Treasurer Jim Chalmers and communications minister Michelle Rowland held a press conference in Canberra to outline amendments to the Telecommunications Regulations 2021, which the ministers say will “Allow Optus and other telcos to better coordinate with financial institutions, the Commonwealth, and states and territories, to detect and mitigate the risks of cyber security incidents, frauds, scams and other malicious cyber activities.”

They said in a release:

The amendments will enable telecommunications companies to temporarily share approved government identifier information (such as drivers licence, Medicare and passport numbers of affected customers) with regulated financial services entities to allow them to implement enhanced monitoring and safeguards for customers affected by the data breach.

It comes after the government had requested Optus share more data with authorities, in order to cross-check for fraud and other issues.

Chalmers and Rowland said the new information to be shared “Can only be used for the sole purposes of preventing or responding to cyber security incidents, fraud, scam activity or identify theft” and must be destroyed after it is used for that purpose.

They say it will allow for better fraud detection.

changes will mean only limited information will be made available temporarily

Communications minister Michelle Rowland is the first to take the mic at the press conference about these changes to the telecommunications act:

What we are going to do is amend the telecommunications regulations to do two things.

This is going to enable Optus and other telcos to better coordinate with financial institutions to detect and mitigate the risks of malicious activity, including ID theft and scams.

And the second is to allow Optus to share limited information about customers with Government agencies like Services Australia to assist in preventing fraud.

Roland said the changes are about trying to reduce the impact of this data breach on Optus customers and to enable financial institutions to implement enhanced safeguards and monitoring.

We have designed these regulations with strong privacy and security safeguards to ensure that only limited information is made available for a specific set of designated purposes.

For example, financial services entities who will be eligible to receive the data must be APRA regulated, financial institutions.

Information can only be used for the sole purposes of preventing or responding to cyber security incidents, fraud, scam activity or identity theft.

The approved recipients must satisfy very robust information security requirement and protocols for the transfer and storage of data.

All information received must be destroyed when it’s no longer required.

Original Story By | Josh Butler