient in a foreign country. However, the note clarifies that temporary routing of data overseas during ordinary internet transmission between two Australian points is not intended to be captured. This is an important nuance for cloud services and email systems that may route data through foreign servers. The holder must assess whether the technical architecture of its data flows could trigger the cross‑border condition.

The Australian Privacy Principles from the Privacy Act 1988 are referenced as the benchmark for assessing whether foreign privacy protections are “at least substantially similar”. This is a comparative standard that will require legal analysis in each case. The instrument also uses the phrase “substantive or systemic breach of security” without defining it, leaving interpretative scope to the ACMA and the IPND Manager. The ten‑business‑day disposal period in section 10 is a relatively tight timeline and imposes a record‑keeping burden to track when data is no longer required.

For researchers, the prohibitions on re‑identification are particularly detailed. Subsection 12(2) prohibits a database from enabling a person who knows only the public number to readily identify the name and/or address, and likewise from enabling a person who knows only the address (or part of it) to identify the name and/or public number. Subsection 12(3) provides a limited exception for postcode‑based searches, which can return a list of numbers and associated data from within that postcode. This creates a tension: the exception might inadvertently allow re‑identification if the postcode area is small. Researchers must design their databases to prevent such outcomes; the condition is outcome‑focused rather than process‑focused, which creates legal risk if the data is later re‑identified by a third party.

The primary entities affected by this determination are the holders of public number directory authorisations and research authorisations under the IPND Scheme. These are likely to be telephone directory publishers, academic or commercial research organisations, and possibly government agencies that have been authorised to use the data for research purposes. The conditions directly constrain how these entities handle, disclose, and destroy protected information. They also impose obligations on the holders in respect of their contractors, meaning that any service provider engaged by the holder must be subject to contractual restrictions on use and disclosure.

The conditions also create responsibilities for the IPND Manager and the ACMA. The IPND Manager must receive notifications of security breaches (section 8) and notifications of contraventions by other persons to whom protected information has been disclosed (section 9). The ACMA likewise receives these notifications and presumably has enforcement powers under the Telecommunications Act if conditions are breached. The ACMA’s involvement represents an ongoing oversight cost, both for the regulator and for authorised entities that must maintain reporting protocols.

Carriage service providers are indirectly affected because they supply the customer data that populates the IPND in the first place. However, this determination does not impose new obligations on carriers - it only governs the downstream use of the data by authorised third parties. The customers themselves are the ultimate beneficiaries of the privacy protections, but they have no direct rights under this instrument. They cannot sue for breach of condition; enforcement is left to the regulator.

Smaller entities face a disproportionately high compliance burden. The cross‑border transfer condition requires either an assessment of foreign privacy regimes or the negotiation of contractual arrangements with every recipient in a foreign country. For a small research firm that uses cloud storage hosted overseas, this could be costly to document and maintain. The obligation to remain legally responsible for the recipient’s use or disclosure (section 6(2)) means that liability cannot be contracted away. Similarly, the requirement to notify the ACMA and IPND Manager upon becoming aware of a breach by a person to whom the holder disclosed the information imposes a monitoring duty that may require ongoing due diligence beyond the initial disclosure.

Directory publishers bear additional costs. They must include a copyright statement in every published directory (section 11(3)), which is a minor burden but must be systemically applied. More significantly, they are limited to publishing only the directory finding name, directory address, and public number. This restricts their ability to offer value‑added services such as including business classifications, email addresses, or other metadata that might be commercially valuable. The concentration of data restrictions reduces the product differentiation that directory publishers can offer, potentially stifling competition.

Researchers face the tightest restrictions. They are prohibited from selling or providing customer data to any person unless authorised or required by law (section 12(5)). This means that even anonymised or aggregated research data that does not identify individuals cannot be transferred to a third party for a related research purpose unless there is a separate legal basis. This significantly limits the commercial exploitation of research results and may discourage private investment in research that relies on the IPND. It also creates a barrier to collaborative research with overseas partners, unless contractual arrangements and data destruction timelines are managed.

The instrument does not confer any rights on authorised holders. It imposes only duties (conditions). The central duties are as follows. The cross‑border transfer condition (section 6) imposes two sub‑duties: (a) a duty not to transfer protected information to a foreign recipient unless the holder reasonably believes the recipient is subject to a law or binding scheme that overall is at least substantially similar to the Australian Privacy Principles, or the holder has made contractual arrangements ensuring the information will not be held, used, or disclosed inconsistently with the Australian Privacy Principles; and (b) a duty to remain legally responsible for any use or disclosure by the recipient that is inconsistent with those Principles. The “remain legally responsible” duty is particularly onerous because it cannot be limited or excluded by contract. It effectively makes the holder a guarantor of the recipient’s conduct.

