Telecommunications Integrated Public Number Database Scheme 2017 The Australian Communications and Media Authority makes the following scheme under section 295A of the Telecommunications Act 1997. Dated: 20 March 2017 Richard Bean [signed] Member James Cameron [signed] Member/General Manager Australian Communications and Media Authority Contents Part 1 Preliminary 1.1 Name 1.2 Commencement 1.3 Authority 1.4 Definitions 1.5 References to other instruments Part 2 Application of the scheme 2.1 Application 2.2 Object of the scheme Part 3 Authorisation to use and disclose customer data – public number directory publishers Division 1 Application of Part 3 3.1 Application Division 2 Provisional authorisation Subdivision A Application for provisional authorisation 3.2 Making an application 3.3 Decision on application 3.4 Duration of provisional authorisation 3.5 Conditions to which provisional authorisation is subject Subdivision B Application for extension of duration of provisional authorisation 3.6 Making an application 3.7 Decision on application 3.8 Start of extended duration of provisional authorisation Division 3 Final authorisation Subdivision A Application for final authorisation 3.9 Making an application 3.10 Decision on application 3.11 Start of final authorisation 3.12 Conditions to which final authorisation is subject Subdivision B Application for extension of period for publishing PND 3.13 Making an application 3.14 Decision on application 3.15 Start of extended period in which to publish PND Part 4 Authorisation to use and disclose customer data — research entities Division 1 Application of Part 4 4.1 Application Division 2 Research authorisation Subdivision A Application for research authorisation 4.2 Making an application 4.3 Decision on application 4.4 Duration of research authorisation 4.5 Conditions to which research authorisation is subject Subdivision B Application for extension of duration of research authorisation 4.6 Making an application 4.7 Decision on application 4.8 Start of extended duration of research authorisation Subdivision C Review of research authorisation that has effect on ongoing basis 4.9 Review at least every 2 years Part 5 End of authorisations Division 1 Public number directory publishers 5.1 End of provisional authorisation or final authorisation – revocation 5.2 Further application to use and disclose customer data if authorisation is revoked 5.3 End of final authorisation – other Division 2 Research entities 5.4 End of research authorisation – revocation 5.5 Further application to use and disclose customer data if authorisation is revoked 5.6 End of research authorisation – other Part 6 Savings and transitional arrangements 6.1 Application of Part 6 6.2 Previous authorisation continues in force 6.3 Other matters Part 1 Preliminary 1.1 Name This is the Telecommunications Integrated Public Number Database Scheme 2017. 1.2 Commencement This scheme commences on the later of: (a) the day after this scheme is registered on the Federal Register of Legislation; (b) the day on which the Telecommunications Integrated Public Number Database Scheme 2007 (F2007L00813) is repealed. Note 1: The Federal Register of Legislation may be accessed at www.legislation.gov.au. Note 2: The Telecommunications Integrated Public Number Database Scheme 2007 is due to be automatically repealed by section 50 of the Legislation Act 2003 on 1 April 2017. Note 3: Both of the events mentioned in section 1.2 must occur before this scheme commences. 1.3 Authority This scheme is made under section 295A of the Telecommunications Act 1997. 1.4 Definitions In this scheme: Act means the Telecommunications Act 1997. business day means a day that is not a Saturday, a Sunday or a public holiday in the place concerned. customer means a person who is supplied with a carriage service by a carriage service provider. customer data means the following data: (a) for a listed entry, originating from the IPND, about a customer or a customer's business: (i) the public number of the customer or business; (ii) the name of the customer or business; (iii) the directory finding name of the customer or business (if relevant); (iv) the directory address of the customer or business; (v) if it is known whether the relevant carriage service being supplied to the customer on the public number is to be used for a government, business, charitable or residential purpose — the relevant purpose; (vi) if the customer has been offered a suppressed address entry — whether the customer has requested that entry; (b) for a listed entry, originating from the IPND, about a customer or a customer's business that becomes an unlisted entry: (i) the public number of the customer or business; (ii) a flag indicating that the entry has become unlisted. directory address means the information contained in the designated directory address fields in the IPND. directory finding name means the information contained in the designated finding name fields in the IPND. fields of customer data means the fields of data for a listed entry, originating from the IPND, about a customer or a customer's business, covered by subparagraphs (a)(i) to (vi) of the definition of customer data in this section. Example: A customer's name and public number, for a listed entry originating from the IPND, are two fields of customer data. final authorisation means an authorisation granted under subsection 3.10(4) for the use and disclosure of customer data (other than information relating to an unlisted number) for purposes connected with the publication and maintenance of a PND. Information Commissioner has the same meaning as in the Australian Information Commissioner Act 2010. interference with the privacy of an individual has the same meaning as in the Privacy Act 1988. IPND is short for integrated public number database. IPND Manager means the person who for the time being maintains the IPND. listed entry means an entry in the IPND relating to a listed number. listed number means a public number other than an unlisted number. member of a representative body means a person: (a) who is a member of the body; and (b) whose name is entered in the register of members kept in accordance with the constitution of the body; and (c) who uses, or wishes to use, customer data to conduct research. personal information has the same meaning as in the Privacy Act 1988. personnel: (a) of a public number directory publisher means any employee or contractor of the publisher involved in assisting with the development of a sample PND or the publication and maintenance of a PND; or (b) of a research entity means any employee or contractor of the entity involved in the conduct of research of a kind to which the research authorisation held by the entity applies; or (c) of a member of a research representative body means any employee or contractor of the member involved in the conduct of research of a kind to which the authorisation held by the body applies. PND is short for public number directory. provisional authorisation means an authorisation granted under subsection 3.3(4) for the use and disclosure of customer data (other than information relating to an unlisted number) in a provisional IPND data source for purposes connected with the development of a sample PND. provisional IPND data source means a restricted version of customer data that is supplied by the IPND Manager to a holder of a provisional authorisation. public number directory publisher means a holder of: (a) a provisional authorisation; or (b) a final authorisation. relevant requirements, in relation to a holder of an authorisation granted under this scheme, means the following: (a) the requirements of the Act, and of any legislative instruments made under the Act (including this scheme), that apply to the holder; (b) any conditions of the authorisation. Note 1: The conditions of the authorisation are: (a) any applicable conditions specified by the Minister in a legislative instrument under section 295P of the Act; (b) the applicable conditions specified in this scheme; and (c) any applicable conditions specified by the ACMA under a provision of this scheme. Section 295R of the Act creates an offence for breaching a condition of an authorisation. Note 2: At the commencement of this scheme, the Telecommunications (Integrated Public Number Database Scheme – Conditions for Authorisations) Determination 2007 (No. 1) is the only legislative instrument in force under section 295P of the Act. representative body means: (a) the Association of Market and Social Research Organisations in Australia (AMSRO) Incorporated (VIC A0026832C); or (b) the Australian Market and Social Research Society Ltd (ACN 002 882 635); or (c) any other body: (i) that represents the interests of research organisations or professionals; and (ii) whose membership is limited principally to such organisations or professionals; and (iii) that is declared in writing by the ACMA to be a representative body for the purposes of this scheme. required arrangements means the arrangements required under paragraph 4.5(4)(b). research means research of a kind specified by the Minister in a legislative instrument under subsection 285(3) of the Act. Note: At the commencement of this scheme, the Telecommunications (Integrated Public Number Database – Permitted Research Purposes) Instrument 2007 (No. 1) is the only legislative instrument in force under subsection 285(3) of the Act. research authorisation means an authorisation granted under subsection 4.3(4) to use and disclose customer data (other than information relating to an unlisted number) for purposes connected with the conduct of research. research