p o s t:	GPO Box 1196 
	Sydney NSW 2001 
e m a i l: 	enquiries@privacy.org.au 
w e b : 	www.privacy.org.au 

	

1 February, 2006

In response to the Department of Communications, Information Technology and the Arts' legislative review of the operation of the Spam Act 2003 and related parts of the Telecommunications Act 1997

Submission by the Australian Privacy Foundation

About the Australian Privacy Foundation 

1.	The Australian Privacy Foundation is the main non-governmental organisation dedicated to protecting the privacy rights of Australians. Relying entirely on volunteer effort, the Foundation aims to focus public attention on emerging issues which pose a threat to the freedom and privacy of Australians. The Foundation has led the fight to defend the right of individuals to control their personal information and to be free of excessive intrusions. The Foundation uses the Australian Privacy Charter as a benchmark against which laws, regulations and privacy invasive initiatives can be assessed.  For information about the Foundation and the Charter, see www.privacy.org.au 

General comments

2.	As noted in the Issues Paper “[s]pam is a global problem that requires a global solution". At the same time, however, one has to start somewhere and as far as Australia is concerned, that was done in 2003 through the Spam Act. While that Act represented, and continues to represent, a good starting point, we welcome the initiative of the Department of Communications, Information Technology and the Arts in publishing the Issues Paper for public consultation. 

3.	The global problem of spam is complicated by the increasingly audacious and technically sophisticated methods used by bulk spammers to evade detection. It has become much worse at this global level since spam laws were passed in many jurisdictions in 2003. While spam regulation may be working well in Australia, it clearly is in a state of complete collapse in some key parts of the Internet.
 
4.	One of the key issues in spam control is the failure of jurisdictions which host major sources of spam, such the USA and some African, European and East Asian countries, to adopt the essentially preferable "opt-in" consent model in the Australian law and to support and engage in vigorous enforcement. For instance, the "opt-out" US federal CAN-SPAM Act, in over-riding other US models such as the Californian "Opt-in, with private right of action" model, set a precedent for ineffective pseudo-regulation and may largely explain the failure of global spam reduction efforts. This parallels other negative compromises against privacy of personal information in favour of abusive commercial interests, under the misinterpreted constitutional rubric of "Free (commercial) Speech" in the US, and with little attempt at justification in other problem jurisdictions. 
 
5.	A key challenge for Australia is how to advocate effectively for change to "opt-in" principles in critical jurisdictions such as the US, without which tinkering at the edges of the Australian Act will have little effect. This is where the hard effort on spam control must be focussed from now on, and will take commitment, courage and sustained well-articulated advocacy. It will be the true test of the mettle of any government in this area.

Definition of a ‘commercial electronic message’ (Questions 1-3)

6.	Not all spam has a clear commercial motivation, and people may be equally inconvenienced by non-commercial spam as commercial spam. The approach chosen in the Spam Act is, in our view, nevertheless justified in being limited to commercial spam, in order to avoid complicated free speech issues. However, this limitation means that there is no further need for special free-speech exceptions, and as is discussed below, this has consequences for the scope of so-called ‘designated’ commercial messages.

7.	Furthermore, the issues associated with VoIP need to be adequately addressed. It would be better that VoIP falls both within the ambits of the Spam Act and the future regulation of a do-not-call list (currently the subject of a separate DCITA consultation, to which we have made a submission – see http://www.privacy.org.au/Papers/DoCITADo-not-call0511.rtf), than that it falls in a gap between the two regulations. Unless it is guaranteed that spam in the context of VoIP will be properly dealt with in the future regulation of a do-not-call list, DCITA and ACMA are invited to reconsider their view (i.e. that “VOIP services are generally ‘carriage services’ and ‘standard telephone services’ within the meaning of the current telecommunications regulatory regime", and should therefore not be subject to the Spam Act) expressed on page 16 of the Issues Paper.

Unsolicited commercial electronic messages must not be sent (Questions 4-6)

8.	Section 16 could be described as the heart of the Spam Act and is appropriately wide in its scope. 

9.	In rare circumstances, the otherwise suitable definition of “Australian link” may be too wide. This was highlighted in Dan Svantesson’s submission in response to the Spam Bill 2003. In that submission the following example was given:

“A person working at the Stockholm office of a large international organisation receives a commercial electronic message (as defined in the Spam Bill), while in Stockholm. Imagine further that the commercial electronic message is in Swedish, is sent by a Swedish corporation located in Sweden, and relate to a specifically Swedish product or service. Under these circumstances it would be undesirable for Australian spam legislation to be applicable. Yet, that is exactly what the result of Sections 7(d)(ii) and 7(c) may be in certain circumstances.  If the international organisation receiving the commercial electronic message “carries on business or activities in Australia when the message is accessed” Sections 7(d)(ii) would seem to indicate an “Australian link”. Further, if the international organisation receiving the commercial electronic message is set up in such a manner that all e-mails are accessed from a mail server located in Australia (perhaps due to the organisation’s head office being located here), Sections 7(c) would seem to indicate an “Australian link”. Both these situations involve what the Explanatory Memorandum refers to as “overseas to overseas” situations. Of course the Swedish company sending the commercial electronic message might find some comfort in Section 16(3), but it is still undesirable for the legislation to provide that there may be an Australian link also in pure “overseas to overseas” situations.”

