When Can You Send Unsolicited Electronic Messages?

This article examines when a business can send cold-call or unsolicited electronic messages. The answer is, broadly, only in very limited circumstances, particularly if the message has a marketing flavour.

Two Acts regulate what can be done, or rather what can not be done:

The Spam Act (Spam Act 2003 (Cth)); and
The Privacy Act (Privacy Act 2008 (Cth)) and the Australian Privacy Principles (in Schedule 1 of the Privacy Act).

Electronic messages

The starting point when considering spam is whether an electronic message is used. That could be a message by email, social media or text. Voice calls on a standard telephone service are not electronic messages (these are considered to be dealt with under the Do Not Call Register Act 2006 (Cth)).

Fax messages are not considered commercial electronic messages (Spam Regulations 2004, Section 6).

Commercial electronic messages

The next consideration is whether the message is a commercial electronic message. This is where the marketing flavour comes in. Under Section 6 of the Spam Act, an electronic message is a commercial electronic message where:

Having regard to:

the content of the message; and
the way in which the message is presented; and
the content that can be located using the links, telephone numbers or contact information (if any) set out in the message;

it would be concluded that the purpose, or one of the purposes of the message is:

to offer to supply goods or services; or
to advertise or promote goods or services; or
to advertise or promote a supplier, or prospective supplier, of goods or services;

…

and lots of other purposes.

This is extremely broad, and even a very “soft-sell” in a message would be likely to render it “commercial”.

Prohibition of CEMs

A commercial electronic message may not be sent (to anyone) if it:

has an Australian link (as this article is directed to Australian businesses, it will be assumed that there is an Australian link); and
it is not a designated commercial message.

(Section 16(1)) unless the receiver (relevant electronic accountholder) has consented (Section 16(2)).

Consent

Schedule 2 of the Spam Act deals with consent, which can be express or reasonably inferred from business or other relationships (clause 3). That is fairly straightforward. Consent can be withdrawn by 5 business days’ notice (clause 6).

Conspicuous publication

Where consent becomes complicated in relation to spam is when an email or other electronic address is “published”. Clause 4(1) of Schedule 2 says:

For the purposes of this Act, the consent of the relevant electronic account holder may not be inferred from the mere fact that the relevant electronic address has been published.

However, there is an exception for conspicuous publication, whatever that is (clause 4(2)). Clause 4(2) of the Schedule reads:

However, if:
1. a particular electronic address enables the public, or a section of the public, to send electronic messages to:
  1. a particular employee; or
  2. a particular director or officer of an organisation; or
  3. a particular partner in a partnership; or
  4. a particular holder of a statutory or other office; or
  5. a particular self-employed individual; or
  6. an individual from time to time holding, occupying or performing the duties of, a particular office or position within the operations of an organisation; or
  7. an individual, or a group of individuals, from time to time performing a particular function, or fulfilling a particular role, within the operations of an organisation; and
2. the electronic address has been conspicuously published; and
3. it would be reasonable to assume that the publication occurred with the agreement of:
  1. if subparagraph (a)(i), (ii), (iii), (iv) or (v) applies—the employee, director, officer, partner, office-holder or self-employed individual concerned; or
  2. if subparagraph (a)(vi) or (vii) applies—the organisation concerned; and
4. the publication is not accompanied by:
  1. a statement to the effect that the relevant electronic account holder does not want to receive unsolicited commercial electronic messages at that electronic address; or
  2. a statement to similar effect,
    
    the relevant electronic accountholder is taken, for the purposes of this Act, to have consented to the sending of commercial electronic messages to that address, so long as the messages are relevant to:
5. if subparagraph (a)(i), (ii), (iii), (iv) or (v) applies – the work-related business, functions or duties of the employee, director, officer, partner, office-holder or self-employed individual concerned; or
6. if subparagraph (a)(vi) applies – the office or position concerned; or
7. if subparagraph (a)(vii) applies – the function or role concerned.

So, in summary, the effect of this exception is that if a particular email or other electronic address of a particular individual is conspicuously published and:

it is reasonable to assume that the publication is with the consent of the individual; and
the publication is not accompanied by any statement that the individual does not want to receive unsolicited CEMs,

consent is taken to have been given for messages, but only if relevant to work-related business, or other functions and duties.

What is “conspicuous”?

“Conspicuous” is not defined in the Spam Act. There is little guidance available from the regulator, the Australian Communications and Media Authority (ACMA). However, Section 4 of the Spam Act defines “published” to include:

published on the internet; and
published to the public or a section of the public.

