Telecommunications Service Provider (Customer Identity Authentication) Determination 2022 (Cth)

Telecommunications Service Provider (Customer Identity Authentication) Determination 2022

The Australian Communications and Media Authority makes the following determination under subsection 99(1) of the Telecommunications Act 1997.

Dated: 1 April 2022 James Cameron [signed] Member

Cathy Rainsford [signed] Member/General Manager

Australian Communications and Media Authority

Part 1—Preliminary

1 Name This is the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022.

2 Commencement This determination commences on 30 June 2022.

3 Authority This determination is made under subsection 99(1) of the Act.

4 Application For the purposes of subsection 99(1) of the Act, this determination applies to carriage service providers: (a) involved in the supply of a telecommunications service; and (b) when conducting a high-risk customer interaction relating to a customer of a carriage service provider. but it does not apply to a customer who is an account managed customer or an integrated customer.

5 Objectives The objectives of this determination are to: (a) reduce the harm caused to customers when access to their personal information, business information or telecommunications service is targeted by unauthorised persons or entities; and (b) require carriage service providers to follow effective identity authentication processes to protect the security of high-risk customer interactions.

6 Definitions (1) In this determination: access-controlled defence site means defence premises which can only be accessed through a defence access control point. account information authenticator means a process used to establish that the requesting person is the customer, or is the customer's authorised representative, for the telecommunications service based on the requesting person's knowledge of a piece of the customer's account security information. account managed customer means a customer of a carriage service provider where the provider assigns one or more of its employees or agents to be a designated contact person for the customer, in relation to all matters relating to the customer's telecommunications services. account security information means information which is created for the purpose of applying security to an account and which may include one or more of: (a) an account username or login information which is used to log into the customer's account on the carriage service provider's website or mobile application; (b) an account number; (c) an account password; (d) a personal identification number related to the account; or (e) the answer to a security question which has been set up for the purposes of identity authentication. Act means the Telecommunications Act 1997.