June 2006

• Office of the Privacy Commissioner
• Background
• A National Do Not Call Register
• Privacy Act coverage
  • The Register
  • Organisations
• Helping the Register to work
  • Registration and re-registration
  • Notice and public awareness
  • Exemptions
  • Consent
• Summary of key recommendations
• Endnotes

Office of the Privacy Commissioner

The Office of the Privacy Commissioner (the Office) is an independent statutory body responsible for promoting an Australian culture that respects privacy. The Office, established under the Privacy Act 1988, has responsibilities for the protection of individuals' personal information that is handled by Australian and ACT government agencies, and personal information held by all large private sector organisations, health service providers and some small businesses. The Office also has responsibilities under the Privacy Act in relation to credit worthiness information held by credit reporting agencies and credit providers, and personal tax file numbers used by individuals and organisations.

In addition, the Office has responsibilities under the Telecommunications Act 1997 in relation to telecommunications industry Codes and Standards (Part 6) and monitoring compliance with the record-keeping requirements under that Act (Part 13 Division 5).

Background

The Office welcomes the opportunity to make a submission on the Do Not Call Register Bill 2006 (the Bill) and the Do Not Call Register (Consequential Amendments) Bill 2006 (the Consequential Amendments Bill).

The Office understands that the Bill, in combination with the Consequential Amendments Bill, establish a Do Not Call Register (the Register), enabling individuals to register their private telephone numbers on the Register. The Bill sets in place a prohibition on making telemarketing calls to an Australian telephone number which is registered on the Do Not Call Register, subject to certain exemptions. It also includes a civil sanctions regime, and a tiered enforcement regime to be administered by the Australian Communications and Media Authority (ACMA).

In addition, the Office understands that the Consequential Amendments Bill will require the ACMA to make national standards regulating the making of all telemarketing calls. The mandatory standards will relate to certain conduct matters such as the time at which telemarketing calls may be made, the information which must be provided to recipients and the termination of such calls.

A National Do Not Call Register

The Office strongly supports the introduction of the Register, and welcomes the Australian Government taking this step in implementing Recommendation 25 of Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988.[1] The provisions of the Bill and the Consequential Amendments Bill set in place the foundations of a national scheme to protect Australians from intrusive telephone calls. 

The Office has previously made a submission to the Department of Communications, Information Technology and the Arts (DCITA) in December 2005, supporting the proposal for a Do Not Call Register.[2]

The comments in this submission, as with the submission to DCITA, are provided with the intention of contributing to the long-term effectiveness of the Do Not Call Register.

The establishment of a national Do Not Call Register is an important mechanism to help address community concerns over the intrusiveness of some direct marketing methods. There is evidence that individuals are more reluctant to give organisations their home telephone number than all other sorts of personal information, with the exception of bank account details and income, and that this sensitivity has increased over the years.[3] This move to assist individuals to ''opt out'' of unwanted telephone contact will no doubt be welcomed by many in the community.

Privacy Act coverage

The Register

Under the Privacy Act, Australian Government agencies such as the ACMA must comply with the 11 Information Privacy Principles (IPPs) when handling personal information. Under s. 13 of the Bill, the ACMA must keep, or arrange for a contracted service provider to keep, on behalf of the ACMA, the Do Not Call Register.

If the ACMA keeps the Register, then it will be bound by the IPPs, which govern the collection, storage, use and disclosure of personal information, as well as providing individuals with certain rights to access their personal information and correct errors. If the ACMA arranges for a contracted service provider to keep the Register, then the ACMA is required under s. 95B of the Privacy Act to take contractual measures to ensure that the contracted service provider does not breach the IPPs.

For example, the keeper of the Register will be prevented from disclosing personal information on the Register, unless the individual has been notified of the disclosure, the individual has consented to the disclosure, or on public interest grounds. The public interest grounds under IPP 11.1(c)-(e) include the prevention of a serious or imminent threat to life or health, where the disclosure is required or authorised by law, and where the disclosure is reasonably necessary for the enforcement of a law, or for the protection of the public revenue.

The Office notes that the Register is likely to include a significant proportion of Australian telephone subscribers. It is also likely that many individuals with unlisted telephone numbers will also choose to register their telephone numbers on the Register. As a result, the Register will likely be of substantial scope and hold information that some individuals see as sensitive.

