All full and associate members of the Association of Market and Social Research Organisations (ABN: 20 107 667 398) who are an organisation covered by the Privacy Act (including because they have opted-in under s 6EA of that Act) are bound by this APP Code. If an organisation covered by the Privacy Act ceases to be a member of AMSRO they will still be liable under this APP code for acts and practices that breach this APP code and that occurred while they were an AMSRO member.
A. PREAMBLE
The Association of Market and Social Research Organisations (AMSRO) is the national industry body of market and social research organisations. AMSRO’s primary objective is to protect and promote the market and social research industry so that it can continue its important contribution to Australia’s economic, social and political wellbeing. In AMSRO’s view, the long-term success of market and social research depends upon the willing cooperation of the public and business community, which is based upon confidence that research is carried out honestly, objectively and without unwelcome intrusion or disadvantage to participants.
This Code replaces the Market and Social Research Privacy Code under the previous Part IIIAA (the superseded Code), which has operated continuously since 2003 (that Code was amended in 2007).
c. Unlike the superseded Code, this Code does not substitute a set of Market and Social Research Privacy Principles (MSRPP) for the default statutory principles. Instead, the main section of this Code (Part E) sets out how the Australian Privacy Principles (APPs) in the Privacy Act are to be applied and complied with by AMSRO members in relation to the collection, retention, use and disclosure of personal information about the subjects of and participants in market and social research (this is defined as ‘identifiable research information). The subjects/participants are any individual about or from whom any information is sought, collected, retained, used and/or disclosed by a research organisation for the purposes of research (research subjects). The provisions of this Code seek to give effect to the APPs in a manner that is tailored to the research context, while providing the public and business community with the assurances needed to encourage informed and willing participation in market and social research activities. This Code acknowledges and draws on relevant Guidelines published by the Office of the Australian Information Commissioner.[1]
d. This Code imposes some additional requirements, which were also in the superseded Code. These obligations reflect the fact that participation by research subjects in market and social research as carried out by AMSRO members is always voluntary; that market and social researchers are generally not interested in making use of the identity of research participants and that they use and disclose the information collected only for research purposes. In some cases, the additional obligations reflect the AMSRS Code of Professional Behaviour (COPB) which is stricter than the APPs in some respects.
e. In some cases, the editing of the APPs in Part E simply deletes wording that is not applicable; such as where it applies only to ‘agencies’, or where it governs practices, such as direct marketing, which are incompatible with market and social research as carried out by AMSRO and AMSRS members.
f. It is not intended that this APP Code will cover acts and practices that are otherwise exempt under section 7B of the Privacy Act.
g. This Code includes (under APP 1.2 in Part E and in Part H) obligations relating to the internal handling of complaints and referral to the Commissioner. It includes standardised provisions for the reporting of complaints to the Code Administrator and to the Commissioner. These are additional to the ‘default’ complaint handling provisions of the Privacy Act (Part V), which apply to any complaints about breaches of this Code.
h. This Code is administered by the AMSRO Secretariat, under direction of the AMSRO Board[3]. It will remain in force whilst registered, but is subject to periodic independent review by an Independent Code Reviewer, appointed afresh for each review (see Part G).
i. Significant penalties apply for breaches of the APPs. In the case of organisations found to have committed serious or repeated breaches, penalties can be up to $1.7 million as at the date of commencement of this Code (which comes into force under the Privacy Act when it is included on the Codes Register kept under 26U(1) of that Act.)
B. OBJECTIVES
a. The aims of this Code include:
To set out how the Australian Privacy Principles (APPs) in the Privacy Act are to be applied and complied with by AMSRO members in the conduct of market and social research;
To facilitate the protection of identifiable research information provided by, or held in relation to, the participants or subjects of market and social research; and
To enable quality research to be carried out, so as to provide accurate information to government, commercial and not for profit organisations to support their decision-making processes.
