Even with massive amounts being spent by the government to assist telecommunications companies with the costs of retaining metadata - a measure the government sees as a vital part of its efforts to strengthen intelligence capabilities and counter extremist messaging - it seems inevitable that internet costs will increase as a result of the implementation of metadata retention. Increased cost not only from the extra effort and expense that will be required to retain data for the two year period but also from what is likely to be an increasing range of legal cases arising out of privacy based issues and access to information litigation.
Budget Allocation for Metadata Not Enough
In its recent Budget the federal government announced that a further $131 million had been set aside for the purpose of assisting telecommunications companies with implementation of metadata retention. The Prime Minister is quoted as saying:
"The $131 million would assist the telecommunications industry to upgrade its systems to implement this policy, . . . The package will include $22 million to combat terrorist propaganda and counter violent extremism".
However, the amount provided for in the Budget of $131 million seems to be at odds with the $400 million being quoted by the government before the Budget as being required to implement the scheme. As the Financial Review points out:
"But the compensation might not be enough to appease business, given Mr Abbott said before the budget that the tougher new laws, which require telcos to hold on to metadata for much longer than they do now, would cost $400 million to implement".
As website Cyber Shack points out the money allocated to telecommunications companies is even at odds with PWCs' determination (which it prepared for the Attorney-General’s department). They determined that the upfront capital cost of the scheme to the telecommunications industry was as an estimate between $188.8 million and $319.1 million. Amounts far greater than the $131 million allocated for the metadata retention scheme in the Budget. Thus as Cyber Shack says:
"As a result, telecommunication industry bodies have raised concerns that the difference will be added to subscribers' monthly bills."
Criticism of the government's original estimates of cost has been that they were not based on widespread industry consultation. Cyber Shack quotes Laurie Patton, CEO of the Internet Society of Australia, as follows:
"The Internet Society is concerned that the costs have been significantly underestimated."
Further, there is a call from bodies like the Internet Society for the government to commit to top up significant shortfalls once final costs have been determined, otherwise the ISPs and telecommunications companies will have to ". . . underwrite the difference and this will be passed on to consumers through increased Internet fees."
Litigation Likely to Follow and Add to Cost
In the recent determination of Privacy Commissioner, Timothy Pilgrim in Ben Grubb and Telstra Corporation Limited [2015] AICmr 35 (1 May 2015) Telstra is reported as having said Commissioner Pilgrim's determination may force it ". . . to hand over more data than it is required to store under the mandatory data-retention law".
The basics of the matter are that two years ago, Fairfax journalist Ben Grubb had sought access to his own metadata relating to a mobile service he had with Telstra. The metadata he sought included matters such as which cell tower he was at at any given time, the phone numbers of both incoming and outgoing calls, and all SMS data.
In response Telstra indicated it could provide outbound call details and data usage session records, however, privacy laws precluded it from providing location and inbound call details.
As a result a complaint was made to the Privacy Commission which on 1 May 2015 ordered Telstra provide the data requested, namely; IP addresses, URL information, and cell tower information, but excluding the numbers for incoming calls. Further, Telstra was ordered to provide the data free of charge.
Telstra's reaction to the decision through the company's Chief Risk Officer Kate Hughes is reported by ZDNet as being:
"We already provide access to personal information, but this decision could extend this practice to every single piece of data in our networks, regardless of whether the data reveals the identity or anything else about someone, . . ."
ZDNet reports that Telstra intends take the matter further, something which if it proceeds will be of great interest to those concerned with the cost effects on an internet subscription of data retention laws.
The decision has been described as regulator over-reach by the Communications Alliance, the peak representative body for telecommunications companies.
In a report by ZDNet the Communications Alliance is quoted as follows:
"Applying the declaration that all metadata is personal information would layer additional costs and complexity on telecommunications service providers, without any tangible benefit in terms of protecting privacy, . . . Asserting that every single trace of network data - no matter how obscure, unintelligible, or remote it is, or whether it reveals anything about a person at all - is captured under the Privacy Act is impractical, unnecessary, and will be very costly for industry to manage. This is a stark example of regulatory over-reach."
Another result of the decision could be to force telecommunications companies to have to hand even more data to law enforcement agencies. This is because many elements of the information required by the Privacy Commissioner to be given to Mr Grubb the journalist in question were not provided to law enforcement and national security agencies currently because such data is very difficult to extract. However, if the trend is having to provide this much broader range of data to customers, then as the Communications Alliance indicates ". . . it is likely only a matter of time before [law enforcement] agencies will start asking for it as well."
Increased Cost is Certain
When the data retention laws were before Parliament for public discussion it was revealed that Telstra, for example, would need to draw data from more than a dozen different systems to one central system to comply with the mandatory scheme and that the company has already implemented a scheme where customers can apply to get their own limited amount of metadata for a fee starting at $25. Thus it seems that already data retention is costing consumers of Internet services and is only likely to cost them more, a lot more going forward.