entity means a holder of a research authorisation, and includes a research representative body. research representative body means a representative body which holds a research authorisation to use, and disclose to its members, customer data (other than information relating to an unlisted number) for purposes connected with the conduct of research. suppressed address entry means an entry in customer data that indicates that a customer has requested that the customer's directory address be flagged as suppressed. unlisted entry means an entry in the IPND relating to an unlisted number. unlisted number means a public number of one of the following kinds: (a) a mobile number, unless the customer and the carriage service provider that provides the mobile service to the customer agree that the number will be listed; (b) a number that the customer and the carriage service provider that provides services for originating or terminating carriage services to the customer agree will not be included in a PND; (c) the number of a public payphone; (d) a number that, when dialled, gives access to a private telephone exchange extension that the customer has requested not be included in a PND; (e) any other number that may be treated as an unlisted number as a result of a change to a law. Note: A number of other expressions used in this instrument are defined in the Act, including: (a) ACMA (see section 7); (b) carriage service (see section 7); (c) carriage service provider (see sections 7 and 87); (d) integrated public number database (see subsection 285(2)); (e) public number (see subsection 285(2)); (f) public number directory (see subsection 285(2)). 1.5 References to other instruments In this instrument, unless the contrary intention appears: (a) a reference to any other legislative instrument is a reference to that other legislative instrument as in force from time to time; and (b) a reference to any other kind of instrument is a reference to that other instrument as in force from time to time. Note 1: For references to Commonwealth Acts, see section 10 of the Acts Interpretation Act 1901; and see also subsection 13(1) of the Legislation Act 2003 for the application of the Acts Interpretation Act 1901 to legislative instruments. Note 2: All Commonwealth Acts and legislative instruments are registered on the Federal Register of Legislation. Part 2 Application of the scheme 2.1 Application This scheme applies to: (a) a person seeking to be granted an authorisation for the purposes of paragraph 285(1A)(d) of the Act; and (b) a holder of an authorisation for the purposes of paragraph 285(1A)(d) of the Act. 2.2 Object of the scheme The object of this scheme is to provide for: (a) the grant of authorisations for the purposes of paragraph 285(1A)(d) of the Act; and (b) the imposition of conditions on the grant of authorisations in accordance with section 295F of the Act; and (c) the variation and revocation of authorisations in accordance with section 295G of the Act. Part 3 Authorisation to use and disclose customer data – public number directory publishers Division 1 Application of Part 3 3.1 Application This Part applies to: (a) a person seeking to be granted an authorisation to use and disclose customer data to publish and maintain a PND; and (b) a public number directory publisher. Division 2 Provisional authorisation Subdivision A Application for provisional authorisation 3.2 Making an application (1) If a person wishes to use and disclose customer data to publish and maintain a PND, the person must apply to the ACMA for the grant of a provisional authorisation. Note: If the person is granted a provisional authorisation, the person may subsequently apply to the ACMA for the grant of a final authorisation. (2) The application must be made using the form approved by the ACMA. Note: The application form is available on the ACMA's website at www.acma.gov.au. (3) The application must be accompanied by: (a) the charge (if any) for the application fixed by a determination under section 60 of the Australian Communications and Media Authority Act 2005; and (b) a completed privacy impact assessment using the form approved by the ACMA. Note: The approved privacy impact assessment form is available on the ACMA's website at www.acma.gov.au. 3.3 Decision on application (1) The ACMA may ask a person (the applicant) in writing to give it further information about an application made under section 3.2. (2) If the ACMA asks for further information under subsection (1), the applicant must give the information to the ACMA within 90 days. (3) If the ACMA asks for further information under subsection (1) but does not receive the information within 90 days, the ACMA may treat the application as withdrawn. (4) The ACMA must, unless the application is withdrawn, decide whether to grant a provisional authorisation. (5) The ACMA must grant a provisional authorisation under subsection (4) if the ACMA: (a) has applied the criteria specified by the Minister in a legislative instrument under subsection 295N(1) of the Act; and (b) has had regard to any other matters that the ACMA considers relevant; and (c) is reasonably satisfied that the applicant has demonstrated that: (i) the proposed PND will satisfy the requirements of the definition of public number directory in subsection 285(2) of the Act, as modified by any legislative instrument that the Minister may make under subsection 285(4), (5) or (6) of the Act; and (ii) the applicant is likely to comply with the other relevant requirements. Note: At the commencement of this scheme: (a) the Telecommunications (Integrated Public Number Database Scheme – Criteria for Deciding Authorisation Applications) Instrument 2007 (No. 1) is the only legislative instrument in force under subsection 295N(1) of the Act; (b) the Telecommunications (Integrated Public Number Database – Public Number Directory Additional Information) Instrument 2007 (No.1) is the only legislative instrument in force under subsection 285(4) of the Act; (c) the Telecommunications (Integrated Public Number Database – Public Number Directory Requirements) Instrument 2007 (No. 1) is the only legislative instrument in force under subsection 285(5) of the Act; and (d) there is no legislative instrument in force under subsection 285(6) of the Act. (6) The ACMA must, as soon as practicable after making the decision: (a) notify the applicant in writing of: (i) the decision; and (ii) for a refusal to grant a provisional authorisation — the reasons for the decision; and (b) for a decision to grant a provisional authorisation — notify the IPND Manager in writing of the decision. Note 1: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. Note 2: If the ACMA grants a provisional authorisation to the applicant, the applicant is treated in this scheme as being a public number directory publisher. (7) If paragraph (6)(b) applies, the ACMA must, as soon as practicable after the IPND Manager has been notified of the decision, give the public number directory publisher written confirmation of that fact. 3.4 Duration of provisional authorisation A provisional authorisation: (a) starts on the day on which the IPND Manager supplies the provisional IPND data source to the public number directory publisher; and (b) has effect for a period of 90 days. Note: The duration of a provisional authorisation may be extended in accordance with Subdivision B and subsection 3.9(3), and may be ended earlier in accordance with Part 5. 3.5 Conditions to which provisional authorisation is subject (1) A provisional authorisation is subject to the conditions specified in this section. Supply of provisional IPND data source (2) The public number directory publisher: (a) must make arrangements with the IPND Manager for the supply of a provisional IPND data source as soon as practicable after receiving written confirmation from the ACMA under subsection 3.3(7); and (b) must notify the ACMA in writing of the date on which the publisher receives the provisional IPND data source within 10 business days after the start of the provisional authorisation. Development of sample PND (3) The public number directory publisher must develop a sample PND within a period of 90 days starting on the day on which the provisional authorisation starts. (4) The public number directory publisher must not publish a sample PND. Note: The public number directory publisher will, however, be able to use the architecture of a sample PND that it has developed as the basis for a PND that the publisher may publish if the ACMA grants a final authorisation. Disclosure of information held in provisional IPND data source or sample PND (5) The public number directory publisher must not disclose information held in a provisional IPND data source or a sample PND to any person other than: (a) the ACMA; or (b) the publisher's personnel; unless the disclosure is authorised or required by or under law. Use of customer data in provisional IPND data source (6) The public number directory publisher must not use the customer data in a provisional IPND data source for any purpose other than the development of a sample PND. Other conditions (7) The ACMA: (a) may specify in writing other conditions to which the provisional authorisation is subject; and (b) may vary or remove any condition so specified (specified condition); and (c) must notify the public number directory publisher in writing of any specified condition, or of any variation or removal of such a condition, as soon as practicable, and before the condition, or the variation or removal, is expressed to take effect; and (d) must notify the IPND Manager in writing of any specified condition, or of any variation or removal of such a condition, that is relevant to its role as IPND Manager. