Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1697641851964.pdf (Australia)
Australian Law Reform Commission Inquiry into the Privacy Act Submission from Obesity Prevention Policy Coalition and Young Media Australia Obesity Prevention Policy Coalition The Obesity Prevention Policy Coalition (OPPC) is a coalition between the Cancer Council Victoria, Diabetes Australia – Victoria and Deakin University, with support from VicHealth.

The Coalition is concerned about the escalating rates of overweight and obesity in Australia, particularly in children.
Young Media Australia (YMA) is a unique national community organisation whose members share a strong commitment to the promotion of the healthy physical, social and emotional development of Australian children.

Their particular interest and expertise is in the role that media experiences play in that development.

YMA is committed to promoting better choices and providing stronger voices in children’s media.
The OPPC and YMA are pleased to have the opportunity to participate in the Australian Law Reform Commission’s Inquiry into the extent to which the Privacy Act 1988 (Cth) and related laws continue to provide an effective framework for the protection of privacy in Australia.
Our main interest in the Inquiry is the extent to which the Act provides effective protection for children and young people against interference with their privacy through use and disclosure of their personal information for direct marketing.
Accordingly, our submission addresses the following questions in the ALRC Issues Paper 31 (‘Issues Paper’) as they relate to this issue: Question 4-12: Is it appropriate that NPP 2 allows for personal non-sensitive information to be used for the secondary purpose of direct marketing?

If so, are the criteria that an organisation needs to satisfy in order to use personal information for direct marketing purposes adequate and appropriate?
Question 9-1: Should the protection of privacy of personal information for children and young people be dealt with expressly in the Privacy Act?

If so, how should the Act be amended?

Executive Summary We are concerned that use or disclosure of children’s and young people’s personal information for direct marketing causes harm to children and young people by interfering with their privacy and subjecting them to inappropriate commercial influence.
Personal information is information or an opinion about an individual whose identity is apparent, or can reasonably be ascertained, from the information or opinion.1 Use or disclosure of children’s or young people’s personal information for direct marketing without the consent of their parents2 is likely to interfere with their privacy as most children and many young people would not have the capacity to make informed and voluntary decisions about how their personal information is used and handled, particularly in circumstances where private sector organisations make consent to use or disclosure of personal information for direct marketing a condition for children’s participation in competitions, promotions and other activities.
1 Privacy Act 1988 (Cth), s 6.

2 In this submission, the word ‘parent’ is used to refer to the parent or legal guardian of a child.

1 Children’s and young people’s susceptibility to commercial influence means that use of their personal information for direct marketing unfairly manipulates them, and is likely to harm them in other ways.
For example, direct marketing of unhealthy food and beverages to children and young people may influence them to consume unhealthy diets, and contribute to them becoming overweight or obese.

In our view, the use and disclosure of children’s and young people’s personal information for direct marketing by private sector organisations should be dealt with expressly in the National Privacy Principles (‘NPPs’) contained in the Privacy Act.
The current NPPs fail to provide clear guidance to private sector organisations on the circumstances in which it is and is not permissible to use or disclose personal information of children’s and young people for the purpose of direct marketing.
Under NPP 2.1 it is permissible for a private sector organisation to use or disclose an individual’s personal information for direct marketing in any of the following situations: • If direct marketing was the primary purpose of collecting the individual’s personal information.
• • • If direct marketing was a related secondary purpose of collecting the individual’s personal information (or if the personal information is sensitive, a ‘directly related’ purpose) and the individual would have reasonably expected the organisation to use or disclose the personal information for this purpose.

If the individual consented to the use or disclosure of his or her personal information for direct marketing.
If direct marketing was a secondary purpose of collecting the individual’s (non-sensitive) personal information and certain criteria are satisfied, including that it is impracticable for the organisation to seek the individual’s consent to the use or disclosure of his or her personal information for direct marketing, the individual has not made a request to the organisation not to receive direct marketing, and the organisation draws the individual’s attention to the ability to ‘opt-out’ of further direct marketing communications.
All these situations assume that people have the cognitive ability and maturity to make decisions about the use or disclosure of their personal information for direct marketing.

