Communications privacy complaints process unacceptable: UNSW

The Australian communications sector’s complaints process has been deemed “unacceptable” in a report compiled by the Cyberspace Law and Policy Centre from the University of NSW.

The Communications privacy complaints report, funded by the Australian Communications Consumer Action Network (ACCAN), noted that complaints were a “vital” element in privacy protection.

It found the three commonly used complaint paths for privacy complaints in the communications sector, the Office of the Privacy Commissioner (OPC), the Australian Communications and Media Authority (ACMA), and the Telecommunications Industry Ombudsman (TIO), do not manage complaints effectively and are not delivering efficient regulation of privacy complaints.

According to a statement from the ACCAN, the ACMA will, on average, resolve a privacy complaint in five days, the TIO in ten days, while the OPC takes an average of six months.

“This situation is unacceptable and is not delivering efficient or effective regulation of privacy complaints in the sector,” the report reads. “It is not the result of a careful or planned policy decision to treat communications privacy complaints in this way.

“It is the result of ad hoc complaints processes, overlaps in jurisdiction, and the individual culture and approach of the three complaints bodies.”

According to the report, all three receive hundreds of privacy complaints each year from consumers, approximately 21,000, although the complaints are not distributed evenly.

The ACMA receives approximately 16,000 (mostly spam, general privacy complaints and “Do Not Call” complaints), the TIO about 5000 (general privacy complaints and internet related complaints) and the OPC, only about 110 complaints (general privacy complaints, telemarketing and internet complaints).

“In some respects the three complaints bodies treat the management of communications sector privacy complaints as if the three regulators were acting as a single entity,” the report reads. “For example, a complaint to one regulator may preclude the individual from complaining to any of the other complaints bodies, yet there is only a system of informal referrals between them.”

However, in many ways, the three bodies act independently, demonstrating different approaches to managing complaints.

The study found inconsistency between resolution times and processing issues and noted a significant disparity exists, for example, in the complaint resolution times between the OPC and the other complaints bodies.

The report also noted that the OPC, has to date, never named a telecommunications organisation that has breached privacy.

Spokesperson from the Cyberspace Law & Policy Centre, Chris Connolly, said the absence of high profile or high impact enforcement action by the OPC means businesses do not feel the pressure to comply with privacy laws or to respond to complaints promptly.

“The OPC take an average of six months to resolve complaints; far longer than the ACMA and TIO,” Connelly said in a statement. “It is surprising following such long investigations the OPC seems unwilling to name and shame telecommunications organisations that breach consumers’ privacy.”

ACCAN, chief executive, Teresa Corbin, said there is a need for better coordination between the bodies and that in an ideal regulatory environment, all three should be able to offer consumers the same outcomes.

“It shouldn’t matter where consumers lodge their complaints, everyone with a serious privacy issue should have access to the same remedies – whether they be an apology, compensation, correction or removal of personal data, a change in individual company’s business practices or industry as a whole for systemic issues,” Corbin said in a statement.

“At the moment there is no clear path for consumers to take and the end result is confusion among consumers and a lack of accountability for the industry.”

The report highlights a number of improvements to be made to the privacy complaints process, including complaints resolution times accompanied by truthful and consistent information, specifically by the OPC, better coordination between the three organisations, clear and consistent messages to complainants about where to complain and to industry on compliance.

It also suggests a range of regulatory tools should be used to ensure than any privacy complaint in the communications sector lodged with any complaints body should be able to achieve, compensation and an apology to the individual, instant removal of personal data, changes to business practices of the company, changes to broader industry practices for systemic issues, the occasional naming of companies as a warning for other consumers and occasional enforcement action to promote compliance.