Privacy (Market and Social Research) Code 2021

The Privacy (Market and Social Research) Code 2021 is an APP code tailored to market and social research that applies to members of the Association of Market and Social Research Organisations (AMSRO). It is a registered APP code under the Privacy Act 1988 and a legislative instrument once included on the Codes Register (s3). The Code commences on 22 March 2021 (s2) and replaces the Privacy (Market and Social Research) Code 2014 (Schedule 1).

Mechanically, the Code customises how the Australian Privacy Principles (APPs) operate for identifiable research information. It specifies bespoke duties on AMSRO member research organisations for transparency, collection, use and disclosure, access and correction, data quality, security, retention and de-identification, cross-border disclosures, government identifiers, and direct marketing (Part 2, ss9-21A). It adds specific procedural and governance obligations for AMSRO as Code Administrator (ss22-23), requires periodic independent reviews (s24), establishes monitoring and annual reporting obligations (s28), and sets an internal misconduct procedure with possible remediation through AMSRO membership sanctions (s29).

The Code is limited in scope to identifiable research information arising in Market and Social Research as defined in the instrument. It explicitly excludes personal information handled by AMSRO members outside the research context, such as client marketing lists and staff recruitment records, which remain governed by the Privacy Act directly (s8(5)). Subscription to the Code is a condition of AMSRO membership; non-members are not eligible to subscribe (s8(1)-(2)). The Code therefore binds only APP entities that are AMSRO members (s7).

The Preamble attributes the Code’s purpose to AMSRO’s objective of protecting and promoting the research sector to sustain public confidence and willing participation, and explains that the Code tailors the APPs to the research context while imposing some additional requirements (Preamble). The Code repeatedly frames certain exceptions and additional rules in terms of “genuine research concerns”, which the instrument defines and employs to justify narrower transparency in some circumstances (Definitions; s13A; s14A). The instrument also places administrative and reporting obligations on research organisations and on AMSRO as the Code Administrator (ss22-23, 28).

meta-content-style-type: text/css meta-content-type: application/xhtml+xml; charset=utf-8

?xml version="1.0" encoding="utf-8" standalone="no"?>

Commonwealth Coat of Arms of Australia

Privacy (Market and Social Research) Code 2021

I, Angelene Falk, Australian Information Commissioner and Privacy Commissioner, approve the following APP code made under the Privacy Act 1988 and have included it on the Codes Register.

Dated 1 March 2021

Angelene Falk

Australian Information Commissioner

Privacy Commissioner

Contents

Part 1—Preliminary

1 Name

2 Commencement

3 Authority

3 Preamble

4 Schedules

5 Definitions

6 Objectives

7 Entities bound by this APP code

8 Eligibility and coverage

Part 2—How the Australian Privacy Principles apply to market and social research

Transparency of management

9 Australian Privacy Principle 1: Open and transparent management of personal information (as customised for the purposes of this Code)

10 Australian Privacy Principle 2: Anonymity and pseudonymity (as customised for the purposes of this Code)

Collection of personal information

11 Australian Privacy Principle 3: Collection of solicited personal information (as customised for the purposes of this code)

12 Australian Privacy Principle 4: Dealing with unsolicited personal information (as customised for the purposes of this Code)

13 Australian Privacy Principle 5: Notification of the collection of personal information (as customised for the purposes of this Code)

13A Additional requirement: matters of which respondents should be made aware – sources of information and identity of client

Dealing with personal information

14 Australian Privacy Principle 6: Use or disclosure of personal information (as customised for the purposes of this Code)

14A Additional requirement: research use and disclosure

15 Australian Privacy Principle 7: Direct marketing (as customised for the purposes of this Code)

16 Australian Privacy Principle 8: Cross-border disclosure of personal information (as customised for the purposes of this Code)

17 Australian Privacy Principle 9: Adoption, use or disclosure of government related identifiers (as customised for the purposes of this Code)

Integrity of personal information

18 Australian Privacy Principle 10: Quality of personal information (as customised for the purposes of this Code)

Security of personal information

19 Australian Privacy Principle 11: Security of personal information (as customised for the purposes of this Code)

19A Additional requirement: retention and disposal

Access to, and correction of, personal information

20 Australian Privacy Principle 12: Access to personal information (as customised for the purposes of this Code)

21 Australian Privacy Principle 13: Correction of personal information (as customised for the purposes of this Code)

21A Additional requirement: destruction or de-identification on request

Part 3—Governance

22 Code Administrator

23 Tasks of the Code Administrator

Part 4—Review

24 Independent Code Review

25 Consultation

26 Reporting following an Independent Code Review

27 Variation of the Code

Part 5—Monitoring and reporting

28 Monitoring and reporting

29 Improper conduct

Schedule 1—Repeals

Privacy (Market and Social Research) Code 2014

Part 1—Preliminary

1 Name

This APP code is the Privacy (Market and Social Research) Code 2021. This APP code may also be cited as the Market and Social Research Privacy Code.

2 Commencement

This APP code commences on 22 March 2021. The Privacy (Market and Social Research) Code 2014 will cease to operate when this APP code comes into force.

3 Authority

This APP code is a ‘registered APP code’ under s 26B(1) of the Privacy Act, and a legislative instrument, once it is included on the Code Register kept under subsection 26U(1) of that Act and is in force. This APP code has been developed under subsection 26E(1) of the Privacy Act.

3 Preamble

The Association of Market and Social Research Organisations (AMSRO) is the national industry body of market and social research, data and insights organisations. AMSRO’s primary objective is to protect and promote the research, data and insights sector so that this sector can continue its important contribution to Australia’s economic, social and political wellbeing. In AMSRO’s view, the long-term success of the sector depends upon the willing cooperation of the public and business community, which is based upon confidence that the work of the sector is carried out honestly, objectively and without unwelcome intrusion or disadvantage to participants.

AMSRO decided on its own initiative to develop this APP code under Part IIIB of the Privacy Act.

The provisions of this Code seek to give effect to the APPs in a manner that is tailored to the research context, while providing the public and business community with the assurances needed to encourage informed and willing participation in market and social research activities.

This Code imposes some additional requirements to the requirements of the APPs. These obligations reflect the fact that participation by research subjects in market and social research as carried out by AMSRO members is always voluntary; that market and social researchers are generally not interested in making use of the identity of research participants and that they use and disclose the information collected only for research purposes.

4 Schedules

Each instrument that is specified in a Schedule to this instrument is amended or repealed as set out in the applicable items in the Schedule concerned, and any other item in a Schedule to this instrument has effect according to its terms.

5 Definitions

Note: A number of expressions used in this instrument are defined in s 6(1) of the Privacy Act, including, but not limited to, the following:

APP code
APP entity
consent
personal information
sensitive information

In this APP code:

Breach of this Code means a breach of any obligation on Research Organisations under Part 2 and Part 5 of this Code (also taking account of the definitions in this section).

Client means an organisation, agency etc. that requests, commissions or subscribes to a given Market and Social Research project; i.e. the ultimate beneficiary of the research findings.

The Code Administrator is AMSRO (see subsection 22(1))

Collection of identifiable research information means gathering, acquiring or obtaining identifiable research information from any source, by any means, for inclusion in a record.

Commissioner means the person who has functions and powers under the Privacy Act.

Contact details means a record of identifying information such as names, companies, position titles, addresses and phone numbers, collected and retained in order to contact individuals in a research sample.

De-identification means a process of ensuring that identifiable research information is rendered permanently non-identifiable, i.e. without retaining a means by which the information could be reasonably re-identified.

Direct marketing involves the use and/or disclosure of identifiable research information to communicate directly with an individual to promote goods and services, whether through voice communications, electronic messaging, mail, email, social media channels or online or mobile advertising.

Disclosure of identifiable research information means identifiable research information becoming known outside an organisation, whether or not it is physically or electronically released or transferred (e.g. including by telling, showing or displaying to another person). Disclosure may be deliberate, or inadvertent (such as a data breach). In assessing whether an individual is reasonably identifiable, regard is to be had to all information reasonably available to an entity, such as other data points and data sources that might be used to infer or confirm the identity of a purportedly non-identifiable person. Accordingly, although information as disclosed by an organisation may not appear to be identifying of any individual, that information may be personal information about an identifiable individual when in the hands of a recipient (even if the information was otherwise not personal information about an individual when in the hands of a discloser). In this circumstance the disclosing entity must treat the disclosure as a disclosure of personal information about an individual, even though the individual is not identified within the information disclosed.

Genuine research concerns mean where the Research Organisation has valid reasons to expect that the purpose of the Market and Social Research exercise would otherwise be defeated.

Identifiable research information means personal information about survey participants, respondents or subjects to which this Code applies. It includes contact details, research status and research data. It does not include unsolicited information.

Market and Social Research means consent-based investigation of the behaviour, needs, attitudes, opinions, motivations or other characteristics of a whole population or a particular part of a population, in order to provide accurate and timely information to clients (government, commercial and not-for-profit organisations) about issues relevant to their activities, to support their decision-making processes.

