Relationship between privacy principles and other legislation

Background

26.49 This part of the chapter considers how the ‘Direct Marketing’ principle should relate to sectoral legislation that deals with particular types or aspects of direct marketing. For example, some aspects of telemarketing are regulated by the Do Not Call Register Act 2006 (Cth) and some aspects of email marketing are covered by the Spam Act. This raises the question whether the regulation of direct marketing should be dealt with by a ‘one size fits all’ model in the privacy principles, or by sectoral legislation tailored to particular types of direct marketing, or a combination of both.

26.50 In DP 72, the ALRC discussed three main options for reform. First, the UPPs could refrain from dealing with direct marketing, given that it is being regulated elsewhere. Secondly, the sectoral legislation that deals with specific types of direct marketing could be repealed, with the UPPs providing the sole form of regulation in respect of all forms of direct marketing. Thirdly, the UPPs could regulate direct marketing, except to the extent that more specific sectoral legislation covers a particular aspect or type of direct marketing. The sectoral legislation could either provide more or less stringent privacy protection.

26.51 The ALRC proposed that the ‘Direct Marketing’ principle should set out the generally applicable requirements for organisations engaged in the practice of direct marketing. These requirements should be displaced, however, to the extent that more specific sectoral legislation regulates a particular aspect or type of direct marketing.[75]

Submissions and consultations

26.52 A number of stakeholders supported the proposal.[76] For example, the Department of Broadband‚ Communications and the Digital Economy (DBCDE) submitted:

During the development of the Spam Act 2003 (which regulates electronic messages) and the Do Not Call Register Act 2006 (which regulates phone calls), the Department received a number of approaches from individuals and small business calling for additional controls on other forms of direct marketing. The proposed UPP 6 would appear to respond to these concerns … [77]

26.53 The Australian Communications and Media Authority (ACMA) supported the proposal and agreed that imposing a blanket rule for all types and aspects of direct marketing would be too rigid. It submitted that specific legislation such as the Do Not Call Register Act can be developed ‘that is more responsive to the specific needs of consumers and business’.[78]

26.54 Some stakeholders, such as the Consumer Action Law Centre, argued that the current sector-specific legislation can be enhanced.[79] The Australian Privacy Foundation and the Cyberspace Law and Policy Centre were supportive of the ALRC’s proposal but argued that any sectoral legislation as far as possible should be consistent with the ‘Direct Marketing’ principle, and that any weakening of standards should be justified.[80] PIAC’s support was conditional on sectoral legislation imposing more stringent requirements on direct marketing than the standards in the Privacy Act.[81]

26.55 The OPC submitted that the ‘Direct Marketing’ principle should set out the generally applicable requirements for organisations engaged in the practice of direct marketing.[82] It noted that the enactment of future legislation to regulate sector-specific direct marketing was a matter for Parliament and did not need to be anticipated expressly in the ‘Direct Marketing’ principle.[83]

26.56 Some stakeholders argued that there should be appropriate consultation with the OPC and other relevant bodies before specific sectoral legislation is enacted, in order to ensure, from a compliance perspective, appropriate alignment with the Privacy Act.[84]

26.57 BPay expressed support for displacing the ‘Direct Marketing’ principle where there is more specific sectoral legislation. It argued, however, that wherever possible, legislation should be in the Privacy Act since ‘reducing overlap with the Privacy Act is likely to minimise confusion and unnecessary duplication of compliance activities for organisations’.[85]

26.58 A number of other stakeholders expressed qualified support. The principal reason for reservations was a concern about the need for certainty as to the regime applying to any particular form of direct marketing.[86] The Law Council of Australia identified the risk of confusion if it is not made clear whether sectoral legislation displaces the principles. It called for any sectoral legislation that displaces the ‘Direct Marketing’ principle to be ‘specifically referred to in Guidelines to the Principle’.[87]

26.59 Microsoft Asia Pacific submitted that the ‘existing regulatory overlaps’ were ‘inefficient and costly for both regulated entities and the government’ and gave rise to uncertainty. Microsoft also expressed concern about existing inconsistencies between the Privacy Act and sectoral direct marketing legislation; and state and territory legislation, such as the Fair Trading Act 1987 (NSW), which it argued regulates the same conduct. Microsoft submitted that these legislative regimes should be harmonised where possible. It expressed a preference for regulation of direct marketing to be consolidated at the federal level, or if that is not possible for constitutional reasons, a Commonwealth-State cooperative scheme.[88]

26.60 Other stakeholders strongly disagreed with the ALRC’s proposal.[89] ADMA argued that organisations that undertake direct marketing are currently subject to differing obligations ‘depending on the channel through which the marketing is being sent’, citing the Spam Act and the Do Not Call Register Act as examples.[90] ADMA’s strong view was that all industry sectors, including the public sector, should be subject to the same legislative requirements with respect to the use of personal information for direct marketing purposes, and that the UPPs should override any specific sectoral legislation regulating a particular type or aspect of direct marketing.[91]

ALRC’s view

26.61 The ‘Direct Marketing’ principle should set out general requirements with respect to direct marketing, but these requirements should be able to be displaced by more specific legislation that deals with a particular type of direct marketing, or direct marketing by a particular technology.