Clearly, many children and young people would not have the capacity to make such decisions.

In other contexts, the law recognises that when a child is incapable of making decisions about matters affecting him or her, the child’s parents have the responsibility to make these decisions on behalf of the child.
In this case, we think the responsibility to make decisions about the use or disclosure of children’s personal information for direct marketing should also fall to children’s parents.

Currently, under NPP 2.1(b), private sector organisations are expected to assess the capacity of children and young people to consent to the use of their personal information for direct marketing on a case-by-case basis.
This is inappropriate and impracticable because private sector organisations that collect personal information for direct marketing would not necessarily have the expertise to assess children’s and young people’s decision-making capacity, and are unlikely to have any direct contact with children or young people that would allow them to do so.

In this situation, age is the only possible basis upon which private sector organisations could assess children’s and young people’s decision-making capacity.
To resolve these issues, we recommend that the NPPs should be amended in the following ways: • To prohibit a private sector organisation, for the purpose of direct marketing, using or disclosing personal information that the organisation knows belongs, or that in the 2 circumstances is reasonably likely to belong, to a child younger than 14, unless a parent of the child has provided express and verifiable consent to the organisation (or to another organisation that disclosed the personal information), or unless the organisation is able to verify that the personal information belongs to a person aged 14 or older.
(Private sector organisations could verify parental consent by requiring the parent to mail or fax a signed form, provide a credit card number, provide an electronic signature or call a toll-free number staffed by trained personnel.)
If a child’s parent provides consent to a private sector organisation to use or disclose the child’s personal information for direct marketing, to require the organisation to allow the child’s parent to retract the consent at any time, and notify the parent of how to do this at the time he or she provides the consent.
If a private sector organisation knows, or the circumstances indicate a reasonable likelihood, that the organisation is seeking to collect personal information from a child younger than 14, to prohibit the organisation from making consent to the use or disclosure of personal information for direct marketing a condition for participation in a competition, promotion or other activity.
• • 3 Children’s privacy and direct marketing As discussed in the Issues Paper, the right to protection against interference with privacy has been recognised in Article 12 of the United Nations Universal Declaration of Human Rights and Article 17 of the International Covenant on Civil and Political Rights as a fundamental human right.

The right to privacy has also been recognised in Article 16 of the United Nations Convention on the Rights of the Child as a fundamental right of children.
One aspect of an individual’s right to privacy is his or her right in maintaining the privacy of his or her personal information.

It is widely accepted, and reflected in privacy law in Australia and other jurisdictions, that this should involve being able to access one’s personal information and exercise a substantial degree of control over how it is used and handled.
Use of children’s and young people’s personal information for direct marketing raises serious privacy issues because most children and many young people would not have the capacity to make informed and voluntary decisions about the use and disclosure of their personal information for direct marketing.
Most children and many young people would lack the cognitive capacity and maturity necessary to understand the consequences of, and make rational decisions about, whether to agree to the use or disclosure of their personal information for direct marketing.

Many children and young people would not even understand what direct marketing is.
Children and young people are also more susceptible to commercial manipulation than adults, and are likely to find it very difficult to resist offers or promotions that are conditioned on provision of their personal information.