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. Compliance with relevant requirements (8) The public number directory publisher must comply with the relevant requirements. (9) The public number directory publisher must take all reasonable steps to ensure that any person who is one of its personnel: (a) is made aware of the publisher's obligations to meet the relevant requirements; and (b) cooperates with the publisher in meeting the relevant requirements; and (c) notifies the publisher in writing as soon as practicable after becoming aware that the person has done, or omitted to do, something that would have breached a relevant requirement if the person had been a public number directory publisher. (10) If the public number directory publisher becomes aware that: (a) the publisher has breached any relevant requirement; or (b) a person who is one of its personnel has done, or omitted to do, something that would have breached a relevant requirement if the person had been a public number directory publisher; the publisher must, as soon as practicable: (c) notify the ACMA in writing of the issue; and (d) take all reasonable steps to minimise the effects of the issue. Subdivision B Application for extension of duration of provisional authorisation 3.6 Making an application (1) A public number directory publisher may apply to the ACMA to extend the duration of a provisional authorisation if the publisher is unable to complete a sample PND before the end of the authorisation for a reason beyond the publisher's control. (2) The application must be made: (a) before the provisional authorisation ends; and (b) using the form approved by the ACMA. Note: The application form is available on the ACMA's website at www.acma.gov.au. (3) If: (a) a public number directory publisher applies to the ACMA to extend the duration of a provisional authorisation; and (b) immediately before the authorisation is due to end: (i) the application is not withdrawn; and (ii) the ACMA has not made a decision under subsection 3.7(4) whether to extend the duration; the duration is taken to be extended until: (c) if subsection 3.7(3) applies – the tenth business day mentioned in that subsection; or (d) the day on which the ACMA makes a decision under subsection 3.7(4). 3.7 Decision on application (1) The ACMA may ask a public number directory publisher in writing to give it further information about an application made under section 3.6. (2) If the ACMA asks for further information under subsection (1), the public number directory publisher must give the information to the ACMA within 10 business days. (3) If the ACMA asks for further information under subsection (1) but does not receive the information within 10 business days, the ACMA may treat the application as withdrawn. (4) The ACMA must, unless the application is withdrawn, decide whether to extend the duration of the provisional authorisation: (a) as soon as practicable after receiving the application; or (b) if the ACMA has asked for further information under subsection (1) – as soon as practicable after receiving the information. (5) The ACMA must extend the duration of the provisional authorisation under subsection (4) if it is satisfied that: (a) the reason why a sample PND is unable to be completed before the end of the authorisation is beyond the public number directory publisher's control; and (b) the publisher has complied, and is likely to continue to comply, with the relevant requirements. (6) If the ACMA extends the duration of the provisional authorisation, the ACMA: (a) must decide the period of the extension (being a period of not more than 90 days); and (b) is not required to extend the duration for any period requested by the public number directory publisher. (7) The ACMA must, as soon as practicable after making the decision: (a) notify the public number directory publisher in writing of: (i) the decision; and (ii) for a refusal to extend the duration or a decision to extend the duration for a period other than a period requested by the publisher — the reasons for the decision; and (b) for a decision to extend the duration — notify the IPND Manager in writing of the decision. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. 3.8 Start of extended duration of provisional authorisation An extension of the duration of a provisional authorisation under subsection 3.7(4) starts on the later of: (a) the day after the day on which the ACMA makes the decision to extend the duration; and (b) the day after the day on which the authorisation would otherwise have ended under section 3.4. Division 3 Final authorisation Subdivision A Application for final authorisation 3.9 Making an application (1) A public number directory publisher that: (a) has only been granted a provisional authorisation; and (b) wishes to continue to use and disclose customer data to publish and maintain a PND; must apply to the ACMA for the grant of a final authorisation. (2) The application must be made: (a) before the provisional authorisation ends; and (b) by giving the ACMA access to the sample PND developed by the public number directory publisher under subsection 3.5(3). Note: The form in which access is given will depend on the format of the PND. (3) If: (a) a public number directory publisher applies to the ACMA for the grant of a final authorisation; and (b) immediately before the provisional authorisation is due to end: (i) the application is not withdrawn; and (ii) the ACMA has not made a decision under subsection 3.10(4) whether to grant a final authorisation; the duration of the provisional authorisation is taken to be extended until: (c) if subsection 3.10(3) applies – the tenth business day mentioned in that subsection; or (d) the day on which the ACMA makes a decision under subsection 3.10(4). 3.10 Decision on application (1) The ACMA may ask a public number directory publisher in writing to give it further information about an application made under section 3.9. (2) If the ACMA asks for further information under subsection (1), the public number directory publisher must give the information to the ACMA within 10 business days. (3) If the ACMA asks for further information under subsection (1) but does not receive the information within 10 business days, the ACMA may treat the application as withdrawn. (4) The ACMA must, unless the application is withdrawn, decide whether to grant a final authorisation: (a) as soon as practicable after receiving the application; or (b) if the ACMA has asked for further information under subsection (1) – as soon as practicable after receiving the information. (5) The ACMA must grant a final authorisation under subsection (4) if the ACMA: (a) has applied the criteria specified by the Minister in a legislative instrument under subsection 295N(1) of the Act; and (b) has had regard to any other matters that the ACMA considers relevant; and (c) is reasonably satisfied that the public number directory publisher has demonstrated that: (i) the sample PND will satisfy the requirements of the definition of public number directory in subsection 285(2) of the Act, as modified by any legislative instrument that the Minister may make under subsection 285(4), (5) or (6) of the Act; and (ii) the publisher is likely to comply with the other relevant requirements. Note: See note at the end of subsection 3.3(5). (6) The ACMA must, as soon as practicable after making the decision: (a) notify the public number directory publisher in writing of: (i) the decision; and (ii) for a refusal to grant a final authorisation — the reasons for the decision; and (b) for a decision to grant a final authorisation — notify the IPND Manager in writing of the decision. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. (7) If paragraph (6)(b) applies, the ACMA must, as soon as practicable after the IPND Manager has been notified of the decision, give the public number directory publisher written confirmation of that fact. 3.11 Start of final authorisation A final authorisation starts on the day on which the IPND Manager first supplies customer data to the public number directory publisher after making arrangements under paragraph 3.12(2)(a). Note: A final authorisation has effect on an ongoing basis unless it ends in accordance with Part 5. 