copyright  |  disclaimer  |  privacy policy  |  print ready

« back

Complying with the anti-'Spam' laws

Laws introduced last year relating to "spam" have changed the way we communicate with and market to our customers and the public generally. We provide a summary of the prohibitions against "spamming" and recommended steps that should be taken to assist you in complying with the Spam Act 2003.

WHAT IS SPAM?

In the first part of the twentieth century, Hormel Foods Corporation developed America's first canned spiced ham (hence 'Spam') which was novel in that it did not require refrigeration. Spam became ubiquitous during WWII and in Britain it was one of the few meats excluded from British rationing and thus becoming a staple.

Later, a Monty Python skit made fun of that history where a man and wife attempt to order a breakfast that doesn't include Spam from a menu that has it included in every single dish. Whenever the word ‘Spam’ is repeated, Vikings break out in a chant repeating 'Spam' louder and louder, drowning out other conversation. It makes sense, then, that Spam has become the colloquial term for what is technically referred to as "unsolicited commercial electronic messaging" or "unsolicited commercial email" (UCE) which is blamed for drowning out normal Internet discourse.

Many, including the Federal Government, are concerned about the ever increasing volume UCE’s or ‘Spam’ which threatens the effectiveness and efficiency of electronic communications, having become more than 50% of email traffic and has an estimated cost of $900 per employee. In response to that concern, Federal Parliament enacted the Spam Act in 2003 which came into effect on 11 April 2004.

WHAT IS THE SPAM ACT AND WHAT DOES IT COVER?

The Spam Act has created a sweeping ban on the sending of 'spam' which the Act refers to as ‘unsolicited commercial electronic messages’. If a message is purely factual, it does not constitute a commercial message. If a message contains an invitation to do business, it does constitute a commercial message. Examples of commercial messages would be those offering to supply goods or services and those advertising or promoting goods or services.

However, in passing the Spam Act, Parliament did not ban all electronic messaging (there would be no email at all otherwise) and recognised that there are many legitimate uses for electronic messaging which has become a popular and relatively inexpensive communications tool.

Under the Spam Act, an electronic message is prohibited if the message is commercial in nature and it is sent without the recipient's consent. The Act can be infringed by the sending of a single message in a way that does not comply with the Act. The Act does not just focus on bulk messages.

To breach the Spam Act the message must have an Australian Link. A message has an Australian link if it originated in Australia (i.e. was sent or authorised to be sent in Australia) or if it originated overseas but was sent to an address accessed in Australia.

Electronic messaging includes emails, short message service (SMS), multimedia message service (MMS) and instant messaging (iM). It does not, however, include telefacsimiles, normal voice-to-voice telephone communications or telemarketing, non-electronic (i.e. hard copy) messages (surface mail, flyers) and many "pop up" windows that appear in the Internet.

ARE THERE EXCEPTIONS TO THE SPAM ACT?

There are certain exceptions to the prohibition against sending unsolicited commercial electronic messages.

Sending Messages with prior consent

The prohibition does not apply where the consent of the recipient has been obtained. Consent may be express or implied.

An example of express consent is where the recipient has subscribed to a business' electronic mailing list.

An example implied consent - which can be inferred from the existing business relationship between parties - is the relationship between a bank and its account holders. Consent may also be inferred from the publication of an electronic address, if it would be reasonable to assume that the publication occurred with the agreement of the individual concerned and there is no accompanying statement that the individual does not wish to receive unsolicited messages.

If an employee is using an e-mail facility provided by the employer, an employee may be able to give consent based on their ostensible authority.

Designated commercial electronic messages

The prohibition does not apply to messages sent by government bodies, registered political parties, religious organisations, charities or charitable organisations and/or educational institutions (where the message is sent to alumni or members of an alumni’s household), if the message relates to the supply of goods or services by the body. These messages must still contain sender identification and an unsubscribe facility.

Factual information messages

The prohibition does not apply to messages which only contain factual information and the name, logo and contact details of the person who sent the message.

Mistake / hidden Australian link

The prohibition does not apply if the person sending the message did not know and could not have reasonably ascertained that the message had an Australian link.

PENALTIES

The Act imposes considerable penalties in the event of breach. The maximum penalties under the Act are:

• for individuals, $44 000 per day and $220 000 for a further contravention of the same provision; and
• for businesses, $220 000 per day and $1.1 million for a further contravention of the same provision.

STEPS TO FOLLOW TO ENSURE COMPLIANCE

The following is a summary of basic steps to take to ensure compliance with the Spam Act when sending commercial electronic messages.

Step 1 - Australian Link

• Identify whether your business sends electronic messages of a commercial nature that have an Australian link.

Step 2 - Exceptions

• Assess whether the message falls within the exceptions provided for factual messages and designated electronic messages.

Step 3 - Consent

• Do not send commercial messages without consent.
• Develop and maintain a method for recording consent so that you can prove that consent was obtained.
• Determine whether consent may have lapsed. For example, inferred consent may no longer exist where a customer has not ordered from your business for a number of years.
• Adopt a cautious approach since the onus is on the business to prove that it had obtained the consent of the individual.
• Ensure that the consent has not been withdrawn or has otherwise lapsed.

Step 4 - Identify

• Accurate and clear information identifying your business should be included in all messages, for example the name, contact telephone and facsimile numbers and the address of the business.
• The information must be valid for a period of 30 days from the date when the message is sent.

Step 5 - Unsubscribe

• Messages must include the functional unsubscribe or opt-out facility which must contain an electronic address to which recipients are instructed to send a message.
• Ensure a responsible person is appointed to attend to the unsubscribe messages received and develop and maintain a control for dealing with such messages in the 5-day period. The organisations Privacy Officer may be an appropriate person to champion compliance with the Spam Act.
• The unsubscribe facility must remain operational for a 30 day period after the date on which the message is sent.
• The request to unsubscribe must be actioned within 5 working days from the date upon which the message to unsubscribe was sent.

Step 6 - Sources of Contact Details

• Do not supply, acquire or use address harvesting software or contact lists produced utilising such software.
• Obtain consent from those recipients that are listed on databases which where compiled prior to the Spam Act.

KEY TIPS

Pay attention to the Spam Act. The potential exposure to the legal and regulatory risk posed by the Spam Act’s penalty provisions is significant. The point of the Spam Act is relatively easy to understand but the devil is in the detail in terms of being comfortable with knowing that it is being complied with.

Key tips regarding compliance with the Spam Act are as follows:

• Conduct a compliance review.
• Develop appropriate internal controls, policies and practices to ensure that the content of all messages comply with the Spam Act.
• Ensure that compliance with the Spam Act is monitored and, if applicable, included in audit plans.
• As a part of compliance monitoring and control, a complaints handling process should be established.
• Train staff on the requirements of Spam Act and the liability to the business that can result from non-compliance.
• Prepare for any investigations by the Australian Communications Authority who supervises compliance with the Spam Act.
• Consider including clear sender identification and an unsubscribe facility in e-mail signatures.
• If you publish you email addresses but do not wish to receive emails other than for the purpose for which they are published, briefly and clearly state that consent for receiving email messages relates only to certain matters.
  

If you require advice or assistance in relation to corporate and commercial issues, or further information about our Corporate and Commercial Practice, please contact Andrew Seaton, Partner on (61 2) 9458 7632 or andrew.seaton@ablawyers.com.au.