It seems to be a common practice for private sector organisations to make consent to use or disclosure of personal information for direct marketing a condition for children’s participation in competitions, promotions and other activities.
In various contexts, the law recognises that when a child or young person lacks capacity to make informed decisions about matters that concern them, the responsibility to make those decisions should rest with the child’s parents.
As discussed in the Issues Paper, Article 5 of the United Nations Convention on the Rights of the Child also recognises the responsibility, right and duty of parents to exercise guidance over their child’s exercise of his or her rights to a degree appropriate to the child’s evolving capacities.
We believe that any use or disclosure for direct marketing purposes of personal information belonging to a child who lacks decision-making capacity, without the prior consent of the child’s parent, denies the parent’s right and duty to exercise guidance over their child’s decisions, and interferes with the child’s right to privacy.
In our view, protecting children from interference with their privacy through direct marketing is becoming increasingly important in light of children’s increasing use of the Internet, email and SMS, and advertisers’ widespread use of these technologies to market products directly to children.
According to a recent report by the Australian Bureau of Statistics, in the 12 months to April 2006, more than 1.7 million Australian children aged 5 to 14 years (amounting to 65%) accessed the Internet during or outside of school hours.3 The report estimated that during this time period, 73% (1,077,000) of children aged 5 to 14 who accessed the Internet at home were online more than once a week and 25% (371,400) were online every day.
A 2005 survey of children’s (aged 8 to 13 years) home Internet and mobile phone use, commissioned by the Australian Broadcasting Authority (now the Australian Communications and Media Authority) and NetAlert Limited, found that children were accessing the Internet for the first time at younger ages, with more than a third of young children (aged eight or nine) surveyed having first used the Internet at the age of five or six.
The survey also reported that mobile phone use was increasing, with one-quarter of children aged 8 to 13 years reporting using a 3 Australian Bureau of Statistics, Children’s Participation in Cultural and Leisure Activities, Australia, April 2006, (cat.

no.

4901.0), available at http://www.abs.gov.au/Ausstats/abs@.nsf/Latestproducts/4901.0Main%20Features1Apr%202006?opendocument&tabname=Su mmary&prodno=4901.0&issue=Apr%202006&num=&view=, accessed 10 January 2007.
4 mobile regularly and 14% of parents reporting that they intended to give their children mobile phones in the following year.4 We are particularly concerned about direct marketing using these technologies because, unlike television, these technologies enable marketers to interact directly with children.

Direct marketing using these technologies intrudes directly into children’s personal space, and provides marketers with unsupervised access to children.
According to the Australian Broadcasting Authority and NetAlert Limited survey of children aged 8 to 13, most children’s use of the Internet was independent, and children most commonly participated in online activities such as email and instant messaging on their own.

The survey also found low involvement of parents with children’s mobile phone use, with one-third of parents reporting total lack of involvement with their children’s use of mobile phones.
Other harmful effects of direct marketing on children We are also concerned about harmful effects of direct marketing on children in addition to the harm caused by interference with children’s privacy.

As noted above, children are more susceptible to commercial manipulation than adults, and are likely to be heavily influenced by direct marketing.
Psychological research shows that children are highly vulnerable to advertising because they lack the experience and cognitive ability necessary to assess advertising messages critically.

In order to properly comprehend advertising messages, children need to be able to distinguish between commercial and non-commercial content and understand the persuasive intent of advertising.

These abilities develop over time as functions of cognitive growth and intellectual development.
5 An American Psychological Association Taskforce report, which reviewed the research on the psychological effects of advertising on children, concluded that children younger than 8 years of age generally cannot understand the persuasive intent of advertising or view it critically.
Older children may have a rudimentary understanding that advertisements are intended to sell products, but many would not understand that advertisements are inherently biased or have the ability to interpret advertising messages critically.

6 These considerations provide grounds for concern about all marketing to children.

If a child is unable to distinguish between marketing and entertainment, then all marketing is ‘cash for comment’ as far as he or she is concerned.
Children who cannot understand the persuasive intent of marketing messages are also vulnerable to unfair manipulation.

We believe that from the point of view of children’s healthy emotional and social development, the importance of protecting them from marketing practices cannot be understated.
We are particularly concerned about the possible effect of direct marketing on children’s healthy physical development, namely its capacity to influence children to eat unhealthily, and to contribute to overweight or obesity in children.
There is substantial evidence that food and beverage advertising influences children’s product preferences and product consumption, and is a probable causal factor in weight gain and obesity in children.7 The most recent systematic reviews of the research on the effects of food and beverage advertising to children 4 Kidsonline@home: Internet Use in Australian Homes, prepared by NetRatings Australia Pty Ltd for the Australian Broadcasting Authority and NetAlert Limited, April 2005, Sydney, available at http://www.acma.gov.au/acmainterwr/aba/about/recruitment/kidsonline.pdf, accessed 10 January 2006.
5 Kunkel, D., Wilcox, B.L., Cantor, J., Palmer, E., Linn, S. and Dowrick, P. ‘Report of the APA Task Force on Advertising and Children.

