Picture yourself surfing the Net when a sales rep from a site you have just visited calls to sell you one of the site's products. Sensational marketing tool? Or do you feel as though your privacy just been invaded?
Direct marketers have the power to track your usage of the Net, to compile personal profiles on your likes and dislikes and amass vast databases composed of personal information. Unlike television or catalogue advertising, direct marketers now have the ability to target their advertising to a much more specific audience by using technology such as cookies or GUIDs.
Take Double Click for example. Through the use of cookies, Double Click has the ability to track the sites you visit and tailor banner advertisements to your likely interests. This ability doesn't sound too invasive until you consider what happened when Double Click merged with Abacus Direct--an offline direct marketing firm with profiles on at least 88 million American households. The merger provided Double Click with the ability to associate people's names, addresses and telephone numbers with its tracking program (which had previously been unable to identify its users).
Although this is a direct marketer's dream come true, consumers are becoming increasingly concerned about their privacy. Look at the public outcry when it was announced that Kerry Packer would have access to information obtained from electoral rolls, banks, post offices and retailers of more than 15 million Australians.
Accordingly, in April this year, the Commonwealth Government introduced the Privacy Amendment (Private Sector) Bill 2000 (the Bill). If passed, the Bill will provide legislative protection for personal privacy where no such protection has previously existed. The Bill was passed as part of the Government's commitment to addressing the concerns, and increasing the confidence of the Australian public when doing business online, while enabling full advantage to be taken of the e-commerce opportunities available for Australian businesses.
The Bill will impose restraints on the way in which businesses who collect personal information, use, disclose, and store that information. It implements the National Principles for the Fair Handling of Personal Information (NPPs) which provide a default framework for the protection of personal information. In other words, private sector organisations will be bound by them unless they have their own privacy code that has been approved by the Privacy Commissioner. A code will only obtain approval if it provides at least as much privacy protection as the NPPs.
The NPPs cover the collection, use and disclosure of personal information, data quality and security, openness, access and correction, use of identifiers, anonymity, and transborder data flows. The NPPs relating to collection, use and disclosure, access, identifiers, anonymity, and personal information will only apply to information collected after the commencement of the Bill. The NPPs relating to data quality, data security, openness and transborder data flows will apply irrespective of when the information was collected.
The Bill permits personal information to be used for direct marketing as long as certain conditions are met. These conditions include ensuring the information is not of a sensitive nature (such as race and political affiliation); and ensuring information is not used if an individual requests not to receive any direct marketing. The business must also prove that it is impractical for it to seek the individual's consent before use of the information. As for the definition of direct marketing, legally, it encompasses more than just spamming, it is defined as the marketing of goods or services or the seeking of donations "through communication at a distance", where consumers are asked to enter into a contract via communication at a distance.
The Bill currently excludes small businesses (businesses with an annual turnover of AU$3 million or less) from the operation of the legislation for a period of 12 months after the Bill's commencement. It is likely that consumer demand will require small business to also comply with the NPPs, or a similar privacy code.
We recommend direct marketers start considering their privacy policy and start instituting a privacy culture. Even if the Bill is not enacted soon, customers may not want to do business with, or disclose information to direct marketers, in the absence of a strict, clearly defined privacy policy.
Andrew Chalet is a Partner at Phillips Fox Law Firm. He can be contacted at andrew.chalet@phillipsfox.com.au
Regarding the Privacy bill talked about in this article - Privacy Amendment (Private Sector) Bill 2000 - I would like to know if the Government did indeed pass this bill...
Thanking You.