26.62 Making clear that the ‘Direct Marketing’ principle in the Privacy Act sets out the general requirements in this area, and that these may be displaced by other requirements in certain contexts, where Parliament deems it appropriate, allows for a regime that is more responsive to the specific needs of consumers and business.

26.63 This approach is preferable to the other options for regulating direct marketing. Imposing a blanket rule for all forms of direct marketing is too rigid. For example, there is a strong community view that some forms of direct marketing are, or have the capacity to be, more intrusive than others. Clearly, those forms of direct marketing should be subject to regulation that differs from the rules applicable to less intrusive forms of direct marketing. Indeed, this explains the advent of sectoral legislation such as the Do Not Call Register Act and the Spam Act. Similarly, relying on such sectoral legislation to the exclusion of the Privacy Act is problematic, because it leaves loopholes that could encourage other types of direct marketing that also may be intrusive.

26.64 The ALRC’s preferred approach allows, for example, the ‘Direct Marketing’ principle in the Privacy Act to operate alongside the more specific provisions in the Do Not Call Register Act and the Spam Act. The ALRC notes that, currently, a number of exemptions apply in the context of the Do Not Call Register Act and the Spam Act—for example, charities and religious organisations are excluded.[92]These exemptions may not apply under the Privacy Act.

26.65 Finally, the requirements of the ‘Direct Marketing’ principle should not be able to be displaced only by more onerous requirements in sectoral legislation. While such an approach may be appealing to those opposed to direct marketing, it would limit Parliament’s options when considering whether to pass sectoral legislation dealing with specific aspects of direct marketing. This, in turn, would ultimately undermine the responsiveness of the regime to the specific needs of those affected by a particular aspect or type of direct marketing.

Recommendation 26–2 The ‘Direct Marketing’principle should set out the generally applicable requirements for organisations engaged in the practice of direct marketing. These requirements should be displaced, however, to the extent that more specific sectoral legislation regulates a particular aspect or type of direct marketing.

[75] Australian Law Reform Commission, Review of Australian Privacy Law, DP 72 (2007), Proposal 23–2.

[76] Suncorp-Metway Ltd, Submission PR 525, 21 December 2007; Legal Aid Queensland, Submission PR 489, 19 December 2007; Australia Post, Submission PR 445, 10 December 2007.

[77] Australian Government Department of Broadband‚ Communications and the Digital Economy, Submission PR 512, 21 December 2007.

[78] Australian Communications and Media Authority, Submission PR 522, 21 December 2007.

[79] Consumer Action Law Centre, Submission PR 510, 21 December 2007.

[80] Australian Privacy Foundation, Submission PR 553, 2 January 2008; Cyberspace Law and Policy Centre UNSW, Submission PR 487, 19 December 2007.

[81] Public Interest Advocacy Centre, Submission PR 548, 26 December 2007.

[82] Office of the Privacy Commissioner, Submission PR 499, 20 December 2007.

[83] Ibid.

[84] Australian Bankers’ Association Inc, Submission PR 567, 11 February 2008; Suncorp-Metway Ltd, Submission PR 525, 21 December 2007.

[85] BPay, Submission PR 566, 31 January 2008.

[86] See, eg, GE Money Australia, Submission PR 537, 21 December 2007.

[87] Law Council of Australia, Submission PR 527, 21 December 2007.

[88] Microsoft Asia Pacific, Submission PR 463, 12 December 2007.

[89] Acxiom Australia, Submission PR 551, 1 January 2008; Australian Direct Marketing Association, Submission PR 543, 21 December 2007; Retail Motor Industry, Submission PR 407, 7 December 2007.

[90] Australian Direct Marketing Association, Submission PR 543, 21 December 2007.

[91] Ibid. See also Acxiom Australia, Submission PR 551, 1 January 2008.

[92] Spam Act 2003 (Cth) s 4; sch 1, cl 3; Do Not Call Register Act 2006 (Cth) s 4; sch 1, cl 2.