10.	The type of situation outlined above may not be a large practical problem, but it is nevertheless unsuitable for Australia to make the type of jurisdictional claims mentioned.

The identification requirement (Question 7)

11.	The requirement that commercial electronic messages must include accurate sender information is a necessity. Not only does it make it possible for people to, to a degree, evaluate the relevance of the message, it also ensures that people do not feel they are being targeted by complete strangers about whom they are unable to find out anything. However, the main value is obviously that; first, it allows them to contact and make complaints to the organisation sending the spam messages, and second, it makes the identification of possible offenders easier.

12.	A key issue here is identification of senders from outside Australia, as noted above. This is critical. But it may be more amenable to enforcement and international harmonisation efforts than any further change to Australian law.
 
13.	In addition, non-spam messages should in principle be able to be sent anonymously. The anonymity principle is one of the most important privacy protections recognised in many sets of privacy principles, and while it may be potentially open to some abuse, it is a key support for the expression of a range of communication rights. Nothing in the Spam Act should inadvertently limit its operation.

The unsubscribe requirement (Question 8)

14.	Where a person receives a commercial electronic message he/she has not consented to receiving, the unsubscribe function provides an easy and manageable option for him/her to take steps to avoid further such messages. Of course, the sending of such a message is contrary to the Spam Act, but as it does still happen, the ability to avoid future spam messages from a particular sender is an important consideration.

15. 	Furthermore, where a person receives a commercial electronic message he/she has consented to receiving, the unsubscribe function provides an easy and manageable option for him/her to revoke that consent, if he/she so wishes. 

16. 	In light of the above, it must be concluded that, despite the dubious advisability of actually using some unsubscribe functions due to the potential for further abuse, the unsubscribe requirement itself is of the greatest importance, and of particular utility in communicating preferences to Australian based spammers.

Rules about address-harvesting software and harvested address lists (Questions 9-10)

17.	The provisions regulating address harvesting are suitable both in aim and scope. However some thought should be given to widening the prohibition in the light of new methods of unethical and unwarranted address collection. Some software systems or collection methods are more diffuse than a simple one piece tool, and should perhaps also be covered if they are not already.

Enforcement (Questions 11-15)

18.	The submission made, to the Issues Paper, by the Electronic Frontiers Australia (EFA) deal in detail with the problems associated with the overly broad enforcement powers granted under the Act. We share the EFA’s concern in this area and support the propositions made by the EFA.

Designated commercial electronic messages (Questions 16-17)

19.	The exceptions for commercial messages sent by political parties and religious organisations are an embarrassing blight on the Spam Act and should be removed.  Double standards of this sort undermines the legitimacy and viability of the Spam Act and suggests that it is too hard to seek consent for sending commercial messages and respecting unsubscribe requests, which we do not accept. The Australian Direct Marketing Association's original far sighted acknowledgement of the better commercial outcomes through respectful marketing practices applies to all commercial marketers.

20.	Indeed, as the freedom of religious and political speech is already catered for by the fact that the Act only regulates commercial messages, there is not even an arguable need for exclusions relating to spam sent by registered political parties or religious organisations. 

21. 	Furthermore, people interested in the work of charitable organisations may approach those organisations directly. Indeed, bearing in mind the number of fraudulent charities seeking donations through spam e-mails, it is perhaps surprising that serious charitable organisations would choose to rely on spam as a means of raising funds. Either way, while charitable organisations doubtless benefit society, it would be inappropriate for all organisations that benefit society to be excluded from the application of the Spam Act. Thus, the exceptions for charitable organisations ought to be removed.

22.	Educational institutions also benefit society. But for the same reasons expressed above, parts of this exception ought to be removed. It is difficult to see how that fact that a former member of the household of the relevant electronic account-holder has been enrolled as a student in a particular educational institution would justify spam being sent to that household.