3.12 Conditions to which final authorisation is subject (1) A final authorisation is subject to the conditions specified in this section. Supply of customer data (2) The public number directory publisher: (a) must make arrangements with the IPND Manager for the supply of customer data as soon as practicable after receiving written confirmation from the ACMA under subsection 3.10(7); and (b) must notify the ACMA in writing of the date on which the publisher first receives the customer data within 10 business days after the start of the final authorisation. (3) The public number directory publisher must not use the customer data for any purpose other than the publication and the maintenance of a PND. Publication of PND (4) The public number directory publisher must publish a PND within a period of 90 days starting on the day on which the final authorisation starts. Notification of publication of PND (5) The public number directory publisher must, within 10 business days after publishing a PND under subsection (4): (a) notify the ACMA in writing that the PND has been published; and (b) give the ACMA details of how the PND can be obtained; and (c) provide the ACMA with access to the PND. Access to PND (6) The public number directory publisher must ensure that each PND that it publishes and maintains is made generally available to members of the public. (7) The public number directory publisher must provide the ACMA with further access to any PNDs that it has published if the ACMA asks the publisher in writing for such access. Unlisted numbers (8) If a customer informs the public number directory publisher that the customer wants the customer's listed number to become an unlisted number, the publisher must advise the customer to contact the customer's carriage service provider. (9) If the IPND Manager notifies the public number directory publisher that a listed number has become an unlisted number in the IPND, the publisher: (a) must, within 2 business days after being notified, amend any PNDs that it publishes and maintains online, or in another streaming electronic format, to remove all of the customer data relating to the number; and (b) must not, after being notified, make available online, or in another streaming electronic format, a PND containing or otherwise disclosing any of the customer data relating to the number; and (c) must not, after being notified: (i) release any document or database containing any of the customer data relating to the number; or (ii) arrange for any document or database of that kind to be released; and (d) must, within 10 business days after being notified, destroy securely all of the customer data in its possession relating to the number. (10) The public number directory publisher must not contact a customer who has an unlisted number in the IPND unless the publisher has a pre‑existing business relationship with the customer that relates to a PND that it publishes. Example: An example of a pre-existing relationship is a paid listing in a PND that the public number directory publisher publishes. Updating PNDs (11) The public number directory publisher must update at least annually each PND that it publishes and maintains in: (a) a hard copy format; or (b) on a disk or in another recorded format. (12) The public number directory publisher must update at least monthly each PND that it publishes and maintains online or in another streaming electronic format. Note: This update is for the PND as a whole, and should not be confused with the obligation in subsection (9) to amend any PND that it publishes and maintains online, or in another streaming electronic format, to remove all of the customer data relating to a number that has become an unlisted number. Correcting customer information (13) If a customer advises the public number directory publisher that the customer's information in a PND that it publishes is incorrect, the publisher must, within 10 business days after being advised: (a) correct the information in: (i) any PNDs that it publishes and maintains online or in another streaming electronic format; and (ii) the customer data in its possession; and (b) tell the customer to contact the customer's carriage service provider to ensure that the information is correctly entered into the IPND. Note: The public number directory publisher is expected to take reasonable steps to verify the identity of the party providing the advice. Internal dispute resolution procedures (14) The public number directory publisher must have internal dispute resolution procedures that will enable it to deal with inquiries or complaints from customers about the use or disclosure of their information in any PND that it publishes. (15) If a customer makes a complaint to the public number directory publisher about the use or disclosure of the customer's information in a PND that it publishes, the publisher must: (a) inform the customer that if the customer is dissatisfied with the way in which the complaint is handled, the customer may make a complaint to: (i) in the case where the customer is an individual whose complaint to the publisher involves an act or practice that may be an interference with the privacy of the individual – the Information Commissioner; and (ii) in any other case – the ACMA; and (b) give the customer information about how to contact the Information Commissioner or the ACMA; and (c) provide reasonable assistance to the Information Commissioner or the ACMA in relation to any such complaint if requested by the Information Commissioner or the ACMA to do so. Technical systems for receiving customer data (16) The public number directory publisher must have technical systems to receive customer data in accordance with any technical method specified by the IPND Manager. Note: The technical method or methods specified by the IPND Manager may be changed from time to time. Suppressed address entry (17) A public number directory publisher must not publish a directory address that is a suppressed address entry. Other conditions (18) The ACMA: (a) may specify in writing other conditions to which the final authorisation is subject; and (b) may vary or remove any condition so specified (specified condition); and (c) must notify the public number directory publisher in writing of any specified condition, or of any variation or removal of such a condition, as soon as practicable, and before the condition, or the variation or removal, is expressed to take effect; and (d) must notify the IPND Manager in writing of any specified condition, or of any variation or removal of such a condition, that is relevant to its role as IPND Manager. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. Compliance with relevant requirements (19) The public number directory publisher must comply with the relevant requirements. (20) The public number directory publisher must take all reasonable steps to ensure that any person who is one of its personnel: (a) is made aware of the publisher's obligations to meet the relevant requirements; and (b) cooperates with the publisher in meeting the relevant requirements; and (c) notifies the publisher in writing as soon as practicable after becoming aware that the person has done, or omitted to do, something that would have breached a relevant requirement if the person had been a public number directory publisher. (21) If the public number directory publisher becomes aware that: (a) the publisher has breached any relevant requirement; or (b) a person who is one of its personnel has done, or omitted to do, something that would have breached a relevant requirement if the person had been a public number directory publisher; the publisher must, as soon as practicable: (c) notify the ACMA in writing of the issue; and (d) take all reasonable steps to minimise the effects of the issue. Subdivision B Application for extension of period for publishing PND 3.13 Making an application (1) A public number directory publisher that has been granted a final authorisation may apply to the ACMA to extend the period in which to publish a PND if the PND is unable to be published within the period for a reason beyond the publisher's control. (2) The application must be made: (a) within a period of 90 days starting on the day on which the final authorisation starts; and (b) using the form approved by the ACMA. Note: The application form is available on the ACMA's website at www.acma.gov.au. (3) If: (a) a public number directory publisher applies to the ACMA to extend the period in which to publish a PND; and (b) immediately before the period is due to end: (i) the application is not withdrawn; and (ii) the ACMA has not made a decision under subsection 3.14(4) whether to extend the period; the period is taken to be extended until: (c) if subsection 3.14(3) applies – the tenth business day mentioned in that subsection; or (d) the day on which the ACMA makes a decision under subsection 3.14(4). 3.14 Decision on application (1) The ACMA may ask a public number directory publisher in writing to give it further information about an application made under section 3.13. (2) If the ACMA asks for further information under subsection (1), the public number directory publisher must give the information to the ACMA within 10 business days. (3) If the ACMA asks for further information under subsection (1) but does not receive the information within 10 business days, the ACMA may treat the application as withdrawn. (4) The ACMA must, unless the application is withdrawn, decide whether to extend the period in which to publish a PND: (a) as soon as practicable after receiving the application; or (b) if the ACMA has asked for further information under subsection (1) – as soon as practicable after receiving the information. (5) The ACMA must extend the period in which to publish a PND under subsection (4) if it is satisfied that: (a) the reason why the PND is unable to be published within the period is beyond the public number directory publisher's control; and (b) the publisher has complied, and is likely to continue to comply, with the relevant requirements. (6) If the ACMA extends the period in which to publish a PND, the ACMA: (a) must decide the period of the extension (being a period of not more than 90 days); and (b) is not required to extend the duration for any period requested by the public number directory publisher. (7) The ACMA must, as soon as practicable after making the decision: (a) notify the public number directory publisher in writing of: (i) the decision; and (ii) for a refusal to extend the period or a decision to extend the period for a period other than a period requested by the publisher — the reasons for the decision; and (b) for a decision to extend the period — notify the IPND Manager in writing of the decision. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. 