Research data means a record of the responses provided by individuals participating in Market and Social Research at the time of collection in order to obtain a representation of a population’s or sub-population’s behaviour, needs, attitudes, opinions and motivations at a given point in time.

Research information privacy policy means the APP policy that a Research Organisation develops, maintains and publishes to comply with APP 1 in relation to identifiable research information.

Research Organisation means an organisation (or that part of an organisation) that is a member of AMSRO and that carries out or acts as a consultant or subcontractor in relation to, Market and Social Research, or offers their services or the services of others to do so.

Research Purpose means the handling of information in order to carry out any function considered essential to the conduct of a Market and Social Research project or communication of the results of a Market and Social Research project.

Research status means information in relation to whether or not an individual has been contacted or has participated in a Market and Social Research exercise but does not include research data.

Research subject means an individual about whom identifiable research information is collected in the course of Market and Social Research. Research subjects may be referred to as participants or respondents and may include another individual about whom a subject is providing information.

Unsolicited information means identifiable research information that a research organisation has taken no active steps to collect.

6 Objectives

The aims of this code include:

to set out how the Australian Privacy Principles (APPs) in the Privacy Act are to be applied and complied with by AMSRO members in the conduct of market and social research;
to facilitate the protection of research information about identifiable individuals being the participants or subjects of market and social research as provided by, or held in relation to, those participants or those subjects; and
to enable quality research to be carried out, so as to provide accurate information to government, commercial and not-for-profit organisations to support their decision-making processes.

7 Entities bound by this APP code

All members of the Association of Market and Social Research Organisations ABN 20 107 667 398 who are an organisation covered by the Privacy Act (including because they have opted-in under s 6EA of that Act) are bound by this APP Code. If an organisation covered by the Privacy Act ceases to be a member of AMSRO they will still be liable under this APP code for acts and practices that breach this APP code and that occurred while they were an AMSRO member.

8 Eligibility and coverage

(1) Subscription to this Code is a requirement of AMSRO membership, regardless of a research organisation’s size or annual turnover. A current list of AMSRO members, and therefore of APP entities bound by this Code, is maintained at http://www.amsro.com.au.

(2) Organisations that are not members of AMSRO are not eligible to subscribe to this Code.

(3) Eligibility for AMSRO membership is open to research organisations provided that the research organisation meets and complies with AMSRO’s Articles or Association.

(4) AMSRO membership, and thus subscription to this Code, is voluntary. However, this Code is binding on those research organisations that are AMSRO members.

(5) Any personal information about individuals that is handled by AMSRO members outside the context of market and social research, such as marketing lists and contact details for clients and service providers, and staff recruitment records, is not subject to this Code but will be governed by the Privacy Act.

Part 2—How the Australian Privacy Principles apply to market and social research

Transparency of management

9 Australian Privacy Principle 1: Open and transparent management of personal information (as customised for the purposes of this Code)

The object of this principle is to ensure that APP entities manage personal information in an open and transparent way.

Compliance with the Australian Privacy Principles

When handling identifiable research information, Research Organisations must take such steps as are reasonable in the circumstances to implement practices, procedures and systems relating to the Research Organisation’s functions or activities to ensure that:
the Research Organisation complies with the Australian Privacy Principles and this Code; and
will enable the Research Organisation to deal with inquiries or complaints from individuals about the Research Organisation’s compliance with this Code.

APP Privacy Policy

A research organisation must have a clearly expressed and up-to-date research information privacy policy about the management of identifiable research information by the Organisation.
Without limiting subsection 9(3), the research information privacy policy must contain the following information:
the kinds of identifiable research information that the organisation collects and holds;
how the organisation collects and holds identifiable research information;
the research purposes for which the organisation collects, holds, uses and discloses identifiable research information;
how an individual may access identifiable research information about the individual that is held by the organisation and seek correction of such information;
how an individual may complain about a breach of this Code, and how the organisation will deal with such a complaint;
whether the organisation is likely to disclose identifiable research information to overseas recipients;
if the organisation is likely to disclose identifiable research information to overseas recipients, the countries in which such recipients are likely to be located if it is practicable to specify those countries in the policy.

Availability of privacy policy

A Research organisation must take such steps as are reasonable in the circumstances to make its research information privacy policy available:
free of charge; and
in such form as is appropriate.
If a person or body requests a copy of the research information privacy policy of a Research Organisation in a particular form, the organisation must take such steps as are reasonable in the circumstances to give the person or body a copy in that form.

10 Australian Privacy Principle 2: Anonymity and pseudonymity (as customised for the purposes of this Code)

Individuals must have the option of not identifying themselves or of using a pseudonym, when dealing with a Research Organisation in the context of Market and Social Research.
Subsection 10(1) does not apply if, in relation to that matter:
the Research Organisation is required or authorised by or under an Australian law, or a court/tribunal order, to deal with individuals who have identified themselves; or
it is impracticable for the Research Organisation to deal with individuals who have not identified themselves or who have used a pseudonym.

Collection of personal information

11 Australian Privacy Principle 3: Collection of solicited personal information (as customised for the purposes of this code)

Personal information other than sensitive information

In the conduct of Market and Social Research, a Research Organisation must not collect identifiable research information (other than sensitive information) unless the information is reasonably necessary for that research.

Sensitive information

A Research Organisation may only collect sensitive information (whether from an individual or from a third party) where the individual has consented, and the information is reasonably necessary for a research purpose, or if the collection is required by Australian law or a court/tribunal order.

Means of collection

In the conduct of Market and Social Research, a Research Organisation must collect identifiable research information only by lawful and fair means.
In the conduct of Market and Social Research, a Research Organisation must collect identifiable research information about an individual only from the individual unless it is unreasonable or impracticable to do so.

Solicited personal information

This principle applies to the collection of identifiable research information that is solicited by a Research Organisation.

12 Australian Privacy Principle 4: Dealing with unsolicited personal information (as customised for the purposes of this Code)

If:
a Research Organisation receives identifiable research information; and
the Research Organisation did not solicit the information;

the Research Organisation must, within a reasonable period after receiving the information, determine whether or not the Research Organisation could have collected the information under APP 3 if the Research Organisation had solicited the information.

The Research Organisation may use or disclose the identifiable research information for the purposes of making the determination under subsection 12(1).
If the Research Organisation determines that it could not have collected the identifiable research information, it must, as soon as practicable, but only if it is lawful and reasonable to do so, destroy the information or ensure that it is de-identified.
If subsection 12(3) does not apply in relation to the identifiable research information, APPs 5-13 apply in relation to the information as if the Research Organisation had collected the information under APP 3.

13 Australian Privacy Principle 5: Notification of the collection of personal information (as customised for the purposes of this Code)

At or before the time or, if that is not practicable, as soon as practicable after, a Research Organisation collects identifiable research information about an individual, the organisation must take such steps (if any) as are reasonable in the circumstances:
to notify the individual of such matters referred to in subsection 13(2) as are reasonable in the circumstances; or
to otherwise ensure that the individual is aware of any such matters.
The matters for the purposes of subsection 13(1) are as follows:
the identity and contact details of the Research Organisation;
if:
the Research Organisation collects the identifiable research information from someone other than the individual; or
the individual may not be aware that the Research Organisation has collected the identifiable research information;

the fact that the Research Organisation so collects, or has collected, the identifiable research information and the circumstances of that collection;

the purposes for which the Research Organisation collects the identifiable research information;
the main consequences (if any) for the individual if all or some of the identifiable research information is not collected by the Research Organisation;
any other APP entity, body or person, or the types of any other APP entities, bodies or persons, to which the Research Organisation usually discloses identifiable research information of the kind collected by the Research Organisation;
that the research information privacy policy of the Research Organisation contains information about how the individual may access the identifiable research information about the individual that is held by the entity and seek the correction of such information;
that the research information privacy policy of the Research Organisation contains information about how the individual may complain about a breach of this Code, and how the entity will deal with such a complaint;
whether the Research Organisation is likely to disclose the identifiable research information to overseas recipients;
if the Research Organisation is likely to disclose the identifiable research information to overseas recipients - the countries in which such recipients are likely to be located if it is practicable to specify those countries in the notification or to otherwise make the individual aware of them.

13A Additional requirement: matters of which respondents should be made aware – sources of information and identity of client

Research Organisations must disclose the source of the research sample (e.g. customer information, information collected by researchers, publicly available lists such as a telephone directory or electoral roll, random digit dialling, door knocking), no later than the end of the collection of information, except where the Research Organisation and client have reasonable grounds to decide that there are genuine research concerns or where there is another compelling reason not to do so (e.g. it may expose one of the parties to legal action).
Research Organisations must disclose the identity of the client, unprompted, no later than the end of the collection of information, except where the Research Organisation and client have reasonable grounds to decide that there are genuine research concerns or where there is another compelling reason not to do so (e.g. it may expose one of the parties to legal action).

