Explanatory Statement
Variation of the Market and Social Research Privacy Code
This Explanatory Statement has been drafted for the purpose of fulfilling the Office of the Privacy Commissioner’s obligations under section 26(1) of the Legislative Instruments Act 2003.
1. PURPOSE
The Association of Market and Social Research Organisations (AMSRO) is the industry body of market and social research organisations. The Market and Social Research Code (the Code) first approved on 1 September 2003 sets out the obligations of AMSRO members in relation to the handling of personal information.
The purpose of approving the variation to the Code is to update references in the Code that relate to the association’s previous name, the Association of Market Research Organisations (AMRO). The Code has also been varied to expressly state that it does not cover acts and practices that are otherwise exempt under sections 7B and 7C of the Privacy Act 1988 (the Act) and to align the definition of sensitive information in the Code with the definition set out in s6(1) of the Privacy Act.
1.2 Authority for making this Approval
The approval to vary the Market and Social Research Privacy Code is made under s18BD of the Privacy Act. Section 18BD states:
(1) An organisation may apply in writing to the Commissioner for approval of a variation of an approved privacy code by giving the Commissioner a copy of the code that incorporates the variations.
(2) The Commissioner may approve in writing the variation.
(3) In deciding whether to approve the variation, the Commissioner must consider all of the matters that the Commissioner would consider in deciding whether to approve under section 18BB a privacy code identical to the approved privacy code with the variation.
(4) However, if the Commissioner thinks that a variation is minor, he or she need not be satisfied that members of the public have been given an adequate opportunity to comment on a draft variation of the code (as would otherwise be required by paragraph 18BB(2)(f)). Instead, the Commissioner may consult any person he or she thinks appropriate about the draft variation.
(5) The approval of the variation takes effect on the day specified in the approval.
(6) The day specified must not be before the day on which the approval is given.
2. REASONS FOR MAKING THE APPROVAL
2.1 Background to Approval
The Code was first approved with effect from 1 September 2003 and is administered by the Association of Market & Social Research Organisations (AMSRO) Secretariat (the Code Administrator).
In August 2006, the Code Administrator wrote to the Office of the Privacy Commissioner (the Office) to advise that it had appointed an independent Code reviewer and an independent review panel to conduct a review of the Code. The review report released in February 2007 recommended, among other matters, that references in the Code to “Association of Market Research Organisations” and “AMRO” be replaced with “Association of Market and Social Research Organisations” and “AMSRO”.
On 10 May 2007 AMSRO applied to the Privacy Commissioner to vary the Code by giving the Commissioner a copy of the Code incorporating the variation, as required under s18BD(1). The variations in the Code gave effect to the recommendation made in the review report.
Following review of the AMRSO’s application, the Office recommended that the two further variations should be made:
- Updating the definition of sensitive information in clause 1.25 of Code to align it with the definition set out in s6(1) of the Privacy Act;
- Including a clause (1.3) in the Preamble to the Code to expressly state that the Code is not intended to cover acts and practices otherwise exempt under section 7B and 7C of the Privacy Act.
Both the suggested amendments were agreed to by AMSRO.
2.2 Public interest and other relevant considerations
Relevant considerations
In deciding whether to approve a variation to a Code, under s18BD(3) the Commissioner must consider the matters that the Commissioner would consider in deciding whether to approve the Code under section 18BB. The provisions as set out in sections 18BB(2) and 18BB(3), provide that the Commissioner should have regard to matters such as whether the Code:
incorporates all the National Privacy Principles (NPPs) and sets out obligations that, overall, are at least equivalent to those principles, subs18BB(2)(a);
specifies the organisations or types of organisations that will be bound by the Code and how organisations can withdraw from the Code, subs 18BB(2)(b), (c) and (d);
sets out procedures for making and dealing with complaints as required by s18BB(3), subs 18BB(2)(e); and
evidence that members of the public have had an adequate opportunity to comment on a draft of the Code, subs 18BB(2) (f).
Compliance with these provisions formed part of the Code review undertaken by the independent code reviewer and public consultation was undertaken as part of the review.
Public interest
The co-regulatory approach offered by Part IIIAA of the Privacy Act allows for some flexibility in how organisations approach their privacy obligations but, at the same time, ensures that minimum enforceable standards apply to the protection of personal information.
AMSRO report that the majority of market and social research businesses in Australia have an annual turnover of less than $3 million. Under s6D these businesses may not be regulated by the Privacy Act unless it is established that the exception in s6D(4)(d) applies or the provisions under s6D(8) do not.
In effect the Market and Social Research Code establishes that members of AMSRO, who are already within the jurisdiction of the Privacy Act or have opted into that jurisdiction under s6EA, and who have agreed to be bound by the Code, are subject to higher privacy protections than the NPPs in relation to collection of personal information. The Code also provides privacy standards which are written in industry specific language.
The experience of our Office indicates that no complaints have been received about market research participants since the Code was approved in September 2003.
Public consultation
Where a code variation is considered to be minor, under s18BD(4) the Commissioner does not need to be satisfied that members of the public have been given an adequate opportunity to comment on the draft variation, though the Commissioner may consult directly about the variation as appropriate. In the Privacy Commissioner’s Guidelines on Privacy Code Development, Guideline 7.1 states that a major amendment is one that is:
“ likely to have a significant effect on the operations embodied in the code or is likely to have a measurable impact on a group of individuals”.
The variation to the Code essentially involves updating references in the Code that relate to the association’s previous name; including an explicit reference that the Code does not cover acts and practices that are otherwise exempt under sections 7B and 7C of the Act; and aligning the definition of sensitive information in the Code with the definition set out in s6(1) of the Act. These changes were reviewed by the Office in terms of s18BD(4) of the Act and Guideline 7.1 of the Code Guidelines and assessed to be minor variations. Further, the Commissioner considered that members of the public had been given sufficient opportunity to comment on the review of the Code. On this basis the Commissioner did not require AMSRO to undertake public consultation in relation to the variations to the Code.