The National Privacy Principles (NPP's) contained in the Privacy Act substantially affect direct marketing activities.

 

Generally personal information collected can be used for direct marketing only in the following circumstances:

 

    * when the primary purpose for collection of the information is direct marketing;

    * when direct marketing is a related activity and it is within the individual's reasonable expectations that the information may be used for direct marketing purposes;

    * when the organisation has the individual's consent to receive direct marketing material;

    * when the information collected is non sensitive personal information and direct marketing is the secondary purpose (but only in limited circumstances).

 

These guidelines generally only apply to information collected on or after 21 December 2001. However, some guidelines dealing with the security of information will also apply to information collected before this date.

 

A Direct Marketing Code of Conduct was released in 2003.

 

What is direct marketing?

 

The Privacy Act does not define direct marketing. However, the Privacy Commissioner considers that direct marketing includes the following:

• activities that promote the sale or purchase of products or services or promote charitable fund raising where the individual is approached directly;

 

• in-person approaches to people's houses and approaches by mail, email, telex, facsimile and phone;

 

• individually targeted approaches by these means where people are encouraged to buy services at a distance (for example to buy by phone, mail or website) or to visit retail and service outlets or to donate to a cause by one of these means;

 

• automated processes such as spam email and computer generated voice calls over the phone.

 

Is the primary purpose of collection direct marketing?

 

National Privacy Principle No. 2 specifically prohibits the use or disclosure of personal information about an individual for a purpose other than the primary purpose of collection. The primary purpose is the main reason an individual gives an organisation information.

 

Where an organisation collects information for the primary purpose of direct marketing and the individual is aware of this, then the information collected can be used for that purpose.

 

Within reasonable expectations that information used for direct marketing

 

Where an individual (or ordinary person in the street) would reasonably expect that information they disclosed to an organisation would be used by that organisation for the secondary purpose of direct marketing, then such use will be permitted.

 

For example, an individual may expect that a company they receive gas from would send them information about gas appliances. They may not reasonably expect that the company would send them information about other energy appliances.

 

Consent

 

The NPP's require an organisation to seek the consent of an individual in a range of circumstances before collecting personal information about that individual. Where an organisation obtains an individual's explicit consent to use information collected for direct marketing purposes, then any such use will be permitted.

 

The Privacy Commissioner takes the view that except in the most limited circumstances, it is questionable whether implied consent can be inferred from a failure to opt out, or the failure of an individual to object to a proposal.

 

Having said that, the Commissioner has indicated that he is likely to regard consent to have been inferred from an individual's failure to opt out if all of the following conditions are met (and even then not in all circumstances):

 

    * the organisation has a direct ongoing relationship with the individual;

    * opt out is part of contact that the organisation will be making anyway with the individual (for example to pay a bill on-line);

    * the individual fully understands implications of not opting out;

    * opting in or opting out is freely available and not bundled with other purposes;

    * there is no financial cost to the individual in receiving the chance to opt out, and the cost of exercising the opt out is so low as to be almost unmeasurable;

    * opting out involves little effort;

    * the consequences of failing to opt out are harmless (for example, the individual continues to receives offers, but disclosures to another party would not be harmless); and

    * if the individual opts out later, the individual is fully restored to the circumstances he or she would have been if the opt out had been exercised earlier.

 

Non sensitive information collected for secondary purpose of direct marketing

 

Sensitive information (ie information about an individual's race, health, political opinions, sexual preferences, or criminal record) can never be used for direct marketing. For example, a private hospital cannot write to former patients seeking donations for new equipment for the hospital unless they have consented to this either when they were admitted or when they left the hospital.

 

However, it is possible in the following circumstances for non sensitive personal information to be used for a secondary purpose of direct marketing:

 

    * where it is impracticable to seek the individual's consent before using the information; and

    * the individual is informed that they can say that they do not want to receive any more marketing communications; and

    * if the individual has not asked not to receive direct marketing from the organisation; and

    * it complies with other requirements about not charging and sending out the organisation's contact details in its communication.

 

This exception only allows organisations to use information for direct marketing in certain circumstances. It does not allow organisations to disclose personal information for direct marketing. In other words, an organisation can use information it has collected for its own direct marketing but an organisation is not allowed to sell a list of individuals to another organisation to be used in that organisation's marketing campaign.

 

Where it is impracticable to obtain consent

 

Whilst the Commissioner has indicated that in certain circumstances obtaining consent will be impracticable, he has taken the view that if an organisation has in mind, at the time it collects information, to use the information for a secondary purpose of direct marketing, then it should tell the individual at the time of collection and get their consent.

 

If the Commissioner receives a complaint about inappropriate use of information for direct marketing and the Commissioner concludes that the organisation could have gained the individual's consent at the time of collection, it will not allow an organisation to succeed in an argument that it was impracticable to get consent.

 

The Commissioner expects that an organisation will keep a record of who has and has not consented to receive direct marketing information.

 

The Commissioner takes the view that it will never be impracticable to seek the individual's consent where an organisation engaged in direct marketing on-line and accordingly, techniques such as spam email cannot rely on the direct marketing exception to NPP2. The organisation will need to seek the individual's consent and in most cases, the Commissioner will require the consent to be explicit consent.

 

Only one use without consent before opt-out must be given

 

Even where an organisation is relying on the exception to direct market, it only allows an organisation one unrelated use of personal information for direct marketing without consent and in that communication it must give the person the chance to opt out. It must also offer the individual who does not opt out the chance to opt out every other time it communicates with that individual for that direct marketing purpose.

 

Not charging individuals for deleting them from marketing list

 

An organisation cannot charge individuals a fee for giving effect to their request not to receive direct marketing. However, an organisation can offer incentives for people to receive direct marketing communications, for example, bonus loyalties, getting points or a chance to win a prize. They can also charge different prices, for example, offer a discount on a product for agreeing to receive direct marketing material.

 

Requests not to receive direct marketing

 

Organisations will need to have an effective system in place to record, request and take account of individuals contacted and whether or not to include them in future direct marketing activities.

 

If contact is by phone and the person hangs up, this should usually be taken as a request not to receive further direct marketing communications.

 

It is not acceptable to write to individuals who have said they do not want to receive direct marketing communications to ask if they want to change their mind and receive direct marketing. However when an organisation sends out statements or invoices or genuine business communications, it would be acceptable for the statement to include a notice saying "Our records show you have asked not to receive direct marketing communications. Please contact us if you wish to change your mind.".

 

An organisation relying on the direct marketing exception to NPP2 must, each time it communicates with the individual, draw to the individual's attention, or prominently display a notice, that individuals may ask not to receive further direct marketing communication.

 

Providing contact details in marketing material

 

When communicating electronically, the organisation must include their business address and telephone number as well as an electronic address. A business address should include a street address as well as any postal address. This will allow individuals who wish to be removed from future marketing communications to easily express this.