Plenty of pitfalls in new privacy legislation

On 14 March amendments to the Privacy Act 1988 come into force that greatly increase the responsibilities placed on all businesses for the treatment and disclosure of personal information of their customers and prospective customers. Here are some of the most important ones from the point of view of contact centre operators.

The amendments replace two parts of the 1988 Act: the Information Privacy Principles, which applied only to Government bodies, and the National Privacy Principles (NPPs), which applied to the private sector, with a unified set of 13 Australian Privacy Principles (APPs) that apply to Government and to any organisation with annual revenue in excess of $3m.

Tal Williams, a partner in law firm Holman Webb, says: “While the new APPs largely mirror the NPPs, they require a much more active management of your privacy policy [because they] will introduce tighter controls on direct marketing and create liability for offshore breaches of privacy when data is sent overseas (cloud storage included).”

The new rules prohibit any organisation that has collected personal information from using the information for direct marketing purposes, or passing it on for this purpose, unless the person: would reasonably have expected the collecting party to do so, and unless a simple ‘opt out’ mechanism has been provided to enable the individual to stop receiving direct marketing material.

Sending personal information overseas to be used by offshore contact centres or for storage in an overseas cloud will still be possible but, says Williams, “Entities must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the APPs in relation to the information,” And if such a breach does occur, the Australian entity that provided the personal information will be liable.

Nor will an organisation be able to make a decision to use an overseas contact centre or cloud facility ‘on the fly’. The new rules require all organisations to have a clear policy about their management of personal information that sets out: the kinds of personal information it collects; how it collects and holds that information; what it does with that information, including if it will be sent overseas and the countries to which it could be sent.

This policy must be publicly available and there must be a complaint mechanism for those who believe the rules have been breached.

The new discipline of ‘big data’ aka ‘data analytics’ is enabling consumer facing organisations to mine masses of data from many disparate sources for insights into customer behaviour to both refine sales and marketing and to improve customer experience. The new rules are likely to impact their ability to do this: they will have to disclose to customers that they intend to use their personal information for this purpose.

According to a report from law firm Shelston IP and iTNews on the implications of the new legislation, to enable the use of data analytics techniques “organisations will be tempted to seek broad and open-ended consent from users before they sign up to a service or offer their personal data.” This, it says, will not be acceptable.

“The Privacy Commissioner has made clear that this will be frowned upon in any audit, as would an organisation coupling consent with permission to use the service or bundling consent up with a large number of other terms and conditions in a long and arduous agreement few users would be likely to read.”

And finally the new rules do not just apply to personal information collected after they come into effect on 12 March. They apply to all such information that an organisation holds at that date.

Premier Technologies

Premier Contact Point provides a hosted contact solution that meets the needs of the modern contact centre. This cost effective solution provides a means of directing calls to the agent who is best suited to meet the needs of the customer, without having to be transferred multiple times. Businesses choose this hosted contact solution because there is no need to purchase and maintain costly hardware like there is with traditional PBX systems. This means the need for capital expenditure is minimal, all a contact centre agent needs is a phone, PC and an Internet connection.

To learn more about Premier Technologies Premier Contact Point, visit :

Page views: 119