paccnd1.html Chapter 1 See index.html for links to the other parts of this report.
http://www.firstpr.com.au/telco/cnd/
- Robin Whittle rw@firstpr.com.au 26 August 1997
EXECUTIVE SUMMARY
This report outlines the findings of the AUSTEL Privacy Advisory Committee
(PAC) on the Calling Line Identification (CLI) based telecommunications
service known as Calling Number Display (CND). CND is a service which delivers
to subscribers or "receivers" of CND, the telephone number, and
sometimes other related information, of the telephone service of the caller,
in this report referred to as the "sender".
CND services have been available in some overseas countries for up to
six years. They can provide subscribers with a range of useful functions
and enhancements which enable organisational and residential consumers
to better manage their incoming telephone traffic. Research indicates that
CND services are considered to be useful and desirable services, even amongst
consumers who do not subscribe to these services.
However, because CND services are based on providing the CLI of senders
to CND receivers, CND services can have serious privacy implications. CND
changes the relationship between calling and called parties, as, with the
introduction of the service, callers will be required to take positive
action on the occasions they wish to withhold the number of the phone service
from which they are calling. The automatic provision of this information
has the potential to identify callers before they have identified themselves,
and to remove the control they have previously had over the disclosure
of their information to others.
The privacy implications of CND for senders fall broadly into two categories.
The first is the level of control CND senders have over the automatic provision
of their number to receivers, and whether this information is provided
on the basis of informed choice. The second major privacy implication arises
from the uses to which CND information may be put by receivers, particularly
organisational and business receivers, who have the capacity to capture
and possibly manipulate CND generated information.
1. SUMMARY OF RECOMMENDATIONS
In line with its terms of reference (Attachment I) the PAC has developed
three sets of voluntary self regulatory guidelines for the protection of
customer privacy in an opt out CND environment. The guidelines provide
a comprehensive framework for the provision of CND services which reflects
the privacy expectations of Australians. In conjunction with this they
reflect one of the highest levels of consumer privacy protection for CND
services in the world.
The guidelines address privacy protection in the internationally accepted
key areas of:
They establish clear, common privacy criteria on which new CND services
can be offered, and are broad and technologically neutral to facilitate
the scope and flexibility of future service innovation. This will enable
both consumers and industry to have a firm baseline of privacy expectations
and guarantees on which new services can be built.
The following recommendations are incorporated by the guidelines:
The introduction of CND must be considered in the context of the post
July 1997 telecommunications regulatory regime. While it is anticipated
that the existing carriers will progressively introduce CND services over
the next few years, there is likely to be in the future a range of carriers
and service providers offering CND services, and telecommunications will
potentially be transmitted from calling to called parties over several
networks. As far as possible the guidelines have been developed to address
the establishment of a standard across different networks.
Regulatory solutions in a multi carrier and multi service provider environment
need to establish a basis for common procedures throughout the industry,
and common understanding by consumers. The guidelines attempt to enhance
seamless delivery of CND services to ensure the integrity of the communication
of consumer privacy preferences and to increase the privacy effectiveness
of the service.
1.1 Principles and requirements for the provision of Calling Number
Display services (CND) in Australia (Attachment A)
The Principles and requirements address the key privacy issues
raised by CND. The privacy protection standards established by the CND
Principles and requirements represent the highest internationally
recognised consumer protections for the privacy regulation of CND services.
The standards established for CND services are based on the principle of
informed choice, and are designed to balance the interests of both CND
senders and receivers. The Principles and requirements will enable
CND services to function effectively by providing receivers with a high
number of identifiable calls, while providing CND senders with an internationally
accepted range of privacy protection options.
It is proposed that CND be introduced to Australia on an opt out basis.
As a result telecommunications consumers who do not exercise a choice to
withhold their CLI will default to sending their CLI each time they make
a telephone call. However, it is recognised that the introduction of new
technologies and services should not result in consumers being required
to pay to maintain a level of privacy which existed before the new service
was available. As a result there will be no charge for consumers maintaining
their current level of privacy, and the choice to withhold transmission
of CLI will be provided free of charge. The withholding of CLI may be implemented
either on all calls made from a telephone service (line blocking), or for
the duration of single calls (per call blocking). Consumers with line blocking
will also be able to send their CLI for the duration of a single call free
of charge (per call sending).
The Principles and requirements provide for consumers to be able
to exercise informed choice concerning their participation in CND services
by requiring a comprehensive Public Education Campaign about CND before
its introduction to a given market.
