6. UPP 6: Direct marketing
Updates and background for this project (Digest)
WHAT IS “DIRECT MARKETING”?
6.1 “Direct marketing” is used by businesses to sell goods and services directly to consumers, bypassing wholesalers and retailers. The producer markets and promotes its goods or services to current and potential customers using conventional and/or electronic communication channels. The former can include mail-outs of advertising material (catalogues, leaflets, brochures or letters), telephone promotion and sales (telemarketing), broadcast fax, and direct-response television and radio. The latter includes web-based sales, email and SMS, as well as other emergent technologies. Direct marketing is a growing phenomenon in Australia, increasing in use at a rate of 17% per annum and now representing over 50% of all media spending.1
6.2 Direct marketing has the potential to impinge on privacy where it utilises databases to target customers. It can involve “the establishment and maintenance of quantities of data about prospects and customers, which is exploited in order to enhance the probability of making a sale to each of them”.2 Direct marketers can use many sources, including public registers such as the electoral roll, telephone directories and land title registers, to compile their lists of individuals to target,3 without an individual knowing his or her personal information is being collected for this purpose.
RELEVANCE FOR NSW
6.3 As explained in the Introduction, the Commission proposed in its CP 34 that NSW legislation apply only to the handling of personal information by agencies5 and the ALRC made a corresponding recommendation in relation to the Privacy Act.
6.4 On the basis, then, that NSW privacy legislation will be changed to apply only to agencies, including State-owned corporations, the incidence in NSW of use of personal information for direct marketing is likely to be extremely small. It is difficult to call to mind many, if any, instances of agencies directly marketing their goods and services to prospective customers, and therefore difficult to envisage them doing so in the future. What is more common is for agencies to use contact details of its current customers to send material to those customers, such as other services the agency can offer, or information about prices and charges. It is arguable, in that context, that distribution of such material is performing a public service rather than acting as direct marketing. Be that as it may, use of personal information by NSW agencies for the secondary purpose of direct marketing will be relatively uncommon.
6.5 The main purpose of this chapter, therefore, is to contribute to the evaluation of the ALRC’s recommendation for balancing privacy considerations and direct marketing practices. If not for the goal of national uniformity, a review of NSW legislation in isolation would probably have concluded that a separate privacy principle regulating direct marketing was not warranted.
ALRC REPORT 108
6.6 Following on from the view we hold that a separate privacy principle regulating direct marketing is not warranted in NSW, it is constructive to note the ALRC’s conclusions.
6.7 The ALRC has recommended that the UPPs should regulate direct marketing in a discrete UPP, separate from the use and disclosure UPP.6 However, mirroring our thinking, the ALRC has concluded that this UPP should apply only to organisations.
Rationale for excluding agencies from the ambit of the direct marketing principle
6.8 The ALRC reviewed the submissions it received in response to the question whether agencies should be subject to the proposed direct marketing principle.7 It noted that there was some support for the application of the principle to agencies,8 including on the basis that this was consistent with the proposal for one unified set of principles,9 and an ackowledgement that “[t]here has been an increasing tendency for government agencies to use direct marketing techniques to promote government services and programs”.10
6.9 On the other hand, agencies submitted that there was a legitimate distinction to be drawn between their direct marketing activities and those of organisations.11 They argued that when they contacted individuals it was only “to offer and/or promote government services” that are of benefit to the public whereas private sector enterprises “are trying to sell goods for their own commercial benefit”.12 The Office of the Federal Privacy Commissioner (“OPC”) supported the agencies’ view, taking it one step further in arguing that it is a “legitimate function” of agencies to ensure individuals are “kept informed of policies, services and entitlements relevant to them”.13 Furthermore:
Permitting individuals to opt out of receiving this type of information from agencies may lessen the extent to which the community is aware of what the government is doing and what effect it may have on individuals.