C. ELIGIBILITY AND COVERAGE [S26C(3)]
Subscription to this Code is a requirement of AMSRO full and associate membership, regardless of a research organisation’s size or annual turnover. A current list of AMSRO members, and therefore of APP entities bound by this Code, is maintained at http://www.amsro.com.au
Non-members of AMSRO are not eligible to subscribe to this Code.
Eligibility for AMSRO membership is open to research organisations provided that the research organisation meets and complies with AMSRO’s Articles of Association.
AMSRO membership, and thus subscription to this Code, is voluntary. However, this Code is binding on those research organisations that are AMSRO Members.
Any personal information handled by AMSRO members outside the context of market and social research (such as marketing lists and contact details for clients and service providers, and staff recruitment records) remains subject to the statutory APPs and not to this Code.
D. TERMINOLOGY
Many terms used in this Code have their meaning defined in the Privacy Act. Further explanation of some of those terms in the Market and Social Research context is required, and the meaning of other key terms is also set out in this section:
Breach of this Code means a breach of any obligation on Research Organisations under Parts E and H of this Code (also taking account of the terminology in Part D).
Client means an organisation, agency etc. that requests, commissions or subscribes to a given Market and Social Research project; i.e. the ultimate beneficiary of the research findings.
This Code means this Market and Social Research Privacy Code (an APP Code under the Privacy Act).
The Code Administrator is AMSRO (see F (a)).
Collection of identifiable research information means gathering, acquiring or obtaining identifiable research information from any source, by any means, for inclusion in a record.
Commissioner means the person who has functions and powers under the Privacy Act 1988.
Contact details means a record of identifying information such as names, companies, position titles, addresses and phone numbers, collected and retained in order to contact individuals in a research sample.
De\-identification means a process of ensuring that identifiable research information is rendered permanently non-identifiable, i.e. without retaining a means by which the information could be reasonably re-identified.
Disclosure of identifiable research information means allowing identifiable research information to become known outside an organisation, whether or not it is physically or electronically released or transferred (e.g. including by telling, showing or displaying to another person).
Genuine research concerns means where the Research Organisation has valid reasons to expect that the purpose of the Market and Social Research exercise would otherwise be defeated.
Identifiable research information means personal information about survey participants, respondents or subjects to which this Code applies. It includes contact details, research status and research data. It does not include any unsolicited information.
Market and Social Research means consensual investigation of the behaviour, needs, attitudes, opinions, motivations or other characteristics of a whole population or a particular part of a population, in order to provide accurate and timely information to clients (government, commercial and not-for-profit organisations) about issues relevant to their activities, to support their decision-making processes.
Research data means a record of the responses provided by individuals participating in Market and Social Research at the time of collection in order to obtain a representation of a population’s or sub-population’s behaviour, needs, attitudes, opinions and motivations at a given point in time.
Research information privacy policy means the APP policy that a Research Organisation develops, maintains and publishes to comply with APP 1 in relation to identifiable research information.
Research Organisation means an organisation (or that part of an organisation) that is a member of AMSRO and that carries out, or acts as a consultant or subcontractor in relation to, Market and Social Research, or offers their services or the services of others to do so.
Research Purpose means the handling of information in order to carry out any function considered essential to the conduct of a Market and Social Research project or communication of the results of a Market and Social Research project.
Research status means information in relation to whether or not an individual has been contacted or has participated in a Market and Social Research exercise, but does not include research data.
Research subject means an individual about whom identifiable research information is collected in the course of Market and Social Research. Research subjects may be referred to as participants or respondents and may include another individual about whom a subject is providing information.
Unsolicited information means identifiable research information that a research organisation has taken no active steps to collect.
E. HOW THE AUSTRALIAN PRIVACY PRINCIPLES APPLY TO MARKET AND SOCIAL RESEARCH
Transparency of management
Australian Privacy Principle 1: Open and transparent management of personal information (as customised for the purposes of this Code)
1.1 The object of this principle is to ensure that APP entities manage personal information in an open and transparent way.