The Principles and requirements also recognise the prima facie
privacy requirement of existing silent line customers, and provide designated
arrangements for existing silent line customers in the transition to opt
out CND services. Existing silent line customers will be automatically
provided with line blocking and per call sending at the introduction of
CND services, and will have the opportunity to change to sending their
CLI with per call blocking when changing their service options with their
direct connect carrier or service provider.
The guidelines require that the privacy protection preferences of customers
must be transmitted between interconnected networks of carriers and service
providers. In a multiple carrier and service provider environment, it is
clear that not all carriers and service providers will provide CND to their
directly connected customers at the same time and that they will compete
with each other on the type and pricing of CND products. While this requirement
for interconnectivity between networks is primarily to maintain the integrity
of the customers' privacy preferences, it is not intended to be an impediment
to competition because of poor co-operation. Thus, in making CND services
available, carriers and service providers will need mechanisms to respond
to other network operators' requests for interoperability in a timely way.
1.2 Calling Number Display (CND) Public Education Campaign Guidelines
(Attachment B)
Public Education Campaigns will play a key role in informing consumers
of both the privacy implications and the available privacy protection options
in the supply of CND services. The CND Public Education Campaign is a precondition
for the provision of CND services. Telephone services must not be able
to send CND unless the consumers who use them have been targeted by a CND
Public Education Campaign and the specified levels of consumer awareness
have been achieved. Campaigns will be resourced, developed and conducted
by the carriers and service providers offering CND services. The Campaign
guidelines address the obligations of carriers and service providers in
structuring campaigns which will provide adequate opportunity for consumers
to understand the privacy implications of CND services for their telephone
usage and the particular level of privacy they require.
The guidelines accommodate the progressive introduction of CND services,
and accordingly are intended to apply to the provision of CND services
in a range of market contexts. Campaign success criteria have been set
at a level of 80 per cent awareness amongst consumers of the key campaign
aims. The methods employed to achieve the awareness success criteria will
vary depending on the size and geographic spread of the consumer group
being targeted by the campaign.
For this reason, the guidelines do not prescribe any particular media
for the promulgation of CND Public Education Campaigns, as the development
of appropriate campaigns will be specific to the nature and scale of the
product being introduced. In the case of CND services introduced to a niche
market, such as exchanging CND between the customers of a single mobile
carrier, carriers and service providers may be able to reach campaign aims
by using direct mailing techniques. In the case of CND services introduced
to the fixed network on a broad metropolitan or regional basis, the use
of mass media would clearly be required.
1.3 Guidelines for the use of CND information (Attachment
C)
The Prime Minister's Innovations Statement of 6 December has flagged
the introduction of generic privacy protection legislation covering information
on individuals held within the private sector in Australia. Although this
legislation is likely to provide for the uses of CND generated information,
in the interim there is no privacy protection for this information. The
Guidelines will provide a voluntary and self regulatory framework for establishing
privacy protection protocols for ethical organisations for the uses of
CND generated information, and may also provide a framework for future
enforceable privacy protection standards.
CND offers benefits to businesses and other organisations by providing
customer personal information relating to incoming calls. This information
can be used to enhance customer services. However the receipt of CLI by
organisational consumers raises privacy protection issues, in particular
because of the potential for secondary uses involving the unconsenting
use, manipulation, and disclosure of personal information. The provision
of CND services places an onus on organisational receivers to employ ethical
privacy protection protocols for the secondary use of customer personal
information.
The Guidelines provide acceptable standards for CLI privacy protection,
within the existing Australian legislative framework. They are based on
internationally accepted privacy protection principles. It is recognised
that government agencies and either commercial or non commercial organisations
may record and use CLI derived from customers' phone calls to the organisation,
and as a result the Guidelines are designed for use by all organisations.
The Guidelines also provide practical models for organisations to notify
consumers of the organisation's use of CLI information.
2. MINISTER'S REFERENCE TO THE AUSTEL PRIVACY ADVISORY COMMITTEE
On 15 September 1994 the Minister for Communications and the Arts, the
Hon Michael Lee MP, wrote to AUSTEL requesting a Privacy Advisory Committee
be formed. The Minister requested AUSTEL provide advice on a number of
privacy issues of particular concern, including CND, as a matter of priority.
In relation to CND he noted:
I am advised by Telecom that the CND trial in Wauchope was conducted
with full community consultation and that it was generally well received.
