An assessment of the risks Family Plans present for users vulnerable to domestic and family violence

This report investigated the surveillance risks associated with so-called Family Plans (i.e., mobile phone/landline in multiple names) offered by most Australian Telecommunications companies (Telcos). Data share arrangements these Family Plans offer can be exploited to harm those involved in family and domestic violence. It is therefore important to understand the surveillance and privacy risks associated with these plans. To this end, we first collated the information regarding Family Plans the three major Australian Telcos (i.e., Telstra, Optus, and Vodafone) provide their consumers. Second, we investigated the strategies used to motivate consumers to sign up for Family Plans.
All three Telcos offer Family Plan arrangements that pose surveillance and privacy invasion risks. For all Telcos, one customer has access to device usage details for all users. The customer also has control over allowing other users on the plan reciprocal access about themselves. Of concern is that none of the Telcos makes any substantial effort to seek informed consent from all users regarding the collection and storage of their data and the availability of that data to the customer.
All three Telcos provide information on usage data (e.g., call, SMS, and data information). This information does not extend to detailed information on the numbers from which calls and messages are received, the content of any SMS messages or the location of any device associated with the plan. However, all three Telcos state that location data of all phones on the plan are collected and stored. Telstra customers may obtain this data through direct request and an associated fee whereas the process for gaining this information for Optus and Vodafone was not explicit.
Telstra and Optus both have features that enable location tracking, whereas Vodafone does not. Telstra's Device Locator is a feature that can be set up on each device and when enabled, provides information on the device’s last known location based on its connection to the mobile network. In contrast, Optus offer all customers a free subscription to a third-party app that permits monitoring. However, unlike Telstra's Device Locator, this third-party app must be installed and is not linked to the customer’s Optus account.
All three Telcos provide incentives for customers to enter these Family Plan arrangements. These incentives provide discounts for combining multiple plans under a single customer account which is desirable given the affordability of these services is a substantial issue for many Australians.
Based on these findings, we offer four recommendations to reduce or eliminate surveillance and privacy invasion risks associated with Family Plans. Three of our four recommendations are concerned with improving transparency and awareness around data sharing in the context of Family Plan arrangements to ameliorate the risks that these arrangements pose. Our fourth recommendation, however, is to replace Family Plans with dual contract offers so that each individual adult is their own recognised customer. In an age where the importance of maintaining privacy over personal data is becoming increasingly recognised, it is no longer appropriate for Telcos to entice the users of their services to sacrifice this privacy in the name of a better deal. Personal data can be weaponised in domestic and family violence scenarios and Telcos have an obligation to educate their customer base about these risks, and encourage privacy best practice. Family Plans that necessitate personal data disclosure among multiple device users are not commensurate with these obligations.