Dealing with personal information

14 Australian Privacy Principle 6: Use or disclosure of personal information (as customised for the purposes of this Code)

Use or disclosure

If a Research Organisation holds identifiable research information about an individual that was collected for a particular purpose (the primary purpose), the Organisation must not use or disclose the information for another purpose (the secondary purpose) unless:
the individual has consented, or
the use or disclosure of the information is required or authorised by or under an Australian law or court/tribunal order;
it is unreasonable or impracticable to obtain the individual’s consent to the use or disclosure; and the Research Organisation reasonably believes that the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual, or to public health or safety.
the Research Organisation has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the Organisation’s functions or activities has been, is being or may be engaged in; and the Organisation reasonably believes that the collection, use or disclosure is necessary in order for the Organisation to take appropriate action in relation to the matter.
the Research Organisation reasonably believes that the use or disclosure of the information is reasonably necessary for one or more enforcement related activities conducted by, or on behalf, of an enforcement body

Note: Australian Privacy Principle 8 sets out requirements for the disclosure of personal information to a person who is not in Australia or an external Territory.

14A Additional requirement: research use and disclosure

Re-use of identifiable research information for subsequent research

A Research Organisation may use identifiable research information for a research purpose provided that:
if re-contact of an individual who initially declined to participate is involved, the Research Organisation and client have genuine research concerns that warrant such re-contact; and
if re-contact of an individual who has participated in a research exercise is involved:
the individual was informed of this likelihood at the time the information was collected, except where the research and client organisations have reasonable grounds to decide that there are genuine research concerns that justify not so notifying; or
any individual who, at the time of collection, indicated a wish not to be re-contacted for research purposes is excluded unless the research and client organisations have reasonable grounds to decide that there are genuine research concerns that warrant the individual’s inclusion.

Disclosure of personal information for research

A Research Organisation may disclose identifiable research information provided that:
the disclosure is necessary for a research purpose; and
only that part of the information considered necessary for this research purpose is disclosed; and
if this research purpose could be achieved using de-identified information, the information is de-identified before being disclosed; and
where the recipient is the client, the consent of all individuals who could be identifiable has been obtained, except where the personal information being disclosed to the client concerns individuals’ research status. In this case:
the Research Organisation should take reasonable steps to ensure that the information concerning individuals’ research status cannot be linked to individuals’ research data about those individuals; and
the Research Organisation should obtain the client’s agreement to restrict use of the information concerning individuals’ research status only for the specific purpose of regulating the frequency of contacts of individuals in the client’s subsequent research.
If subsection 16B(2) of the Privacy Act applies in relation to the collection of the identifiable research information by the Research Organisation, it must take such steps as are reasonable in the circumstances to ensure that the information is de‑identified before the Organisation discloses it in accordance with subsections 14(1).

Written note of use or disclosure

If a Research Organisation uses or discloses identifiable research information in accordance with paragraph 14(1)(e), the Organisation must make a written note of the use of disclosure.

Related bodies corporate

If a Research Organisation is a body corporate; and it collects identifiable research information from a related body corporate; this principle applies as if the Research Organisation’s primary purpose for the collection of the information were the primary purpose for which the related body corporate collected the information.

Exceptions

This principle does not apply to the use or disclosure by a Research Organisation of:
identifiable research information for the purpose of direct marketing; or
government related identifiers.

15 Australian Privacy Principle 7: Direct marketing (as customised for the purposes of this Code)

If a Research Organisation holds identifiable research information about an individual, the Research Organisations must not use or disclose the information for the purpose of direct marketing.

16 Australian Privacy Principle 8: Cross-border disclosure of personal information (as customised for the purposes of this Code)

Before a Research Organisation discloses identifiable research information about an individual to a person (the overseas recipient):
who is not in Australia or an external Territory, and
who is not the Research Organisation itself or the individual,

the Research Organisation must take such steps as are reasonable in the circumstances to ensure that the overseas recipient does not breach the Australian Privacy Principles (other than Australian Privacy Principle 1) in relation to the information.

Note: In certain circumstances, an act done, or a practice engaged in, by the overseas recipient is taken, under section 16C, to have been done, or engaged in, by the APP entity and to be a breach of the Australian Privacy Principles.

(2) Subsection 16(1) does not apply to the disclosure of identifiable research information about an individual by a Research Organisation to the overseas recipient if:

the Research Organisation reasonably believes that:
the recipient of the information is subject to a law, or binding scheme, that has the effect of protecting the information in a way that, overall, is at least substantially similar to the way in which the Australian Privacy Principles protect the information; and
there are mechanisms that the individual can access to take action to enforce that protection of the law or binding scheme; or
both of the following apply:
the Research Organisation expressly informs the individual that if he or she consents to the disclosure of the information, subsection 16(1) will not apply to the disclosure;
after being so informed, the individual consents to the disclosure; or
the disclosure of the information is required or authorised by or under an Australian law or a court/tribunal order; or
a permitted general situation (other than the situation referred to in item 4 or 5 of the table in subsection 16A(1) of the Privacy Act) exists in relation to the disclosure of the information by the Research Organisation.

Note: For permitted general situations, see section 16A of the Privacy Act.

17 Australian Privacy Principle 9: Adoption, use or disclosure of government related identifiers (as customised for the purposes of this Code)

Adoption of government related identifiers

A Research Organisation must not adopt a government related identifier of an individual as its own identifier of the individuals unless:
the adoption of the government related identifier is required or authorised by or under an Australian law or a court/tribunal order;
subclause 9.3 applies in relation to the adoption.

Note: An act or practice of an agency may be treated as an act or practice of an organisation, see section 7A of the Privacy Act.

Use or disclosure of government related identifiers

A Research Organisation must not use or disclose a government related identifier of an individual unless:
the use or disclosure of the identifier is reasonably necessary for the organisation to verify the identity of the individual for the purposes of the organisation’s activities or functions; or
the use or disclosure is reasonably necessary for the organisation to fulfil its obligations to an agency or a State or Territory authority; or
the use or disclosure of the identifier is required or authorised by or under an Australian law or a court/tribunal order; or
a permitted general situation (other than the situation referred to in item 4 or 5 of the table in subsection 16A(1) of the Privacy Act) exists in relation to the use or disclosure of the identifier; or
the organisation reasonably believes that the use or disclosure of the identifier is reasonably necessary for one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
subclause 9.3 applies in relation to the use or disclosure.

Note 1: An act or practice of an agency may be treated as an act or practice of an organisation, see section 7A of the Privacy Act.

Note 2: For permitted general situations, see section 16A of the Privacy Act.

Regulations about adoption, use or disclosure

This section applies in relation to the adoption, use or disclosure by a Research organisation of a government related identifier of an individual if:
the identifier is prescribed by the regulations; and
the Research Organisation is prescribed by the regulations, or is included in a class of organisations prescribed by the regulations; and
the adoption, use or disclosure occurs in the circumstances prescribed by the regulations.

Note: There are prerequisites that must be satisfied before the matters mentioned in this section are prescribed, see subsections 100(2) and (3) of the Privacy Act.

Integrity of personal information

18 Australian Privacy Principle 10: Quality of personal information (as customised for the purposes of this Code)

A Research Organisation must take such steps (if any) as are reasonable in the circumstances to ensure that the identifiable research information that the Research Organisation collects is accurate, up‑to‑date and complete.
A Research Organisation must take such steps (if any) as are reasonable in the circumstances to ensure that the identifiable research information that the Research Organisation uses or discloses is, having regard to the purpose of the use or disclosure, accurate, up‑to‑date, complete and relevant.

Security of personal information

19 Australian Privacy Principle 11: Security of personal information (as customised for the purposes of this Code)

If a Research Organisation holds identifiable research information, the Research Organisation must take such steps as are reasonable in the circumstances to protect the information:
from misuse, interference and loss; and
from unauthorised access, modification or disclosure.
If:
a Research Organisation holds identifiable research information about an individual; and
the Research Organisation no longer needs the information for any purpose for which the information may be used or disclosed by the Research Organisation under this Code; and
the information is not contained in a Commonwealth record; and
the Research Organisation is not required by or under an Australian law, or a court/tribunal order, to retain the information;
the Research Organisation must take such steps as are reasonable in the circumstances to destroy the information or to ensure that the information is de‑identified.

19A Additional requirement: retention and disposal

A Research Organisation must retain identifiable research information only while the details of the identity of the individual whom the information is about continue to be necessary to be retained for research purposes. The information must be destroyed or de-identified once these purposes have been achieved. Where identifiable research information has been returned to a third party (in accordance with APP6) any copies, including archived copies, must be destroyed or de-identified.
If a Research Organisation wishes to de-identify identifiable research information that exists in a physical form that makes de-identification impracticable (e.g. on paper), the information must be moved to another medium, de-identified, and the physical records then destroyed.
Where it is necessary to retain identifiable research information, identifying (contact) details must, if practicable, be stored separately from other information (research status and research data), with measures in place (e.g. by the use of an encrypted intervening variable) to ensure the identity of the individuals cannot be readily revealed from the other information.
A Research Organisation must take reasonable steps to ensure that any identifiable research information that it discloses:
will only be retained, used or disclosed by the recipient of the information in a manner that is consistent with this Code; and
will be protected by the recipient from misuse, interference and loss and from unauthorised access, modification, use and disclosure; and
will only be used or disclosed by the recipient for a specified limited purpose and will be destroyed or de-identified once this purpose has been achieved. Where identifiable research information has been returned by the recipient to a third party (in accordance with APP6) any copies, including archived copies, must by destroyed or de-identified.
A Research Organisation may disclose de-identified information freely, provided that there is no reasonable likelihood that the disclosed information could be used to identify one or more of the individuals who participated in the research, such as where the pattern of answers could reveal their identity.