However, I would expect any widespread introduction of CND to be accompanied
by appropriate industry guidelines to ensure that consumers are able to
exercise informed choice.
3. THE AUSTEL PRIVACY ADVISORY COMMITTEE'S (PAC) CONSIDERATION OF
THE ISSUES
The PAC was established to advise AUSTEL, under section 53 of the Telecommunications
Act 1991. Consistent with the Minister's reference, the PAC has developed
guidelines addressing the offering of CND services in accordance with its
terms of reference:
... to identify general privacy principles applicable to the telecommunications industry and to develop specific guidelines where necessary ...
[and]
... to make recommendations concerning appropriate privacy principles,
including the principle of "informed choice", about the introduction
of new technologies and specifically the use and re-use of personal data.
In 1992 AUSTEL conducted a public enquiry into the privacy implications
of telecommunications services, including CND. Public submissions were
invited and received, and the resulting report, Telecommunications Privacy
(December 1992), devoted a chapter to issues raised by public submissions
on CND.
The deliberations of the PAC took account of international developments
in privacy protections for CND services, and expert opinion on specific
communications and technical issues. The Committee was also able to examine
in detail the evidence of the Telstra CND trial in Wauchope in northern
New South Wales, conducted during 1994, and to compare the results of this
trial with the findings of international studies on consumer attitudes
to CND.
The Wauchope trial research report is valuable, as it is the only available
evidence of the consumer experience of CND in Australian conditions. The
trial provided the Committee with evidence of the operation of CND, the
effectiveness of CND public awareness campaigns, and consumer privacy experiences
and expectations. Several member organisations of the PAC, including AUSTEL,
were involved in a consultative capacity advising on the trial structure
and conduct through the Wauchope CND Trial Consultative Committee.
Early in its consideration of CND, the Committee received a presentation
from Denny Sterley, of Sterley and Associates, the communications consultant
to the Wauchope trial. The Committee has had the opportunity on three separate
occasions to consult in detail with Denny Sterley on the Wauchope community's
attitude to CND and privacy, on the effectiveness of the communications
strategies used in the trial's public awareness campaign, and on the development
of guidelines for the implementation of future CND Public Education Campaigns.
The Committee also attended a demonstration of CND equipment and a range
of CLI based services at the Melbourne offices of Nortel.
In order to more intensively address the issues, the Committee formed
a CND working group, comprising AUSTEL, the carriers, the Privacy Commissioner
and the consumer representative nominated by the Federal Minister for Consumer
Affairs. The working group concentrated on developing guidelines reflecting
the best of international regulation for the protection of consumer privacy
in the provision of CND services, and met on average every three weeks.
CND has been available in a range of European countries and North America
for up to six years. In North American jurisdictions in particular, the
introduction of CND services was associated with considerable controversy,
largely because of inadequate consideration of the privacy interests of
CND senders. In the period since introduction, privacy protections in North
America have become more widely available and more accessible. In developing
an appropriate privacy protection strategy for Australia, the PAC has had
the opportunity to examine and take account of the experiences of other
jurisdictions. International regulatory solutions to privacy protections
have provided valuable models for introducing CND services to Australia
in a way which will balance the benefits of the service to receivers with
the reasonable privacy expectations of all telecommunications consumers.
The group considered in detail the issues of:
customers; and
The group also considered some CND issues which are indirectly related
to privacy, including the consistency of CND blocking codes, the seamless
operation of CND services across telecommunications technologies and carrier
networks, and the ranges of available customer equipment. The Committee
was concerned that consumers should be able to exercise privacy options
simply, reliably and effectively, that the integrity of the communication
of consumers' privacy choices between interconnected carriers be ensured,
and that carriers and service providers provide options for receiving CND
and related services which meet a range of consumer privacy needs. These
issues are fundamental to both the ease of understanding and the ease of
use of CND privacy protection options by consumers, enabling them to better
and more easily exercise informed choice in determining an appropriate
level of privacy protection.
In line with the Minister's reference, the AUSTEL Privacy Advisory Committee
decided in the first instance to limit its examination of CLI based services
to CND. It should be noted therefore that this report has considered only
narrowband services on existing PSTN and ISDN networks. It has not considered
CLI uses in the broadband environment where customers are likely to increasingly
use interactive services, rather than just carriage services. These services
may give rise to different commercial and privacy imperatives which will
require additional consideration as broadband networks evolve to enable
such applications.
The AUSTEL Privacy Advisory Committee has reserved the right to review
the privacy implications of new CLI based services before they are introduced
to Australia.