Washington, DC: American Psychological Association, February 20, 2004.

(Accessed July 12 2006 at http://www.apa.org/releases/childrenads.pdf.)

6 As above.

7 Report of a Joint WHO/FAO Consultation.


Diet, Nutrition and the Prevention of Chronic Diseases, WHO Technical Report Series 916, World Health Organisation: Geneva, 2003, available at: http://www.who.int/hpr/NPH/docs/who_fao_expert_report.pdf, accessed 19 July 2006; Hastings, G., Stead, M., McDermott, L., Forsyth, A., MacKintosh, A.M., Rayner, M., Godfrey, C., Caraher, M. & Angus, K. (2003), Review of Research on the Effects of Food Promotion to Children.

Final Report to the UK Food Standards Agency.


University of Strathfclyde Centre for Social Marketing: Strathclyde, available at: http://www.food.gov.uk/multimedia/pdfs/foodpromotiontochildren1, accessed 19 July 2006; Committee on Food Marketing and the Diets of Children and Youth, Institute of Medicine of the National Academies, Overview of the IOM Report on Food Marketing to Children and Youth: Threat or Opportunity?
Institute of Medicine, 2005, available at: http://www.iom.edu/CMS/3788/21939/31330/31337.aspx, accessed 19 July 2006.
5 have confirmed that such advertising influences children’s food preferences, purchasing, purchase-related behaviour and consumption, as well as their diet and health status.8 Inadequacies of NPP 2.1 for protecting children and young people from privacy interference through direct marketing NPP 2.1(b) – use or disclosure of personal information for secondary purpose with consent of individual As the Commission knows, currently NPP 2.1(b) permits private sector organisations to use or disclose an individual’s personal information for the secondary purpose of direct marketing with the consent of the individual.
As noted by the Commission in the Issues Paper, this assumes that an individual is capable of understanding the issues relevant to consenting to the use or disclosure of his or her personal information for direct marketing and of communicating his or her consent to the use or disclosure.
The Guidelines to the National Privacy Principles published by the Office of the Privacy Commissioner (‘Guidelines’) recognise that an individual must have this capacity in order to provide valid consent to the use or disclosure of his or her personal information, and suggest that if a child lacks this capacity, private sector organisations may satisfy NPP 2.1(b) by obtaining the consent of a parent on behalf of the child.9 However, as noted in the Issues Paper, the Act does not prescribe an age at which an individual is capable of making decisions about his or her personal information.
The Guidelines indicate that capacity must be assessed on an individual basis, and that this assessment should be based on the general law principle that a person is capable of giving consent when he or she has sufficient understanding or maturity to understand what is being proposed.
However, as the Issues Paper observes, individual assessment of capacity may not be possible if there is no direct relationship between the individual and the person or organisation who holds the information; individual assessment is only likely to be appropriate if the organisation that collects the personal information has expertise in making such assessments and an opportunity to interact with the individual in question.
Clearly this is very unlikely to be the case when children’s personal information is collected for direct marketing.

Such information would usually be collected from children online, or by email, SMS or regular mail.

Organisations collecting this information would not necessarily have any expertise in assessing children’s decision-making capacity and would be unlikely to have any direct contact with children from whom they collect this information.
In addition, such organisations would have a vested interest in determining that children are capable of consenting to use or disclosure of their personal information.

When children’s personal information is collected for direct marketing, the only possible basis upon which organisations could assess children’s capacity is their age, if organisations collect or have access to that information, and even then children’s age would probably not be verifiable.
We are concerned that the current lack of clarity with respect to the application of NPP 2.1(b) to children and young people means that private sector organisations may attempt to rely on NPP 2.1(b) by seeking to obtain the consent of children to use or disclosure of their personal information for direct marketing through means such as including such consent as one of the conditions for participating in promotional offers or competitions.
8 Hastings, G., McDermott, L., Angus, K., Stead, M., Thomson, S. (2006).

