Where the bill is up to
The Attorney-General’s Department published an
exposure
draft of the bill and a
consultation
paper on 31 August 2026, and took submissions until Friday 18 September. Its
consultation
page, unchanged when we read it on 14 October, says The Bill remains subject to further
consideration by government.
The draft’s commencement table is blank, and a
search
of the Parliament’s bills database for the title returned no results on 14 October. So
everything below is a draft that can still change, and nothing in it binds anyone yet.
According to a
Print21 report of
18 September, the VMA, with support from the Australasian Paper and Packaging Industry
Association, wrote to Attorney-General Michelle Rowland backing concerns raised by Fundraising
Institute Australasia. The report says the reforms may significantly impact print
volumes
, and lists the changes it has in mind: opt-in rather than opt-out direct marketing, a
ban on selling or renting physical address lists, more difficulty mailing people an
organisation has no relationship with, a wider definition of personal information, and a duty
to destroy data that is no longer needed. We could not find a published statement from
Fundraising Institute Australasia on this draft.
Five concerns, checked against the draft
Direct marketing stays opt-out
The draft repeals the current direct marketing principle, APP 7, and replaces it with a shorter
one. New APP 7.1 says an organisation must not make a direct marketing communication to an
individual unless the organisation provides a simple means by which the individual may easily
request not to receive direct marketing communications from the organisation.
It must take
reasonable steps to act on a request (7.2), and every communication must say how to make one
(7.3), in clear, plain, concise words (7.4). The consultation paper is explicit: The
framework does not require consent for direct marketing, but entities must obtain consent to
trade personal information.
The definition reaches the letterbox. Direct marketing becomes the communication, by any
means, of advertising or marketing material to an individual
, where the person is selected
or targeted using personal information, individually or as a member of a class. A catalogue
addressed by name from a customer file is plainly inside it. Neither the draft nor the paper
mentions post, catalogues, charities or fundraising anywhere; the paper’s examples are
email, text messages, telemarketing calls and online advertising.
The trading rule is the one with teeth
New APP 4.2 says an organisation that holds personal information must not trade the
information unless the individual has consented to the trading of the information.
Section
6FC defines a trade as a disclosure for money or other consideration
or for the
purposes of direct marketing
. The paper says consideration takes its contract-law meaning and
may include the exchange of customer lists
, and that “for the purposes of direct
marketing” is to be read broadly. On the draft’s wording, a list rental is a trade
because it is paid for, and a list swap between two organisations is a trade twice over.
| How the name arrives | Today (APP 7, in force) | Exposure draft |
|---|---|---|
| The organisation’s own customers or supporters | Allowed where the person gave the details and would reasonably expect the mailing, with an opt-out (7.2) | Allowed with an opt-out (new 7.1 to 7.4), if the use is fair and reasonable (new APP 3) |
| Rented, bought or swapped from another organisation | The mailer needs the person’s consent, or consent must be impracticable to obtain, plus an opt-out in every piece (7.3) | The list owner must have each person’s consent to trade (new 4.2, s 6FC); impracticability is not an exception (new 4.6) |
| Sent to a mailing house to print, address and lodge | No trading rule exists; the client’s own obligations under APP 6 and APP 7 apply | Not a trade where the mailing house acts as the client’s processor (s 6FC(2)(c)) |
The middle row is the change. Under APP 7.3(b) as it stands, an organisation can direct market
using information it collected from someone other than the individual if the person consented or
it is impracticable to obtain that consent
, provided every communication carries a
prominent opt-out. The draft moves the consent question to the organisation handing the list
over, and its exceptions in new APP 4.6 are narrow: a disclosure required or authorised by law or
a court order, a permitted general or health situation, or a government related identifier. A
list owner without recorded consent from the people on it would have nothing to trade.
The third row matters to print businesses directly. A mailing house that receives a client’s file only to print and post on the client’s behalf falls within the processor carve-out, so the ordinary production job is not a trade. A business that also brokers or enhances lists for clients is in a different position, and would need to work out which side of the line each service sits.
Fair and reasonable, for every mailing
Even a mailing to an organisation’s own supporters would need to clear new APP 3.1: no
collection, use or disclosure of personal information unless it is fair and reasonable in
the circumstances
and lawful. APP 3.2 lists seven matters to weigh, starting with whether a
reasonable person would expect it, and including whether the person has genuine choice and
whether the purpose could be met with less information. The paper says this test operates
alongside the direct marketing rules rather than replacing them. How it applies to a
particular mailing would depend on the facts; the draft gives no examples involving post.
The smaller changes
Destroying data is not new. APP 11.2 already requires an entity to destroy or de-identify personal information it no longer needs. The draft adds a duty to first consider whether to destroy it, to be able to identify the information the rule covers, and to evaluate compliance regularly (new 11.2, 11.4 and 11.5). The wider definition is real: section 6FD makes personal information anything that “relates to” an identified or reasonably identifiable individual.
The $3 million small business exemption survives in the draft, with one adjustment that could
catch small mailers. Section 6D(4)(c) already says an operator that discloses personal
information for a benefit, service or advantage
is not a small business operator. The
draft swaps that wording for “trades”, and a trade includes a disclosure for direct
marketing with no payment. On our reading, a small organisation that hands its mailing list to
another for that organisation’s marketing would come inside the Act even if nothing came
back in return.
Our view
The VMA is right to worry, but about a narrower thing than the reported list suggests. The draft does not take addressed mail opt-in, and a printer or mailing house can say so to clients who have heard otherwise: mailing an organisation’s own customers or supporters keeps working on an opt-out, subject to the new fairness test. What the draft would squeeze is acquisition mailing that relies on names from someone else’s list, and it does that by removing the impracticability route the current law leaves open. That is a defensible privacy choice, and a significant one for any mailer that finds new donors or customers through rented or swapped lists. The industry’s case is strongest made on that clause, with numbers on how much addressed mail depends on traded lists, rather than on an opt-in rule the draft does not contain.
What to watch
Whether the bill is introduced, and whether the trading consent rule, the exceptions in new APP 4.6 or the processor carve-out change between this draft and the introduced bill. Whether the department publishes submissions, which would show what Fundraising Institute Australasia and the VMA actually asked for. And commencement: the draft leaves the dates blank, and the direct marketing changes would apply only to communications made on or after commencement.