Slip 4 · Contact lists
Buying a list of leads
Buying or renting a list of contacts does not transfer anyone’s consent to you. The ACMA says that buying or using a marketing list still leaves you responsible for making sure you have consent for each address you use, and that businesses cannot outsource their spam and telemarketing obligations.
General information, not legal advice. The ACMA explains the spam and telemarketing side on telemarketing and e-marketing; the OAIC explains the privacy side in its direct marketing guide.
Who stays responsible. The ACMA’s statement of expectations says businesses are responsible for their consent obligations whether they outsource their telemarketing, their e-marketing, or the gathering of consent itself through third-party or affiliate arrangements.
Five questions follow from what the regulators have published. This guide’s reading is that a seller’s assurance does not settle any of them, because the regulators place the responsibility on the business that uses the list.
-
Did each person agree to hear from your business?
ACMAThe ACMA expects consent terms to say who will use the consent, including affiliates and partners, and it lists refer-a-friend arrangements as a poor practice because consent must be given by the person it applies to.
For calls, the register’s consumer page describes express consent as a person clearly agreeing or asking to receive marketing calls from a particular organisation.
-
How were the addresses and numbers gathered?
ACMAUnder the Spam Act you cannot use or supply a list created with address-harvesting software. The ACMA also says not to send messages only because an email address or phone number has been published, since publication does not mean consent has been given. For calls, a number listed in a directory or on a website is not consent either.
-
How old is the consent?
ACMAFor telemarketing, express consent given without a set period is taken to expire three months after it was given. The ACMA describes telemarketing consent older than three months as stale unless the person agreed to a longer period, and expects businesses not to rely on consent so old that the person would not expect it to still apply.
-
Can the records be produced?
ACMAThe ACMA tells businesses not to assume that third parties working with them will keep records of consent, and to have oversight and assurance processes so the records are reliably kept. If the ACMA requires those records using its compulsory information-gathering powers, they must be produced. The consent records slip covers what a record should hold.
-
Have the phone numbers been washed, and who is calling?
ACMAA registered number may be called if the list was washed against the Do Not Call Register in the previous 30 days and the number was not on it, or with the account holder’s consent. Where another party makes the calls, both that party and the business wanting the calls made have to comply, and the arrangement must include express provisions requiring compliance with the Act.
The privacy side of a bought list
OAICWhere the Privacy Act covers an organisation and APP 7 applies, information bought from a list provider or taken from third-party lead generation falls under the second exception, APP 7.3. That means the person’s consent, unless getting it is impracticable; a simple way to opt out; and a prominent statement in every marketing message that they can opt out. A person can also ask where their information came from, and the organisation must tell them unless that is impracticable or unreasonable.
Being a small business does not by itself keep a list buyer outside the Privacy Act. The OAIC says a business is trading in personal information if it collects or discloses it to someone else for a benefit, service or advantage, and gives buying a mailing list without first getting the consent of everyone on it as an example. A business that trades in personal information has to comply with the Australian Privacy Principles. The OAIC lists trading in personal information among the activities that bring a small business under the Privacy Act regardless of turnover.
The same page notes that a business is not trading if it has the consent of all the individuals concerned, or only does so when authorised or required by law.
Selling or sharing your own list
The OAIC calls collecting information in order to pass it to another organisation for that organisation’s own marketing “facilitating” direct marketing. A person can ask the first organisation to stop using or disclosing their information that way, and it must stop within a reasonable period and without charge. Engaging a mailing house or a telemarketer to market on your own behalf is different: that is carrying out your own marketing through a contractor.
Public sources
The OAIC says the APPs do not stop a business from using personal information that is publicly available in its marketing, but APP 7 still requires consent, or that consent be impracticable, along with a simple opt-out, and the Spam Act and Do Not Call Register Act may still apply. Some public registers have their own laws limiting how their information is used.