The extent, nature and effects of food promotion to children: A review of the evidence.
Background document no 1, WHO Forum and Technical Meeting on the marketing of food and non-alcoholic beverages to children, Lysebu (Oslo), Norway, 2-5 May 2006; Committee on Food Marketing and the Diets of Children and Youth, Institute of Medicine of the National Academies, Overview of the IOM Report on Food Marketing to Children and Youth: Threat or Opportunity?

Institute of Medicine, 2005, available at: http://www.iom.edu/CMS/3788/21939/31330/31337.aspx, accessed 19 July 2006.
9This is based on the following statement on page 21 of the Guidelines: ‘In some circumstances, it may be appropriate for a parent or guardian to consent on behalf of a young person; for example if the child is very young or lacks the maturity or understanding to do so themselves.’ 6 We are aware of one such recent case in which Kellogg ran a ‘Win an Xbox 360 promotion’ to encourage children to purchase specially marked packs of certain Kellogg products in order to enter daily draws to win an Xbox 360 video game entertainment system.
To enter the competition, children were required to SMS their full name and the first line of their address to Kellogg, or to complete an online entry form on Kellogg’s website10 which required children to provide their full name, contact telephone number and email address.

A clause in the terms and conditions for entry to the competition stated: ‘…the personal information supplied to Kellogg for the purpose of entering this competition may be used for future marketing and publicity purposes’.
This clause was written in legalistic terms and appeared near the end of a long and complicated series of terms and conditions, which were printed in very small print on the inside of product packs, or could be accessed via a link provided on the online entry form.
The Kellogg promotion was clearly aimed at children, who would have been highly unlikely to have read or understood the terms and conditions, and many of whom would have been incapable of providing valid consent to the use of their personal information for direct marketing.
However, Kellogg did not ask competition entrants to provide their age, so it would have had no basis for determining whether individual entrants were likely to have had capacity to consent, and it did not require parents to provide consent on children’s behalf.11 If Kellogg were to use children’s personal information it collected through the promotion, we think it is clear that it would breach NPP 2.1 because most children would not have been aware that they were consenting to the use of their personal information for direct marketing, and could not have provided valid consent to this in any case.
However, we think this case illustrates the need for reform of NPP 2.1 to clarify when it is permissible to rely on young people’s consent to the use or disclosure of their personal information and when parental consent must be obtained, and the methods by which it is permissible to obtain such consent.
Use or disclosure of personal information for direct marketing without consent As the Commission knows, NPP 2.1 also allows private sector organisations to use or disclose an individual’s personal information for direct marketing without the individual’s specific consent if any of the following criteria are met: 1. direct marketing was the primary purpose of collecting the individual’s personal information; 2. direct marketing was a related secondary purpose of collecting the individual’s personal information (or if the personal information is sensitive, a ‘directly related’ purpose) and the individual would have reasonably expected the organisation to use or disclose the personal information for this purpose (under NPP 2.1(a)); or 3. direct marketing was a secondary purpose of collecting the individual’s (non-sensitive) personal information and the criteria set out in NPP 2.1(c) are satisfied, including that it is impracticable for the organisation to seek the individual’s consent to the use or disclosure of his or her personal information for direct marketing, the individual has not made a request to the organisation not to receive direct marketing, and the organisation draws the individual’s attention to the ability to ‘opt-out’ of further direct marketing communications (under NPP 2.1(c)).
Again, these criteria assume that an individual is capable of assessing the likely outcomes of providing his or her personal information to private sector organisations, and making rational decisions on this basis.
Presumably the policy rationale for the lack of a consent requirement if either of the first two criteria is met is that an individual who provides personal information for a certain purpose (which is the primary purpose of collection) impliedly consents to the use or disclosure of their personal information for that purpose, and any related purposes that 10At http://www.kelloggcomps.com.au/xbox/default.htm.
11 The Obesity Prevention Policy Coalition wrote to the Privacy Commissioner in October 2006 to draw her attention to this matter and to request her to investigate the matter on her own motion pursuant to section 40(2) of the Act.

The Office of the Privacy Commissioner is currently investigating the issues the Coalition raised and deciding how to deal with the matter.