Communications campaigns conducted by agencies are qualitatively different to the practice of “Direct Marketing” in the private sector, in that they are not conducted primarily to generate a benefit or advantage to the entity, but rather to promote a fully informed constituency.14
6.10 The OPC conceded that “agencies do not have, and should not have, an unfettered right to use personal information to contact individuals for any purpose unrelated to their administrative and policy responsibilities”.15 However, improper use and disclosure of personal information would be caught by UPP 5.16
6.11 The ALRC agreed with submissions that the application of a direct marketing principle to agencies “may preclude the legitimate communication of important information by agencies”.17 It concluded that the direct marketing UPP should not, therefore, apply to agencies.
A direct marketing principle to apply to organisations
6.12 The ALRC recommended that the direct marketing UPP should apply regardless of whether the organisation has collected the individual’s personal information for the primary purpose, or a secondary purpose, of direct marketing. The principle should distinguish between direct marketing to individuals who are existing customers and direct marketing to individuals who are not existing customers.18
6.13 The proposed direct marketing principle, UPP 6, provides as follows:
How does UPP 6 differ from the current Commonwealth principles?
6.14 There is presently no Principle under the Privacy Act dealing with direct marketing by agencies. There is, on the other hand, an NPP that deals with direct marketing by organisations as part of the use and disclosure principle. As set out in Chapter 5, NPP 2 prohibits use or disclosure of personal information for a secondary purpose, except in a number of specified circumstances.19 The exception that is relevant here is contained in NPP 2.1(c). NPP 2.1(c) permits use, but not disclosure, of personal information that is not sensitive information for direct marketing, providing a number of conditions are met. These are:
- it is impracticable to seek the individual’s consent to the use of his or her information for direct marketing;
- the individual has not asked not to receive direct marketing communications;
- each direct marketing communication clearly notifies the individual that he or she can ask not to receive any more; and
- each direct marketing communication sets out the organisation’s phone number and a business or electronic address, depending on whether the communication is written or sent electronically.
6.15 In addition, if the individual subsequently asks not to receive any further direct marketing communications, the organisation is prohibited from levying a charge on the individual for discontinuing the communications.
6.16 Aside from the specific reference to direct marketing in NPP 2.1(c), an organisation could use or disclose information for directing marketing purposes if:
- this was the primary purpose for which the information was collected;
- the secondary purpose of direct marketing is related (or directly related in the case of sensitive information) to the primary purpose of collection and the individual would reasonably expect the organisation to use or disclose the information for direct marketing purposes;20 or
- the individual consents to use of his or her information for direct marketing.21
6.17 Unlike NPP 2.1(c), UPP 6 allows both use and disclosure of information for direct marketing. The second significant departure from the existing principle is that UPP 6 distinguishes between an organisation’s existing customers, and individuals who are not existing customers or who are younger than 15 years. UPP 6 applies different conditions to each circumstance.
6.18 In the first scenario, the organisation may use or disclose personal information for direct marketing where the individual would reasonably expect such use or disclosure; and the organisation provides the individual with an easy way of putting a stop to the direct marketing communications. The second scenario stipulates that the organisation must:
- have either the individual’s express consent, or demonstrate that obtaining consent was impracticable and the information is not sensitive;
- give the individual notice that he or she can put a stop to the communications, and provide an easy way of doing so; and
- disclose to the individual the source of its information about the individual, if asked.
6.19 The decision to take direct marketing out of the use and disclosure principle and regulate it in a dedicated principle was to overcome an ambiguity relating to the purpose for which the information was collected.22 Under NPP 2.1(c), it is important to determine whether an organisation that collects personal information that it intends to use later for direct marketing has collected the information for the primary or secondary purpose of direct marketing. This is not always clear-cut. Furthermore, if it can be shown that the information was collected for the primary purpose of direct marketing, under NPP 2.1(c), it can be used “almost without restraint”,23 an entirely unsatisfactory situation. The problem of different consequences flowing depending on whether information has been collected for the primary or secondary purpose of direct marketing is eliminated by making the direct marketing rules apply regardless of the purpose for which the information was collected.24
6.20 The ALRC acknowledged that the issue of direct marketing has been, and continues to be, the subject of a very strong response from stakeholders and the community generally:25
On one hand, there is a strong push from consumers and consumer advocates to tighten the rules on direct marketing to make it more difficult for companies engaged in direct marketing to communicate with people in this way, particularly with respect to unsolicited direct marketing. This draws on the conceptualisation of privacy as including, at least, “the right to be let alone”.
