Privacy reform: flow-on effects for direct marketing

Businesses that engage in direct marketing will be very familiar with the Spam Act and the Do Not Call Register Act. Currently, it looks like these will not be updated as part of the Privacy Act reforms. This does not, however, mean that direct marketing is immune, with elements of the Privacy Act reforms inevitably impacting direct marketing.

Unqualified right to opt-out of direct marketing

In the Government's Response to the Privacy Act Review Report, it continues to agree that individuals should have an unqualified right to opt-out of their personal information being used or disclosed for "direct marketing purposes" but this has been tempered somewhat. This appears to now be contingent on a more traditional and restrained definition of "direct marketing" applying. However, there does seem to be some potential creep here with the response suggesting that "direct marketing" in this regard may extend to certain targeting scenarios (eg. customer matching).

Providing individuals with targeted advertising choices

Harmful targeting remains of concern. The response reiterates that targeting individuals should be fair and reasonable in the circumstances and targeting individuals based on sensitive information should be prohibited (with an exception for socially beneficial content). Rather than an unqualified right to opt out of targeting which was proposed in the Privacy Act Review Report, the response focuses on providing additional choice and control to individuals in relation to the way in which their information is used (eg. layered opt-outs and online advertising industry codes).

Consent required for personal information trading

Things could get a bit sticky for businesses if they do not have opt-in consents to trade personal information. The response restates that, to prevent individuals losing control of their personal information, an individual's consent should be required in order to trade their personal information. This is again subject to working out what "trading" should comprise. There are some routine marketing practices that could get caught up in this (eg. the use of cookies).

Protecting children

Children are particularly vulnerable to online harms, and various developments are in play in this space including the upcoming requirement for providers of age-restricted social media platforms to take reasonable steps to prevent children under the age of 16 from having an account. The response reiterates the need to protect children from direct marketing, targeting and trading, while acknowledging that there could be some exceptions where doing so would be beneficial to children (eg. to prevent children from seeing age-sensitive advertisements).

It's audit time

The first tranche of legislated reforms only dabbled in this space by introducing penalties for failing to provide a simple means for an individual to opt out of direct marketing. We will need to wait and see what comes into play in subsequent tranches. Organisations should use what time they have now to refamiliarise themselves with their current direct marketing practices (eg. review consent and any age verification arrangements) and consider the impact of the proposed changes.