The safeguarding duty (section 7) requires reasonable steps to protect and secure protected information and any related personal information from misuse, loss, unauthorised access, modification, use, or disclosure. This is a high‑level obligation that imports the ordinary law of negligence by reference. There is no prescriptive list of security measures. The holder must determine what is “reasonable” in its circumstances, which invites regulatory second‑guessing if a breach occurs. The duty extends to “any personal information related to the protected information”, which could be broad - for example, internal notes linking a phone number to a research participant might be captured.

The breach notification duties are among the most significant. Section 8 requires the holder to notify the ACMA and the IPND Manager as soon as practicable after becoming aware of a “substantive or systemic breach of security” that could reasonably be regarded as having an adverse impact on the integrity and confidentiality of the information. This is a low threshold for reporting: any breach that could be more than trivial must be reported. The holder must also take reasonable steps to minimise the effects. Section 9 adds a second notification duty: the holder must notify the same recipients if it becomes aware that any person to whom the holder disclosed protected information has contravened legal restrictions on use or disclosure. This imposes a monitoring obligation on the holder to keep track of its data recipients’ compliance. In practice, the holder may need to include audit rights in its contracts with recipients.

The secure disposal duty (section 10) requires destruction within ten business days after the information is no longer required for the purpose for which it was disclosed, or after the authorisation ceases or is revoked, whichever is earlier. This means the holder must have a system to track the purpose for which each dataset was obtained and to proactively delete data when that purpose is exhausted. The duty does not permit retention for a longer period even if the holder believes the data may be useful for another lawful purpose; the condition ties destruction to the specific purpose of the disclosure.

For directory publishers, additional duties include: making contractual arrangements with contractors to restrict their use of protected information to the directory purpose; limiting published directory content to directory finding name, address, and public number; and including a copyright statement. For researchers, additional duties include: contractual restrictions on contractors; ensuring databases do not enable re‑identification by public number or address (subject to a postcode exception); using only the three directory fields when contacting customers; and prohibiting the sale or provision of customer data without legal authorisation. None of these duties confer corresponding rights on the holder; they are purely restrictive.

This determination does not itself create penalty provisions or prescribe monetary fines. Instead, the conditions it imposes are conditions of the authorisations granted under the IPND Scheme. If a holder fails to comply with any condition, the likely consequence is that the authorisation may be revoked or varied by the person who granted it (presumably the Minister or a delegate under the scheme). The Telecommunications Act 1997, which is the empowering Act, contains general enforcement mechanisms for contraventions of legislative instruments, including civil penalties and injunctions. Section 295P of the Act authorises the Minister to determine conditions, and a breach of a condition is a breach of the Act itself (since the determination is a legislative instrument made under the Act). The reader must therefore look to the Act for the specific penalty provisions that apply to the conduct prohibited by these conditions.

Relevantly, the Act provides for civil penalty provisions in Part 31. A contravention of a condition determined under section 295P could be a contravention of a civil penalty provision if the Act so designates it, or it could simply be a basis for the ACMA to issue a direction or apply to the Federal Court for an injunction. The determination does not specify that a breach is an offence or a civil penalty provision, so the default enforcement pathway would be through the scheme’s revocation powers and the ACMA’s general enforcement functions. The notification requirements to the ACMA in sections 8 and 9 ensure that the regulator will be promptly informed of non‑compliance, which increases the likelihood of enforcement action.

For a directory publisher or researcher, the most severe practical penalty is the loss of the authorisation. Without the authorisation, the entity cannot legally access or use protected information from the IPND. This is effectively a market exclusion measure. For a business that relies on that data as its core input, revocation can be fatal. The determination’s conditions therefore operate as high‑stakes compliance rules. The cross‑border transfer condition in particular, if breached, could lead to revocation even if the breach was technical and no harm occurred. The “remain legally responsible” duty in section 6(2) exposes the holder to liability for the recipient’s actions, meaning a breach by the foreign recipient is also a breach by the holder.