Organisations

The private sector provisions of the Privacy Act apply to organisations (including not-for-profits) with an annual turnover of more than $3 million and, in particular circumstances, some small businesses with an annual turnover of $3 million or less.

The private sector provisions of the Privacy Act centre around 10 National Privacy Principles (the NPPs) that set out how private sector organisations should collect, use, keep secure and disclose personal information.

The Office notes that the private sector provisions of the Privacy Act will continue to operate alongside the provisions of the Bill. This means that while organisations may be exempt from the provisions of the Bill they will still be bound by the Privacy Act (where they are already bound by that Act). 

In this situation, while the organisation will not be prohibited from making a telemarketing call to a telephone number on the list, it will be required to comply with its obligations under the Privacy Act. Relevantly, these obligations include the direct marketing provisions of NPP 2.1. NPP 2.1(c) relates to situations where personal information is collected for a purpose other than marketing. In this situation, NPP 2.1(c) provides that individuals can make a request to an organisation not to receive direct marketing communications.

In summary, the Bill does not change an organisation''s existing obligations under the Privacy Act, and where the Privacy Act presently prohibits the making of a telephone call (because of the operation of NPP 2.1, for example), that prohibition will continue after the Bill is enacted, despite any exemptions in the Bill.

However, the Office notes that there are a number of exemptions to the private sector provisions of the Privacy Act, including in relation to many small businesses, and political acts and practices. In addition, where personal information such as a person''s telephone number is collected for the primary purpose of direct marketing, NPP 2.1(c) does not apply. The Bill therefore will provide privacy protections additional to those already provided by the application of NPP 2.1(c).

Helping the Register to work

Registration and re-registration

The approach of the Bill is to provide individuals with the opportunity to opt-out of receiving calls, by taking steps to have their personal telephone number or numbers listed on the Register. This approach puts the onus on the individual to act if they wish to restrict calls, therefore consideration should be given to ensure that the mechanism by which individuals register telephone numbers is simple and does not place an undue burden on them.

In this regard, the Office notes s. 17(1) of the Bill in relation to the duration of a registration. A telephone number is only registered for three years, after which time it is automatically removed from the Register. The effect of this provision seems to be that individuals will need to take action every three years to ensure that they continue to be afforded the protections of the Register.

The Office believes the automatic de-registering of telephone numbers after three years is an unnecessary barrier for individuals seeking to use a privacy-enhancing tool such as this Register, and may ultimately reduce the Register''s effectiveness. If an individual has not changed their telephone number, it is not clear why they should have to register again after three years.

The Office recommends that telephone numbers remain on the register until such time as the individual chooses to de-register the telephone number, or the telephone number moves to a different subscriber.

Notice and public awareness

The issue of re-registration also leads to the broader issue of the community''s understanding of the Register and its operation. The Office would strongly recommend public awareness raising, including a Government or business driven educational campaign to ensure that individuals are aware of:

• the existence of the Register
• how to register their telephone number on the Register and
• what the Register will, and won''t do, in terms of preventing unwanted telephone calls.

In addition to general public awareness-raising, it will be critical that individuals who do register their telephone numbers be provided with information about the Register''s operation. Notice of some aspects of the Registers operation is required by IPP 2. In addition to these existing requirements, the Office recommends that consideration should be given to ensuring that individuals are clearly notified about:

• who has access to information on the Register, and for what purposes
• who to complain to about continued unwanted telephone calls
• that re-registration is required on a regular basis (if this provision is retained) and
• which sorts of calls should be prevented by registration, and which will not be prevented.

A well-informed public will help ensure that individuals make the right choices about registering, and help to ensure the effectiveness of the scheme for individuals and the community.

Exemptions

The Office notes that the Bill applies only to telemarketing calls, and so may not prevent all unwanted telephone calls. According to the Explanatory Memorandum to the Bill, telemarketing calls are voice calls made with the purpose to offer, supply, provide, advertise or promote goods or services for land or an interest in land; or a business opportunity or investment opportunity; or to solicit donations.

