ACMA fines Optus $1.5m for emergency database failures

The nation’s second largest telco has failed give almost 200,000 customer details to an emergency database used to contact people during floods and bushfires.

Optus has been $1.5m for failing to provide customer details to an emergency services database. Picture: Getty Images

Optus has been fined $1.5m for failing to upload customer ­details to the public emergency database.

The nation’s second-largest telco left almost 200,000 customers “at risk” by failing to provide their details to a database used to contact people during bushfires and flash flooding, an Australia Communications Media Authority investigation found.

The fine relates to a 2½-year period from January 2021 to September 2023 and does not include the period when Optus underwent a national outage and customers were also unable to reach emergency services via piggyback methods with other networks.

ACMA member Samantha Yorke described Optus’s failure to list the almost 200,000 customer details in the integrated public number database (IPND) as “alarming”.

“While we are not aware of anyone being directly harmed due to the noncompliance in this case, it’s alarming that Optus placed so many customers in this position for so long,” Ms Yorke said.

“Optus cannot outsource its obligations, even if part of the process is being undertaken by a third party.”

The telco has admitted that it did not have “proper audits” in place to meet IPND rules.

“Optus accepts that proper audits and checks were not in place to ensure IPND obligations were being met for services we supply through our partner brands,” a spokeswoman told The Australian.

“We apologise for this and accept that we have not met community expectations.”

The telco had now introduced “audits and checks over its supplier’s performance” to ensure it would not happen again, she said.

The IPND is the database police, ambulance and fire brigades use to locate and contact customers during emergency situations including flash flooding and bushfires.

All telcos are required to upload customer details to the IPND within 20 business days of a service being active.

They are also required to crosscheck records in the IPND against their own database every six months, under the Telecommunications Act 1997.

Optus had failed to upload the contact details of users from its MVNO partners Coles ­Mobile and Catch Connect.

“All telcos need to have systems in place that ensure they are meeting their obligations, including having robust oversight and assurance processes for third-party suppliers,” Ms Yorke said.