Access to, and correction of, personal information

20 Australian Privacy Principle 12: Access to personal information (as customised for the purposes of this Code)

Access

If a Research Organisation holds identifiable research information about an individual, the Research Organisation must, on request by the individual, give the individual access to the information.

Exception to access

Despite subsection 12.1, a Research Organisation is not required to give the individual access to the identifiable research information to the extent that:
the Research Organisation reasonably believes that giving access would pose a serious threat to the life, health or safety of any individual, or to public health or public safety; or
giving access would have an unreasonable impact on the privacy of other individuals; or
the request for access is frivolous or vexatious; or
the information relates to existing or anticipated legal proceedings between the Research Organisation and the individual, and would not be accessible by the process of discovery in those proceedings; or
giving access would reveal the intentions of the Research Organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
giving access would be unlawful; or
denying access is required or authorised by or under an Australian law or a court/tribunal order; or
both of the following apply:
the Research Organisation has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the Research Organisation’s functions or activities has been, is being or may be engaged in;
giving access would be likely to prejudice the taking of appropriate action in relation to the matter; or
giving access would likely to prejudice one or more enforcement related activities conducted by, or on behalf of, an enforcement body; or
giving access would reveal evaluative information generated within the Research Organisation in connection with a commercially sensitive decision‑making process.

Dealing with requests for access

The Research Organisation must:
respond to the request for access to the identifiable research information within a reasonable period after the request is made; and
give access to the information in the manner requested by the individual, if it is reasonable and practicable to do so.

Other means of access

If the Research Organisation refuses:
to give access to the personal information because of subsection 20(2); or
to give access in the manner requested by the individual;

the Research Organisation must take such steps (if any) as are reasonable in the circumstances to give access in a way that meets the needs of the Research Organisation and the individual.

Without limiting subsection 20(4), access may be given through the use of a mutually agreed intermediary.

Access charges

If the Research Organisation charges the individual for giving access to the identifiable research information the charge must not be excessive and must not apply to the making of the request.

Refusal to give access

If the Research Organisation refuses to give access to the identifiable research information because of subsection 20(2), or to give access in the manner requested by the individual, the Research Organisation must give the individual a written notice that sets out:
the reasons for the refusal except to the extent that, having regard to the grounds for the refusal, it would be unreasonable to do so; and
the mechanisms available to complain about the refusal; and
any other matter prescribed by the regulations.
If the Research Organisation refuses to give access to the personal information because of paragraph 20(2)(j), the reasons for the refusal may include an explanation for the commercially sensitive decision.

21 Australian Privacy Principle 13: Correction of personal information (as customised for the purposes of this Code)

Correction

If:
a Research Organisation holds identifiable research information about an individual; and
either:
the Research Organisation is satisfied that, having regard to a purpose for which the information is held, the information is inaccurate, out‑of‑date, incomplete, irrelevant or misleading; or
the individual requests the entity to correct the information;

the Research Organisation must take such steps (if any) as are reasonable in the circumstances to correct that information to ensure that, having regard to the purpose for which it is held, the information is accurate, up‑to‑date, complete, relevant and not misleading.

Notification of correction to third parties

If:
the Research Organisation corrects personal information about an individual that the Research Organisation previously disclosed to another APP entity; and
the individual requests the Research Organisation to notify the other APP entity of the correction;

the Research Organisation must take such steps (if any) as are reasonable in the circumstances to give that notification unless it is impracticable or unlawful to do so.

Refusal to correct information

If the Research Organisation refuses to correct the identifiable research information as requested by the individual, the Research Organisation must give the individual a written notice that sets out:
the reasons for the refusal except to the extent that it would be unreasonable to do so; and
the mechanisms available to complain about the refusal; and
any other matter prescribed by the regulations.

Request to associate a statement

If:
the Research Organisation refuses to correct the identifiable research information as requested by the individual; and
the individual requests the Research Organisation to associate with the information a statement that the information is inaccurate, out‑of‑date, incomplete, irrelevant or misleading;

the Research Organisation must take such steps as are reasonable in the circumstances to associate the statement in such a way that will make the statement apparent to users of the information.

Dealing with requests

If a request is made under subsections 21(1) or 21(4), the Research Organisation:
must respond to the request within a reasonable period after the request is made; and
must not charge the individual for the making of the request, for correcting the personal information or for associating the statement with the personal information (as the case may be).

21A Additional requirement: destruction or de-identification on request

A Research Organisation must accept and act on requests for identifiable research information to be destroyed or de-identified, except in the following circumstances:
the request is frivolous or vexatious; or
destruction, deletion or de-identification would have an unreasonable impact upon the privacy of other individuals; or
the organisation reasonably believes that destroying, deleting or de-identifying the information would pose a serious threat to the life, health or safety of any individual or to public health or public safety; or
destroying, deleting or de-identifying the information would reveal the intentions of the research organisation in relation to negotiations with the individual in such a way as to prejudice those negotiations; or
destroying, deleting or de-identifying the information would be unlawful; or
retaining the identifiable information is required or authorised by or under an Australian law or a court/tribunal order; or
the Research Organisation has reason to suspect that unlawful activity, or misconduct of a serious nature, that relates to the organisation’s functions or activities has been, is being or may be engaged in; and destroying, deleting or de-identifying the information would be likely to prejudice the taking of appropriate action in relation to the matter; or
destroying, deleting or de-identifying the information, would be likely to prejudice one or more enforcement related activities conducted by or on behalf of an enforcement body; or
where the Research Organisation is contractually obliged to retain the identifiable research information.

Part 3—Governance

22 Code Administrator

The Code Administrator for this Code is AMSRO. In practice, this Code is administered by the AMSRO Secretariat, under direction of the AMSRO Board.
AMSRO will fund the administration of this Code in such manner as the AMSRO Board considers appropriate, having regard to the resource requirements necessary for the effective execution of those tasks described in section 23.

23 Tasks of the Code Administrator

In administering this Code, the AMSRO Secretariat will perform the following tasks:
maintain an accurate and up to date online list of AMSRO members, which doubles as a public register of research organisations which are bound by this Code;
commission periodic reviews of this Code in accordance with Part 4;
produce a written response to a report resulting from an independent code review;
consider the need for any variation of this Code, and make any consequent applications;
monitor and report on compliance with this Code (see Part 5);
make available on the AMSRO website the following:
information about this Code;
a copy of the most current version of this Code;
contact details for the Code Administrator;
information about making complaints in relation to matters contained in this Code;
the annual report on the operation of this Code required under Part 5;
a link to the website of the Commissioner;
any other information that the Code Administrator considers relevant to the efficient functioning of this Code.
perform such other tasks as the AMSRO Board considers necessary or desirable for the effective operation of this Code, including but not limited to the establishment and management of a formal complaints handling process relating to alleged breaches of this Code.
in relation to paragraphs 23(1)(a)-(e), the Administrator will be assisted and advised by AMSRO’s Privacy Compliance Committee.
AMSRO has established a Privacy Compliance Committee, comprising an independent chair, at least two industry representatives and one consumer representative, which meets at least twice a year.
The Privacy Compliance Committee terms of reference include the following functions relevant to this Code:

“To make recommendations on matters including, but not limited to:

the Code Reviewer’s recommendations concerning streamlining industry Guidelines to clarify how they work in conjunction with the Code;
the Code Reviewer’s recommendations concerning implementing an explicit privacy component into industry quality audits;

…

Industry awareness/education regarding privacy issues, including information sheets, FAQs and best practice;

…

Systemic issues arising from privacy complaints.”

The Privacy Compliance Committee will advise the Code Administrator about the timing and conduct of the periodic independent review of this Code under Part 4.
The Privacy Compliance Committee may be required by the Code Administrator to participate in any formal complaints handling process that might be established by the Code Administrator relating to addressing alleged breaches of this Code.

Part 4—Review

24 Independent Code Review

This Code is subject to periodic independent review by a reviewer to be appointed by the AMSRO Board for each review.
The purpose of Code reviews is to ensure that this Code is meeting its objectives and remains effective and relevant.
There will be a review of this Code at least every five years, but the Code Administrator may commission a review at any time, for example if regular monitoring indicates a lack of compliance with this code or if the Code Administrator becomes aware of systemic issues that would justify a review.
The terms of reference for each review will be drawn up by the Code Administrator in consultation with the Privacy Compliance Committee.
Each review will be funded by AMSRO in such manner as the AMSRO Board considers appropriate, having regard to the resource requirements necessary for the effective execution of the review.
Reports of the independent code review will include recommendations for any amendments to this Code that are considered necessary or desirable for the effective operation of this Code.