There is no internal dispute resolution mechanism in the determination. If the ACMA issues a direction or the Minister revokes an authorisation, the holder’s recourse would be to the Administrative Appeals Tribunal for merits review or to the Federal Court for judicial review. The costs of such proceedings are likely to be high relative to the value of the authorisation for a small operator. The instrument therefore creates a strong incentive for conservative compliance: rather than testing the boundaries of the “reasonably believes” standard or the “substantially similar” threshold, a prudent holder will err on the side of not transferring data overseas, thereby reducing the value of the data for legitimate purposes such as international research collaboration.

The instrument sits within a regulatory framework that includes the Telecommunications Act 1997, the Privacy Act 1988, and the IPND Scheme itself. It is expressly made under section 295P of the Telecommunications Act and must be read together with the scheme that it conditions. The IPND Scheme is the primary instrument that creates the authorisations; this determination merely attaches conditions to those authorisations. If the scheme is amended or replaced, this determination may need to be updated to remain consistent.

The Australian Privacy Principles (APPs) from the Privacy Act 1988 are referenced directly in the cross‑border transfer condition. Section 6(1)(a) requires the holder to reasonably believe that the foreign recipient is subject to a law or binding scheme that “overall, is at least substantially similar to the way in which the Australian Privacy Principles protect the information”. This imports an entire external regulatory regime into the condition. The holder must assess not only the content of foreign privacy laws but also their enforcement mechanisms and coverage. The Office of the Australian Information Commissioner’s guidance on the APPs may be relevant in making that assessment. If the foreign recipient is already bound by the APPs (for example, because it is an Australian entity that has an APP‑compliant privacy policy), that would likely satisfy the test.

The determination also refers to “legal restrictions” in section 9, which is a broad term encompassing any law that restricts use or disclosure of protected information. This could include the Telecommunications Act itself, the Privacy Act, and state privacy laws. The holder must monitor whether any recipient with whom it has shared protected information has contravened any such restrictions. This interdependence creates a compliance burden that goes beyond the determination: the holder must understand the legal restrictions applicable to each recipient.

The relationship with the IPND Scheme is critical. The scheme defines the purposes for which authorised persons may use and disclose protected information. Those purposes are referenced in the definitions of “public number directory authorisation” and “research authorisation”. The determination’s conditions do not expand or contract those purposes; they merely impose additional constraints on how the data may be handled. For example, a researcher is already limited by the scheme to research purposes, and the determination adds the condition that the researcher cannot sell customer data unless authorised by law. If a researcher wants to sell the data for a non‑research purpose, that would require separate legal authorisation (such as a court order) - the determination does not create such authorisation.

There is no direct interaction with the Telecommunications (Interception and Access) Act 1979 mentioned in the instrument, but that Act separately governs the use of telecommunications data for law enforcement and national security purposes. Entities that hold authorisations under the IPND Scheme may also be subject to obligations under that Act if they are also carriers or carriage service providers, but those obligations are distinct.

The instrument’s definition of “transfer” to a foreign country explicitly excludes temporary routing of data through overseas infrastructure en route to an Australian destination (see note to section 4). This attempts to avoid conflict with the practical realities of internet routing. However, if a holder uses cloud services hosted overseas, the data will be stored there, which is not mere routing - it is a transfer that triggers the condition. This interacts with the Privacy Act’s cross‑border disclosure provisions, which are similar but not identical. Compliance with the Privacy Act does not automatically mean compliance with this determination, as the determination imposes additional duties such as remaining legally responsible and the notification obligations.

The instrument was made on 18 July 2017 by the then Minister for Communications, Mitch Fifield, and commenced the day after registration. It is a legislative instrument under the Legislation Act 2003. Its only substantive amendment history is that it replaced the Telecommunications (Integrated Public Number Database Scheme - Conditions for Authorisations) Determination 2007 (No. 1), which is repealed in full by Schedule 1. That 2007 instrument was the first iteration of conditions under the IPND Scheme. The 2017 determination updated the conditions to align with current privacy expectations, particularly the cross‑border transfer condition and the notification requirements. No further amendments to this instrument have been identified in public records. The instrument has not been subject to sunsetting review (the normal ten‑year sunset period would fall in 2027) but may be amended or remade before then.

The repeal of the 2007 instrument means that any authorisation that was subject to the older conditions is now governed by the 2017 conditions. There is a transitional element: authorisations that were granted under the 2007 instrument are not automatically revoked; the new conditions attach to those authorisations upon commencement of the 2017 determination. The instrument does not contain a transitional provision specifying a grace period for compliance. In practice, both the ACMA and the IPND Manager are likely to allow a reasonable period for existing holders to adjust their processes, but the legal obligation commenced from the day after registration. This could create a situation where a holder was in technical breach of a new condition from the day it commenced, through no fault of its own, if it had not yet updated its cross‑border transfer contracts or its data destruction procedures. That risk is a classic compliance trap for existing holders.

