Telecommunications Amendment (Disclosure of Information for the Purpose of Cyber Security) Regulations 2022
Amendments to the Telecommuncations Regulations have been made that allow telecommunications carriers and carriage services providers to disclose certain customer data in limited circumstances have been registered. This follows the Government's announcement last week of their intention to make these regulations. These amendments come into effect on 12 October 2022.
The regulations permit carriers and carriage service providers to securely disclose government identifiers such as:
- drivers licence and
- passport numbers and,
- other information that relates to identification, if specified by the Minister
to financial services entities (such as Australian banks and superannuation funds) and government agencies. Other related financial services entities or supporting bodies (such as fund administrators) can be approved by the Minister.
As noted in the Explanatory Statement :
- 'This could include entities that are trusted portals for exchanging information that would receive data from the carrier or carriage service provider, and then provide other financial services entities with access to this data directed at a sole permitted purpose.'
Financial services entities will be required to provide the ACCC with written commitments confirming they will comply with a series of steps outlined in the regulations regarding access, use and storage of the data in compliance with the Privacy Act 1988 and Principles.
In addition, APRA-regulated financial services entities, such as super funds, will also be required to provide APRA with an attestation signed by an authorised officer, confirming they are complying with Prudential Standard CPS 234 – Information Security.
Where the Minister grants access to other related financial services entities or supporting bodies, the information security credentials of that financial services entity would be considered by the Minister, based on advice from relevant government agencies.
The changes that allow this data to be shared are temporary and the amendments will be automatically repealed 12 months after they come into effect (that is they will be repealed on 12 October 2023).