Information privacy: the commercial context

1.69 Most people think about information privacy in terms of the collection and use of their personal information—most likely based on a one-to-one relationship with the agency or organisation concerned. Modern information technology, however, greatly facilitates the collection, aggregation, systematisation and matching of vast amounts of data, acquired from large numbers of individuals, with or without their consent—or even their awareness.

1.70 Database construction may occur for a variety of reasons. For example, human genetic research has now moved beyond the ‘mapping’ or ‘sequencing’ of an individual genome (the goal of the historic Human Genome Project) to scanning DNA profiles from many thousands of people, in order to identify genetic variations that might be associated with common but complex health problems (such as diabetes, degenerative nerve diseases and cancers). A number of countries and regions have established (or proposed) large databases of genetic information and tissue samples—often referred to as ‘biobanks’—to pursue this sort of ‘population genomics’. The UK Biobank already has collected over 100,000 samples from volunteer participants, with a target of 500,000.^[83] Obviously, such collections of sensitive personal information require the highest standards of ethical oversight and governance, including regard for individual privacy.^[84]

1.71 The accumulation and ‘mining’ of large databases containing other forms of personal information—such as property holdings, financial transactions, credit worthiness^[85] and consumer preferences—also has tremendous value for various commercial and direct marketing^[86] purposes. This is particularly relevant in an era characterised by globalisation and the massive growth of the internet and e-commerce. Veda Advantage submitted that:

Information networks are now the rapidly growing core of the information economy. Large fixed and variable data networks now operate across the finance, travel, health and telecommunications industries. Our credit reporting system was one of the earliest and largest information networks in Australia and gives real experience of the challenges of data protection and business efficiency in this information age.^[87]

1.72 Veda also noted that ‘there are two worlds of data—direct and indirect’, so that while a service provider organisation collects data directly from an individual, ‘that organisation lives in two data worlds … transferring data to other organisations’. As a matter of course,

these organisations have multiple relationships with each other, but do not have direct relationships with the individual data subject. In reality these relationships are [very complex]. They are also an essential part of the information economy …

Our submission is drawn from experience with the large, networked data sets collected, analysed and shared among corporations. The technologies, business processes and regulation that cover organisations which collect, collate, mine and network information are now relatively mature.^[88]

1.73 Indeed, and not surprisingly, the information economy has given rise to major corporations that provide services almost entirely based on the collection and strategic mining and analysis of data. For example, the giant Acxiom Corporation, based in the United States, promotes itself as

a global leader in helping companies maximize the value of information. Our innovative information management solutions provide critical insights into consumers that help companies acquire and build stronger, more profitable relationships with their customers … When companies work with Acxiom, we make it easy for them to establish strong ties with customers by helping them better understand what customers like, what they want and the best ways to communicate with them. Acxiom’s customer information management solutions help close gaps in customer knowledge—a key to our clients’ ability to sustain and grow their businesses.^[89]

1.74 Among other things, Acxiom offers services relating to information management, direct marketing strategies, online marketing, and improving the privacy and security of customer information.^[90] As the oft-repeated slogan goes, ‘privacy is good business’—that is, consumer trust is a sine qua non of engagement with such services as e-commerce and internet banking.

1.75 In Australia, Ticketek established a joint venture with Veda Advantage, aimed at generating revenue by providing marketers with access to a ‘permission-based’ database of consumers joining the Ticketek Rewards program. According to the executive in charge of the program, it is projected to grow to 150,000 or 200,000 individuals by the end of 2008,

making it one of Australia’s largest online research panels. It is growing rapidly … It’s becoming a big panel and, just as importantly, a quality panel. It skews to people with high disposable income and, unlike some other online consumer panels, we know that Ticketek Rewards members are real customers who spend money.^[91]

1.76 Another good example of the shifting nature of service provision in the ‘information age’ is the recent trend of companies selling off, or selling significant stakes in, their loyalty programs. Air Canada was the first to do this, floating 35 per cent of its Aeroplan frequent flyer program in 2003^[92]—which, remarkably, is now more highly capitalised than the airline itself.^[93] Qantas also is looking at floating a significant minority share in its Qantas frequent flyers program, with brokers estimating in March 2008 that Qantas frequent flyers is worth up to $2 billion, or about a quarter of the market capitalisation of the airline itself.^[94]

1.77 The high stand-alone value of these loyalty programs is attributable almost entirely to the size and nature of the databases holding the personal information of their customers. Frequent flyer programs are particularly prized because their lists contain many people who are high net worth individuals, or at least substantial spenders.

One of the reasons the Aeroplan business [was] considered more valuable than the airline that once owned it is that the market applies a much larger multiple to the loyalty company’s earnings. This is because investors see growth opportunities in these reward programs and they see more reliable and less volatile earnings.^[95]

1.78 In the course of the Inquiry, the ALRC found that a good deal of the debate about privacy protection in the business community was focused on the compliance burden. To the extent that this reflects the unnecessary complexity of the current legal regime, it is understandable—and in this Report, a central thrust of the ALRC’s recommendations is to simplify greatly and harmonise the law in this area, with the aim of reducing the compliance burden.

1.79 However, compliance with basic information privacy principles should not be seen as a punishment—it accords with commercial best practice standards and, in most cases, with basic common sense. Most critically, consumers do, and should be entitled to, expect that their personal information will be treated with due care and respect. As the mantra goes, ‘privacy is good for business’, and information can be the basis of ‘big business’. The commercial context of privacy must be considered carefully in the law reform process.