Direct marketing with customer data and your APP 7 obligations

Almost every Australian business wants to stay in front of its customers, and direct marketing is one of the most effective ways to do it. But if your business is bound by the Privacy Act 1988 (Cth) (the Privacy Act), using personal information for direct marketing is not an open choice. Australian Privacy Principle 7 (APP 7), which sits in clause 7 of Schedule 1 to the Privacy Act, starts from a blunt position: an organisation must not use or disclose personal information for direct marketing unless one of the exceptions in the principle applies.

This article sets out who has to comply with APP 7, the rule and its exceptions, what you must do when a customer asks to opt out, and what is at stake if you get it wrong. It also points to where a privacy lawyer earns their keep.

Do the privacy rules apply to your business?

APP 7 binds APP entities, which are Australian Government agencies and organisations. In broad terms, an organisation is any individual, body corporate, partnership, trust or unincorporated association that is not a small business operator.

Small business operators are generally exempt from the Australian Privacy Principles. Under s 6D of the Privacy Act, a business is a small business if its annual turnover for the previous financial year was $3 million or less. But the exemption does not apply if your business:

has had annual turnover above $3 million in a financial year;
provides a health service and holds health information (other than in an employee record);
discloses personal information about another person for a benefit, service or advantage, meaning you trade in personal information;
collects personal information from other people for a benefit, service or advantage;
is a contracted service provider for a Commonwealth contract; or
is a credit reporting body.

A body corporate that is related to a larger group is also not a small business operator, even if its own turnover is under the threshold. The practical point is that the exemption is narrower than it looks. A trades business with turnover under $3 million is probably exempt, but a small marketing agency that buys and sells contact lists, or a sole practitioner who provides health services, is not.

Even if your business is exempt from the Privacy Act, direct marketing is still regulated. The Spam Act 2003 (Cth) controls commercial electronic messages such as email and SMS, and the Do Not Call Register Act 2006 (Cth) controls telemarketing calls. APP 7 itself recognises these regimes in clause 7.8. This article focuses on the privacy rules, but any campaign also needs to clear those separate hurdles.

The core rule: no direct marketing without an exception

APP 7.1 states that if an organisation holds personal information about an individual, it must not use or disclose the information for the purpose of direct marketing.

The Privacy Act does not define the term direct marketing, and it carries its ordinary meaning: using personal information to communicate directly with an individual to promote goods or services, or to solicit donations. It covers emails, SMS messages, phone calls, addressed mail and any other direct channel. Advertising through media where you hold no personal information about the recipient is not direct marketing for this purpose.

The rule applies to both use and disclosure. You breach APP 7 if you market to the individual yourself, and also if you hand their details to another organisation so it can market to them. A breach of APP 7 is an interference with the privacy of the individual concerned under s 13(1) of the Privacy Act, which is the gateway to the enforcement consequences set out below.

Exception 1: information you collected from the customer yourself

The most common exception, in APP 7.2, allows you to use or disclose personal information other than sensitive information for direct marketing if all of the following are satisfied:

you collected the information directly from the individual;
the individual would reasonably expect you to use or disclose it for direct marketing;
you provide a simple means by which the individual can easily request not to receive direct marketing from you; and
the individual has not made such a request.

Two parts of this exception deserve attention. First, it only covers information you collected yourself. Second, the reasonable expectation test is objective, and it is assessed against the circumstances of the collection. A customer who gives you their email address so you can arrange a delivery may not reasonably expect to be added to a weekly promotional newsletter, even though you collected the address directly. The safer course is to state your marketing intentions in your collection notice. APP 5 requires you to notify individuals, at or before collection, of the purposes for which you are collecting their information, and telling people that their details may be used for marketing is the clearest way to make the expectation reasonable.

Exception 2: information collected from someone else

APP 7.3 deals with information you did not collect from the individual, or information collected from the individual in circumstances where they would not reasonably expect marketing. This is the provision that governs purchased lists and data shared by other businesses. You may use or disclose the information only if:

the individual has consented to the use or disclosure; or
it is impracticable to obtain that consent;

and, in addition:

you provide a simple means by which the individual can easily request not to receive direct marketing;
each direct marketing communication includes a prominent statement that the individual can make such a request, or otherwise draws their attention to that fact; and
the individual has not made such a request.

Consent is the safe path for bought-in data. The alternative of showing that it was impracticable to obtain consent is a high bar and is rarely met where the data was acquired commercially. If you rely on this exception, every single message must carry a prominent, easy-to-find opt-out statement, not just a link buried in fine print.