The simplicity of the instrument - it has never been amended - suggests that the Department of Communications and the Arts may have considered the conditions stable. However, the absence of amendment could also reflect a lack of regulatory attention to an area that is not politically salient. The instrument’s continued operation depends on the IPND Scheme remaining in force. If the scheme is re‑made or amended significantly, this determination will need to be updated.

There is no reported litigation that directly interprets or applies this determination. The instrument is a legislative instrument that sets conditions; it has not been tested in court. The courts have considered related matters under the Telecommunications Act concerning the IPND scheme, such as challenges to access requests or privacy complaints, but no case law citing this specific determination is available in public legal databases. The absence of litigation may reflect the relatively limited number of authorised holders and the willingness of those holders to comply with conditions without legal challenge. Alternatively, it may indicate that the conditions are sufficiently clear that disputes have been resolved at the administrative level without reaching the courts.

If litigation were to arise, likely issues could include the interpretation of “substantively or systemic breach of security”, the scope of “reasonably believes” in the cross‑border transfer condition, or whether a particular database produced by a researcher prevents re‑identification (section 12(2)). The burden of proof in any enforcement action would be on the regulator (likely the ACMA) to show non‑compliance. The instrument does not create an express right of action for individuals whose privacy is affected; they would need to rely on other causes of action such as breach of confidence or statutory tort under the Privacy Act.

The most significant trap is the definition of “transfer” to a foreign country. The instrument says transfer occurs when the information becomes accessible to the intended recipient in a foreign country. This is broader than merely sending a file overseas. If a holder uses a cloud email service that stores messages on servers in the United States, or a customer relationship management system hosted in Ireland, protected information may become accessible to the foreign provider. Many cloud providers are not “recipients” in the sense of a named party but are service providers. The instrument’s condition applies to “someone who is in a foreign country”, which could include the cloud provider’s employees or systems administrators. The holder must assess whether that provider is subject to a law or binding scheme substantially similar to the APPs. In many jurisdictions, such as the United States, there is no comprehensive federal privacy law akin to the APPs. The holder would then need contractual arrangements, which may be difficult to negotiate with a large cloud provider on standard terms. The practical outcome is that many holders may be forced to keep all data within Australia to avoid triggering the condition, which increases costs and reduces flexibility.

Another trap is the ten‑business‑day disposal timeline. The holder must destroy protected information within ten business days of it “no longer being required for the purpose for which it was disclosed”. That is a judgment call. If the holder retains data because it may be needed for a related research project, it must be able to demonstrate that the data is still required for the original purpose. The subjective test creates risk: if the ACMA later determines the data was no longer required, the holder has breached the condition. There is no exemption for potential future litigation, data backup, or audit purposes. The duty is absolute, except that the word “securely destroy” may permit deletion in a manner that prevents reconstruction.

The researcher’s database conditions are deceptively simple. Subsection 12(2)(b) prohibits a database from enabling a person who only knows the whole or part of an end‑user’s address to readily identify the end‑user’s name and/or public number. “Readily identify” is not defined. If the database allows a person to combine the address with other publicly available information (such as the electoral roll) to find a phone number, is that “readily”? The condition focuses on the database’s functionality alone, but a creative plaintiff might argue that the database should be considered in the context of ordinary internet search capabilities. The postcode exception (subsection 12(3)) may inadvertently undermine the prohibition in small postcode areas. If a postcode contains only one household, a search by postcode effectively discloses the full address and number. The researcher still must not allow that, but the condition grants a specific permission - it is unclear whether this statutory permission overrides the general prohibition or must be read harmoniously.

The “reasonably believes” standard in the cross‑border condition is also a gotcha. It is an objective test: the holder’s belief must be reasonable. If a foreign jurisdiction’s privacy law is under review for reform, the holder may not be able to maintain a reasonable belief that it is substantially similar. The holder has an ongoing obligation, not a one‑off assessment. So if a foreign country weakens its privacy protections after the holder’s initial assessment, the holder must stop transferring data or change its contractual arrangements. This ongoing monitoring duty is not explicit in the condition but flows from the nature of the reasonable belief requirement.

