In a statement on Sunday, the APF said the ABC was yet to deal with unresolved questions, "particularly about adequate disclosure of their apparent intent to export individual-level, ineffectively de-identified iview account usage data to foreign third party commercial surveillance companies like Tealium, Google and Facebook".
The privacy body initially raised these issues with the ABC in March and followed up in April.
As iTWire has reported, after a period of holding off following its announcement that iview logins would be made compulsory in March, the ABC, which is entirely taxpayer-funded, made the use of credentials compulsory during the federal election campaign.
Security researcher Dr Vanessa Teague, who runs her own outfit Thinking Cybersecurity, has illustrated the extent to which iview user data is being siphoned to commercial companies, using a video in March.
Though the ABC said initially, it would allow those who did not wish to have their data sent to these companies to opt out, that feature has not been implemented.
APF chair David Vaile and vice-chair Dr Juantita Fernando said in Sunday's statement: "Dr Teague’s analysis suggested that the weak efforts to de-identify iview account users by ‘hashing’ their email address in the export data would fall at the first serious attempt at re-identification, especially if the recipient has lots of potentially matching data (as is to be the case here)".
The ABC sent a response to the APF's first letter but has since then maintained a stoic public silence after the privacy body followed up with further queries. A response marked "Private" was sent to the second inquiry.
"[The] ABC now appears to have closed the door to further consultation after a brief, inconclusive response, declining to clarify factual questions about this practice or to address related, unresolved issues," Vaile and Dr Fernando said.
Vaile pointed to the hypocrisy inherent in the ABC's journalists often investigating and writing stories about violation of privacy and the corporation's silence about its own data use policies.
"iview usage data may be intended for routine disclosure to data aggregators and marketing businesses with a history of privacy abuse” said Vaile.
"If iview consents were invalid due to failure to provide proper information about these practices, the data recipients and their implications and risks, then the operation of iview may be in breach of privacy law.”
Vaile and Fernando said unless these questions were resolved, users concerned about data security and privacy may need to reconsider using iview, or adopt defensive measures like ‘burner’ email addresses or mass sharing of accounts.
"It is unfortunate a flagship public service, ostensibly 'our' ABC, one the community expects should be promoting best practice, trustworthy safe computing and full disclosure, is leaving the facts and policy issues unresolved, putting self-respecting users in an invidious position," they added.
The ABC was contacted for comment, but has not responded.