3.15 Start of extended period in which to publish PND An extension of the period in which to publish a PND under subsection 3.14(4) starts on the later of: (a) the day after the day on which the ACMA makes the decision to extend the period; and (b) the day after the day on which the period would otherwise have ended under subsection 3.12(4). Part 4 Authorisation to use and disclose customer data — research entities Division 1 Application of Part 4 4.1 Application This Part applies to: (a) a person seeking to be granted an authorisation to use and disclose customer data for purposes connected with the conduct of research; and (b) a research entity. Division 2 Research authorisation Subdivision A Application for research authorisation 4.2 Making an application (1) If a person wishes to use and disclose customer data for purposes connected with the conduct of research, the person must apply to the ACMA for the grant of a research authorisation. (2) The application must: (a) be made using the form approved by the ACMA; and (b) indicate whether the authorisation is sought by a representative body to use, and disclose to its members, customer data; and (c) specify the kind or kinds of research for which customer data is sought; and (d) specify each of the fields of customer data, originating from the IPND, about a customer or a customer's business that is sought; and (e) outline the reasons why each of those fields is sought; and (f) specify the duration of the authorisation sought, including: (i) whether it is to have effect for a finite period or on an ongoing basis; and (ii) if it is to have effect for a finite period – the length of the period. Note 1: The application form is available on the ACMA's website at www.acma.gov.au. Note 2: A research authorisation that has effect on an ongoing basis may be appropriate if customer data is to be supplied continuously or periodically. (3) If an application is made by a representative body to use, and disclose to its members, customer data, the application must not specify the name of a customer or a customer's business as a field of customer data under paragraph (2)(d). (4) The application must be accompanied by: (a) the charge (if any) for the application fixed by a determination under section 60 of the Australian Communications and Media Authority Act 2005; and (b) a completed privacy impact assessment in the form approved by the ACMA. Note: The approved privacy impact assessment form is available on the ACMA's website at www.acma.gov.au. 4.3 Decision on application (1) The ACMA may ask a person (the applicant) in writing to give it further information about an application made under section 4.2. (2) If the ACMA asks for further information under subsection (1), the applicant must give the information to the ACMA within 90 days. (3) If the ACMA asks for information under subsection (1) but does not receive the information within 90 days, the ACMA may treat the application as withdrawn. (4) The ACMA must, unless the application is withdrawn, decide whether to grant a research authorisation. (5) The ACMA must grant a research authorisation under subsection (4) if the ACMA: (a) has applied the criteria specified by the Minister in a legislative instrument under subsection 295N(1) of the Act; and (b) has had regard to any other matters that the ACMA considers relevant; and (c) is reasonably satisfied that the applicant has demonstrated that: (i) the applicant's proposed research will satisfy the requirements of the definition of research in section 1.4; and (ii) the applicant is likely to comply with the other relevant requirements. Note: At the commencement of this scheme, the Telecommunications (Integrated Public Number Database Scheme – Criteria for Deciding Authorisation Applications) Instrument 2007 (No. 1) is the only legislative instrument in force under subsection 295N(1) of the Act. (6) The ACMA: (a) must specify in its decision to grant a research authorisation: (i) the kind or kinds of research to which the research authorisation applies; and (ii) the fields of customer data to which the authorisation applies; and (iii) the duration of the authorisation, including: (A) whether it is to have effect for a finite period or on an ongoing basis; and (B) if it is to have effect for a finite period – the length of the period; and (b) is not required to grant the authorisation for any duration requested by the applicant. (7) The ACMA must, as soon as practicable after making the decision: (a) notify the applicant in writing of: (i) the decision; and (ii) for a refusal to grant a research authorisation or a decision to grant a research authorisation for a period other than a period requested by the applicant — the reasons for the decision; and (b) for a decision to grant a research authorisation — notify the IPND Manager in writing of the decision. Note 1: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. Note 2: If the ACMA grants a research authorisation to the applicant, the applicant is treated in this scheme as being a research entity. (8) If paragraph (7)(b) applies, the ACMA must, as soon as practicable after the IPND Manager has been notified of the decision, give the research entity written confirmation of that fact. 4.4 Duration of research authorisation A research authorisation: (a) starts on the day on which the IPND Manager first supplies customer data to the research entity after making arrangements under paragraph 4.5(2)(a); and (b) has effect for the duration specified by the ACMA in its decision under subparagraph 4.3(6)(a)(iii). Note: The duration of a research authorisation that has effect for a finite period may be extended in accordance with Subdivision B. The duration of a research authorisation that has effect for a finite period or on an ongoing basis may be ended earlier in accordance with Part 5. 4.5 Conditions to which research authorisation is subject (1) A research authorisation is subject to the conditions specified in this section. Supply of customer data (2) The research entity: (a) must make arrangements with the IPND Manager for the supply of the fields of customer data to which the research authorisation applies as soon as practicable after receiving written confirmation from the ACMA under subsection 4.3(8); and (b) must notify the ACMA in writing of the date on which the entity first receives the customer data within 10 business days after the start of the authorisation. Disclosure of customer data (3) The research entity must not disclose the customer data to any person other than: (a) the ACMA; or (b) the entity's personnel; or (c) if the entity is a research representative body – its members; unless the disclosure is authorised or required by or under law. (4) If the research entity is a research representative body, the entity must comply with the following: (a) the entity is only permitted to disclose the following fields of customer data, about a customer or a customer's business, to any of its members: (i) the public number of the customer or business; (ii) the postcode, and the State or Territory, included in the directory address of the customer or business; (b) the entity must ensure that, before any disclosure of the customer data to any of its members, there are adequate arrangements in place that: (i) meet the requirements of this section; and (ii) are legally enforceable as between the entity and its members; (c) the entity must take reasonable steps to ensure that its members comply with the required arrangements; (d) the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must not disclose the customer data to any person other than: (i) the ACMA; or (ii) the member's personnel; unless the disclosure is authorised or required by or under law. Application of Privacy Act 1988 (5) The research entity must, for at least the duration of the research authorisation, be one of the following: (a) an organisation within the meaning of the Privacy Act 1988; (b) an entity whose name is entered in the register of small business operators who have chosen to be treated as organisations within the meaning of the Privacy Act 1988, which is kept by the Information Commissioner in accordance with section 6EA of that Act. Note: Subsection (5) ensures that the Privacy Act 1988 applies to the research entity, for at least the duration of the research authorisation, in relation to the handling of any personal information. (6) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with subsection (5) as if: (a) the member were a research entity; and (b) the duration of the research authorisation were the period during which the member has access to the customer data. Note: Subsection (6) ensures that the Privacy Act 1988 applies to the member, for at least the period during which the member has access to the customer data, in relation to the handling of any personal information. Use and security of customer data (7) The research entity: (a) must not use the customer data for any purpose other than conducting research of a kind to which the research authorisation applies; and (b) must not add other information to the customer data without the express consent of the person to whom the information relates; and (c) must make the customer data secure so that only its personnel and (if it is a research representative body) its members have access to the customer data for the purposes of conducting the research. (8) If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that: (a) the member must comply with paragraphs (7)(a) and (b) as if it were a research entity; and (b) the member must make the customer data secure so that only its personnel have access to the customer data for the purposes of conducting the research. Contacting customers (9) If the research entity contacts