Consent

72.94 Section 289(1)(b)(ii) provides that the use or disclosure by a person of information is permitted if the information relates to the affairs or personal particulars (including any unlisted telephone number or any address) of another person and the other person has consented to the use or disclosure. Consent is also an exception under NPP 2.1(b) and the ‘Use and Disclosure’ principle in the model UPPs.^[82]

72.95 The Telecommunications Act does not provide a definition of ‘consent’ for the purposes of s 289 or other provisions.^[83] The term ‘consent’ is defined in the Privacy Act to mean ‘express consent or implied consent’,^[84] but remains otherwise undefined. In DP 72, the ALRC proposed that Part 13 of the Telecommunications Act should be amended to provide that ‘consent’ means ‘express consent or implied consent’.^[85]

Submissions and consultations

72.96 A number of stakeholders supported the proposal.^[86] The DBCDE submitted that the proposal has merit, as it would make Part 13 of the Telecommunications Act consistent with the Privacy Act, Spam Act 2003 (Cth) and the Do Not Call Register Act 2007 (Cth).^[87]

72.97 Some stakeholders submitted that there should only be a very limited role for ‘implied consent’ in the telecommunications context. In their view, there are a range of uses and disclosures of telecommunications information which should require express consent, such as the disclosure of unlisted numbers and mobile phone location information. It was submitted that this should be provided for in the legislation, and not left to guidance.^[88]

ALRC’s view

72.98 In the interest of clarity, and consistency with the Privacy Act, Part 13 of the Telecommunications Act should be amended to provide that ‘consent’ means ‘express consent or implied consent’.

72.99 The specific requirements of consent—particularly as regards the requisite level of voluntariness—are highly dependent on the context in which the personal information is collected, used or disclosed. In other words, what may be required to obtain valid consent in one situation may differ, sometimes significantly, from what is required to obtain consent in another situation. For example, only ‘implied consent’ may be required when a telecommunications service provider needs to disclose information relating to a customer in order to provide a telecommunications service requested by the customer. ‘Express consent’, however, may be required when using or disclosing sensitive information, such as an unlisted number.

72.100 In Chapter 73, the ALRC recommends that ACMA, in consultation with relevant stakeholders, should develop and publish guidance relating to privacy in the telecommunications industry. This guidance should explain how consent may be obtained in certain contexts—such as, when an individual is entering an agreement for the provision of services with a telecommunications provider. This guidance should also include advice on when it is appropriate to use the mechanism of bundled consent.