This document summarises the complaint process to a company that sent an unsolicited marketing email to a consumer. It evidences several things, including:

• improper use of the Electoral Roll and the White Pages (use of which, because of the weakness of Australian privacy law, is not illegal)
• an inadequate initial response by the company
• by dint of persistence by the consumer, a subsequent appropriate response

In March 2010, a consumer received an unsolicited letter promoting Woolworths Everyday Money credit-card. Some problems perceived by the consumer were that:

• it provided no information on where the consumer's details had been acquired
• in the small print at the bottom of the application form, it mentioned that the card is issued by HSBC
• the data collected would be available to:
  • "HSBC, any company which is related to HSBC [i.e. a lot of banks!], and HSBC's assignees"
  • "Woolworths and any company which is related to Woolworths" [the promo letter alone mentions BigW, Dick Smith, Thomas Cook, and three liquor chains]
  • any insurer that may become involved

In late March 2010, the consumer wrote to Woolworths Everyday Money, as follows:

• "could you please advise me as to where you obtained my personal details
• "I believe that you are legally obliged to reply yo my request within 30 days".

In mid-April, a Darren Nguyen, Manager, Verifications, Card Partnerships, replied, on Woolworths Everyday Money letterhead:

• "Woolworths Everyday Money commissions the use of external data to use for promoting products, services, special offers and promotions relating to the Woolworths Everyday MasterCard.
• "Your details were obtained from the electoral roll or from a publicly available database such as the White Pages and Veda Advantage".

The consumer wrote back to Woolworths Everyday Money that:

• "The vague words "the electoral roll or ... a publicly available database ..." don't answer my question.
• "Please advise specifically where you got my data from.
• "I believe that you are obliged to provide a specific answer, and will escalate the matter if you fail to do so.
• "I note that your form, contrary to standard practice, appears to contain no human-readable reference number. I enclose a photocopy of the form. It shows machine-readable codes that presumably contain further, hidden data."

In early May, a reply was received from (presumably the same) Darren Nguyen, but this time on HSBC letterhead, and over the title Team Manager, HSBC Credit Card Operations, On Behalf of Everyday Money. It said:

• "Further investigations with Veda Advantage has shown that your details were sourced from the Electoral Roll prior to July 2004.
• "The Veda Advantage Solutions Group (VSG) database is sourced from a series of privacy compliant publicly available lists such as the telephone directories and pre July 2004 hard copies of the Electoral Roll. The database is privacy compliant in the National Privacy Principles as released by the Privacy Commissioner. [Apparently the company isn't aware that they're promulgated by the Federal Parliament, and are law.]
• "Further to your letter, Veda Advantage has now suppressed your name [and address] from their direct marketing database ...
• "You may also wish to contact [ADMA] and request your details be placed on the industry suppression file administered by them. This is referred to as the 'Do Not Mail & Do Not Call' suppression file and is utilised by all responsible direct marketers ...".

Some Conclusions

Trafficking in consumer data is rife.

Because of the prevalence of diverse conglomerates and strategic partnerships in big business, consumer data acquired from many sources gets strewn across many companies' files.

The Electoral Roll and the White Pages are being used for purposes that have nothing whatsoever to do with the purpose of collection.

The consumer marketing industry is depending very heavily on the authorisations provided to it by the anti-privacy amendments to the Privacy Act that were enacted in 2000 in violation of the consultation process that the then Attorney-General wasted the consumer advocates' time on.

At least some consumer marketing companies will respond to requests for information about where the consumer's details were acquired from; but it requires persistence and the threat of escalation to get an answer.

In this case, the company (i.e. Woolworths and/or HSBC and/or unnamed subsidiaries and/or strategic partners of those companies):

• presumed that their information-provider Veda Advantage could become involved
• presumed that the complaint represented implied consent to "suppress" the consumer's name and address in the Veda database

Veda doesn't "delete", but "suppresses". There can be justification for retaining some data, if and only if it is used to ensure that no further data is collected. The relevant data would appear to be:

• sufficient details to distinguish the individual
• the date and source of the request to suppress the individual from the database