7 are within the individual’s reasonable expectations.
In relation to the third criterion, presumably the rationale is that an individual can choose not to receive direct marketing communications by making a specific request to this effect at the time of providing personal information or later, and that the harm caused by interference with an individual’s privacy through unsolicited direct marketing is minimised if the individual has an opportunity to ‘opt- out’ of receiving further marketing communications.
In our view, these policy justifications have no application in relation to children or young people who lack the capacity to understand the implications of, and to make rational decisions about, the use and disclosure of their personal information for direct marketing.
In effect, NPP 2.1 requires people to be aware that if they provide their personal information to a private sector organisation for a particular purpose, they effectively permit the organisation to use or disclose the personal information for any related purposes, including direct marketing, and for the unrelated secondary purpose of direct marketing, if they do not make a specific request not to receive direct marketing communications.
Clearly, many children would lack the ability to be cognisant of all these matters, and to make rational decisions about these matters, when they provide their personal information to private sector organisations.

The third circumstance also requires individuals to be capable of making decisions whether or not to opt out of receiving further direct marketing communications.
Again, many children would lack the capacity to understand the issues relating to, and make rational decisions about, opting out of receiving direct marketing.

Children would also be very unlikely to understand how NPP 2.1 operates, and may assume that organisations are only permitted to use their personal information for purposes to which they expressly consent.
However, NPP 2.1 allows private sector organisations to rely on any of these criteria in relation to children or young people who lack the capacity to make decisions about their personal information in the absence of consent or involvement by a parent, and in relation to the third criterion, without providing a parent the opportunity to opt out of receiving future marketing communications on behalf of the child.
For example, in one case we are aware of, Hungry Jack’s is collecting children’s personal information through online entries to its ‘Hungry Jack’s Kids Club’ via the Hungry Jack’s website.12 According to the online entry form, membership of the ‘Hungry Jack’s Kids Club’ is open to children aged 12 years or younger.

The entry form requires children to provide their full name and address, date of birth and the name of a parent.
The names of members of the Kids Club are recorded on a ‘special membership roll’ and members are sent membership cards and ‘special birthday cards’ on their birthdays, and ‘special free treats’ throughout the year.
However, consent of a parent to use children’s personal information for these marketing purposes is not required and there is no privacy policy on the Hungry Jack’s website.13 We believe that Hungry Jack’s is in breach of NPP 1.3 because it has failed to take reasonable steps to make children from whom it collects personal information aware of the matters set out in NPP 1.3.
However, on our interpretation, Hungry Jack’s will not breach NPP 2.1 by using the children’s personal information for direct marketing.

This is despite the fact that since the children are younger than 12, the majority would clearly lack the capacity to make decisions about their personal information, and Hungry Jack’s has not obtained the consent of parents to use the children’s personal information for direct marketing.
Recommendations for reform of NPP 2.1 to protect children and young people In our view, the use and disclosure of children’s personal information for direct marketing should be dealt with expressly in the NPPs.

We believe that the NPPs need to be amended to clarify the circumstances in which private sector organisations may, for the purpose of direct 12 At http://www.hungryjacks.com.au/KidsClub.aspx.
13 The Obesity Prevention Policy Coalition wrote to the Privacy Commissioner in November 2006 to draw her attention to this matter and to request her to investigate the matter on her own motion pursuant to section 40(2) of the Act.

The Coalition has not yet received a response to the letter.

