Telcos confused and unprepared for new data retention laws

Fewer than one in five Australian telecommunications companies say they are ready to store all the information required under Australia's new data retention laws, which officially come into force on Tuesday.

Most major providers do not expect to fully comply with the scheme – which requires them to store Australians' "metadata" for two years – for another 18 months. Almost a year after legislation was introduced into Parliament, telecommunications companies say they remain confused about how the scheme will work and how much of the cost will be passed on to consumers.

Just 16 per cent of telcos are ready to retain and encrypt the data required of them, according to an industry survey conducted over the past two weeks by peak body the Communications Alliance.

The survey, based on responses from 63 telecommunications providers, found more than two thirds of providers were not confident at all or only somewhat confident they understood what is required of them under the laws.

The laws allow companies to work towards full compliance within 18 months, as long as they submit an "implementation plan" to the government. Approximately 80 per cent of companies - including the biggest players - have taken this option, according to the Communications Alliance survey.

Security agencies have argued they must have access to two years' worth of telecommunications data so they can catch terrorists and other offenders such as child abusers.

Companies will have to store details such as the numbers used to make and receive phone calls, as well as the duration and locations of phone calls and internet sessions. The scheme does not cover the content of phone calls amd emails or customers' web browsing history.

A Telstra spokesman said the company had submitted a data retention implementation plan to the Attorney-General's Department and was awaiting approval.

"If this is approved we will have 18 months to become fully compliant," the spokesman said.

"We continue to discuss the funding for this program with the government and other stakeholders and we are hopeful that there will be a sensible solution that does not impact on our customers or shareholders. "

A Vodafone spokeswoman said the company was "working with the federal government to fulfil our obligations by April 2017".

"Industry is still seeking clarification from government about how the funding allocated to the significant cost of systems set up and on-going data retention will be distributed among the carriers," the spokeswoman said.

An Optus spokeswoman said the company "has established a significant compliance program and is on track to meet its meta-data retention obligations".

The government has announced it will provide $130 million to telecommunications companies to pay for implementation costs associated with the scheme, but has not announced how the money will be distributed.

Communications Alliance chief executive John Stanton said: "It is no surprise that many service providers won't be compliant when the legislation comes into force - many of these because they are still waiting to hear from government as to whether their implementation place have been approved.

"All providers are still waiting to hear from government as to how it will apportion the $131.3 million that has been pledged in assistance to partially meet the set-up costs that service providers - and ultimately their customers - are facing as a result of the regime."

A spokeswoman for Attorney-General George Brandis said: "The government is working constructively with the telecommunications industry to achieve full compliance by April 2017.

"Metadata is the basic building block in nearly every counter-terrorism, counter-espionage and organised and major crime investigation. It is also essential for child abuse and child pornography offences that are frequently carried out online."

When introducing the government's data retention legislation last year, then-communications minister Malcolm Turnbull noted it "allows individual service providers to develop an implementation plan that provides a pathway to compliance over up to 18 months".

"These plans will allow industry and government to prioritise the retention of data that is most critical to investigations, while allowing service providers to significantly reduce their costs by aligning any system's changes with their internal business cycles," he said.