23.	Further, while there can be no doubt that the sending of spam e-mails containing purely factual information may be just as annoying to the receivers and have as negative effects on network efficiency as commercial spam, the exception made in relation to purely factual information seems to flow naturally from the Act’s limitation to commercial messages. Indeed, it could be argued that as non-commercial spam is excluded from the Act altogether, there is no need for further exclusions for purely factual information. Either way, it is very difficult to draw a clear distinction between what constitute purely factual information and what does not. For example, where a company sends purely factual information about one of its products, such a message is clearly motivated by commercial incentives. It is our view that such a message must fall outside the exclusion made for purely factual information. Otherwise, misuse of the exclusion is to be expected, and the whole Act will be severely undermined.

24.	Finally, even if it was concluded that the types of messages currently defined as ‘designated commercial messages’ should continue to be exempt from the prohibition outlined in Section 16, in no circumstances is it justified that those types of messages are exempt from the requirement for a functional unsubscribe facility.

Consent (Questions 18-19)

25.	While certain exceptions may be justified, the starting point for spam regulation must be that people should receive no spam unless they have consented to receiving it. In other words, an opt-in approach must be taken. This means that the definition of how consent can be given is crucial to the effective operation of the regulation.

26.	As we noted in our submission in relation to the Spam Bill 2003, “Spam from an organisation I have dealt with before is still Spam" – there simply is no justification for consent being inferred based, for example, on prior relationships. The average person has “prior relations” with a large number of organisations, and the problem is of spam has reached such proportions, that a requirement for consent to be expressly given for it to be valid is entirely justified.

27.	In addition, a requirement for consent to be expressly given would enhance the clarity of the distinction between legitimate commercial electronic messages and spam.

28.	We share the EFA’s view that the exemptions made for “conspicuous publication” is inappropriate, impractical and unworkable, and we agree with the suggested improvements outlined in the EFA’s submission. 

29.	An issue not raised ion the Discussions Paper, is the problems associated with spam messages that reveal a list of receivers. Where a person receives a spam message addressed to more than one person, and the addresses to other recipients are visible, the sender has arguably acted in breach of the Privacy Act’s provisions dealing with disclosure of personal information. However, the Privacy Act is unfortunately severely restricted in its application (e.g. due to the exclusion of small businesses). Thus, it is crucial that the Spam Act addresses this issue. Even where a person has consented to receiving spam, he/she should be guaranteed anonymity in relation to other receivers of the same spam messages. The Spam Act must insist on the senders of spam acting in a manner that allows receivers of spam to remain anonymous in relation to other receivers of the same spam messages. Thus a provision along the lines of the following should be introduced:

“Where a person sends a commercial electronic message, or a designated commercial electronic message, it must do so in a manner that ensures that a receiver of that message cannot ascertain the name, alias, contact address or other personal information of other receivers of that message.”

Facsimile spam (Questions 20-22)

30.	Spam sent via facsimile is at least as intrusive and annoying as spam sent by other means. Thus, it needs to be regulated. 

31.	Just like with VoIP, there is a risk that fax messages fall in a gap between different types of regulations, and just like with VoIP it is our view that overlapping regulation is preferable to no regulation. Consequently, unless it is guaranteed that facsimile spam will be properly dealt with in the future regulation of a do-not-call list, it is necessary that is addressed within the ambit of the Spam Act. 

The role of industry (Questions 23-28)

32.	We believe that there is a role for a Code of Practice under the Spam Act to guide the activities of all telecommunications service providers, including Internet Service Providers, as potential carriers of Spam.  The Australian Communications Industry Forum (ACIF) has considered the possibility of developing a Spam Act Code, in the context of a review of its SMS Code. However, many of the key providers have resisted this on the basis that they cannot be held responsible for the uses made of their networks.  We believe this is a simplistic and unhelpful view.  While we agree ISPs cannot be held responsible for the content of messages, and should certainly not be authorised to monitor such content, we believe they are in a good position to do much more to filter Spam based on obvious characteristics of the traffic data, and to provide Spam Management tools to their customers (as required to some extent by the Act).  We urge the review to encourage ACIF to revisit the desirability of a Spam Act Code to support the objectives of the legislation.

International cooperation

33.	DCITA and ACMA are to be congratulated on taking such an active role in different forms of international co-operations – such internationally coordinated approaches are truly the only way to effectively address the spam problem.

34.	As to the future direction of the work on protecting Australians against spam, the main priority should be to build an international constituency for a change to a more effective "opt-in" regulatory model in other key countries, such as the US, which would further marginalise the abusers and prohibit, rather than authorise, the sending of spam. 

For further information contact: 

Dr Dan Svantesson, (07) 5595 1418
Board Member
E-mail: enquiries@privacy.org.au
APF Web site: http://www.privacy.org.au