Changes to protect consumers following Optus data breach

The Albanese Government has prepared amendments to the Telecommunications Regulations 2021 to better protect Australians following the Optus data breach.

The Government will recommend to the Governor-General that the regulations be amended to allow Optus and other telcos to better coordinate with financial institutions, the Commonwealth, and states and territories, to detect and mitigate the risks of cyber security incidents, frauds, scams and other malicious cyber activities.

The amendments will enable telecommunications companies to temporarily share approved government identifier information (such as drivers licence, Medicare and passport numbers of affected customers) with regulated financial services entities to allow them to implement enhanced monitoring and safeguards for customers affected by the data breach.

In addition, Optus will be able to share identifiers to assist Commonwealth, and state and territory agencies, to detect and assist in preventing fraud.

The proposed regulations have been carefully designed with strong privacy and security safeguards to ensure that only limited information can be made available for certain purposes. Specifically:

• The regulations cover financial institutions that are regulated by APRA, excluding branches of foreign banks
• The Communications Minister has the ability to specify additional services entities, if required, but only for entities that are related to or support an APRA-regulated entity
• Information can only be used for the sole purposes of preventing or responding to cyber security incidents, fraud, scam activity or identify theft
• Entities that wish to receive the data must provide written commitments to the ACCC that they will comply with their obligations under the Privacy Act 1998, attest to APRA that they meet the relevant information security standard, and confirm in writing that the information they are seeking is necessary and proportionate
• Approved recipients must satisfy robust information security requirements and protocols for any transfer and storage of data
• Information received must be destroyed once it is no longer required.

The proposed changes will also allow for increased fraud detection in the broader financial services sector through existing industry mechanisms to report fraudulent transactions, such as fraud information exchanges.

In addition, the Council of Financial Regulators’ cybersecurity working group will examine and report on options to further improve the ability of financial institutions to identify at risk customers and credentials by utilising an existing secure and privacy protecting data sharing platform, to enable financial institutions to further enhance their protections for consumers from financial crime.

In developing this approach, the Government has undertaken extensive consultation across Commonwealth agencies, financial system regulators, Optus, the banking sector, major telecommunications providers, and the Australian Information Commissioner.

The financial regulators have taken additional steps to protect customers, including through the ACCC’s ScamWatch, and direct engagement with financial institutions.

Financial institutions have also been proactive in response to the data breach, including through implementing heightened controls on those accounts identified as at higher risk.

Quotes attributable to the Treasurer, the Hon Dr Jim Chalmers MP:

"Our Government has been working in lockstep with banks and financial regulators to facilitate the safe and secure sharing of data between Optus and regulated financial institutions, with appropriate safeguards, to improve consumer protection."

"Financial institutions can play an important role in targeting their efforts towards protecting customers at greatest risk of fraudulent activity and scams in the wake of the recent Optus breach. These new measures will assist in protecting customers from scams, and in system-wide fraud detection."

Quotes attributable to the Minister for Communications, the Hon Michelle Rowland MP:

"The Albanese Government takes seriously the protection of personal information. The proposed regulations have been carefully designed with strong privacy and security safeguards to ensure that only limited information can be made available for designated purposes."

"This will enable Optus, the financial services sector and relevant agencies to work together more effectively, to implement enhanced monitoring and safeguards to protect customers affected by the breach."