Sensitive information gets stricter treatment. Under APP 7.4, an organisation may use or disclose sensitive information for direct marketing only with the individual's consent. A reasonable expectation is not enough.

Sensitive information includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation, criminal records and biometric information. If your marketing relies on any of these categories, consent must be obtained, and it should be recorded so you can prove it later. A business that markets health services based on a customer's medical history, for example, cannot rely on the reasonable expectation exception at all.

Exception 3: contracted service providers

APP 7.5 provides a narrow exception for organisations that are contracted service providers for a Commonwealth contract. You may use or disclose personal information for direct marketing if:

your organisation is a contracted service provider for a Commonwealth contract;
you collected the information for the purpose of meeting, directly or indirectly, an obligation under that contract; and
the use or disclosure is necessary to meet such an obligation.

This exception only applies to marketing that is genuinely required to perform the contract. It does not give a contractor a general licence to market to people whose information it handles under a government engagement.

Honouring opt-out requests

APP 7.6 gives individuals three related rights. Where you use or disclose personal information for direct marketing, the individual may:

request not to receive direct marketing communications from you;
request that you not use or disclose their information to facilitate direct marketing by other organisations; and
request that you tell them the source of the information.

Under APP 7.7, you must not charge the individual for making a request or for giving effect to it. You must give effect to an opt-out request within a reasonable period after it is made, and if the individual asks for the source of the information, you must notify them of it within a reasonable period unless it is impracticable or unreasonable to do so.

In practical terms this means a free, working unsubscribe mechanism in every campaign, and a process for removing the person from your lists promptly. An opt-out that is ignored for weeks, or an unsubscribe link that requires the customer to call a premium number, is a breach in the making. It also means keeping records of where you obtained each contact, because a customer can demand to know the source.

What happens if you get it wrong

A breach of APP 7 is an interference with privacy under s 13(1) of the Privacy Act, and the Privacy Act now carries serious teeth.

Under s 13G, for a serious or repeated interference with privacy, the maximum civil penalty for a body corporate is the greatest of $50 million, three times the value of the benefit obtained from the conduct, or 30% of adjusted turnover during the breach period. For an individual or other entity, the maximum is $2.5 million. These figures follow the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 (Cth), which took effect in December 2022. Older articles quoting penalties of $1.7 million for companies and $340,000 for individuals are well out of date. Interferences that are not serious attract a maximum of 2,000 penalty units under s 13H.

Enforcement sits with the Office of the Australian Information Commissioner (OAIC), which can investigate complaints, make determinations that include compensation awards, accept enforceable undertakings and seek civil penalties in the Federal Court. Beyond the dollar figures, a privacy breach can draw regulator and media attention to your handling of customer data in a way that no marketing campaign justifies.

A direct marketing compliance checklist

If you are planning or running direct marketing, work through these steps:

Confirm whether the Australian Privacy Principles apply to you, using the turnover and activity tests above, and check the position each year because the $3 million threshold is tested against the previous financial year.
Audit where your marketing data came from. Separate information you collected directly from information sourced from third parties, because the exceptions are different.
For information you collected yourself, check whether the individual would reasonably expect marketing, and state the marketing purpose in your collection notice under APP 5.
Build a simple, free, working opt-out into every campaign, and honour opt-out requests within a reasonable period.
If you rely on the purchased-list exception, make sure every communication carries a prominent opt-out statement.
Obtain and record consent before using sensitive information for marketing.
Review the contracts under which you obtained lists or data, and keep evidence of consent where you rely on it.
Check your campaigns against the Spam Act and the Do Not Call Register rules for the channels you use.

When a privacy lawyer should review your marketing

A lawyer adds the most value at three points. First, when you draft or update your collection notice and privacy policy, because those documents do the work of making marketing expectations reasonable. Second, when you buy lists or share data with other businesses, because the contract and the consent trail determine whether the APP 7.3 exception is available. Third, if the OAIC contacts you about a complaint or investigation, where the response you give in the first weeks shapes the outcome.

The expectation test is where most businesses trip up

Of all the moving parts in APP 7, the reasonable expectation test is the one that catches businesses by surprise. Marketing teams tend to assume that because a customer provided contact details, those details are theirs to use. The law takes the opposite view: the purpose of the collection, and what the customer was told about it, define what you can do with the information afterwards. A data list bought from a broker, used without consent and without a prominent opt-out statement in every message, is the classic breach. Before your next campaign goes out, ask where every contact on the list came from and whether a customer receiving it would genuinely expect to hear from you. If you cannot answer yes, stop and get consent, or get advice, before you send.