25 Consultation

In conducting an independent review, the Code Administrator will notify the Commissioner of the review; and the Independent Code Reviewer will seek the views of the Commissioner, government agencies, industry representatives, consumer representatives, the general public and other persons or bodies as appropriate in Australia and internationally; regarding the operation of this Code and in relation to suitable revisions and amendments.

26 Reporting following an Independent Code Review

The report of the Independent Code Reviewer shall be made publicly available online and shall outline the issues raised by the review and the findings of the review.
The report shall be accompanied by a response from the Code Administrator, outlining the actions taken, or that will be taken, by the Code Administrator and/or the research organisations bound by this Code to address issues identified by the review.

27 Variation of the Code

Following a recommendation of an Independent Code Review, or for any other reason, the Code Administrator may apply to the Commissioner for variation of the Code.
Any such application would follow the process set out in the Act and guidance issued by the Commissioner.

Part 5—Monitoring and reporting

28 Monitoring and reporting

Research Organisations must report annually, by 31 August, to the Code Administrator, on the number, nature and outcomes of any complaints received about Breaches of this Code.
Research Organisations must report systemic issues in relation to their compliance with this Code, or serious and repeated Breaches of this Code, to the Commissioner as soon as they become aware of them.
Research Organisations must notify eligible data breaches to the Australian Information Commissioner and otherwise comply with the eligible data breach requirements of the Privacy Act. Research Organisations should also inform the Code Administrator of any notification of an eligible data breach as provided to the Australian Information Commissioner and of any reasonably likely or actual serious data breach (whether or not a notifiable eligible data breach) that demonstrates a significant vulnerability of other Research Organisations in handling of identifiable research information that might reasonably be expected to be mitigated by appropriate action taken by Research Organisations generally.
Research Organisations must handle enquires and complaints received from individuals as to handling of identifiable research information about those individuals courteously, promptly and efficiently. Research Organisations should establish reliable processes and procedures for handling enquires and complaints received from individuals as to handling of identifiable research information, including by taking reasonable steps to address special needs and requirements of individuals with disabilities or particular vulnerabilities. In general responses should be provided within 30 days.
The Code Administrator will monitor compliance by research organisations with this Code and will investigate serious and repeated breaches and systemic issues about code compliance.
The Code Administrator will publish an Annual Report on the operation of this Code and make it available both to the Commissioner and publicly, including online. The Code Administrator will conduct an annual feedback review by making enquiries of research organisations in relation to issues or concerns that research organisations have experienced in relation to or within the scope of operation of this Code during the year in review, including complaints or other concerns of any individual raised with a research organisation in relation to or within the scope of operation of this Code during the year in review, and consider any responses of research organisations in relation to such matters, before finalising and publishing an Annual Report on the operation of this Code. The Annual Report will include a summary of complaints handled by Research Organisations and reported to the Code Administrator under subsection 28(1).
The Code Administrator will report systemic issues or serious and repeated breaches of this Code to the Commissioner as soon as it becomes aware of them.

29 Improper conduct

If a Research Organisation subject to this Code acts in a manner that, in the AMSRO Board’s opinion, constitutes seriously improper conduct in relation to this Code, the AMSRO Board shall direct the Code Administrator to notify the Research Organisation of the conduct.
Within 7 business days of receipt of notification by the Code Administrator of an opinion by the AMSRO Board concerning seriously improper conduct by the Research Organisation, the Research Organisation must:
take all reasonable steps to rectify the seriously improper conduct; and
notify the Code Administrator of the steps taken to rectify the seriously improper conduct.
If the Research Organisation fails to adequately comply with paragraph 29(2)(a) then the AMSRO Board will issue a final notice requiring the Research Organisation to rectify the seriously improper conduct within 7 business days.
Where the AMSRO Board is satisfied that seriously improper conduct has occurred in relation to this Code, AMSRO may take such remedial action against the Research Organisation as is permitted under its Rules of Association and/or terms of membership, as varied from time to time, including suspension or expulsion.
These misconduct provisions operate independently of the complaint provisions of the Privacy Act and the enforcement role of the Commissioner.

Schedule 1—Repeals

Privacy (Market and Social Research) Code 2014

1 The whole of the instrument

Repeal the instrument

meta-content-style-type: text/css meta-content-type: application/xhtml+xml; charset=utf-8

?xml version="1.0" encoding="utf-8" standalone="no"?>

Privacy (Market and Social Research) Code 2021

I, Angelene Falk, Australian Information Commissioner and Privacy Commissioner, approve the following APP code made under the Privacy Act 1988 and have included it on the Codes Register.

Dated 1 March 2021

Angelene Falk

Australian Information Commissioner

Privacy Commissioner

Contents

Part 1—Preliminary

1 Name

2 Commencement

3 Authority

3 Preamble

4 Schedules

5 Definitions

6 Objectives

7 Entities bound by this APP code

8 Eligibility and coverage

Part 2—How the Australian Privacy Principles apply to market and social research

Transparency of management

9 Australian Privacy Principle 1: Open and transparent management of personal information (as customised for the purposes of this Code)

10 Australian Privacy Principle 2: Anonymity and pseudonymity (as customised for the purposes of this Code)

Collection of personal information

11 Australian Privacy Principle 3: Collection of solicited personal information (as customised for the purposes of this code)

12 Australian Privacy Principle 4: Dealing with unsolicited personal information (as customised for the purposes of this Code)

13 Australian Privacy Principle 5: Notification of the collection of personal information (as customised for the purposes of this Code)

13A Additional requirement: matters of which respondents should be made aware – sources of information and identity of client

Dealing with personal information

14 Australian Privacy Principle 6: Use or disclosure of personal information (as customised for the purposes of this Code)

14A Additional requirement: research use and disclosure

15 Australian Privacy Principle 7: Direct marketing (as customised for the purposes of this Code)

16 Australian Privacy Principle 8: Cross-border disclosure of personal information (as customised for the purposes of this Code)

The Code's approach turns on a small set of core concepts defined in Part 1 and applied throughout Part 2. These concepts determine coverage, permitted handling, and exceptions.

Research Organisation. Any AMSRO member that carries out or subcontracts market and social research, or offers such services (Definitions). The Code applies only to these organisations when they handle identifiable research information (s7; s8).
Market and Social Research. Defined as consent-based investigation of behaviour, attitudes and related characteristics of populations, conducted to provide information to clients to support decision-making (Definitions). The definition frames the scope of permissible handling as being research purpose-driven.
Identifiable research information. Personal information about survey participants, respondents or subjects , including contact details, research status and research data , that is within the Code’s scope. It excludes unsolicited information (Definitions).
Research purpose. Any function necessary to conduct a Market and Social Research project or communicate its results (Definitions). Many substantive permissions and limits, such as re-use and disclosure, are tied to whether an action is a research purpose (s14A).
De-identification. A process to ensure identifiable research information is rendered permanently non-identifiable, without retaining a means by which it could be reasonably re-identified (Definitions). The Code requires destruction or de-identification when retention is no longer necessary (s19(2); s19A).
Genuine research concerns. A working exception used by the Code where disclosure of a sample source, client identity or re-contact could defeat the research exercise (Definitions; s13A; s14A). The concept is used to qualify transparency obligations.
Identifiable vs de-identified distinction. The Code regulates identifiable research information tightly, but allows freer use and disclosure of de-identified information provided there is no reasonable likelihood of re‑identification (s19A(3)).
APP customisation and relationship to Privacy Act. The instrument is an APP code made under Part IIIB of the Privacy Act, and it modifies how certain APPs apply in the research context (s3). It frequently cross-references the APPs and the Privacy Act, for example ensuring cross-border disclosures comply with APP 8 (s16). Where the Code is silent, the APPs remain relevant under the Act.

Those concepts structure consequential duties: transparency (research information privacy policy, s9), constrained collection (only what is reasonably necessary, s11), limits on use and disclosure (primary and secondary purpose rules, s14 and s14A), a ban on using identifiable research information for direct marketing (s15), retention and separation of identifiers (s19A), and procedural rights such as access, correction and requests for destruction or de-identification (ss20-21A). The Code also sets governance mechanisms administered by AMSRO to monitor compliance and commission independent reviews (ss22-24).

Primary legal subjects

AMSRO member Research Organisations. The Code binds “all members of the Association of Market and Social Research Organisations” who are APP entities under the Privacy Act (s7). Subscription is mandatory for AMSRO membership (s8(1)), and the AMSRO online member list doubles as the public register of organisations bound by the Code (s23(1)(a)).
Research subjects. Individuals who are participants or respondents in Market and Social Research whose identifiable research information is collected, used, disclosed, retained, accessed or corrected under the Code (Definitions; Parts 2 and 5). The Code creates specific rights for those individuals, including anonymity/pseudonymity, access, correction, and requests to destroy or de-identify data (ss10, 20, 21, 21A).

