The Australian Communications and Media Authority (ACMA) has found Telstra Limited (Telstra) breached conditions of its carrier licence on more than 163,000 occasions after the details of over 140,000 telco customers who had requested unlisted numbers were made available to the public.
An ACMA investigation found Telstra published 24,005 unlisted numbers, sometimes referred to as 'silent numbers', with corresponding customer names and addresses in the White Pages.
Telstra also included 139,402 unlisted numbers with customer details in its directory assistance database, which is used by Telstra operators when answering calls from customers for services such as Call Connect and Directory Assistance.
Most of the incidents occurred between 2021 and 2022. Some customers had their unlisted numbers and details included in both the White Pages and the directory assistance database.
ACMA member and consumer lead Samantha Yorke said when someone requests an unlisted or silent number it can be for any number of reasons, including concerns for their privacy or safety.
"While we are not aware of any harm to people as a result of these breaches, Telstra failing to safeguard customer information, putting people's privacy and safety at risk, is a serious matter," Ms Yorke said.
"Telstra is entrusted with personal details of millions of Australians and those people have the right to expect that Telstra has robust systems and processes in place to ensure their information is being protected."
Telstra reported the incidents to the ACMA after it discovered system issues and process failures had resulted in the release of the unlisted numbers.
In response to the breaches, the ACMA has given Telstra a remedial direction requiring it to take actions to support compliance with obligations not to disclose or use information related to unlisted numbers.
Telstra has been directed to reconcile its customer data with its White Pages and directory assistance database listings every 6 months, implement a training program for staff, and have its systems and compliance procedures independently audited.
The remedial direction will remain in force until Telstra implements recommendations identified by the audit to ensure the effectiveness of its systems, processes and practices.
If Telstra breaches the direction the ACMA may commence civil penalty proceedings in the Federal Court where Telstra could face pecuniary penalties of up to $10 million per contravention.