On the other hand, business groups and others have emphasised the importance of direct marketing for the economy generally. They have also stressed that, if direct marketing is carried out appropriately, it can be of considerable assistance to consumers that receive direct marketing communications.26
6.21 The ALRC has formulated UPP 6 so as to balance these competing positions.27 Crucial to achieving the appropriate balance was to make the requirements that apply to direct marketing to individuals who are not existing customers more onerous than those applying in relation to existing customers.28 This recognises that “direct marketing to existing customers is a legitimate business activity and is acceptable where it is within the reasonable expectations of such customers”.29 UPP 6 also allows sensitive information to be used or disclosed for the purpose of direct marketing but only to existing customers and only where it is within the customer’s reasonable expectations.30
6.22 Whether use or disclosure of information for direct marketing could be reasonably expected would depend on the level of sensitivity that attaches to the information.31 The ALRC concluded that the concept of reasonable expectation was “an appropriate way to anchor the requirements applying in the context of existing customers” and noted that the concept is already used in the Privacy Act in relation to use and disclosure of information.32
6.23 Resolving the question of whether an individual is an existing customer would depend on the particular circumstances and the organisation involved, but would need to be more than a one-off transaction and would involve an ongoing commercial, contractual or business relationship.33 However, direct marketing to an existing customer need not be restricted to goods or services already purchased by the customer.34
6.24 The part of UPP 6 that regulates direct marketing to individuals who are not existing customers was generally modelled on the existing requirements attaching to secondary purpose direct marketing under NPP 2.1(c). However, the ALRC was of the view that further protections were warranted in relation to the use or disclosure of sensitive information for the purpose of unsolicited direct marketing, and direct marketing to persons under 15 years. For example, the concept of “impracticability” under UPP 6 is broader, and more flexible, than that which exists currently in relation to secondary purpose direct marketing because “whether it is possible logistically to contact the relevant individuals is not a complete answer to the question of whether it is impracticable to obtain consent”.35
6.25 The ALRC also considered whether UPP 6 should be formulated as an “opt-out” or “opt-in” model, that is, whether direct marketing may be permissible until such time as an individual indicates a wish not to be subjected to approaches (“opt-out”), or whether direct marketing approaches can only be made to those individuals who indicate that they are prepared to receive communications (“opt-in”). It proposed that the direct marketing principle should require organisations to present individuals with a simple means to opt out of receiving direct marketing communications.36
6.26 The majority of submissions received by the ALRC in response to this proposal were in support,37 although some submissions qualified that support. For example, Optus and the Australian Direct Marketing Association argued that it would be too restrictive, and also unnecessary, to require each and every direct marketing communication, particularly to existing customers, to provide an individual with an opportunity to opt out.38
6.27 The ALRC concluded that the concerns expressed by stakeholders were addressed by a principle that was media neutral and required organisations “to provide a simple and functional means by which an individual (whether or not an existing customer) may”, at any time, “advise the organisation that he or she does not wish to receive any further direct marketing communications”.39
6.28 The ALRC concluded that it was legitimate to distinguish between existing and prospective customers in imposing conditions as to “the frequency with which express opportunities to opt out must be provided by organisations”.40 Modelling the formulation of UPP 6.2(b) on NPP 2.1(c)(iv), the ALRC recommended that every direct market communication that is to an individual who is not an existing customer, or is under 15 years of age, must provide an opportunity to opt out of receiving further direct marketing communications.41 The ALRC was of the view that this requirement was “warranted by the high level of community concern about unsolicited direct marketing”.42 On the other hand, it was sufficient for existing customers simply to be made aware, through an organisation’s Privacy Policy, that they had the right to opt out of direct marketing communications at any time.43
