This week’s Secret Soloist is answered by lawyer Craig Yeung.
There are laws that govern what information businesses can collect from customers and how they may use and manage that information.
Whether your business needs to comply with these laws, or the extent to which it needs to comply with them, will depend on a range of factors including the industry in which your business operates, its size, the nature of the information you intend to use and the circumstances in which the information was gathered.
Privacy Act
The key legislation governing privacy laws is the Privacy Act. It applies to most businesses with an annual turnover of more than $3 million, and some small businesses with annual turnover of less than $3 million, such as health service providers or business that are part of a larger businesses, for example, the subsidiaries of larger companies.
Businesses that are not covered by the Privacy Act can also elect to opt into the Privacy Act.
National Privacy Principles
If your business is covered by the Privacy Act, the National Privacy Principles (NPPs) will apply with respect to any personal information of customers that your business collects.
Personal information is information from which an individual’s identity can or could be determined. Examples of personal information include a person’s name, address or bank account details.
The NPPs set the minimum standards for handling personal information. They cover things such as collection, use and disclosure, security, openness, access to and correction of personal information.
Generally speaking, if you intend to save contact and personal information from customers and build them into a database, you may be required to let them know what information you are collecting and how you will use their information.
Most businesses prepare a privacy policy for these purposes.
In addition, the Privacy Act is likely to require you to:
There may also be some additional requirements if your business operates as a health service provider, a credit reporter or in other limited, prescribed industries.
Direct marketing
If you intend to use a customer’s personal information for direct marketing such as unsolicited mail or telemarketing, there are a number of other things to think about.
If you are covered by the Privacy Act and a customer requests you to stop sending them direct marketing materials you must do so, unless you originally collected their information in order to send them direct marketing material (in this case you will still need to comply with the NPPs in sending the material to the customers).
If you wish to use customers’ phone numbers to conduct telemarketing, you must not call any customer whose number appears on the Do Not Call Register.
This restriction applies regardless of whether your business is covered by the Privacy Act.
If you intend to use the personal information to conduct door-to-door marketing and sales, there are also specific provisions covering those activities under the Australian Consumer Law.
The Australian Consumer Law also contains a range of other non-privacy related provisions aimed at protecting consumers in their dealings with businesses and amongst other things, prohibits business from engaging in misleading and deceptive conduct.
If you intend to send commercial electronic messages to customers, the provisions in the Spam Act may also be applicable.
The Spam Act will generally require, amongst other things, for you to have the customer’s consent to send them commercial electronic messages and to set out certain required information in each such message you send to customers, such as:
Importantly, the Spam Act has a broader application than the Privacy Act and many businesses, persons and organisations that are not covered by the Privacy Act may be required to comply with the Spam Act.
In summary, there are a range of potential privacy boundaries that you need to be aware of, and these must be considered when you are collecting and using that information from customers.
Craig is the founding director at Motus Legal, a non-traditional legal consulting company that specialises in corporate transactions, financial services and advisory.