If an email or other address is published on the internet, but is not readily available, such as on a webpage which is not generally available to the public, like a chatroom or a subscriber webpage, it would not be likely that the publication would be considered to be conspicuous or that the account holder for the address consents to receiving commercial electronic messages.

Harvested addresses

It is also not possible to use an address that has been obtained by address-harvesting software. The supply, acquisition and use of address-harvesting software and harvested-address lists is expressly prohibited by Sections 20 - 21 of the Spam Act.

Designated commercial messages

As well as the possibility of consent, including inferred consent, to receipt of commercial electronic messages, there is also a carve-out in Section 16(1)(b) for designated commercial electronic messages. This is probably a more difficult concept than consent. Schedule 1 of the Spam Act defines what is meant by the expression “designated commercial electronic message”. There are a number of elements, and it is necessary to look at the definition in detail. Clause 2 of Schedule 1 reads:

Factual information
1. For the purposes of this Act, an electronic message is a designated commercial electronic message if:
  1. the message consists of no more than factual information (with or without directly-related comment) and any or all of the following additional information:
    1. the name, logo and contact details of the individual or organisation who authorised the sending of the message;
    2. the name and contact details of the author;
    3. if the author is an employee—the name, logo and contact details of the author’s employer;
    4. if the author is a partner in a partnership—the name, logo and contact details of the partnership;
    5. if the author is a director or officer of an organisation— the name, logo and contact details of the organisation;
    6. if the message is sponsored—the name, logo and contact details of the sponsor;
    7. information required to be included by section 17;
    8. information that would have been required to be included by section 18 if that section had applied to the message; and
  2. assuming that none of that additional information had been included in the message, the message would not have been a commercial electronic message; and
  3. the message complies with such other condition or conditions (if any) as are specified in the regulations.

Government bodies and educational institutions get special treatment for their messages to be designated commercial messages.

Factual information

The first element of the definition of designated commercial electronic message is that it must only consist “of no more than factual information (with or without directly-related comment)”.

Some commentaries limit this concept to solely transactional messages, such as acknowledging an online transaction, confirming a product or service purchase, or advising how to reset a password. This approach, however, is too narrow. It is hard to see how such a merely transactional message (unless accompanied by other matters) could have the purposes with a marketing flavour required by Section 6(1) to be a commercial electronic message.

A designated commercial electronic message must have the details of the message's sender and other information specified in clause 2(1) of Schedule 1. The addition of this information could be seen to be marketing, but clause 2(b) makes it clear that the message is to be considered without reference to the additional information, so that if the content of the message, on its own, without reference to the additional information would not be taken to be a commercial electronic message, then the message as a whole, with the additional information, will be a designated commercial electronic message.

What is factual information?

There is no real guidance available from ACMA as to what is “no more than factual information”. However, the Explanatory Memorandum to the Bill for the Spam Act does contain some guidance and says that:

This provision is designed to ensure that messages which may be seen to have some form of commercial element, but which are primarily aimed at providing factual information are not covered by the rules relating to commercial electronic messages in clauses 16 and 18 of the Bill. Many firms and organisations provide newsletters and updates of this type which are of benefit to sections of the general business community and it is not intended to prevent this beneficial activity.

Examples given in the Explanatory Memorandum include:

An electronic message from a private law firm which includes an information sheet outlining the effects of a particular court decision. At the bottom of (the) sheet the law firm may have the firm name, address, contact details and logo. Of itself this message could be seen to be commercial in nature as ultimately the message is designed in some way to promote the interests of the private law firm. However the messages primary intent is to provide factual information.

Messages that are not DCEMs

The Explanatory Memorandum also has some interesting examples of messages that would not qualify as designated commercial electronic messages because they have some sort of marketing flavour. These examples are:

an electronic message which states that television sets are all 20 percent off a major retailer this week with a link to the retailer’s website, or the contact details for the retailer. While this message may contain purely factual information (i.e. it is in fact true that all television sets are 20% off this week) it falls outside this exclusion as the factual information would have brought the message within the meaning of a commercial electronic message (under clause 6);
an electronic message which states that all the girls whose photos appear at a particular site are over 18 years of age would not be covered by this exclusion. While the statement may be factual it falls outside this exclusion because the message comes within the meaning of a commercial electronic message;
a message discussing the erectile dysfunction and containing a link to a site where Viagra is sold would likewise fall outside this exclusion as the link has brought the message within the meaning of a commercial electronic message (under clause 6) except for this exception.