Secondary legal and practical stakeholders

Clients of research. Organisations that commission or subscribe to research projects are defined as clients (Definitions). The Code governs disclosure of identifiable research information to clients, including tighter requirements for disclosure of information that could identify individuals and restrictions around research status (s14A).
AMSRO as Code Administrator. AMSRO funds administration and executes monitoring, reporting and review tasks through its Secretariat and Privacy Compliance Committee (ss22-23). AMSRO’s Board also has powers to act if it considers a Research Organisation’s conduct seriously improper (s29).
The Commissioner. The Australian Information Commissioner retains functions and powers under the Privacy Act; the Code is registered under the Act and the Commissioner is part of the review and enforcement landscape (s3, s24-25). The Code requires reporting to the Commissioner of systemic issues or serious and repeated breaches (s28(2), s28(7)).

Who is excluded or unaffected

Non-AMSRO organisations. Organisations that are not AMSRO members cannot subscribe to the Code and are not bound by it (s8(2)). They remain subject to the APPs and the Privacy Act directly.
Personal information outside research context. Personal information that AMSRO members handle unrelated to market and social research, such as client marketing lists or recruitment records, is explicitly not covered by the Code and remains governed by the Privacy Act (s8(5)).

Practical distribution of compliance costs and enforcement leverage

Financial and administrative burdens fall primarily on AMSRO members who must create and maintain a research information privacy policy, implement practices and systems to comply with APPs and the Code, report annually on complaints (by 31 August, s28(1)), and notify eligible data breaches to the Commissioner (s28(3)). AMSRO itself bears administrative costs of code maintenance, review commissioning and reporting (s22-23).
Enforcement as between the Commissioner and members remains possible through the Privacy Act processes because the Code is a registered APP code. Independently, AMSRO can impose membership remedies including suspension or expulsion for seriously improper conduct (s29(2)-(3)).

Transparency and policies

Research Organisations must implement reasonable practices, procedures and systems to ensure compliance with the APPs and this Code and to deal with enquiries or complaints (s9(1)). They must adopt and publish a research information privacy policy containing specified elements: kinds of data collected, methods of collection and storage, research purposes, access and correction arrangements, complaint mechanisms, likely overseas disclosures and, if practical, the countries likely to be involved (s9(2)(a)-(g)). Policies must be available free of charge and in an appropriate form (s9(4)-(5)).

Anonymity and pseudonymity

Individuals must have the option to remain anonymous or use a pseudonym when dealing with a Research Organisation in the research context, except where identification is required by law or where it is impracticable (s10).

Collection

A Research Organisation must not collect identifiable research information (other than sensitive information) unless it is reasonably necessary for that research purpose (s11(1)). Sensitive information may only be collected with consent and only if reasonably necessary for a research purpose, or if required by law or court order (s11(2)). Collection must be by lawful and fair means and generally directly from the individual unless impracticable (s11(3)-(4)).

Notification and sample/client transparency

At or before collection, or as soon as practicable thereafter, Research Organisations must take reasonable steps to notify individuals of specified matters including identity and contact details of the organisation, purposes of collection, consequences of non-collection, types of usual disclosures, and whether overseas disclosure is likely (s13(1)-(2)). The Code adds an explicit obligation to disclose the source of the research sample and the identity of the client no later than the end of collection, unless there are reasonable grounds based on genuine research concerns or other compelling reasons (s13A(1)-(2)).

Use, disclosure and re-use

Use or disclosure of identifiable research information collected for a primary purpose is not permitted for a secondary purpose unless one of the APP exceptions applies, including consent, required by law or necessity to prevent a serious threat, suspicion of unlawful activity, or necessity for enforcement activities (s14(1)(a)-(e)). The Code supplements this with a research-specific regime permitting re-use and disclosure for research purposes subject to safeguards: re-contact constraints, prior notice at collection, respecting opt-outs, disclosing only the minimum necessary information, de-identifying where possible, and obtaining consent where disclosure to clients could identify individuals (s14A).

Direct marketing

A Research Organisation must not use or disclose identifiable research information for direct marketing (s15). That is a firm prohibition within the Code.

Cross-border disclosures

Before disclosing identifiable research information to an overseas recipient, a Research Organisation must take reasonable steps to ensure the recipient does not breach the APPs other than APP 1 (s16(1)). Exceptions mirror APP 8 exceptions: if the recipient is subject to substantially similar protections and there are enforcement mechanisms, or where the individual is informed and consents, or where an Australian law or permitted general situation applies (s16(2)).

Government identifiers

A Research Organisation must not adopt a government related identifier as its own identifier unless required by law (s17(1)). Use or disclosure of such identifiers is restricted to verification, legal obligations, enforcement related activities, or prescribed circumstances (s17(2)-(3)).

Data quality and security

Organisations must take reasonable steps to keep collected information accurate, up-to-date, complete and relevant (s18). They must take reasonable steps to protect identifiable research information from misuse, interference, loss and unauthorised access, modification or disclosure (s19(1)). When information is no longer needed for permitted purposes and is not a Commonwealth record and there is no legal retention requirement, the organisation must destroy or de-identify it (s19(2)).

Retention, de-identification and separation

The Code requires retention only while identity details remain necessary for research purposes and instructs destruction or de-identification once purposes are achieved (s19A(1)). Where de-identification of physical records is impracticable, data must be moved to another medium for de-identification and physical records destroyed (s19A(2)). Where identifiable information is retained, contact details should be stored separately from other research data, with technical measures to prevent easy linkage (s19A(3)). Recipients of disclosed identifiable information must be contractually or reasonably obliged to protect and limit use and to destroy or de-identify it once the purpose is achieved (s19A(4)).

Access, correction and destruction on request

Individuals have a right to access identifiable research information held about them (s20(1)). There are enumerated exceptions to access, such as threats to life or public safety, unreasonable impact on others’ privacy, frivolous requests, legal proceedings, prejudice to negotiations, unlawfulness, law enforcement prejudice, and protection of commercially sensitive internal evaluative material (s20(2)(a)-(j)). Research Organisations must respond within a reasonable period, and where practical, give access in the manner requested (s20(3)-(4)). Refusals must be accompanied by reasons and complaint mechanisms (s20(7)).
Correction obligations require an organisation to take reasonable steps to correct information that is inaccurate, out-of-date, incomplete, irrelevant or misleading, whether on its own initiative or on request (s21(1)). If notified, the organisation must notify third-party recipients of corrections if requested by the individual, unless impracticable or unlawful (s21(3)).
The Code creates an explicit right for individuals to request destruction or de-identification of identifiable research information, subject to limited exceptions including legal or contractual retention obligations, serious threats to safety, prejudice to enforcement or investigation, or where the request is frivolous or would unreasonably impact others (s21A).

Governance and reporting

AMSRO as Code Administrator must maintain an up-to-date list of AMSRO members, commission independent reviews at least every five years, produce written responses to review reports, consider Code variations, monitor and report on compliance, publish an Annual Report, and make specified information available on its website (ss22-23, 24-27, 28). Research organisations must report annually on the number, nature and outcomes of complaints and report systemic issues or serious and repeated breaches to the Commissioner as soon as aware (s28(1)-(2), (6)-(7)). Eligible data breach notifications must be made to the Commissioner in accordance with the Privacy Act (s28(3)).

Remedies and membership sanctions

Internal conduct procedures allow the AMSRO Board to determine seriously improper conduct and require remediation within tight timeframes: notification, seven business days to rectify and report steps taken, final notice and further seven days before AMSRO may take remedial action available under its membership rules including suspension or expulsion (s29).

Statutory context and the Code’s legal character

The Code is a registered APP code under Part IIIB of the Privacy Act and a legislative instrument once included on the Code Register (s3). That registration means the APPs as modified by the Code are enforceable under the Privacy Act framework. The Code itself does not introduce separate statutory monetary penalties; enforcement of compliance with the APPs and registered APP codes occurs under the Privacy Act and by the Commissioner pursuant to that Act. The instrument repeatedly connects to the Commissioner and to the Privacy Act framework (s3; ss24-25, 28(2)-(3), 28(7)).

Internal enforcement and membership sanctions

AMSRO has an internal enforcement mechanism that operates through membership rules. If the AMSRO Board determines a Research Organisation’s conduct is “seriously improper” in relation to the Code, the Board directs the Code Administrator to notify the organisation (s29(1)). The organisation then must take all reasonable steps to rectify the conduct and report those steps within seven business days (s29(2)). Failing adequate remediation, the Board will issue a final notice requiring rectification within seven days (s29(3)). If the Board is satisfied seriously improper conduct occurred, AMSRO may take remedial action permitted under its Rules of Association and terms of membership, including suspension or expulsion (s29(4)). These remedies operate independently of the Privacy Act complaint and enforcement mechanisms (s29(5)).

Reporting obligations and referral to Commissioner

Research Organisations must report systemic issues or serious and repeated breaches to the Commissioner as soon as they become aware of them (s28(2) and s28(7)). They must notify eligible data breaches to the Australian Information Commissioner and otherwise comply with the Privacy Act’s eligible data breach requirements (s28(3)). The Code Administrator also has duties to report systemic issues or serious and repeated breaches to the Commissioner (s28(7)).

