The Times Australia
The Times World News

.
The Times Real Estate

.

Optus says it needed to keep identity data for six years. But did it really?

  • Written by Brendan Walker-Munro, Senior Research Fellow, The University of Queensland
The Australian government's MyGov website was hacked in 2020.

Among the many questions raised by the Optus data leak – cybersecurity experts are confident it wasn’t a hack, but that may have to be decided by a court – is why the company was storing so much personal information for so long.

Optus had a legitimate need[1] to collect that data – to verify customers were real people and potentially to recover any debts later. This is known as a “know your customer[2]” (or “KYC”) requirement.

But the reason about 4 million former customers[3] along with 5.8 million current customers are now worrying about their driver’s licences, passport numbers and Medicare numbers ending up in the hands of criminals[4] is due to Optus hanging on to it for six years.

Optus has said[5] it is legally required to do so.

It is required by the Telecommunications Consumer Protections Code[6], the industry code of practice overseen by the Australian Communications and Media Authority, to provide customers (or former customers) billing information for “up to six years prior to the date the information is requested”.

But your name, address and account reference number should be all it needs for this, not your passport, driver’s licence or Medicare details. If it needs to confirm your identity it could simply ask for documents again.

The only clear legal requirement for it to keep “information for identification purposes” comes from the Telecommunications (Interception and Access) Act 1979[7], which requires that identification information and metadata be kept for two years (to assist law enforcement and intelligence agencies).

Read more: What does the Optus data breach mean for you and how can you protect yourself? A step-by-step guide[8]

Is there any limit?

The big problem with Australia’s data retention laws is that there’s really no limit on how long a company can keep personal data.

The federal Privacy Act[9] says only that information must be destroyed “where the entity no longer needs the information for any purpose for which the information may be used or disclosed by the entity”.

That’s a loose requirement. A company could theoretically argue it “needs” to keep customer information for anything – such as defending against a civil claim in court, as part of its corporate records, or for marketing. This is especially the case when we have consented to those uses when we sign up for the services, another practice the Privacy Act allows.

This is a serious weakness with our privacy laws. Consumer data is big business. Companies are collecting – and keeping – much more personal information than they need without a truly legitimate commercial or legal purpose.

I call this trend “hyper-collection”. It’s turning companies into goldfields for hackers. Once personal information is stolen there is often little authorities can do[10].

Read more: What do TikTok, Bunnings, eBay and Netflix have in common? They’re all hyper-collectors[11]

It’s time to get serious about data privacy

Australia needs to get more serious about unnecessary data collection and retention. As technology gets more interwoven into our daily lives, protecting personal data presents massive challenges.

The need for vigilance should have been made clear to the federal government in 2020, when its own myGov website was hacked[12].

The usernames and passwords of thousands of accounts were made available for sale on the dark web. Anyone buying those details would have had access to Medicare, Centrelink, National Disability Insurance Scheme and tax office records.

The Australian government's MyGov website was hacked in 2020.
The Australian government’s MyGov website was hacked in 2020. Shutterstock

Privacy laws are too weak both in obligations and penalties. The fines for “serious interference with privacy” are $444,000 for individuals and $2.2 million for companies – hardly enough for a corporation the size of Optus to sit up and take notice. Nor do they offer comfort to those affected.

Legislative action is needed to clarify what information companies can collect, how they can collect it, and what they can do with it.

Read more: The 'Optus hacker' claims they've deleted the data. Here's what experts want you to know[13]

Opportunities for action

There are two obvious opportunities for the federal government to act.

The first is in its response to recommendations arising from the Attorney-General’s Department’s long-running review of the Privacy Act[14] (which has yet to deliver its final report). Ironically Optus made a submission to the review that actually suggested weakening privacy protections[15].

The second is what it does with the National Data Security Action Plan[16] being developed by the Department of Home Affairs.

The intention of this plan appears to be to treat data as a national asset. If so, it should strengthen policy and legislation around security, ensure Australians know their rights and responsibilities, and ensure consistent responses to cybercrime.

We need to scrutinise every company – not just Optus, and not just after the fact – and ask questions about their data collection. Why do they need to know things? What information are they keeping, how long for and why?

Without action, the next breach at this kind is a matter of when, not if.

We asked Optus to clarify the reasons it needs to keep identification data for six years but received no response.