a customer, using the customer data, for the purposes of conducting the research, the entity must: (a) tell the customer: (i) the name of the person or organisation conducting the research; and (ii) the contact details of the person or organisation, if requested by the customer; and (iii) the purpose of the research; and (iv) that the person or organisation has collected the customer data relating to the customer and, if requested by the customer, the circumstances of that collection; and (v) how the person or organisation proposes to use the customer data and any other information relating to the customer in the research; and (vi) how the customer can access the personal information about the customer held by the person or organisation, if requested by the customer; and (b) ask the customer if the customer gives consent: (i) for the use of the customer data and any other information relating to the customer in the research; and (ii) to having the customer's details identified in the research; and (c) tell the customer that the customer may withdraw any consent so given at any time; and (d) give the customer any other information that is required by law (for example, under the Privacy Act 1988); and (e) comply with all applicable laws relating to unsolicited contact with another person. Example: For paragraph (e), applicable laws relating to unsolicited contact with another person include the following: (a) the Privacy Act 1988; (b) the Spam Act 2003; (c) the Do Not Call Register Act 2006. (10) If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the following effect: (a) the member is only permitted to use the fields of customer data specified in paragraph (4)(a) to contact customers for the purposes of conducting the research; and (b) the member must, when contacting a customer, using such data, for such purposes, comply with subsection (9) as if it were a research entity. Unlisted numbers (11) If a customer informs the research entity that the customer wants a listed number to become an unlisted number, the entity must advise the customer to contact the customer's carriage service provider. (12) If the IPND Manager notifies the research entity that a listed number has become an unlisted number in the IPND: (a) the entity must not, after being notified, use any of the customer data to contact the customer who has the number; and (b) the entity must, within 10 business days after being notified, destroy securely any customer data or document that it holds that it is able to identify as being associated with that unlisted number; and (c) if the entity is a research representative body – the entity must notify each of its members who have access to the customer data relating to the customer that the listed number has become an unlisted number in the IPND as soon as practicable. (13) If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the following effect: (a) if a customer informs the member that the customer wants a listed number to become an unlisted number, the member must comply with subsection (11) as if it were a research entity; and (b) if the entity gives a notice to the member under paragraph (12)(c), the member must comply with paragraphs (12)(a) and (b) as if: (i) it were a research entity; and (ii) the notice were a notice from the IPND Manager. Refusal or withdrawal of consent (14) If a customer does not consent, or withdraws consent, to the use of the customer data or any other information relating to the customer in the research, the research entity: (a) must not continue to use any of the customer data or other information that can be identified as being associated with the customer; and (b) must not keep any of the customer data or other information that can be identified as being associated with the customer. (15) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with subsection (14) as if it were a research entity. Internal dispute procedures (16) The research entity must have internal dispute resolution procedures that will enable it to deal with inquiries or complaints from any customer about its use or disclosure of the customer data relating to the customer. (17) If a customer makes a complaint to the research entity about the use or disclosure of the customer data or other information relating to the customer, the entity must: (a) inform the customer that if the customer is dissatisfied with the way in which the complaint is handled, the customer may make a complaint to: (i) in the case where the customer is an individual whose complaint to the entity involves an act or practice that may be an interference with the privacy of the individual – the Information Commissioner; and (ii) in any other case – the ACMA; and (b) give the customer information about how to contact the Information Commissioner or the ACMA; and (c) provide reasonable assistance to the Information Commissioner or the ACMA in relation to any such complaint if requested by the Information Commissioner or the ACMA to do so. (18) If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the following effect: (a) the member must comply with subsection (16) as if it were a research entity; and (b) if a customer makes a complaint to the member about the use or disclosure of the customer data or other information relating to the customer, the member must: (i) comply with subsection (17) as if it were a research entity; and (ii) notify the entity in writing of: (A) the nature of the complaint as soon as practicable after the complaint is made; and (B) the outcome of the complaint as soon as practicable after the complaint has been finalised. Disaggregation of research findings (19) If geographic disaggregation of the research findings is to occur using the customer data, the research entity must not carry out the disaggregation below the level of a postcode included in a directory address of a customer or a customer's business. Note: Other geographic disaggregation of the research findings is permissible, subject to paragraph (7)(b). (20) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with subsection (19) as if it were a research entity. Updating customer data (21) If the IPND Manager notifies the research entity of an update to the customer data: (a) the entity must, within 2 business days after being notified, update the customer data in its possession that can be identified as being associated with the customer; and (b) if the entity is a research representative body – the entity must notify each of its members who have access to the customer data of the update to the customer data as soon as practicable. (22) If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that, if the entity gives a notice to a member under paragraph (21)(b), the member must comply with paragraph (21)(a) as if: (a) it were a research entity; and (b) the notice were a notice from the IPND Manager. Correcting customer data (23) If a customer advises the research entity that the customer data or any other information relating to the customer held by the entity is incorrect: (a) the entity must, within 2 business days after being advised: (i) correct the information in its possession that can be identified as being associated with the customer; and (ii) tell the customer to contact the customer's carriage service provider to ensure that the information is correctly entered into the IPND; and (b) if the entity is a research representative body – the entity must notify each of its members who have access to the customer data that the information is incorrect as soon as practicable. Note: The research entity is expected to take reasonable steps to verify the identity of the party providing the advice. (24) If the research entity is a research representative body, the entity must comply with the following: (a) the entity must ensure that the required arrangements impose obligations on each of its members to the following effect: (i) if the entity gives a notice to the member under paragraph (23)(b), the member must comply with subparagraph (23)(a)(i) as if: (A) it were a research entity; and (B) the notice were advice from the customer; (ii) if a customer advises the member that the customer data or any other information relating to the customer held by the member is incorrect, the member must: (A) comply with paragraph (23)(a) as if it were a research entity; and (B) notify the entity in writing that the information is incorrect as soon as practicable; Note: It is anticipated that the required arrangements will note that the member is expected to take reasonable steps to verify the identity of the party providing the advice. (b) if a member gives the entity a notice under required arrangements in accordance with sub-subparagraph (a)(ii)(B), the entity must: (i) comply with subparagraph (23)(a)(i) as if the notice were advice from the customer; and (ii) notify all of its other members who have access to the customer data relating to the customer that the information referred to in the notice is incorrect as soon as practicable. Technical systems for receiving customer data (25) The research entity must have technical systems to receive customer data in accordance with any technical method specified by the IPND Manager. Note: The technical method or methods specified by the IPND Manager may be changed from time to time. Supressed address entry (26) The research entity must not use a directory address that is a suppressed address entry. (27) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with subsection (26) as if it were a research entity. Identification of customer or customer's business by name (28) If: (a) the fields of customer data to which the research