The notification of breaches by others (section 9) imposes an obligation to notify the ACMA and IPND Manager as soon as practicable after becoming aware that a person to whom the holder has disclosed protected information has contravened legal restrictions. This means the holder must have systems to monitor its data recipients’ compliance. If a holder sends data to a research collaborator, and that collaborator later leaks the data, the holder must notify the regulator. The collaborator’s breach becomes the holder’s reporting obligation. Failure to notify is a separate breach of condition. The holder may not even be aware of the recipient’s contravention if the recipient does not self‑report. This places pressure on holders to negotiate audit or notification clauses in their downstream contracts.

The absolute prohibition on selling customer data (section 12(5)) for researchers will catch many commercial research outfits. Even selling aggregated, non‑identifying statistical outputs to a client could be seen as “provid[ing] customer data” if the output is derived from the IPND data. The only exception is if the provision is “authorised or required by or under law”. The researcher must identify a specific legal provision that authorises the sale. A general commercial purpose will not suffice. This effectively forces researchers to internalise all costs of data processing without the ability to recoup them through licensing.

Compliance begins with obtaining a valid authorisation under the IPND Scheme. No entity should access or use protected information without such an authorisation. Once authorised, the holder must embed the determination’s conditions into its operational policies, contracts with third parties, and data management systems. The key steps are as follows.

First, map all data flows involving protected information. Identify whether any data will be accessible to a person in a foreign country - including cloud service providers, subcontractors, or collaborative researchers. For each foreign recipient, assess whether that recipient is subject to a law or binding scheme that overall is at least substantially similar to the Australian Privacy Principles. This is a legal analysis that should be documented. If the assessment is negative, negotiate contractual arrangements with the recipient that prohibit any use or disclosure inconsistent with the APPs. The contract must also include a provision ensuring the holder remains legally responsible for the recipient’s non‑compliance (section 6(2) requires this, but the contract does not remove the holder’s liability - it merely imposes a contractual obligation on the recipient). The holder should also consider whether the foreign jurisdiction has mandatory data localisation laws that could conflict with the Australian conditions.

Second, implement reasonable security measures. While the instrument does not prescribe specific technologies, the steps must be proportionate to the sensitivity of the data and the size of the holder. Typical measures include encryption at rest and in transit, access controls (role‑based, with logging and auditing), staff training on privacy and security obligations, and physical security for any premises where data is stored. The holder should document these measures in a written information security policy that is reviewed regularly.

Third, establish procedures for breach detection and notification. The holder must be able to identify a “substantive or systemic breach of security” as soon as possible. This requires a breach response plan that includes a defined escalation path, a communication protocol to notify the ACMA and the IPND Manager, and a remedial action plan. The plan should also cover notification under section 9 - the holder must have a mechanism to receive reports from its data recipients about any contraventions of legal restrictions. This could be achieved by requiring recipients to notify the holder of any breach or compliance failure within a short timeframe. The holder should also conduct periodic audits of recipient’s compliance.

Fourth, manage data lifecycle and destruction. The holder must track the purpose for which each dataset was obtained. When that purpose is exhausted, the holder must securely destroy the protected information within ten business days. This requires a data inventory with retention deadlines. The destruction method should render the data unrecoverable (e.g., cryptographic erasure for digital data, shredding for paper). The holder should also have a procedure for when an authorisation ceases or is revoked - immediate destruction is required, not after the ten‑day period runs.

Fifth, for directory publishers, only include the three permitted fields (directory finding name, address, public number) in any published directory. Insert a copyright notice as specified. Include contractual restrictions on any contractor that receives protected information, and ensure those contracts are enforceable.

Sixth, for researchers, design databases to prevent re‑identification by public number or address. De‑identification techniques such as aggregation, perturbation, or hashing may be used, but must be tested. The postcode exception can be used but with caution; if a postcode area contains very few individuals, the exception may not be safe. Researchers must also restrict customer contacts to the directory fields, and never sell or provide customer data to any person unless they have identified a specific legal authorisation for that transfer. Regular legal advice should be sought before any disclosure.

Seventh, maintain records of all compliance steps: assessments of foreign regimes, executed contracts, security policies, breach notifications, destruction logs, and any legal advice obtained. These records will be critical if the ACMA investigates a potential breach.

Finally, keep the authorisation itself in good standing. The conditions are ongoing; if the holder merges with another entity or changes its data handling practices, it must reassess compliance. The holder should also monitor any amendments to the determination or the IPND Scheme and adjust its practices accordingly.