Fair Conduct in Consumer Data Protection

Compliance with the Privacy Act 1988

Members that collect, use, store or disclose personal information for direct marketing purposes must comply with the National Privacy Principles (NPPs) as specified in the Privacy Act 1988.

The National Privacy Principles relate to the following:

• NPP1 – Collection
• NPP2 – Use and disclosure
• NPP3 Data quality
• NPP4 Data security
• NPP5 Openness
• NPP6 Access and correction
• NPP7 Identifiers
• NPP8 Anonymity
• NPP9 Transborder data flow
• NPP10 Sensitive information

Use of Third Party Contacts for Direct Marketing Purposes

Members must only use third party contacts for marketing purposes if:

• The personal information supplied forms part of or is extracted from a database that is currently registered with the ADMA List Warranty Register; or
• Confirmation has been received in material form (ie: in a contract or other documented format) that the data supplied has been collected and disclosed in accordance with the Privacy Act 1988 including the NPPs.

In addition to the above, members using email addresses or mobile phone numbers supplied by a third party for eMarketing purposes must ensure compliance with the Australian eMarketing Code of Practice.

Supply of Personal Information by Third Party Data Suppliers

For the purposes of this section, ‘supply’ shall mean the sale, rental, swapping or brokering of third party contacts between organisations, whether or not for financial gain.

Members must not supply, promote, advertise or offer to supply third party contacts for direct marketing purposes unless:

• The personal information forms part of or is extracted from a database that is currently registered with the ADMA List Warranty Register
• The member supplying, promoting, advertising or offering to supply the personal information is also the data owner and can demonstrate the personal information has been collected and will be disclosed in accordance with the NPPs; or
• The member supplying, promoting, advertising or offering to supply the personal information is not the data owner but has received confirmation in material form from the data owner that the personal information has been collected and will be disclosed in accordance with the NPPs.

In addition to the above, members must not supply, promote, advertise or offer to supply third party email and mobile phone contacts for eMarketing purposes unless:

• The personal information forms part of or is extracted from a database that is currently registered with the ADMA List Warranty Register
• The member supplying, promoting, advertising or offering to supply the personal information is also the data owner and can demonstrate that the email and mobile contacts have given express or inferred consent to have their details disclosed to and used by a third party, or
• The member supplying, promoting, advertising or offering to supply the personal information is not the data owner but has received confirmation in material form from the data owner that the email and mobile contacts have given express or inferred consent to have their details disclosed to and used by a third party