6.29 UPP 6 specifically regulates direct marketing to children under 15 years of age because of their greater susceptibility to commercial manipulation as compared with adults, and less developed cognitive capacity and maturity to give informed consent. It also recognises that digital technologies (in particular, the internet, email and SMS) are increasingly being used by organisations to target children.44 Under UPP 6, children under the age of 15 can never be treated as “existing customers”. Rather, the provisions applying to non-existing customers likewise apply to children. UPP 6.2(a) requires the organisation to obtain the child’s consent to the direct marketing, unless it is impracticable to do so and providing the information is not sensitive. This effectively means obtaining parental consent, as the ALRC has recommended that, where it is not reasonable or practicable to assess the capacity of a child under 15 to give consent, it is presumed that he or she is not capable of consenting.45
6.30 When UPP 6.2 was proposed in DP 72, the Obesity Policy Coalition submitted that the obligations it imposed were insufficient and would “too easily allow organisations to avoid the consent requirement where ‘it is difficult to identify, locate or communicate’ with the person with parental responsibility”.46 To meet this criticism, the ALRC has proposed that the OPC should give guidance as to how the exception would operate so as to limit organisations claiming in inappropriate circumstances that it is impracticable to obtain parental consent.47 The ALRC concluded that this proposal, together with the conditions imposed by UPP 6 and its recommendations regarding decision-making on behalf of individuals under the age of 18, provided sufficient protection for children.48
6.31 The provision in UPP 6.2(d) (revealing the source from which an organisation acquired an individual’s personal information) was included to “facilitate individuals being able to assert substantive, as distinct from merely formal, privacy rights with respect to direct marketing”.49 It enables an individual who has received unsolicited marketing communications to go to the source of the contact information and take action to have his or her name removed from the data bank, or lodge a complaint if appropriate. As the OPC submitted, this “would enhance transparency in how individuals’ personal information is handled and promote handling that accords with individuals’ reasonable expectations”.50 The Public Interest Advocacy Centre also submitted that it would “empower individuals to take back control” of the use of their personal information, and may encourage organisations to consider carefully “whether they have a legitimate basis for collecting the personal information in the first place”.51
6.32 In formulating UPP 6.2(d), the ALRC took note of submissions objecting to the requirement to reveal the source of personal information on the basis of the difficulty and expense in complying, and the fact that its terms of reference required it to consider the “desirability of minimising the regulatory burden on business in the privacy area”. It therefore limited the right to ask where an organisation got its information from to individuals who are not existing customers. This recognises that there will be most concern about privacy where there is no existing business relationship between an organisation and an individual,52 without unduly adding to the compliance burdens faced by organisations. Another balancing factor is introduced by the proviso that an organisation need only comply with the requirement to reveal the source of its information if this is reasonable and practicable.
THE COMMISSION’S VIEW
6.33 The Commission supports inclusion in privacy legislation of a dedicated privacy principle to regulate direct marketing. Advertising and promotional material posted to an address or deposited in a letterbox can be irritating but the increasing onslaught of direct marketing via telephone, fax, internet, email and SMS can be not merely irritating but of significant concern for its privacy implications. This is particularly so when a person has never done business with the organisation sending the communication. Individuals can also find it difficult to have their details removed from a direct marketing list, once they have been included in one.
6.34 However, the Commission agrees with the ALRC that it is fair to draw a distinction between the material sent by public sector agencies and the material sent by private sector organisations. When an agency engages in direct marketing it can generally be categorised as a public service, as the purpose is predominantly to keep the public informed of policies, services, charges and entitlements, whereas, when an organisation engages in direct marketing, it is to reap commercial benefits for the organisation. The Commission therefore agrees that a direct marketing principle should apply to organisations only.
6.35 The Commission also supports drawing a distinction between direct marketing to existing customers and direct marketing to individuals who are not existing customers, and regulating the latter more strictly than the former. We also particularly support the protections that are built into UPP 6 for children under 15 years. This is a vulnerable target audience for direct marketing: children’s susceptibility to media manipulation, and not yet fully developed cognitive abilities, call for special treatment by the law.
FOOTNOTES
1. Nielsen Media Research, «http://www.nielsenmedia.com.au/industry.asp?industryID=21» at 9 February 2009.
2. R Clarke, “Direct marketing and privacy” (version of 23 February 1998) «http://www.rogerclarke.com/DV/DirectMkting.html» at 9 February 2009.
3. Australian Law Reform Commission, For Your Information: Australian Privacy Law and Practice, Report No 108 (2008) (“ALRC Report 108”) vol 2 [26.1].
