Part 6—System security, record keeping and privacy

23 Requirement to keep records

A telecommunications provider must keep records to demonstrate its compliance with this industry standard. Where a telecommunications provider keeps records under subsection (1) it must take all reasonable steps in the circumstances:

Note: to protect any such record from misuse, interference and loss and from unauthorised access, modification or disclosure; and

Note: to ensure that any such record is destroyed or otherwise disposed of in a secure manner where the record is no longer required to be retained under this industry standard or any other applicable law.

24 Record retention

Note: A telecommunications provider must:

Note: retain any record required to be kept under subsection 23(1) for 2 years from the date of creating the record; and

Note: make any such record available to the ACMA within 5 business days after receiving a written request from the ACMA.

25 System security

A participating telecommunications provider must take all reasonable steps to ensure that its information technology systems and processes relating to the sending of sender identification messages and its interactions with the Register are secure.
Where a participating telecommunications provider becomes aware of a breach or suspected breach of the security of any of its information technology systems or processes referred to in subsection (1), it must notify the ACMA, as soon as practicable, of what has occurred and what steps have been taken to rectify the matter.

26 Privacy

Note: Where a participating telecommunications provider is not subject to the requirements of the Privacy Act 1988, it must ensure that personal information it collects for a particular purpose in connection with this industry standard:

is not used or disclosed for some other purpose except:

as required to manage a complaint made by the person to whom the information relates; or with the express consent of the person to whom the information relates; or where the use or disclosure is required or authorised by or under an Australian law or a court or tribunal order; and

is destroyed or otherwise disposed of in a secure manner where it is no longer required to be retained under this industry standard or any other applicable law.

Note: Where a provider is subject to the Privacy Act 1988, Australian Privacy Principle 6 in Schedule 1 to that Act will apply to the use or disclosure of personal information it collects in connection with this industry standard.