Unsubscribe facility

A commercial electronic message must have information about the sender required by Section 17 of the Spam Act and must contain a functional unsubscribe facility that complies with Section 18 of the Act. Regulation 7 of the Spam Regulations contains conditions for electronic addresses for receiving unsubscribe messages.

Section 18 does not apply to a designated commercial electronic message (Section 18(1)(b)). However, notwithstanding that an unsubscribed facility may not be required in a designated commercial electronic message, it may be wise to include such a facility.

Privacy Act/personal information

So, if it seems likely that electronic messages can be sent to addresses relying on the consent, express or implied, of the recipient or designation of the messages as electronic commercial messages, is this all that needs to be considered? Well, no, it will also be necessary to consider the requirements of the Privacy Act and the Australian Privacy Principles [APPs].

The relevant APPs are:

APP 3 – collection of solicited personal information;
APP 5 – notification of the collection of personal information;
APP 6 – use or disclosure of personal information;
APP 7 – direct marketing.

Personal information

Personal information is defined in the Privacy Act as meaning “information or an opinion about an identified individual, or an individual who is reasonably identifiable”. This is considered to include an address, such as an email address, for an individual, but not for an entity that is not an individual.

APP entities

A business will only be required to comply with the APPs if the business is an APP entity, that is, generally, with some exceptions, an organisation that is not a small business operator (with an annual turnover of $3 million or less). A health service provider is an APP entity regardless of turnover.

Direct marketing

Dealing with the APPs in reverse order, APP 7.1 prohibits the use or disclosure of personal information for direct marketing, other than within certain limited exceptions. However, APP 7.8 provides that this APP does not apply to the extent that the Spam Act applies. Accordingly, the Spam Act will govern the sending of commercial electronic messages, and it is not necessary to consider APP 7.

However, as only APP 7 is excluded from consideration, it is necessary to consider the application of other APPs.

Correction of personal information

APP 3.2 provides that an APP entity that is an organisation “must not collect personal information (other than sensitive information) unless the information is reasonably necessary for one or more of the entity’s functions or activities”.

Collecting electronic addresses, such as emails, to send out commercial electronic messages will almost certainly be information that is reasonably necessary for the functions or activities of a business.

Notification of collection of personal information

APP 5 requires that an APP entity must take steps that are reasonable in the circumstances to notify an individual or to ensure that the individual is aware of matters that are set out in APP 5.2. These matters include the identity and contact details of the entity, which will, in any event, be required to be disclosed in a commercial electronic message.

Other likely relevant requirements of APP 5.2 for a business that sends commercial electronic messages include:

the fact that the entity collects, or has collected information and the circumstances of the collection;
the purposes for which the information is collected;
consequences (if any) if the information is not collected (likely to be that the individual will not receive these letters or information promulgated by the entity);
that the APP privacy policy of the entity contains information about how an individual can access personal information or complain.

There are other requirements of APP 5.2.

If an email or other commercial electronic message is sent by a business, the entity may be able, in the body of the message, to direct the attention of the recipient to a link or document that sets out the information required by APP 5.2.

Use of personal information

APP 6 contains requirements for the use by an organisation of personal information that has been collected for a particular purpose (primary purpose) for another purpose (secondary purpose). As noted above, in relation to APP 3, if a business collects email, or other electronic addresses, for the purposes of sending out commercial electronic messages, this will be a primary purpose, and it should not be necessary to consider APP 6.

What if you get it wrong?

The regulators for the Spam Act (ACMA) and the Privacy Act (OAIC) go to great lengths to stress that it is a very bad idea to commit breaches of the legislation.

Both Acts have very substantial penalties or breaches.

ACMA says that breaches of the Spam Act “can result in the ACMA seeking civil penalties in the Federal Court, giving an infringement notice, accepting court-enforceable undertakings or issuing a formal warning. Repeat corporate offenders may face penalties of up to $2.22 million a day."

The OAIC advises that a recent amendment to the Privacy Act “increases the maximum penalties for serious or repeated privacy breaches from the current $2.2 million to whichever is the greater of:

$50 million;
three times the value of any benefit obtained through the misuse of information; or
30% of a company’s adjusted turnover in the relevant period.”

For a person other than a body corporate, the maximum penalty is $2,500,000.

These are obviously at the extreme end of the penalty spectrum, but the message is very clear that considerable care should be taken to ensure that breaches of the legislation do not occur.