Feeds

Vodafone Aus off the hook, kind of

A 50-50 verdict from Privacy Commissioner

The essential guide to IT transformation

The Australian Privacy Commissioner has delivered a 50-50 verdict in his report on breaches of customer privacy in Vodafone’s computer system.

On the one hand, the allegation that data on “four million Vodafone customers including their billing and call records were uploaded onto a publicly accessible website” has been found to be unsubstantiated.

That allegation appears, in part, to have arisen from stories such as this, in which a dealer (with legitimate access to the system) showed a journalist what information was held in the company’s Siebel CRM system.

As Privacy Commissioner Tim Pilgrim states in his report, since “an organisation will not be disclosing information, where they are giving an individual access to information the organisation holds about them”, there was no breach of privacy according to National Privacy Principle (NPP) 2.1 (which covers the disclosure of personal information).

More seriously, however, the commissioner has decided that Vodafone’s security was not adequate to protect customer data according to another NPP. NPP 4.1 requires companies to protect personal information against misuse.

The commissioner singled out the use of shared logins for branded retailers’ stores as in breach of this principle. A single login for a store, instead of individual logins for each staff member, reduced the effectiveness of audit trails, the commissioner said, and exposed customer information to misuses such as identity fraud.

Vodafone has also undertaken to improve its security, reassess the level of access required by users, and end the use of shared logins.

As for login IDs, passwords and customer data – all of which, at some point in the story, were reported as being available “on the internet” – the Privacy Commissioner has said there was “no evidence that this information was available on the internet or Vodafone’s website”. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
6 Obvious Reasons Why Facebook Will Ban This Article (Thank God)
Clampdown on clickbait ... and El Reg is OK with this
Kaspersky backpedals on 'done nothing wrong, nothing to fear' blather
Founder (and internet passport fan) now says privacy is precious
TROLL SLAYER Google grabs $1.3 MEEELLION in patent counter-suit
Chocolate Factory hits back at firm for suing customers
Facebook, Google and Instagram 'worse than drugs' says Miley Cyrus
Italian boffins agree with popette's theory that haters are the real wrecking balls
Mozilla's 'Tiles' ads debut in new Firefox nightlies
You can try turning them off and on again
Sit tight, fanbois. Apple's '$400' wearable release slips into early 2015
Sources: time to put in plenty of clock-watching for' iWatch
Facebook to let stalkers unearth buried posts with mobe search
Prepare to HAUNT your pal's back catalogue
Ex-IBM CEO John Akers dies at 79
An era disrupted by the advent of the PC
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.