Watchdog Finds Vodafone Australia Breached Privacy Obligations

Mobile phone operator Vodafone Hutchison Australia breached its obligations under the Privacy Act by allowing customer details kept on a web portal to be compromised, Australia's privacy watchdog ruled Wednesday.

But the Privacy Commission cleared Vodafone of a more serious allegation that customers' personal information, including credit card details, was available on a publicly accessible website.

"In my view, Vodafone did not have appropriate security measures in place to protect customer's personal information at the time. Consequently Vodafone was in breach of their obligations under the Privacy Act," Privacy Commissioner Timothy Pilgrim said in a statement.

"I was particularly concerned by Vodafone's use of shared logins and passwords for staff and the broad range of detailed personal information available to them," Pilgrim said.

Vodafone last month fired an unspecified number staff after discovering a password-secured web portal was compromised when an employee shared the access password.

The commission currently has only limited powers to penalize Vodafone for any breach of the Privacy Act. The Australian government plans to grant additional powers to the watchdog as part of privacy law reforms still to be enacted.

Vodafone has agreed to review its security and issue staff with individual online identifications and passwords in response to the commission's findings.

"There were areas that needed improvement, which this incident highlighted. We responded quickly, took action with those employees involved who had shared passwords, and brought forward the implementation of a number of new security measures to better protect all customer information," Nigel Dews, chief executive of Vodafone Hutchison Australia, said Wednesday.

Vodafone Hutchison Australia is a joint venture between Vodafone Group PLC (VOD.LN) and Hutchison Telecommunications Australia Ltd. (HTA.AU). It had around 7.43 million mobile phone customers on June 30, 2010.

-By Rachel Pannett, Dow Jones Newswires; 61-2-6208-0901; [e-mail]