Agencies are required to comply with the Information Privacy Principles (IPPs) set out in the Information Privacy Act 2009 (Qld) (IP Act).
IPP 11 provides that personal information must not be disclosed outside the holding agency unless one of the exceptions applies. The exceptions to IPP 11 are set out in IPP 11(1). An agency which discloses information under IPP 11(1) may only do for commercial marketing purposes if it followed the requirements set out IPP 11(4).
Disclosure and commercial marketing
IPP 11(4) provides:
The agency may disclose the personal information under subsection (1) if the information may be used for a commercial purpose involving the relevant entity’s marketing of anything to the individual only if, without limiting subsection (3), the agency is satisfied on reasonable grounds that –
(a) it is impracticable for the relevant entity to seek the consent of the individual before the personal information is used for the purpose of the marketing; and
(b) the relevant entity will not charge the individual for giving effect to a request from the individual to the entity that the individual not receive any marketing communications; and
(c) the individual has not made a request mentioned in paragraph (b); and
(d) in each marketing communication with the individual, the relevant entity will draw to the individual’s attention, or prominently display a notice, that the individual may ask not to receive any further marketing communications; and
(e) each written marketing communication from the relevant entity to the individual, up to and including the communication that involves the use, will state the relevant entity’s business address and telephone number and, if the communication with the individual is made by fax, or other electronic means, a number or address at which the relevant entity can be directly contacted electronically.
Where an agency is disclosing personal information under IPP 11(1) —
- to another entity
- where the entity can use it for commercial purposes
- that involve marketing anything to the individual the information is about
—IPP 11(4) allows disclosure only where the agency is satisfied on reasonable grounds that the receiving entity will comply with the requirements in IPP 11(4)(a)-(e).
IPP 11(4) does not permit the disclosure of personal information for commercial marketing purposes, but rather requires an agency to place controls on what a recipient of personal information may do with it in the event that such marketing would be possible.
Satisfied on reasonable grounds that the entity will follow IPP 11(4)(a) to (e)
Before an agency can disclose personal information to another entity where the entity can use it for commercial marketing purposes to the individual, it must be satisfied on reasonable ground that the entity will comply with IPP 11(4)(a) to (e).
The most effective way of ensuring that the entity will comply will be to bind them in a contract or other legally enforceable agreement. If the entity's compliance is voluntary, as opposed to required by an enforceable agreement, it is unlikely that the agency could have reasonable grounds to be satisfied that the entity would comply.
There are, however, some voluntary measures which have an enforcement element which would be sufficient to satisfy this requirement, such as rules which apply to a particular profession or sector which involve sanctions if breached. Such measures may include voluntary industry codes of practice that address the treatment of personal information.
What IPP 11(4)(a) to (e) requires
Not practicable to seek agreement
Only if it is not practicable to seek consent can personal information be used for commercial marketing practices. ‘Not practicable’ does not mean difficult or undesirable. To be impracticable, it must be impossible, or extremely difficult, to seek that consent. The fact that seeking consent is inconvenient or would involve expenditure of some effort or resources is not sufficient.
The impracticability of seeking consent must not be confused with the undesirability of seeking consent. For example, it is not sufficient that, if consent were sought, refusal by some individuals would make the marketing less successful.
Whether it is impracticable to seek consent will depend on the individual circumstances.
Request to stop marketing
The entity that is sending out the marketing material must have simple and accessible procedures in place to allow an individual to be removed from their marketing lists. This must not involve any cost or hardship to the individual.
Once such a request is received, the entity must immediately cease sending marketing material to the individual and remove them from its lists.
Content of notices to accompany marketing
Each communication with the individual must inform them that they can tell the entity to stop sending the communications. If it is a written communication, it must be included as a notice; if it is an oral communication, the individual must be told. The individual should also be told how they can make the request. It is not sufficient that the information is given in the first communication; it must be given in every communication.
Where the communication is written, it must also include full details:
- of the entity's business address and telephone number
- if it is made by fax or other electronic means – a number or address (such as an email or web page address) at which the entity can be directly contacted electronically.
Current as at: July 19, 2013