Compliance with the Australian Privacy Principles
1.2 When handling identifiable research information, Research Organisations must take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to the Research Organisation’s functions or activities to ensure that:
(a) the Research Organisation complies with the Australian Privacy Principles and this Code; and
(b) will enable the Research Organisation to deal with inquiries or complaints from individuals about the Research Organisation’s compliance with this Code.
APP Privacy policy
1.3 A Research Organisation must have a clearly expressed and up‑to‑date research information privacy policy about the management of identifiable research information by the Organisation.
1.4 Without limiting subclause 1.3, the research information privacy policy must contain the following information:
(a) the kinds of identifiable research information that the organisation collects and holds;
(b) how the organisation collects and holds identifiable research information;
(c) the research purposes for which the organisation collects, holds, uses and discloses identifiable research information;
(d) how an individual may access identifiable research information about the individual that is held by the organisation and seek the correction of such information;
(e) how an individual may complain about a breach of this Code, and how the organisation will deal with such a complaint;
(f) whether the organisation is likely to disclose identifiable research information to overseas recipients;
(g) if the organisation is likely to disclose identifiable research information to overseas recipients, the countries in which such recipients are likely to be located if it is practicable to specify those countries in the policy.
Availability of privacy policy
1.5 A Research Organisation must take such steps as are reasonable in the circumstances to make its research information privacy policy available:
(a) free of charge; and
(b) in such form as is appropriate.
1.6 If a person or body requests a copy of the research information privacy policy of a Research Organisation in a particular form, the organisation must take such steps as are reasonable in the circumstances to give the person or body a copy in that form.
Australian Privacy Principle 2: Anonymity and pseudonymity (as customised for the purposes of this Code)
2.1 Individuals must have the option of not identifying themselves, or of using a pseudonym, when dealing with a Research Organisation in the context of Market and Social Research.
2.2 Subclause 2.1 does not apply if, in relation to that matter:
(a) the Research Organisation is required or authorised by or under an Australian law, or a court/tribunal order, to deal with individuals who have identified themselves; or
(b) it is impracticable for the Research Organisation to deal with individuals who have not identified themselves or who have used a pseudonym.
Collection of personal information
Australian Privacy Principle 3: Collection of solicited personal information (as customised for the purposes of this Code)
Personal information other than sensitive information
3.1 Not applicable (agencies only)
3.2 In the conduct of Market and Social Research, a Research Organisation must not collect identifiable research information (other than sensitive information) unless the information is reasonably necessary for that research.
Sensitive information
3.3 A Research Organisation may only collect sensitive information (whether from an individual or from a third party) where the individual has consented, and the information is reasonably necessary for a research purpose, or if the collection is required by Australian law or a court/tribunal order.
Means of collection
3.5 In the conduct of Market and Social Research, a Research Organisation must collect identifiable research information only by lawful and fair means.
3.6 In the conduct of Market and Social Research, a Research Organisation must collect identifiable research information about an individual only from the individual unless it is unreasonable or impracticable to do so.
Solicited personal information
3.7 This principle applies to the collection of identifiable research information that is solicited by a Research Organisation.
Australian Privacy Principle 4: Dealing with unsolicited personal information (as customised for the purposes of this Code)
4.1 If:
(a) a Research Organisation receives identifiable research information; and
(b) the Research Organisation did not solicit the information;
the Research Organisation must, within a reasonable period after receiving the information, determine whether or not the Research Organisation could have collected the information under APP 3 if the Research Organisation had solicited the information.
4.2 The Research Organisation may use or disclose the identifiable research information for the purposes of making the determination under subclause 4.1.
4.3 If the Research Organisation determines that it could not have collected the identifiable research information, it must, as soon as practicable, but only if it is lawful and reasonable to do so, destroy the information or ensure that it is de-identified.
4.4 If subclause 4.3 does not apply in relation to the identifiable research information, APPs 5-13 apply in relation to the information as if the Research Organisation had collected the information under APP 3.
Section 4. Entities bound by this APP code - Privacy (Market and Social Research) Code 2014 - 4. Entities bound by this APP code | Zoe