Commissioner powers

The instrument does not restate the Commissioner’s powers under the Privacy Act, but it makes clear the Code functions within that regulatory architecture by requiring notifications and consultations with the Commissioner during independent reviews (ss24-25, 28). Enforcement of APPs and registered APP codes , including investigation, conciliation, determinations, and remedies available under the Privacy Act , remain matters for the Privacy Act’s statutory processes, not the Code text itself. Because the Code is a registered APP code under the Act, breaches may feed into the Commissioner’s investigatory and enforcement functions under the Privacy Act (s3).

Procedural and practical penalties

The Code’s own enforceable immediate penalties are membership-based: the remedial ladder is notification, remediation steps, final notice and then possible suspension or expulsion (s29). There are no monetary fines or criminal sanctions in the Code text itself. However, reporting obligations and the Code’s status under the Privacy Act create pathways for Commissioner involvement that can lead to statutory remedies under the Act.

Relationship to the Privacy Act 1988

The Code is an APP code made under Part IIIB of the Privacy Act and is a legislative instrument once registered on the Codes Register (s3). It customises the operation of the APPs in relation to identifiable research information for AMSRO members. As such, the Code operates within and alongside the Privacy Act rather than replacing the Act. Specific interactions include cross-references to APPs: APP 1 is customised (s9), APPs 3-13 are customised via Parts 2 and 5, and APP 8 cross-border rules are adapted in s16 which explicitly notes the Privacy Act provisions (s16 note and s16(2)).
The Code preserves the Commissioner’s role under the Privacy Act: the Commissioner is to be notified of reviews and consulted (s24-25), and research organisations must report systemic issues and eligible data breaches to the Commissioner (s28(2)-(3), (7)). The Code is silent on substituting or displacing the Commissioner’s statutory powers; it therefore sits as a specialised layer under the Act.

Intersection with Commonwealth record and external Territory rules

The destruction/de-identification obligation in s19(2) is qualified by an exception where the information is contained in a Commonwealth record or retention is required by law or court order. Accordingly, data covered by Commonwealth retention rules or external Territory law may require longer retention despite the Code’s default deletion obligation.

Cross-border data flows and foreign law

Section 16 requires reasonable steps to ensure overseas recipients do not breach the APPs other than APP 1. There are APP-like exceptions available where the recipient is subject to substantially similar protections with enforceable mechanisms, or where the individual consents after being informed (s16(2)(a)-(b)). The Code adopts the Privacy Act’s approach to permitted general situations (see note to s16(2)), so it operates in concert with the Act’s rules about cross-border disclosures.

Contract law and contractual retention obligations

The Code recognises that contractual obligations may require retention of identifiable research information. The destruction/de-identification on request exception expressly includes situations where a Research Organisation is contractually obliged to retain identifiable research information (s21A(1)(j)). At the same time, s19A(4) requires Research Organisations to take reasonable steps to ensure recipients retain, use or disclose information in a manner consistent with this Code and to destroy or de-identify it once the specified purpose is achieved.

Other statutory regimes

The Code does not displace legal obligations imposed by other Australian laws. It expressly preserves circumstances where adoption, use or disclosure of government related identifiers may be required or authorised by law or court order (s17(1)-(2)). It also treats as valid legal exceptions situations where data collection, retention or disclosure is required by law or a court order (multiple provisions, e.g. ss11(2), 12(3), 19(2), 21A(1)(f)).

Administrative law and AMSRO internal rules

AMSRO’s internal disciplinary steps, including suspension or expulsion under its Rules of Association, are an administrative mechanism that interacts with private law (membership agreements) rather than statute. Those remedies are available in parallel to statutory enforcement under the Privacy Act (s29(5)). The Code requires AMSRO to fund administration and commission reviews but does not prescribe how AMSRO’s internal rules should be structured; it only permits remedial action “as is permitted under its Rules of Association and/or terms of membership” (s29(4)).

International standards and codes

The Code contemplates consultation with international persons or bodies during independent reviews (s25). It also allows cross-border disclosures where the recipient is subject to substantially similar legal protections and enforcement mechanisms, tying the Code’s operation to comparative privacy regimes in other jurisdictions (s16(2)(a)). The Code does not, however, define a list of acceptable foreign regimes; the test is the Research Organisation’s reasonable belief as to similarity and enforceability.

Overall interaction

The Code works as a sector-specific layering atop the Privacy Act. It customises APP application for research contexts while preserving the statutory framework, the Commissioner’s role, and the primacy of other legal obligations. It adds organisational governance obligations and membership-based enforcement, creating a mixed compliance environment of statutory oversight and industry self-regulation.

Instrument origin and commencement

The Code was made by the Australian Information Commissioner and Privacy Commissioner, with the approval statement signed by Angelene Falk on 1 March 2021 and the Code commencing on 22 March 2021 (cover page; s2). It was developed under subsection 26E(1) of the Privacy Act and is a registered APP code under s26B(1) once included on the Codes Register (s3).

Repeal of prior code

Schedule 1 effectually repeals the Privacy (Market and Social Research) Code 2014 in whole (Schedule 1). The instrument therefore replaces the 2014 Code for AMSRO members.

Review and variation machinery

The Code mandates independent reviews at least every five years and permits the Code Administrator to commission reviews sooner if monitoring shows issues or systemic problems (s24(1), (3)). The Code Administrator draws up terms of reference in consultation with the Privacy Compliance Committee (s24(4)) and funds the reviews (s24(5)). The Independent Code Reviewer’s report must be made publicly available and accompanied by a response from the Code Administrator outlining actions to be taken (s26). Following recommendations, the Code Administrator may apply to the Commissioner for variation of the Code, following the Act’s process and guidance from the Commissioner (s27).

Internal governance changes

AMSRO is designated as the Code Administrator (s22), and the Code prescribes tasks for AMSRO’s Secretariat and Privacy Compliance Committee in maintaining membership lists, monitoring compliance, commissioning reviews, publishing information and handling complaints (s23). The Privacy Compliance Committee comprises an independent chair, at least two industry representatives and one consumer representative, and its terms of reference include advising on review recommendations, education and systemic complaint issues (s23(2)-(3)).

No textual history beyond repeal

The instrument text provided does not include subsequent amendments to the 2021 Code. The only explicit amendment-history matter within the instrument is the repeal of the 2014 Code by Schedule 1. Any further variations must follow the procedure in s27 and the Privacy Act; the Code Administrator may apply to the Commissioner for variation based on review recommendations or other reasons (s27(1)-(2)).

Implication for practitioners

The presence of scheduled periodic reviews and a formal variation pathway means the Code is designed to evolve. Practitioners should watch AMSRO’s review reports, the Code Administrator’s responses, and any applications to the Commissioner for variations under the Act as the primary sources for amendment activity. The Code’s own text requires public availability of reviewer reports and AMSRO’s responses (s26), enabling tracking of changes that may be proposed or implemented.

No cases named in the instrument

The Code text does not cite or refer to any judicial decisions or administrative determinations. It contains no litigation history or examples of case law adjudicating its provisions. The Preamble and body speak only of policy aims and mechanisms, not of past disputes or precedent.

Enforcement pathways implying potential litigation

While the instrument itself does not record litigation, the Code’s registered status under the Privacy Act means breaches could be investigated and, as necessary, subject to the Commissioner’s investigatory and enforcement powers under the Privacy Act. The Code does not detail those statutory powers; practitioners must consult the Privacy Act for the Commissioner’s enforcement toolkit, including investigation, conciliation, and binding determinations (see s3 linking to Commissioner functions).

AMSRO internal procedures and membership remedies

The Code provides an internal enforcement pathway through AMSRO membership remedies that could, in practice, lead to disputes within membership contexts (s29). Those disputes might involve internal processes, potential judicial review of membership decisions in some circumstances, and contract or association law issues, but the instrument itself does not record litigation or precedents for these mechanisms.

What to monitor for case law

As the Code is sector specific and tied to the Privacy Act, litigation or determinations may arise in relation to cross-border disclosures, de-identification adequacy, consent contours for sensitive information, re-use/re-contact controversies, and when “genuine research concerns” are invoked to limit disclosure or transparency obligations. Practitioners should monitor Commissioner determinations and any court decisions that interpret the interaction between registered APP codes and the Privacy Act, but the instrument itself supplies no litigation history.

Several specific traps and practical pitfalls for practitioners and compliance officers arise directly from the Code’s text. These are concrete mechanics to watch rather than normative judgments.