As a consequence of the definition of ''telemarketing call'' in s. 5 of the Bill, and the definition of ''designated telemarketing call'' in Schedule 1 to the Bill, unsolicited and unwanted telephone calls relating to social and some market research will not be subject to the prohibition in the Bill. Those definitions also mean that unsolicited and unwanted calls from charities, religious organisations, educational institutions, government bodies and political parties are not prohibited by the Bill.

The Bill will also not apply to non-voice calls, however the Office notes that Spam Act 2003 regulates the sending of unsolicited electronic messages.

The Office has previously expressed the view that, rather than exempting particular types of organisations from the Bill (as is the approach in Schedule 1), greater consistency in privacy regulation would be achieved by framing any necessary exemptions in terms of the type or purpose of the telephone call.[4]

The Office has also previously urged that any exemptions to the Bill be as tightly constrained as possible, and based on a clear public interest test that reflects community attitudes and values.

To this end, the Office supports the review provisions of the Bill at s. 45, and would recommend that this review look particularly at whether the exemptions from the Bill have had an impact on the effectiveness of the Register in reducing unwanted telephone calls.

Consent

The operation of the Register will provide a welcome increase in the degree to which individuals can choose how they are contacted.

In our review of the private sector provisions of the Privacy Act, the Office took a number of submissions on the issue of ''bundled consent''. ''Bundled consent'' is the practice of bundling together consent to a wide range of uses and disclosures of personal information without giving the individual an opportunity to choose which uses and disclosures they agree to and which they do not. The Office found that bundled consent may confuse consumers and may derogate from their rights under the Privacy Act. It is also an issue that confuses a lot of organisations.[5] This issue is sometimes exacerbated when organisations require that the individual cannot access a good or service unless they consent to all the uses and disclosures listed.

Since the commencement of the private sector provisions in the Privacy Act, this office has received complaints and enquiries in relation to the use of bundled consent forms, particularly by finance and insurance organisations.

The Office notes that the Bill adopts an approach to consent based on that in the Spam Act. There is a risk that through the operation of bundled consents, individuals may expressly consent to receiving telemarketing calls, without being fully aware that they have done so, or in circumstances where they feel they had little choice but to consent to the telemarketing call if they were to receive the good or service in question. If this risk is realised, individuals may find that the Register is not as effective as they may wish in reducing unwanted telemarketing calls.

In order to ensure the effective operation of the Register, the Office recommends that consideration be given to preventing bundled consents applying to telemarketing calls to telephone numbers on the Register. One possible solution may be to provide that where explicit consent to telemarketing calls is a required condition of the provision of a good or service, then, for the purposes of the Bill, such consent only relates to telemarketing calls that are directly related to that good or service. The Office notes that the concept of "directly related" purposes in the handling of personal information is familiar from the Privacy Act 1988, for example IPP 10.1(e) and NPP 2.1(a).

Summary of key recommendations

The Office strongly supports the introduction of the Register, and welcomes the Australian Government taking this step in implementing Recommendation 25 of Getting in on the Act: The Review of the Private Sector Provisions of the Privacy Act 1988.

The Office recommends that:

• telephone numbers remain on the register until such time as the individual chooses to de-register the telephone number, or the telephone number moves to a different subscriber
• public awareness raising, including a Government or business driven educational campaign, be undertaken
• individuals who register their telephone numbers on the Do Not Call Register be provided with clear notice about the details of the handling of their information
• the three-year review of the Bill should look particularly at whether the exemptions from the Bill have had an adverse impact on the effectiveness of the Register and
• consideration be given to preventing bundled consents applying to telemarketing calls to telephone numbers on the Register.

Endnotes

[1]    Available from www.privacy.gov.au/law/reform/review/. [2]    Available from www.privacy.gov.au/materials/types/download/8656/6501. [3]     Community Attitudes Towards Privacy 2004, Office of the Federal Privacy Commissioner, available from www.privacy.gov.au/materials/types/download/8819/6615. [4]    See the Office''s submission to DCITA''s Do Not Call Register discussion paper, available from www.privacy.gov.au/materials/types/download/8656/6501.[5]    See section 4.1 of Getting in on the Act, available from www.privacy.gov.au/law/reform/review/.