Telstra to allow customers to access their own metadata

Australia's largest telco will allow its customers to access the 'metadata' they generate. Telstra said this morning that its customers will get the same access to their personal data that law enforcement organisations can get from the telco.

The move follows an announcement by the government that it will amend its data retention bill to allow individuals to access the information that will be stored for two-years under the scheme.

The parliamentary inquiry into the Telecommunications (Interception and Access) Amendment (Data Retention) Bill 2014 said that the government should amend the bill "to make clear that individuals have the right to access their personal telecommunications data retained by a service provider under the data retention regime".

"Telecommunications service providers should be able to recover their costs in providing such access, consistent with the model applying under their Privacy Act in respect of giving access to personal information," stated the report, which was released last week.

"We believe that if the police can ask for information relating to you, you should be able to as well," Telstra's chief risk officer, Kate Hughes, wrote on the telco's Exchange blog.

"We already make a lot of data available to customers, such as call records and service details, through our bills and Telstra MyAccount," Hughes wrote.

"We will build on this with our new principle of offering the same access to a customer’s own metadata as we are required to offer to law enforcement agencies."

From 1 April this year Telstra's customers will be able to request more data about their accounts.

Ben Grubb, Fairfax's deputy tech editor, has engaged in a protracted battle to access the metadata held by Telstra linked to his account.

In refusing him access to his metadata, Telstra argued that to do so would be too expensive and difficult.

"Requests for data beyond what is available on MyAccount will be subject to a cost recovery fee when a request is actioned," Hughes wrote in her blog entry.

"This fee will depend on how far back into Telstra records you request."

Simple requests are likely to cost $25. More complex requests will be billed at an hourly rate.

The report of the data retention inquiry recommended that the cost recovery measures under the Privacy Act 1988 should apply to individuals who wish to access their metadata.

In the 12 months to 30 June 2014, Telstra received close to 85,000 requests from government agencies for customer information, the telco revealed in a transparency report published last year.

Of these, the overwhelming majority were warrant-less requests for customer metadata.

"Providing this information to customers is not the same as providing information to authorised enforcement agencies and would involve additional costs, for example in verifying a customer’s identity and redacting information on incoming calls to protect the privacy of other individuals," a submission (PDF) from Telstra to the data retention inquiry said.

"There is a fundamental difference between responding to a reasonably precise and limited request from agencies for information to dealing with blanket requests for all personal information about an individual."

Hughes' blog entry said that the telco would provide a customer only with information associated with his or her account. So for example, it would exclude the number of a person who called the customer at a particular time.

Follow Rohan on Twitter: @rohan_p