NSW bus Wi-Fi privacy, regulation: 'Move along, nothing to see here'
Vulture South isn't so sure
On Monday, we noted the privacy nightmare that is the NSW State Government's latest attempt at public transport Wi-Fi, and asked APN Outdoor, owner of Catch, questions about security and its regulatory status.
Our questions have travelled around a bit, to finally get a response from the State Transit Authority. Its stance? Everything's just fine, folks. Nothing to see here - and it believes it doesn't need TIO membership.
On the matter of how APN Outdoor intends to secure the trove of personal data it may (or may not) collect, we're assured that:
APN Outdoor uses a combination of technical solutions, security controls and internal processes to help protect information and their network from unauthorised access and disclosure. Security measures are in place to protect against the loss, misuse and alteration of Personal Information under the control of APN Outdoor.
This doesn't define what measures are in place, nor is Vulture South certain why the State Transit Authority is answering on behalf of its contractors.
Our other question was whether Catch Oz or APN Outdoor are complying with the law, in offering Internet services without membership of the Telecommunications Industry Ombudsman scheme. Here's the State Transit Authority response:
The Telecommunications Industry Ombudsman (TIO) scheme is directed at Carrier Service Providers that supply services to residential and SME customers.
APN Outdoor has complaint measures in place for this trial via the CATCH product and the microsite. If APN Outdoor decide to scale this project in the future, they will be assessing and looking at all suitable complaint procedures, including joining the TIO scheme.
The Register remembers the requirement differently, so we looked up the Telecommunications (Consumer Protection and Service Standards) Act 1999. That law says all “eligible” carriers and service providers have to join the TIO scheme, and here's how it defines eligibility:
For the purposes of this Part, an eligible carriage service provider is:
- (a) a carriage service provider who supplies:
- (i) a standard telephone service, where any of the customers are residential customers or small business customers; or
- (ii) a public mobile telecommunications service; or
- (iii) a carriage service that enables end-users to access the internet; or
- (b) a carriage service intermediary who arranges for the supply of a service referred to in subparagraph (a)(i), (ii) or (iii).
It sounds to The Register like Catch is either enabling end-user access to the Internet, or that it's reselling access (acting as an intermediary).
A TIO spokesperson told Vulture South exemptions to membership exist in some circumstances, “taking in to account the extent to which the carrier or provider deals with residential customers in relation to the supply of carriage services; the extent to which the carrier or provider deals with proprietors of small businesses in relation to the supply of carriage services; and the potential for complaints under the Telecommunications Industry Ombudsman scheme about services supplied by the carrier or provider”.
Those exemptions are determined not by the TIO, but by the Australian Communications and Media Authority (ACMA), so Vulture South has asked the authority about the operation of exemptions.
A spokesperson said: "We consider exemption applications received from service providers on a case by case basis, having regard to the criteria set out in the legislation", and directed Vulture South to the legislation quoted above.
The ACMA maintains an exemption register, and it's clear that exemptions aren't handed out willy-nilly to public hotspot operators.
Rather, the companies on the register of exemptions are infrastructure owners and wholesalers who don't deal with the public at all.
In the absence of a specific exemption, then, it seems clear that to offer Internet access, Catch will have to join the TIO. ®