authorisation applies do not include the name of a customer or a customer's business; and (b) the research entity becomes aware that other information has been added to the customer data in breach of the relevant requirement in paragraph (7)(b); and (c) as a result of the breach, a customer or a customer's business is identified by name as being the customer or the customer's business to which the customer data relates; the entity must, as soon as practicable: (d) destroy the customer data and the other information that has been added to the customer data; or (e) take other steps to ensure that the customer or the customer's business is no longer identified in the way mentioned in paragraph (c). (29) If the research entity is a research representative body, the entity must ensure that the required arrangements impose obligations on each of its members to the effect that if: (a) the member becomes aware that other information has been added to the customer data in breach of the required arrangements; and (b) as a result of the breach, a customer or a customer's business is identified by name as being the customer or the customer's business to which the customer data relates; the member must: (c) comply with subsection (28) as if: (i) it were a research entity; and (ii) the breach were a breach of the relevant requirement in paragraph (7)(b); and (d) notify the entity in writing of the breach, and the steps taken to ensure that the customer or the customer's business is no longer identified in the way mentioned in paragraph (b), as soon as practicable. (30) The requirement in subsection (28) or (29) is in addition to the requirement in subsection (36). Note: Under subsection (36), if the research entity becomes aware of a breach of the kind mentioned in subsection (28) or (29), the entity must, as soon as practicable, notify the ACMA of the breach and take all reasonable steps to minimise the effects of the breach. Conditions specified by the Minister (31) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must comply with the conditions specified by the Minister in a legislative instrument under section 295P of the Act as if the member were a research entity. Note: See Note 2 under the definition of relevant requirements in section 1.4. Other conditions (32) The ACMA: (a) may specify in writing other conditions to which the research authorisation is subject; and (b) may vary or remove any condition so specified (specified condition); and (c) must notify the research entity in writing of any specified condition, or of any variation or removal of such a condition, as soon as practicable, and before the condition, or the variation or removal, is expressed to take effect; and (d) must notify the IPND Manager in writing of any specified condition, or of any variation or removal of such a condition, that is relevant to its role as IPND Manager. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. Compliance with requirements (33) The research entity must comply with all relevant requirements. (34) The research entity must take all reasonable steps to ensure that any person who is one of its personnel: (a) is made aware of the entity's obligations to meet the relevant requirements; and (b) cooperates with the entity in meeting the relevant requirements; and (c) notifies the entity in writing as soon as practicable after becoming aware that the person has done, or omitted to do, something that would have breached a relevant requirement if the person had been a research entity. (35) If the research entity is a research representative body, the entity must ensure that the required arrangements impose an obligation on each of its members to the effect that the member must notify the entity in writing as soon as practicable after becoming aware that the member has not complied with such arrangements. (36) If the research entity becomes aware that: (a) the entity has breached any relevant requirement; or (b) a person who is one of its personnel has done, or omitted to do, something that would have breached a relevant requirement if the person had been a research entity; or (c) if the entity is a research representative body – any one of its members has not complied with the required arrangements; the entity must, as soon as practicable: (d) notify the ACMA in writing of the issue; and (e) take all reasonable steps to minimise the effects of the issue. Subdivision B Application for extension of duration of research authorisation 4.6 Making an application (1) A research entity may apply to the ACMA to extend the duration of a research authorisation that has been granted for a finite period if the research to which the authorisation applies is unable to be completed before the end of the authorisation for a reason beyond the entity's control. (2) The application must be made: (a) before the research authorisation ends; and (b) using the form approved by the ACMA. Note: The application form is available on the ACMA's website at www.acma.gov.au. (3) If: (a) a research entity applies to the ACMA to extend the duration of a research authorisation; and (b) immediately before the authorisation is due to end: (i) the application is not withdrawn; and (ii) the ACMA has not made a decision under subsection 4.7(4) whether to extend the duration; the duration is taken to be extended until: (c) if subsection 4.7(3) applies – the tenth business day mentioned in that subsection; or (d) the day on which the ACMA makes a decision under subsection 4.7(4). 4.7 Decision on application (1) The ACMA may ask a research entity in writing to give it further information about an application made under section 4.6. (2) If the ACMA asks for further information under subsection (1), the research entity must give the information to the ACMA within 10 business days. (3) If the ACMA asks for further information under subsection (1) but does not receive the information within 10 business days, the ACMA may treat the application as withdrawn. (4) The ACMA must, unless the application is withdrawn, decide whether to extend the duration of the research authorisation: (a) as soon as practicable after receiving the application; or (b) if the ACMA has asked for further information under subsection (1) – as soon as practicable after receiving the information. (5) The ACMA must extend the duration of the research authorisation under subsection (4) if it is satisfied that: (a) the reason why the research is unable to be completed before the end of the authorisation is beyond the research entity's control; and (b) the entity has complied, and is likely to continue to comply, with the relevant requirements. (6) If the ACMA extends the duration of the research authorisation, the ACMA: (a) must decide the period of the extension (being a period of not more than a quarter of the initial duration of the authorisation under section 4.4); and (b) is not required to extend the duration for any period requested by the research entity. (7) The ACMA must, as soon as practicable after making the decision: (a) notify the research entity in writing of: (i) the decision; and (ii) for a refusal to extend the duration or a decision to extend the duration for a period other than a period requested by the entity — the reasons for the decision; and (b) for a decision to extend the duration — notify the IPND Manager in writing of the decision. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. 4.8 Start of extended duration of research authorisation An extension of the duration of a research authorisation under subsection 4.7(4) starts on the later of: (a) the day after the day on which the ACMA makes the decision to extend the duration; and (b) the day after the day on which the authorisation would otherwise have ended under section 4.4. Subdivision C Review of research authorisation that has effect on ongoing basis 4.9 Review at least every 2 years (1) The ACMA must cause a review of a research authorisation that has effect on an ongoing basis at least once in every 2 year period after the start of the authorisation. (2) The review must consider the following: (a) whether the research authorisation is still required to have effect on an ongoing basis; (b) whether each field of customer data to which the authorisation applies is still being, or to be, used and disclosed for purposes connected with the conduct of research of the kind or kinds to which the authorisation applies; (c) whether the research entity has appropriate practices, procedures, processes and systems in place to protect the privacy and security of the customer data and to ensure compliance with all other relevant requirements; (d) the extent to which the research entity has complied with all relevant requirements; (e) any other matters the ACMA considers relevant. Part 5 End of authorisations Division 1 Public number directory publishers 5.1 End of provisional authorisation or final authorisation – revocation (1) The ACMA may, in accordance with this section, revoke a provisional authorisation or final authorisation if it is satisfied that the public number directory publisher who holds the authorisation has breached a condition to which the authorisation is subject. (2) If the ACMA proposes to revoke an authorisation under this section, the ACMA must: (a) notify the public number directory publisher in writing of the proposal and the ACMA's reasons for the proposal; and (b) invite the publisher to give the ACMA in writing, within a period of at least 30 days specified in the notice, reasons why the authorisation should not be revoked. (3) After the end of the period specified in the notice: (a) the ACMA must decide whether to revoke the authorisation, having regard to any reasons given by the public number directory publisher; and (b) the ACMA may revoke the authorisation if it is satisfied of the matter mentioned in subsection (1). (4) If the ACMA revokes an authorisation under this section, the ACMA must, as soon as practicable, notify the person who held the authorisation and the IPND Manager in writing of the revocation. