Australia's exposure draft Privacy Amendment bill adds a 'fair and reasonable' test and, for the first time, a legal definition of direct marketing, with consent required where personal data is traded. An estimated 2.5 million businesses will lose the small business exemption. The marketing team is the part of the business most exposed.
The Take: The rules on collecting and using customer data in Australia are being rewritten, and the marketing team is the part of the business most exposed. The exposure draft released on 31 August adds a "fair and reasonable" test and, for the first time, a legal definition of direct marketing. Consent by default is on the way out, and the data trade that quietly powers a lot of targeting is squarely in scope.
The mechanics: The Privacy Amendment bill would require that any collection, use or disclosure of personal information is objectively fair and reasonable, judged on customer expectations, transparency, data minimisation and genuine choice, as Mi3 reported. It also rewrites the direct marketing rule into a single technology-neutral definition and requires consent where personal information is traded, including disclosures to advertising partners.
Who pays: The small business exemption that keeps firms under A$3 million turnover out of the Act is being wound back, with an estimated 2.5 million Australian businesses set to come under the full 13 privacy principles, per DLA Piper's analysis. Read that again. Most of those businesses have never mapped what customer data they hold or why they hold it.
Australian businesses set to lose the small business exemption and fall under the full Privacy Act
The fine print: Consultation on the draft closed on 18 September, so the shape is close to set. The parts that touch marketing directly, consent for data sharing and a fair-and-reasonable test on collection, are the ones to plan around now rather than in the last week before they commence.
For Australian operators: Map every place you collect customer data and every partner you share it with, because "we pass it to our ad platforms" is exactly the disclosure that will soon need consent. Cut the data you cannot justify holding. Rewrite consent language so it offers a genuine choice rather than a pre-ticked box, and treat your customer database as a compliance asset rather than only a targeting one. The businesses that tidy this early will spend less and worry less than the ones waiting for the deadline.