4. NSW Law Reform Commission, Privacy Legislation in New South Wales Consultation Paper 3 (2008) (“NSWLRC CP 3”).
5. NSWLRC CP 3 Proposal 3.
6. ALRC Report 108 vol 2 Recommendation 26-1.
7. ALRC Report 108 vol 2 [26.42]-[26.47]; See Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007) (“ALRC DP 72”) Question 23–1.
8. Australian Privacy Foundation, Submission PR 553, 2 January 2008; Australian Direct Marketing Association, Submission PR 543, 21 December 2007; Confidential, Submission PR 535, 21 December 2007; P Youngman, Submission PR 394, 7 December 2007.
9. Law Council of Australia, Submission PR 527, 21 December 2007.
10. Public Interest Advocacy Centre, Submission PR 548, 26 December 2007. See also Australian Privacy Foundation, Submission PR 553, 2 January 2008; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.
11. Australian Government Department of Agriculture‚ Fisheries and Forestry, Submission PR 556, 7 January 2008; Australian Government Centrelink, Submission PR 555, 21 December 2007; Australian Government Department of Human Services, Submission PR 541, 21 December 2007; Medicare Australia, Submission PR 534, 21 December 2007.
12. Medicare Australia, Submission PR 534, 21 December 2007. See also Australian Taxation Office, Submission PR 515, 21 December 2007; and Australian Government Department of Agriculture‚ Fisheries and Forestry, Submission PR 556, 7 January 2008.
13. Office of the Federal Privacy Commissioner, Submission PR 499, 20 December 2007.
14. Office of the Federal Privacy Commissioner, Submission PR 499, 20 December 2007.
15. Office of the Federal Privacy Commissioner, Submission PR 499, 20 December 2007.
16. ALRC Report 108 vol 2 [26.47].
17. ALRC Report 108 vol 2 [26.48]. It is important to bear in mind that the ALRC reached its conclusions on the basis that “agencies” will not generally include Commonwealth, State or Territory commercial enterprises which are in competition with private sector organisations.
18 ALRC Report 108 vol 2 Recommendation 26-1.
19. ALRC Report 108 vol 2 [26.9].
20. NPP 2.1(a).
21. NPP 2.1(b).
22. ALRC Report 108 vol 2 [26.30]-[26.31].
23. ALRC Report 108 vol 2 [26.15], quoting Law Council of Australia, Submission PR 177, 8 February 2007.
24. ALRC Report 108 vol 2 [26.16].
25. ALRC Report 108 vol 2 [26.27].
26. ALRC Report 108 vol 2 [26.27]-[26.28].
27. ALRC Report 108 vol 2 [26.29].
28. ALRC Report 108 vol 2 [26.33].
29. ALRC Report 108 vol 2 [26.67].
30. ALRC Report 108 vol 2 [26.83].
31. ALRC Report 108 vol 2 [26.83].
32. ALRC Report 108 vol 2 [26.86].
33. ALRC Report 108 vol 2 [26.84]-[26.85].
34. ALRC Report 108 vol 2 [26.84].
35. ALRC Report 108 vol 2 [26.88].
36. ALRC DP 72 Proposals 23-3 and 23-4.
37. ALRC Report 108 vol 2 [26.92].
38. ALRC Report 108 vol 2 [26.96]-[26.97].
39. ALRC Report 108 vol 2 [26.99].
40. ALRC Report 108 vol 2 [26.100].
41. ALRC Report 108 vol 2 [26.100].
42. ALRC Report 108 vol 2 [26.100].
43. ALRC Report 108 vol 2 [26.100].
44. ALRC Report 108 vol 2 [26.101].
45. ALRC Report 108 Recommendation 68-1.
46. ALRC Report 108 vol 2 [26.104].
47. ALRC Report 108 vol 2 [26.106].
48. ALRC Report 108 vol 2 [26.106]-[26.108].
49. ALRC Report 108 vol 2 [26.136].
50. ALRC Report 108 vol 2 [26.122].
51. ALRC Report 108 vol 2 [26.123].
52. ALRC Report 108 vol 2 [26.138].
