Privacy a key issue for e-tailers

By DITA DE BONI

As the popularity of direct marketing campaigns grows, more people are offering up more personal information to marketers than ever before.

As a result, privacy advocates are on guard. They warn that business will be damaged by unethical use of information, especially in the area of e-tailing, where online purchasing is often a matter of divulging everything from your bank-balance to your blood type.

Spam, or junk e-mail, is just one outcome of lax privacy provisions. As many e-mail users know to their horror, details sloppily managed can fall into the hands of anyone from TeenSex.com to Molotovs4u.co.nz.

The personal and targeted nature of direct marketing campaigns require a certain amount of information gathering, storing and exploitation by companies. But are New Zealand marketers doing enough to ensure their database practices adhere to the 1993 Privacy Act? And, if they belong to the Direct Marketing Association (DMA), to its code of practice?

Privacy Commissioner Bruce Slane said he did not receive many formal complaints about direct marketers but was often rung by people asking: "How did Company X get my name and number?"

He suggested confusion about how, when and where information can and cannot be used may be hurting business.

"It can stop people doing business online, for example, because they are not always sure how their information will be used."

He said that although selling databases was not illegal, people volunteering their information must be aware that may happen.

Information can be passed on by marketers, as long as they are open about what they are doing and provide people access to correct misinformation held about them.

The issue confronting marketers is highlighted in survey results released this week from the Ministry of Consumer Affairs. The survey showed that while New Zealand websites with e-commerce functions improved their information disclosure from two years ago, many were still not clearly disclosing what they would do with that information.

In the 1999 survey, 90 per cent failed to notify customers which laws applied to their transactions, 62 per cent provided no exchange or refund policy, and 75 per cent had no privacy policy. By 2001, 45 per cent still displayed no exchange or refund policy and 50 per cent did not show privacy policies.

Multinational companies such as IBM and Microsoft have said they would not advertise on sites which do not give some sort of privacy assurance to users.

Not only advertisers but consumers are looking for credible assurances from their commerce portals. And doing business in other countries requires companies to consider their standing on privacy across borders.

One company has ensured its information conforms not only to these two sets of laws, but also to the European Union Directive on Data Protection to boot. Auckland-based marketing services firm Atlantis Marketing, underwent a privacy audit to ensure its business within New Zealand and overseas would be given what it describes as a "seal of respectability."

Atlantis employs 150 people in New Zealand, Australia, the US, Singapore and Japan, and boasts a roster of around 750 corporate clients including Clear, Telstra, Winz and Caltex. The company drives the Mobil Max customer loyalty card and several other similar initiatives, as well as offering call centre, data mining and mail fulfilment services.

With such a vast network of information stored and manipulated by such a large staff, the need to ensure the company's data conformed to all applicable provisions was essential.

The company initiated a privacy audit with PricewaterhouseCoopers to ensure it complied not only with New Zealand privacy legislation but also European Union specifications.

Group managing director Michael Whittaker said: "People don't actually ask for proof that a privacy audit has been carried out yet but we are happy to say that we've got it."

The process involved a team of auditors inspecting every aspect of the organisation's operations, including its data storage and usage, internal and external security measures, how it handled complaints or requests, communications within the company and staff training.

Mr Whittaker said everyone from the receptionist up must understand the privacy principles the firm was trying to uphold.

Of course, not every marketing company can afford to undergo such a wide-ranging and costly process. New Zealand's Direct Marketing Association chief executive Keith Norris said the association would consider offering the service for a fee, but said it was always available to offer advice. He hoped all members would carry out internal audits. A new Code of Practice for Direct Marketing in New Zealand, which came into force in February, is based on five principles which have evolved from the 1993 Privacy Act. Both Mr Norris and Mr Slade agree that New Zealand consumers are fairly well protected if companies adhere to existing legislation.

In cases of a breach of the Privacy Act, a complaint can be laid with Mr Slade which can result, in extreme cases, with civil cases being taken.

While maintaining that most members adhere to the Code of Practice, Mr Norris says privacy is still a prominent issue within the industry.

"Direct marketing is all about one-to-one communication and a high level of trust is a vital ingredient."

Privacy principles


Information must be:

* Relevant for business purpose.

* Collected directly from source.

* Collected with explanation of why 1it is required, who is using it and how it can be accessed for correction.

* Collected lawfully and fairly.

* Accessible by consumers for correction.

* Safeguarded against misuse - and companies with a database must have a privacy officer.

* Kept updated for accuracy.

* Disposed of when out of date.

Must not be:

* Disclosed to third parties without consumer's permission.

Must not have:

* A unique customer number unless the database is large and it is necessary to carry out business.

(From the DMA's Guide to the Privacy Act 1993).

Links


Direct Marketing Association

Office of the Privacy Commissioner