What are the privacy laws for direct marketing?

Marketing is an integral part of growing your business. Using marketing strategies which directly target specific people can have a significant impact on the success of your company. However, it is crucial to understand what you can and cannot do when running a marketing campaign. LegalVision Senior Lawyer, Jacqueline Gibson, explains the different privacy laws which apply to sending direct marketing to your clients.

What Type of Marketing Do You Want to Send? 

The privacy and spam laws in Australia apply to different types of marketing. Therefore, the first step is deciding what kind of marketing you want to send. 

For example, you may plan to send:  

• emails;  
• text messages; or  
• letters via post.

Is My Business an APP Entity? 

Before sending direct marketing materials to anyone, you need to determine whether your business is an ‘APP entity’. This is because only APP entities must comply with the primary privacy law in Australia, the Privacy Act. Not all businesses will be an APP entity. The key test of whether you are an APP entity is if your company has an annual turnover of $3 million or more. Other tests include whether your business conducts activities which make handling personal information riskier. 

For example, a doctor holding health information is an APP entity. A business which buys and sells personal contact details will also be an APP entity. 

If your business falls into this classification, you will need to consider how the Privacy Act applies to your business before directly sending any marketing material to anyone.

Which Laws Apply to Sending Letters?

Before sending a marketing letter via post, you need to think about which laws will apply. Privacy laws sometimes apply to businesses sending marketing through the post. 

For example, this includes where the letter reads ‘To the occupant’. 

However, if the letter is not addressed to anyone specifically, privacy laws will not be applicable. 

If you are an APP entity, and the Privacy Act applies to your business, you need to consider whether the receiver of your letters has consented to you sending them. If you do not have consent, you need to consider whether you collected the contact details from the person and if they would reasonably expect you to send them letters.

Sending Letters With Consent

To obtain proper consent for sending direct marketing: 

• the person must know what they have consented to; 
• consent must be optional; and 
• consent must be specific. Consent will be specific, for example, if it is a clear statement next to a tick box. 

If you have received consent, you can send the letter. You must say in the letter that the person may withdraw their consent at any time. You must also provide an easy way to do this and, once they have, you must stop sending them marketing letters.

Sending Letters Without Consent

If you do not have consent, you still may be able to send marketing letters in some circumstances. This is where the person gave you their contact details and would reasonably expect you to send them letters. A person may also reasonably expect to receive direct marketing from you if:  

• they are an existing customer of yours; and 
• you have stated in your privacy policy that you may send direct marketing. 

In the letter, you must also include a similar statement that the recipient can request that you stop sending marketing materials. 

In some circumstances, you can still send direct marketing if you collected the contact details from a third party or if it is impracticable to obtain consent. However, it is best to speak to your lawyer before you do so.

What Laws Apply to Sending Emails or Text Messages?

If you wish to send marketing emails or text messages, the laws that apply are slightly different from those that apply to sending letters. 

If your business is an APP entity, the Privacy Act will also apply when you send electronic marketing messages. But, you also need to be aware of how spam laws impact sending marketing emails and text messages. 

When sending electronic marketing messages, you should focus on how spam laws affect what you can send. Even if your business is not an APP entity, your business will need to comply with spam laws. 

The Spam Act requires that you meet three requirements when sending an electronic marketing message. These are that you have: 

1. consent; 
2. identified yourself as the sender; and 
3. an unsubscribe function.

1. Consent

To obtain consent, the Spam Act says you can receive either: 

• express consent; or  
• implied consent.  

For example, express consent is a phone call with a customer where you ask if you can send marketing emails, and the customer says ‘yes’ and provides their email address. 

In this scenario, you should: 

• keep a record of the call; 
• note they provided consent; 
• note how they provided consent; and  
• record the date of the call.  

An example of inferred consent is a text message sent to a customer of your business about a sale you are having. It is inferred that, as a customer of your business, they will be interested in your products and sales. 

You can only use inferred consent to send content related to the existing relationship you have with that person. 

2. Identification of You as the Sender 

You must identify your business in the email or text message as the sender of the marketing content. You should also include your business’ name and contact details. 

3. An Unsubscribe Function 

If you send an electronic marketing message, you must also include an unsubscribe link. The link should be operational for at least 30 days after sending the message. If someone requests to unsubscribe, you need to unsubscribe them within five working days.