Privacy Law and Policy Reporter
In July 1994 the Ministerial Council on Consumer Affairs, composed of Commonwealth, State and Territory Ministers, directed the Standing Committee on Consumer Affairs to examine emerging trends in direct marketing and suggest appropriate options to promote fair trading and consumer protection. This followed a report of the working party on the sale of mailing lists from July 1994. The Standing Committee established a working group to examine the issues and present a report to the July 1995 meeting of the Ministerial Council on Consumer Affairs. The working group has now issued its discussion paper and seeks comments.
The committee's discussion paper identifies five issues relating to direct marketing and consumers. These issues are: information; delivery; payment; privacy; and redress.
The discussion paper suggests that privacy 'is probably the issue that is of the greatest concern' (p 7).
In issues 5 and 19, discussing information practices, the paper notes that consumers are rarely informed about how their personal details were obtained. Nor are they told that their personal information may also be sold to other direct marketers. Many consumers would not be aware that their personal details may be captured through a range of transactions such as enrolment in a loyalty marketing scheme, filling out warranty cards, or entering a competition.
The report canvasses whether direct markets should be required to advise consumers of the source of their personal information used in marketing, whether consent for inclusion on a mailing list should be required, and whether it should be required on an opt-in or opt-out basis. It notes that the Council of Europe Recommendation on the Protection of Personal Data for the Purposes of Direct Marketing allows for mailing lists to be sold to third parties provided that all consumers have been informed of the possibility of transmitting data to third parties and provided they have not objected.
Issue 13 raises the question of whether privacy and consumer protection issues should be handled by separate codes of practice or in a single code. The report notes that while consumer issues have an economic basis, privacy issues arise from a much wider social concern: 'the need to protect the individual as a member of society in his or her dealings with large or powerful organisations, which hold personal information about individuals and use increasingly sophisticated techniques to process that information' (p 22).
Issue 14 questions whether there should be any restrictions on the categories of personal information collected by direct marketers, or whether a higher standard of data protection should be applied to particular categories. Marketers are now amassing large databases of personal information. In the course of its investigations, the working group has become aware of a database which holds 195 categories of information on individuals.
The report notes that the Council of Europe Recommendation requires the express consent of the data subject for the collection of certain information. Article 6 of the Convention for the Protection of Individuals with regard to the Automatic Processing of Personal Data sets out these categories including racial origin, political opinions, religious or other beliefs, health, sexual life and criminal convictions.
Issue 15 notes the increased use of computer matching and profiling technologies and asks whether restrictions should be placed on the extent to which data is matched.
Issue 16 relates to the use of 'intelligent hardware' such as calling line identification and automatic dialling equipment. A strong objection to the calling number display is the potential for direct marketers to use this information. The working group asks whether, assuming that CLI is adopted, restrictions should be placed on the use of this information by direct marketers. It also asks whether restrictions should be placed on the use of automatic dialling equipment.
The approach of interactive media through broadband networks is discussed in issue 17. It foreshadows a range of issues likely to emerge in coming years with services such as home shopping and video-on-demand. The paper questions whether there should be any controls on the collection and use of such personal information as general personal information, as well as specific transaction-based records such as viewing and purchasing habits relating to the users of interactive media.
The paper also raises more traditional concerns relating to limitations on telephone contacts between consumers and direct marketers in issue 18. Issue 20 asks whether there should be controls over publicly-available information, such as that held on share registers, business name registrations, electoral rolls and telephone directories.
Noting that the direct marketing industry is not affected by privacy legislation in Australia, the working group turns to the question of general private sector regulation in issue 21. It notes that most industrialised countries have adopted a self-regulatory or co-regulatory approach. France has a Code of Conduct for Direct Marketing; NZ has the Privacy Act 1993 which covers the private sector and facilitates the development of industry-specific codes. The UK has a limited degree of regulation. The US has voluntary national privacy guidelines developed by the Direct Marketing Association, but no general, private sector legislation.
Provisions relating to consent, access, correction, erasure and notification of third party disclosure are included in the Directive on the Protection of Individuals with Regard to the Processing of Personal Data and on Free Movement of Such Data from the Commission of European Communities. The Council of Europe also adopted standards relating to direct marketing in October 1985, establishing opt-out provisions on third party disclosure, as well as rights relating to access, correction and notification.
The working group is seeking comment relating to these issues, in particular the content of any privacy regulation on direct marketers, the nature of any complaints handling body and enforcement mechanism, and what redress might be available to consumers by way of penalties against direct marketers who act in contravention of regulations.
In assessing regulatory options in issue 24, the discussion paper canvasses self-regulation, voluntary codes, mandatory codes, legislation, and broad-versus-specific regulation. The paper suggests that 'it may not be sufficient to leave individuals' privacy and economic interests in the hands of those who often have contrasting interests' (p 36). It suggests that while there is value in industry taking responsibility for administering and playing a part in enforcing standards, it is also important that consumers have an active role in obtaining a fair bargain and enforcing control of their personal data.
The paper also notes that it is important that there be a means of independent scrutiny and enforcement of standards in relation to disputes. While a voluntary code may establish the mechanism of a code compliance committee, 'if the sanctions are not enforceable or there is little incentive to comply then it may, in reality, be little better than self-regulation' (p 37). A mandatory code may provide enforceability, but would require legislative amendments at a Commonwealth and/or State level.
The main difficulty relating to legislation is uncertainty over whether the Commonwealth has power to legislate with respect to privacy rights in the private sector. The alternative option of State-based legislation raises concerns that Australia could develop a set of nationally inconsistent privacy protection standards. Another issue is whether such legislation would be implemented under consumer protection legislation or privacy legislation. The paper also suggests that legislation may not be the appropriate form in which to develop the kind of detailed regulation required. This might be better enforced through general legislative principles and more specific codes.
The final regulatory issue raised in the discussion paper is whether regulation should be broad or specific. The report notes that direct marketing is not limited to a single sector, but occurs across the public and private sectors. This might suggest that the most appropriate regulation would be to develop general principles across industry, although these could be supplemented by different codes for individual sectors.
The Standing Committee is consulting with groups from the industry, charities, regulatory bodies and the consumer movement on each of these issues. Comments may be directed to Ms Mandy Doherty, Senior Policy Officer, Federal Bureau of Consumer Affairs, Robert Garran Offices, National Circuit, Barton ACT 2600.