References

  1. ^ legitimate need (www.sbs.com.au)
  2. ^ know your customer (www.austrac.gov.au)
  3. ^ 4 million former customers (www.news.com.au)
  4. ^ the hands of criminals (www.sbs.com.au)
  5. ^ has said (www.theguardian.com)
  6. ^ Telecommunications Consumer Protections Code (www.commsalliance.com.au)
  7. ^ Telecommunications (Interception and Access) Act 1979 (www.oaic.gov.au)
  8. ^ What does the Optus data breach mean for you and how can you protect yourself? A step-by-step guide (theconversation.com)
  9. ^ Privacy Act (www.oaic.gov.au)
  10. ^ little authorities can do (www.afr.com)
  11. ^ What do TikTok, Bunnings, eBay and Netflix have in common? They’re all hyper-collectors (theconversation.com)
  12. ^ myGov website was hacked (www.afr.com)
  13. ^ The 'Optus hacker' claims they've deleted the data. Here's what experts want you to know (theconversation.com)
  14. ^ Privacy Act (www.ag.gov.au)
  15. ^ suggested weakening privacy protections (www.ag.gov.au)
  16. ^ National Data Security Action Plan (www.homeaffairs.gov.au)

Read more https://theconversation.com/optus-says-it-needed-to-keep-identity-data-for-six-years-but-did-it-really-191498

The Times Features

Itinerary to Maximize Your Two-Week Adventure in Vietnam and Cambodia

Two weeks may not seem like much, but it’s just the right time for travelers to explore the best of Vietnam and Cambodia. From the bustling streets of Hanoi to the magnificent te...

How to Protect Your Garden Trees from Wind Damage in Australia

In Australia's expansive landscape, garden trees hold noteworthy significance. They not only enhance the aesthetic appeal of our homes but also play an integral role in the local...

Brisbane Homeowners Warned: Non-Compliant Flexible Hoses Pose High Flood Risk

As a homeowner in Brisbane, when you think of the potential for flood damage to your home, you probably think of weather events. But you should know that there may be a tickin...

Argan Oil-Infused Moroccanoil Shampoo: Nourish and Revitalize Your Hair

Are you ready to transform your hair from dull and lifeless to vibrant and full of life? Look no further than the luxurious embrace of Argan Oil-Infused Moroccanoil Shampoo! In a...

Building A Strong Foundation For Any Structure

Building a home or commercial building can be very exciting. The possibilities are endless and the future is interesting. You can always change aspects of the building to meet the ...

The Role of a Family Dentist: Why Every Household Needs One

source A family dentist isn’t like your regular dentist who may specialise in a particular age group and whom you visit only when something goes wrong. A family dentist takes proa...

Times Magazine

"Eternal Nurture" by Cara Barilla: A Timeless Collection of Wisdom and Healing

Renowned Sydney-born author and educator Cara Barilla has released her latest book, Eternal Nurture, a profound collection of inspirational quotes designed to support mindfulness, emotional healing, and personal growth. With a deep commitment to ...

How AI-Driven SEO Enhancements Can Improve Headless CMS Content Visibility

Whereas SEO (search engine optimization) is critical in the digital landscape for making connections to content, much of it is still done manually keyword research, metatags, final tweaks at publication requiring a human element that takes extensiv...

Crypto Expert John Fenga Reveals How Blockchain is Revolutionising Charity

One of the most persistent challenges in the charity sector is trust. Donors often wonder whether their contributions are being used effectively or if overhead costs consume a significant portion. Traditional fundraising methods can be opaque, with...

Navigating Parenting Arrangements in Australia: A Legal Guide for Parents

Understanding Parenting Arrangements in Australia. Child custody disputes are often one of the most emotionally charged aspects of separation or divorce. Parents naturally want what is best for their children, but the legal process of determining ...

Blocky Adventures: A Minecraft Movie Celebration for Your Wrist

The Minecraft movie is almost here—and it’s time to get excited! With the film set to hit theaters on April 4, 2025, fans have a brand-new reason to celebrate. To honor the upcoming blockbuster, watchfaces.co has released a special Minecraft-inspir...

The Ultimate Guide to Apple Watch Faces & Trending Wallpapers

In today’s digital world, personalization is everything. Your smartwatch isn’t just a timepiece—it’s an extension of your style. Thanks to innovative third-party developers, customizing your Apple Watch has reached new heights with stunning designs...

LayBy Shopping