No good reason for invasion of directors’ privacy

In what other professions does this happen?

Remember, there are about 2.2 million registered company directors in Australia, the vast majority of whom sit on the boards of private proprietary companies, large unlisted firms, charities, and not-for-profits – large and small. Another 0.5 per cent are on publicly listed company boards.

No other professional group in society – not politicians, senior bureaucrats, lawyers, or journalists – is required to divulge their home address or date of birth on a public register. This is despite all of these roles providing vital services to the community.

In its modest changes to the public access settings for the companies register, ASIC has expressly outlined that relevant agencies, liquidators, journalists, and others with legitimate cause will continue to be able to access home address information via a simple application process and, in some instances, a small fee.

We should not be making it easy for the scammers and cybercriminals to access this information.

All it means is that the home address of company directors and their date of birth won’t automatically be available for all and sundry to see. This isn’t a hypothetical argument. The inclusion of these personal details, residential addresses in particular, has for years exposed company directors to unnecessary risk.

Indeed, it was the terrorist attack at Bondi last December that brought this issue into sharp focus. Following security advice, the government instructed ASIC to suppress the personal information of directors on an interim basis as a precaution, ahead of the formal consultation that’s under way.

The Australian Institute of Company Directors has long advocated for stronger protections for directors’ personal information, including the removal of residential addresses. The physical and cyber threats faced by directors with the public availability of this data are an unacceptable risk in this day and age.

It is possible for cybercriminals to use director information for the purpose of impersonating directors and running scams, fraudulently claiming GST, and applying for credit. All that’s needed is a director’s name, date and place of birth, as well as their home address.

We should not be making it easy for the scammers and cybercriminals to access this information.

We’ve seen cases where the homes of high-profile directors have been the target of protests and other unwelcome activities that have threatened their sense of security and created an air of menace for them, their families and neighbours.

There are plenty of ways for activists to legitimately protest, express their views and make their point, without targeting the homes of company directors.

Limiting public access to residential addresses, while preserving appropriate access for regulators and other authorised parties including liquidators, lawyers and journalists, strikes a proportionate balance between transparency and risk management and reflects a core principle of good governance.

The removal of directors’ residential addresses from full public access will also bring Australia into line with comparable jurisdictions. ASIC has made clear that those with legitimate regulatory and business needs will continue to have access to this information, as they should.

Serious concerns

To be clear, the AICD still holds serious concerns over ASIC’s proposal to make the residential addresses of directors publicly available if they haven’t nominated a service address.

No other group has their home address published and made available to the public this way. With millions of directors across companies, charities and community organisations, the protection of private information should be paramount.

As ASIC itself says, the intent of the proposed changes is to keep core company information broadly available while restricting sensitive personal information to verified users who have a clear need for it, amid an increasing risk of cybercrime and impersonation scams.

To avoid any confusion, the changes do not in any way change the information ASIC collects on directors. This information is critical to ASIC performing its regulatory functions and the effectiveness of the Director ID regime to guard against illegal phoenixing.

Those concerned that these changes amount to the suppression of public information are entitled to put forward that view, but it is important to consider the proposal in its full context and avoid overstating its effect.

Despite these protestations, no one who legitimately needs it is being denied information.

Those with a legitimate need for it will continue to be able to access directors’ personal details, while the integrity, transparency and accountability built into the system will remain intact.

That should be preserved without putting the safety and wellbeing of directors and their families at risk.