ellipticalpointofview

I had the privilege of attending ADMA’s WA Marketing Conference last week where their CEO Jodie Sangster discussed proposed changes to Australia’s Privacy Laws that are in train and how they will affect any business:

• using their own website, data lists or third party sites (e.g. social sites like Facebook and LinkedIn) to collect data that they may use for marketing purposes
• supplying data they have collected for marketing purposes to other companies and/or across national borders

There are a wide range of ramifications when this legislation is passed, I encourage you to review the slides I found of the presentation:

These were helpfully uploaded for the education of all by datalicious 😀

From the sounds of the presentation, this legislation is in the post.

So it is well to be aware of the bare bones and be ensuring any business processes are working in a way that is agile to these changes, rather than finding out how the penalties will apply.

Penalties which could range from a $1.1 million AUD fine for a contravention overall…to $1.1 million for every consumer record involved in that breach. Ouch.

If you can, I thoroughly recommend sitting in on any future presentations ADMA/Ms Sangster gives on this topic – the value add information and examples to demonstrate the concepts make this abstract concept understandable and applicable to business great and small.

I take all my notes on twitter these days (hate trying to read my hand writing after conferences), so you can review my public facing commentary in my stream: twitter.com/natachasuttor.

I have also pasted an expanded version below [square brackets = slides under discussion]:

– #ADMAWA indications there may be legislation/restriction about privacy re retargetting, geo-location & more

– #ADMAWA privacy laws will affect data kept on unnamed individuals, similar to European (EU) legislation. [SLIDE 4]

– #ADMAWA EU legislation currently under discussion: to protecting consumer rights:. if taking business elsewhere, consumers can ask companies to pass on data to competitor

– #ADMAWA EU legislation currently under discussion: consumers can request businessess delete all data on them. This will also mean requirement on companies to ensure anyone they supplied it to deletes too.

– if you do business in the region, their law applies. it is unwise to transfer individuals data to regions with a lower level of privacy protection [SLIDE 5]

– #ADMAWA data gathering: no longer able to make name mandatory for forms. Individuals must have option for pseudonym & anonymity

– #ADMAWA govt statement prohibiting direct marketing has clauses which mean business as usual.

– Using 3rd party data: new rules inc lists & extend to 3rd party sites eg LinkedIn, Facebook & etc #ADMAWA disclosure required on site. Requirement for a highly visible opt out in every communication.

– this includes opt out required for every marketing communication for 3rd party data. [SLIDE 8]

– Does not seem to take into account fact that opting out on social v different to opting out from email: in social’s case opting out is a function of the app and always at the discretion of the consumer

– Future cross border disclosure laws: 3 possible options. Complexity causing stumbling block for legislation #ADMAWA [SLIDE 9]

Future planning…

I would be starting to consider possible future requirements by interrogating your current activities and processes, querying things like:

• do you have a schedule of marketing communications you send to a set of people?
  • are you sending to people beyond Australia (if so: have you confirmed that your marketing communications adhere to the privacy laws in their regions?)
  • do you make it transparent and easy for people to opt out?
  • does a third party handle these communications to your database?
• does your website drop cookies on peoples browsers to collect data? what sort of data are you collecting?
• do you undertake or plan to undertake remarketing or retargetting activities as part of your marketing activities?
• if you have sign up forms, where does the sign up occurs? who hosts any forms you have for prospect/customer sign up? e.g. is it on your site, via an app hosted by a third party, via a 3rd party registration/survey site? are you considering using Google adwords email subscription extension etc?
• who hosts the database you store the prospect/customer information that you collect? is it stored on that registration/survey site, in databases on your servers etc (Jodie Sangster mentioned that cloud computing renders some of the requirements for trans-national data transfer as problematic, possibly one reason why the legislation is still in train)
• do you provide that data to other departments or 3rd parties? if so, how would you handle an instance where a customer wants all their data deleted?

ADMA have a great set of resources available to their members, including a compliance hub, it would be worth signing up to their emails and tapping their expertise and background in the area.