Keith Norris, Independent Compliance Consultant for the Marketing Association, discusses the Privacy Amendment Bill introduced to Parliament in early 2024, focusing on its requirement for organisations to inform individuals when collecting personal information from third parties.

The Marketing Association submitted recommendations to exempt charities and small businesses from some requirements, but the Justice Select Committee supported the bill with limited exceptions. Marketers and fundraisers now have until June 1, 2025, to ensure compliance.

Early in 2024 The Privacy Amendment bill was introduced to Parliament. Its major effect is to require organisations collecting personal information from any source other than the individual concerned (e.g. a third party) to advise the person concerned.

The Marketing Association made submissions and met with the Justice Select Committee to recommend a number of amendments on behalf of marketers and charities who rent lists of prospects from data services companies. Every new piece of legislation has unintended consequences and this was no exception.

So, we recommended:

  1. Registered charities should be exempt from the requirements of the proposed IPP 3A. and that strong consideration be given to extending the exemption to small business.
  2. Personal contact information obtained from a third party which is the subject of a single use agreement should be exempt from the requirements of the proposed IPP 3A.
  3. Where data is exchanged for a limited time period it should be exempt from the requirements of the proposed IPP 3A.
  4. When individuals are advised that their information will be shared with multiple named organisations, further notification will not be required under the exemption clause which states ‘the individual has previously been made aware of the organisation’s collection of the information.’

Unfortunately, but predictably, the Select committee has now reported back to the House supporting the bill. Our submissions obviously fell on stony ground!

If this bill now proceeds to 2nd and 3rd readings it will come into effect on 1st June 2025. This means that marketers and fundraisers have just 6 months to ensure their systems are able to comply.

Here’s an edited extract from the Justice Select committee’s report to parliament:

‘Privacy Amendment Bill Government Bill

As reported from the Justice Committee on 25 Oct 2024

Recommendation:

The Justice Committee has examined the Privacy Amendment Bill and recommends that it be passed.

At present, the Act requires an agency, when collecting personal information from the individual concerned, to take reasonable steps to ensure that the individual is aware of various matters. However, there is no such requirement when information is collected about an individual indirectly, from other sources. Under the bill a new privacy principle, IPP 3A would require an agency that is collecting personal information about an individual from other sources to take reasonable steps to ensure that the individual is aware of specified matters, including:

  • the fact that the information has been collected
  • the name and address of the collecting agency
  • the purpose for which the information has been collected
  • the intended recipients of the information
  • the rights of the individual relating to access to and correction of the information.

As introduced, the bill includes some exceptions to IPP 3A. For example, it is not necessary for an agency to comply with the requirement in IPP 3A if the agency believes, on reasonable grounds, that:

  • non-compliance would not prejudice the interests of the individual concerned, or
  • the information is publicly available, or
  • compliance is not reasonably practicable in the circumstances.

Submissions on other exceptions

We received submissions from organisations in the banking, insurance, real estate, and fundraising sectors that proposed exceptions to the bill. Submitters told us that the proposed exceptions would allow more flexibility for business operations. We considered the points raised by these submissions, but recommend only the narrow exception for archiving in the public interest.’ 

Source: Keith Norris, 6 November 2024