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. 5.2 Further application to use and disclose customer data if authorisation is revoked If the ACMA revokes an authorisation under section 5.1, the person who held the authorisation cannot apply for the grant of a provisional authorisation or final authorisation for a period of 90 days starting on the day on which the revocation took effect. 5.3 End of final authorisation – other (1) If a public number directory publisher who holds a final authorisation fails to publish a PND within: (a) a period of 90 days, starting on the day on which the authorisation starts, in accordance with subsection 3.12(4); or (b) if the period has been extended under subsection 3.13(3) or 3.14(4), the extended period; the authorisation is taken to have ended immediately after the end of the period of 90 days or the extended period. (2) If: (a) a public number directory publisher holds a final authorisation that is still in force; and (b) the publisher notifies the ACMA in writing that the authorisation is no longer required; the authorisation is taken to have ended immediately after the end of a period of 10 days, or such longer period as is specified in the notice, starting on the day on which the ACMA receives the notice, unless the authorisation ends earlier. (3) The ACMA must, as soon as practicable after becoming aware that an authorisation has ended under subsection (1) or (2), notify the IPND Manager in writing of the matter. Division 2 Research entities 5.4 End of research authorisation – revocation (1) The ACMA may, in accordance with this section, revoke a research authorisation if it is satisfied that the research entity that holds the authorisation has breached a condition to which the authorisation is subject. (2) If the ACMA proposes to revoke an authorisation under this section, the ACMA must: (a) notify the research entity in writing of the proposal and the ACMA's reasons for the proposal; and (b) invite the entity to give the ACMA in writing, within a period of at least 30 days specified in the notice, reasons why the authorisation should not be revoked. (3) After the end of the period specified in the notice: (a) the ACMA must decide whether to revoke the authorisation, having regard to any reasons given by the research entity; and (b) the ACMA may revoke the authorisation if it is satisfied of the matter mentioned in subsection (1). (4) If the ACMA revokes an authorisation under this section, the ACMA must, as soon as practicable, notify the person who held the authorisation and the IPND Manager in writing of the revocation. Note: See Part 29 of the Act for additional requirements in relation to the notification of certain decisions under this scheme. (5) If: (a) the ACMA revokes an authorisation under this section; and (b) the authorisation was held by a research representative body; the person who held the authorisation must, as soon as practicable after being notified of the revocation under subsection (4), notify each of its members who had access to any customer data under the authorisation of the revocation. 5.5 Further application to use and disclose customer data if authorisation is revoked If the ACMA revokes a research authorisation under section 5.4, the person who held the authorisation cannot apply for the grant of another research authorisation for a period of 90 days starting on the day on which the revocation took effect. 5.6 End of research authorisation – other (1) If: (a) a research entity holds a research authorisation that is still in force; and (b) the entity notifies the ACMA in writing that the authorisation is no longer required; the authorisation is taken to have ended immediately after the end of a period of 10 days, or such longer period as is specified in the notice, starting on the day on which the ACMA receives the notice, unless the authorisation ends earlier. (2) The ACMA must, as soon as practicable after becoming aware that an authorisation has ended under subsection (1), notify the IPND Manager in writing of the matter. (3) If: (a) an authorisation has ended under subsection (1); and (b) the authorisation was held by a research representative body; the person who held the authorisation must, as soon as practicable after becoming aware that the authorisation has ended, notify each of its members who had access to any customer data under the authorisation of the matter. Part 6 Savings and transitional arrangements 6.1 Application of Part 6 This Part applies to an authorisation granted to a person (the holder) under subsection 3.10(4) of the Telecommunications Integrated Public Number Database Scheme 2007 (the old scheme) and in force immediately before the commencement of this scheme (a previous authorisation). Note: The only authorisations granted to persons under the old scheme and in force immediately before the commencement of this scheme were authorisations granted to persons under subsection 3.10(4) of the old scheme to use and disclose customer data to publish and maintain a PND. 6.2 Previous authorisation continues in force (1) A previous authorisation continues in force immediately after the commencement of this scheme: (a) as if it had been granted to the holder under subsection 3.10(4) of this scheme; and (b) subject to the conditions specified in section 3.12 of this scheme. (2) This scheme has effect, in relation to the previous authorisation, as if: (a) a reference to customer data includes a reference to customer data that has been received by the holder under the previous authorisation before the commencement of this scheme; and (b) a reference to final authorisation is a reference to the previous authorisation; and (c) a reference to PND includes: (i) a reference to a PND that has been published by the holder under the previous authorisation before the commencement of this scheme; and (ii) a reference to a PND that is required to be, or has been, published by the holder in compliance with subsection 6.3(1) of this scheme; and (d) a reference to public number directory publisher is a reference to the holder; and (e) a reference to the day on which a final authorisation starts is a reference to the day on which the previous authorisation started under section 3.11 of the old scheme; and (f) a reference to the period in which to publish a PND is a reference to the period of 90 days (or any extended period under subsection 3.13(3) or 3.14(4) of the old scheme) starting on the day on which the previous authorisation started under section 3.11 of the old scheme. (3) For the avoidance of doubt: (a) the holder may apply to the ACMA to extend the period in which to publish a PND in accordance with section 3.13 of this scheme; and (b) the previous authorisation: (i) may be made subject to other conditions, or have existing conditions varied or removed, in accordance with subsection 3.12(18) of this scheme; and (ii) may be ended in accordance with Part 5 of this scheme. 6.3 Other matters (1) If, immediately before the commencement of this scheme: (a) the holder was required, at that time, to do a particular thing under a condition specified in any of the following provisions of the old scheme: (i) subsection 3.12(3); (ii) subsection 3.12(4); (iii) subsection 3.12(7); (iv) subsection 3.12(8); (v) subsection 3.12(9); (vi) subsection 3.12(10); (vii) subsection 3.12(11); (viii) subsection 3.12(12); and (b) the holder had not done the thing; and (c) the time period for doing the thing had not ended; the holder must do the thing within the time period as if the condition had not been repealed. (2) For the purposes of subsection (1), the time period for doing a particular thing under a condition referred to in that subsection is: (a) if the condition required the thing to be done within a particular period – the particular period; or (b) otherwise – a reasonable period of time. Example: If, immediately before the commencement of this scheme: (a) the holder was required, at the time, to publish a PND under the condition specified in subsection 3.12(3) of the old scheme (because the previous authorisation had started under section 3.11 of the old scheme); and (b) the holder had not published a PND; (c) the time period for publishing a PND had not ended (because subsection 3.12(3) of the old scheme required a PND to be published within 90 days and only 10 of those days had expired); the holder would still be required to publish a PND within that time period, which, at the commencement of this scheme, would be due to expire in 80 days. (3) Anything done by the holder in compliance with subsection (1), in relation to a condition referred to in that subsection, is taken to have been done under, or for the purposes of, the corresponding condition of this scheme. Example: A PND published by the holder in compliance with subsection (1), in relation to the condition specified in subsection 3.12(3) of the old scheme, is taken to have been done under, or for the purposes of, the condition specified in subsection 3.12(4) of this scheme. (4) Anything done by the holder, the ACMA or the IPND Manager under the old scheme before the commencement of this scheme has effect, on and after the commencement, as if it had been done under, or for the purposes of, this scheme.