The government ignored advice that the cost of implementing mandatory data retention for telcos was $55 million lower than expected, leading it to give out $28 million more than was needed, a new audit report has found.
Subscribe now for unlimited access.
$0/
(min cost $0)
or signup to continue reading
When the government announced in 2015 telecommunications companies would be required to retain customers' metadata for two years, it also committed to covering half of the industry's costs through a grant program. Instead it ended up covering 79 per cent of the costs involved.
The extra spending was a risk of the way the program was designed, the Australian National Audit Office found, with 26 providers having their costs of implementing the program completely covered by the government to the tune of $23 million.
"Implementation of the program was not to an appropriate standard having regard to the risks involved and the policy outcomes being sought," the report said, pointing to issues managing conflicts of interest, errors and delays in developing and signing the grant agreements and the reporting and administration of the grants.
The report found the Attorney General's Department engaged consultants PriceWaterhouseCoopers to estimate the costs to industry in February 2015, with the midpoint coming in at $254 million. That led to the decision for the government to set aside half of that sum, about $128 million for the grant program. Despite better data in 2016 showing the cost to industry to implement the program was $55.4 million lower than first estimated, at $198.5 million, the total grant funding amount was not revised down.
"The data from eligible providers that applied for funding would have supported a reduction of $28 million (22 per cent) in program funding whilst still meeting 50 per cent of estimated industry costs (as earlier agreed by the government)," the report found.
"Limiting grant expenditure to 50 per cent of the aggregated estimated costs of industry applicants would have saved $28 million in Australian government expenditure."
The report found after the program had actually been implemented, telcos reported in June this year the cost to industry was lower than the second estimate, at $154.7 million, "meaning the Australian government has met 79 per cent of industry’s reported upfront capital costs of achieving compliance with the data retention obligations".
The report found there was no probity plan in place, an assurance plan was not fully implemented and risks around conflicts of interest weren't well managed.
PriceWaterhouseCoopers had some telcos as clients, including Telstra and some smaller internet providers, and while the consulting company ensured staff working on the government project were not also working for the telcos.
The report found the Attorney General's Department didn't manage the conflicts consistently.
The Attorney General's Department and the Department of Industry, Innovation and Science agreed with four recommendations made by the auditor-general, with the Attorney General's department saying it had already began to implement the recommendations.
Former attorney general George Brandis announced in 2016 Telstra, Optus and Vodafone made up the bulk of grant recipients, receiving more than $83 million of the grants between them.
A review of the effectiveness of the way data retention is used by law enforcement agencies will be conducted next year.