Scope is membership‑based, not sector‑wide. Only AMSRO members who are APP entities are bound (s7). Non-members may conduct identical research but will not be subject to these bespoke Code obligations. That distinction affects competitive and compliance landscapes and may give rise to differing operational practices in the same market (s8(2)-(4)).
“Identifiable” is context-sensitive. The Definition of Disclosure stresses that in assessing identifiability one must regard “all information reasonably available to an entity, such as other data points and data sources” (Definitions). Information that seems non-identifying in the discloser’s hands may be identifying to a recipient. Practitioners must evaluate identifiability against external data sources, not just internal perception.
“Genuine research concerns” creates discretionary carve-outs. Sections 13A and 14A permit non-disclosure of sample source, client identity or not informing about re-contact where Research Organisation and client have reasonable grounds to decide genuine research concerns exist. The Code provides an example where disclosure might expose parties to legal action, but the term remains fact-specific and could be a site of contest between transparency and methodological needs (s13A(1)-(2); s14A(1)(a), (1)(b)(i)). Maintain contemporaneous records of the rationale for invoking this exception.
De-identification standard is strict. De-identification is defined as rendering information “permanently non-identifiable” without retaining means of reasonable re-identification (Definitions). Section 19A permits disclosure of de-identified information only where there is no reasonable likelihood of re-identification. Technical and legal teams must be able to justify the permanence and process for de-identification.
Retention restrictions vs contract and law. The Code requires destruction or de-identification where identity details are no longer necessary for research purposes (s19A(1)), but exceptions permit retention where contractually obliged or where law requires retention (s21A(1)(j); s19(2)(3)). Practitioners must reconcile client contracts with the Code’s default deletion obligation and explicitly address retention in contracts.
Cross-border “reasonable steps” is not prescriptive. Section 16 requires reasonable steps to ensure overseas recipients do not breach APPs other than APP 1. The Code does not list specific contractual clauses or technical safeguards; the adequacy assessment may fall back on the research organisation’s judgement. Consider contractual protections, audits, and selection of recipients in jurisdictions with similar regimes (s16).
Direct marketing ban is absolute. Section 15 prohibits use or disclosure of identifiable research information for direct marketing by Research Organisations. Practitioners must segregate research contact lists from marketing lists and ensure processes prevent accidental use for marketing.
Access exceptions are numerous and fact-sensitive. Section 20(2) lists many grounds to refuse access, including prejudice to others, commercial confidentiality, and investigations. Those exceptions require legally defensible assessments and written refusal notices with reasons and complaint mechanisms (s20(7)). Record the decision process and evidence supporting refusal.
Re-use and disclosure to clients has consent nuances. Section 14A permits disclosure to clients only where consent has been obtained from identifiable individuals who could be identified, except where only research status is disclosed and appropriate safeguards are in place (s14A(2)(4)). The Code expects prior notice at collection about likely re-contact and re-use, and provides for opt-outs. Failure to document consent or notice can jeopardise downstream disclosures.
Timelines in internal misconduct process are tight. The AMSRO Board can require remediation within seven business days and may issue a final notice with another seven days before suspension or expulsion (s29(2)-(3)). Organisations should respond promptly to Code Administrator notifications and keep evidence of remedial steps.
Annual reporting obligations are specific and public-facing. Research Organisations must report to AMSRO annually by 31 August on complaints about breaches (s28(1)). AMSRO will include summaries of complaints in its Annual Report (s28(6)). These obligations create recordkeeping and public disclosure expectations.
Requests for destruction or de-identification can be limited. Section 21A allows Research Organisations to refuse such requests on several grounds, including contractual retention requirements and situations where deletion would risk life, public safety, investigations or enforcement activities (s21A(1)). Have clear contractual language and legal assessments before refusing a request.
The Code is silent on monetary fines. The Code’s own remedies are membership-based; any statutory fines or consequences arise under the Privacy Act rather than the Code text itself. Practitioners should not rely on the Code to prescribe monetary penalties but should consider the Privacy Act enforcement regime in parallel.

Practical compliance checklist mapped to the Code (with section references)

Register and identify coverage
- Confirm AMSRO membership status and APP entity status under the Privacy Act to determine whether the Code applies (s7; s8). Ensure the organisation appears on the AMSRO members list and track AMSRO’s public register (s23(1)(a)).
Research information privacy policy
- Draft, adopt and publish a research information privacy policy that contains: kinds of identifiable research information collected, collection and holding methods, research purposes, access and correction procedures, complaint process, overseas disclosure likelihood and, if practicable, likely countries (s9(2)). Make the policy freely available in appropriate forms and fulfil requests in specific formats where reasonable (s9(4)-(5)).
Implement internal governance
- Put in place practices, procedures and systems to ensure compliance with APPs and the Code and to handle enquiries and complaints (s9(1)). Establish clear roles for privacy compliance, data security and records management. Use the Privacy Compliance Committee model as a guide for governance participation and advice (s23).
Collection controls
- Limit collection of identifiable research information to what is reasonably necessary for the research purpose (s11(1)). Collect sensitive information only with consent and when necessary (s11(2)). Collect directly from individuals unless impracticable (s11(4)). Ensure collection methods are lawful and fair (s11(3)).
Notification, sample source and client identity
- At or before collection, notify individuals of the identity of the Research Organisation, collection purposes, consequences of non-collection, typical disclosure recipients and overseas disclosure risk (s13(1)-(2)). Disclose the sample source and client identity no later than the end of collection unless genuine research concerns or other compelling reasons apply; document the rationale if you withhold disclosure (s13A).
Consent and re-use governance
- Where re-contact or re-use is contemplated, inform individuals at collection if possible. Respect indications not to be re-contacted (s14A(1)-(2)). For disclosure to clients that could identify individuals, obtain consent or de-identify data where feasible (s14A(2)(3)).
Prohibit direct marketing usage
- Segregate research contact data from marketing lists and ensure processes prevent identifiable research information being used for direct marketing (s15).
Cross-border risk management
- Before transferring identifiable research information overseas, take reasonable steps to ensure overseas recipients comply with APPs other than APP 1. Consider contractual obligations, data processing agreements, audits, choice of jurisdiction, and where applicable obtain informed consent from individuals (s16).
Government identifiers and ID usage
- Avoid adopting government related identifiers as internal IDs unless required by law. Limit use/disclosure of such identifiers to matters specified in s17 and record legal bases when used (s17).
Data quality regime
- Implement processes to keep research data accurate, up-to-date, complete and relevant for the research purpose. Document validation and quality-control procedures (s18).
Security, retention and de-identification
- Apply reasonable security measures to protect against loss, unauthorised access and misuse. Implement retention schedules that retain identifiable research information only while identity details are necessary for the research purpose. De-identify or destroy when no longer needed; separate contact details from research data where practicable and use technical controls like encryption or intervening variables to prevent easy re-identification (s19; s19A(1)-(3)). If physical records make de-identification impracticable, transfer to another medium for de-identification and destroy physical originals (s19A(2)).
Contracts with recipients
- When disclosing identifiable research information to a third party, contractually require recipients to use and retain the data consistently with the Code, protect it, and destroy or de-identify once the purpose is achieved (s19A(4)). Ensure data transfers reflect these obligations.
Access, correction and deletion processes
- Establish procedures to respond to access and correction requests within a reasonable period, to provide access in the requested manner where reasonable, and to issue written refusal notices that explain reasons and complaint mechanisms where refusal grounds apply (s20(3)-(7); s21(1), (4)-(6)). Implement a process to accept and act on destruction/de-identification requests, including robust legal checks for exceptions such as contractual, legal or investigatory retention obligations (s21A).
Complaint handling and reporting
- Implement complaint-handling processes to respond courteously and promptly, providing responses typically within 30 days. Maintain records of complaints and remedial steps (s28(4)). Prepare annual reporting on numbers, nature and outcomes of complaints by 31 August and provide systemic issue or serious/repeated breach notifications to the Commissioner as soon as they are known (s28(1)-(3), (6)-(7)).
Data breach readiness
- Ensure compliance with the Privacy Act’s eligible data breach notification regime and notify the Commissioner of eligible breaches. Inform the Code Administrator of eligible notifications and any significant breaches that expose system vulnerabilities (s28(3)).
Documentation and evidence
- Keep contemporaneous records justifying decisions to withhold sample source or client identity on genuine research concern grounds, choices about re-contact, cross-border risk assessments, de-identification methodology, and compliance with access/correction requests. These records are essential for internal remediation and any Commissioner inquiries.
Prepare for AMSRO engagement
- When notified by AMSRO of seriously improper conduct, have rapid response teams and remediation plans ready to comply with seven-business-day remediation windows (s29). Participate in AMSRO reviews and be ready to provide information for independent reviews and for the Code Administrator’s Annual Report (ss24-26, 28).
Contract drafting with clients
- Ensure contracts with clients address consent, re-use, retention obligations, disclosure limits, and responsibilities for de-identification. If a contractual retention obligation exists that will limit deletion or de-identification requests, document and disclose that limitation to participants where relevant (s21A(1)(j)).
Training and operationalisation
- Train project teams, interviewers, subcontractors and vendors on Code obligations, especially on collection limits, anonymity options, sample/source disclosure, de-identification standards and non-use for direct marketing. Include Code compliance clauses in subcontracting arrangements.
Monitor reviews and variations
- Monitor AMSRO independent review outputs and any variations to the Code proposed to the Commissioner, and be prepared to update policies and procedures in response to AMSRO administrative or Code changes (ss24-27).

Following these steps will address the principal operationalised duties in the Code and position an organisation to respond to both AMSRO internal processes and the Commissioner’s oversight under the Privacy Act. Keep legal counsel involved where rights to refuse access or deletion are contested, where cross-border flows raise complex jurisdictional issues, and where contract terms intersect with statutory reporting or retention obligations.

Privacy (Market and Social Research) Code 2021

Plain English Summary

Deep Dive

What it does

Current sections