Rural Connectivity Study: ComCom planning to compel ISP's to hand over personally identifiable data

Forums › ICT Policies and Regulation › Rural Connectivity Study: ComCom planning to compel ISP's to hand over personally identifiable data

Beccara

1469 posts

Uber Geek

ID Verified

#306051 23-Jun-2023 19:57

Thru contacts within the industry I have become aware that with this years annual industry survey they are intending to add in a bunch of data requests for the Rural Connectivity Study, the draft document is with ISP's at the moment.

Of concern is that are intending to compel ISP's to hand over identifiable data in the form of your address/location coordinates along with the data usage from the past 2 years, how many minutes you've spent on the phone, if you are a business or residential client along with a bunch of other data:

The "location information" they are talking about is:

When providing location of end-user, cabinet etc. please supply the following:
• x-y coordinates; or
• land parcel ID; or
• a full address which can be matched to the LINZ NZ addresses database

Personally I find this concerning that the data they are asking for is quite exact and not anonymized in any way. It's not clear that ComCom are intending to delete the data at the end of the study and yes this is a draft that they are seeking ISP feedback on but I still find it a bit of an overstep to not even ask for this in format that offers at least a little bit of privacy like clustering users into the NZ Stats meshblocks or suburb level group.

So far from what I've heard any push back on this has resulted in mentions that ComCom can legally compel ISP's for the data if ComCom thinks they need it for their study

Most problems are the result of previous solutions...

All comment's I make are my own personal opinion and do not in any way, shape or form reflect the views of current or former employers unless specifically stated

Jase2985

13457 posts

Uber Geek

ID Verified

Lifetime subscriber

#3094233 23-Jun-2023 20:08

but without that piece of information how relevent is the rest of the data?

it helps with future planning of infrastructure both fixed line and wireless.

Beccara

1469 posts

Uber Geek

ID Verified

#3094234 23-Jun-2023 20:14

Why do they need to know the exact physical location of the service? You can cluster/clump data into mesh blocks and get the same result: "We have 10 connections in this meshblock, 5 x on $Y/mth etc etc". Don't need to know that you're in the $99/mth plan and the person next door is on the $69/mt and they are on phone for 4 hours per month on average

nzkc

1571 posts

Uber Geek

#3094235 23-Jun-2023 20:17

Beccara:

Why do they need to know the exact physical location of the service? You can cluster/clump data into mesh blocks and get the same result: "We have 10 connections in this meshblock, 5 x on $Y/mth etc etc". Don't need to know that you're in the $99/mth plan and the person next door is on the $69/mt and they are on phone for 4 hours per month on average

100% this! No need to get every address at all.

PolicyGuy

1726 posts

Uber Geek

ID Verified

Lifetime subscriber

#3094236 23-Jun-2023 20:18

IANAL but it seems to me that providing that data (PII) to ComCom would put the RSP in breach of the Privacy Act - it would be using the PII for purposes other than those for which the data owner (customer) provided it to the RSP.
In that case, I doubt that ComCom could compel the RSP to provide it.

I suggest you should raise the matter with the Privacy Commission

Beccara

1469 posts

Uber Geek

ID Verified

#3105487 18-Jul-2023 12:18

Following up on this, ComCom look to be hellbent on going ahead with this at this level of detail. Any step back from GPS/Address level resolution will prevent them doing their study apparently

So in the end, all your traffic habits, plan selections, addresses will be hoovered up and stored on https://www.box.com/ with https://www.snowflake.com/en/ building their reports and it's going to be retained by them for an unknown period of time. Any ISP who doesn't comply is up for a $300k fine

SirHumphreyAppleby

2844 posts

Uber Geek

#3105502 18-Jul-2023 12:51

Beccara:

Any ISP who doesn't comply is up for a $300k fine

My old IP address had a GeoIP location of Mt Eden Prison... clearly, someone had a sense of humour. Will that satisfy them?

Is it just one $300k fine per year for not complying? If I were running one of the larger ISPs, I'd just take the hit and not send them any information at all. That'd bugger up their data more than not having GPS/address information.

Beccara

1469 posts

Uber Geek

ID Verified

#3105508 18-Jul-2023 13:15

SirHumphreyAppleby:

My old IP address had a GeoIP location of Mt Eden Prison... clearly, someone had a sense of humour. Will that satisfy them?

Is it just one $300k fine per year for not complying? If I were running one of the larger ISPs, I'd just take the hit and not send them any information at all. That'd bugger up their data more than not having GPS/address information.

Nope they want the service address or barring that GPS. No idea about the fines, I'm not sure any of the big 3 will want to annoy ComCom like this and impact their chances of RBI3/4/5+ funds

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

PolicyGuy

1726 posts

Uber Geek

ID Verified

Lifetime subscriber

#3105605 18-Jul-2023 15:59

SirHumphreyAppleby:

Beccara:

Any ISP who doesn't comply is up for a $300k fine

Is it just one $300k fine per year for not complying? If I were running one of the larger ISPs, I'd just take the hit and not send them any information at all. That'd bugger up their data more than not having GPS/address information.

They won't do that.

They might (and in my view ought to) apply to the High Court for a Judicial Review of ComCom's decision.
At the very least, that would delay the whole thing by many months, and give time for political pressure to be brought to bear

boosacnoodle

963 posts

Ultimate Geek

#3105717 18-Jul-2023 19:58

PolicyGuy:

IANAL but it seems to me that providing that data (PII) to ComCom would put the RSP in breach of the Privacy Act - it would be using the PII for purposes other than those for which the data owner (customer) provided it to the RSP.
In that case, I doubt that ComCom could compel the RSP to provide it.

I suggest you should raise the matter with the Privacy Commission

Not sure I would immediately agree. ComCom can conduct all kinds of studies under the Act that enables that organisation which requires telcos to supply data.