8 marketing, collect, use or disclose personal information of children who lack the capacity to make decisions about this information.
Specifically, we believe that the NPPs should require private sector organisations to obtain the express consent of a parent of a child who lacks decision-making capacity before they may collect, use or disclose the child’s personal information for direct marketing, and that the NPPs should prescribe 14 as the age below which organisations must presume that children lack this decision-making capacity.
To achieve this, we recommend that the NPPs should be amended to prohibit a private sector organisation, for the purpose of direct marketing, using or disclosing personal information that the organisation knows belongs, or that in the circumstances is reasonably likely to belong, to a child younger than 14, unless a parent of the child has provided express and verifiable consent to the organisation or another organisation that disclosed the personal information, or unless the organisation is able to verify that the information belongs to a person aged 14 or over.
The NPPs should also require private sector organisations to allow a parent to retract consent to use or disclosure of a child’s personal information (whether provided by the parent or the child) at any stage, and to notify the parent of how to do this at the time he or she provides consent.
We also believe that where private sector organisations know, or the circumstances indicate a reasonable likelihood, that personal information is being collected from children younger than 14, the NPPs should prohibit private sector organisations making consent to the use or disclosure of the personal information for direct marketing a condition for participation in competitions, promotions or other similar activities.
This would be similar to the regulatory approach taken in the United States to online collection of children’s personal information under the Children’s Online Privacy Protection Act of 1998 (‘COPPA’).14It would also be similar to the requirement in Korea under the Act on Promotion of Information and Communications Network Utilization and Information Protection, etc 200215 for telephone and internet service providers that collect, use or disclose personal information of a child younger than 14 to obtain the consent of the child’s legal representative.
However, the proposed NPP requirements would apply to all private sector organisations rather than just to website operators or telephone and internet service providers, and the requirements would apply only to the use or disclosure of children’s personal information for direct marketing, rather than to any collection, use or disclosure, of children’s personal information.
Need for parental consent requirement In our view, when a child is incapable of making decisions about the use or disclosure of his or her personal information for direct marketing, this responsibility should fall to the child’s parents.

In other situations involving children, the law recognises that when a child is incapable of making decisions about matters affecting him or her, the child’s parents have the responsibility to make these decisions on behalf of the child.
For example, the law has long recognised the authority of parents to consent to or refuse medical treatment on behalf of a child.16 This responsibility arises from each parent’s parental responsibility for their child, which under the Family Law Act 1975 (Cth), is defined as ‘all the duties, powers, responsibilities and authority which, by law, parents have in relation to children,’ and applies to each parent of a child younger than 18.17 It is also consistent with Article 5 of the United Nations Convention on the Rights of the Child, which, as noted above, requires ratifying 14 15 U.S.C.
15 Act n.6797/2002 16 But see the High Court’s decision in Secretary, Department of Health and Community Services v JWB and SMB (‘Marion’s case’) (1992) 175 CLR 218 on the scope of parental authority to consent to sterilisation of children.

17 Sections 61B, 61C and 61D.

9 countries to respect the responsibility, rights and duties of parents to provide appropriate direction and guidance in the exercise of the child’s rights.
In our view, private sector organisations should be required to obtain the express and verifiable consent of a parent before they use or disclose the personal information of a child who lacks decision-making capacity for direct marketing, irrespective of whether direct marking was the primary, related secondary or unrelated secondary purpose of collection, and irrespective of whether it is impractical to seek consent or the child has been given an opportunity to opt-out of receiving direct marketing communications.
As discussed above, the current approach of NPP 2.1 under which it is permissible to use personal information for direct marketing without express consent in certain circumstances is premised on people having the capacity to make a rational decision as to whether or not to provide their personal information to private sector organisations based on knowledge and evaluation of the likely outcomes.
To ensure that personal information of children who lack this capacity is not used or disclosed for direct marketing in a manner that interferes with their privacy, children’s parents should have knowledge and control over the child’s provision of personal information to private sector organisations for direct marketing.

The only way to ensure this occurs is to require private sector organisations to obtain a parent’s prior express consent to such use or disclosure.
To allow parents to exercise effective ongoing control over the use of their children’s personal information for direct marketing, we believe private sector organisations should be required to allow parents of children younger than 14 to retract consent to use or disclosure of their children’s personal information for direct marketing at any stage, and to notify parents of how they can do this at the time such consent is provided.
To ensure children do not falsely supply consent on behalf of parents, we believe that the NPPs should require the consent of parents to be verifiable.

This is required in the US under COPPA in relation to the consent of parents to online collection, use or disclosure of children’s personal information.
COPPA defines ‘verifiable parental consent’ as ‘any reasonable effort (taking into consideration available technology)…to ensure that a parent of a child authorises the collection, use and disclosure’ of a child’s personal information.18 The US Federal Trade Commission’s Children's Online Privacy Protection Rule, 16 C.F.R.
Part 312, sets out several methods for obtaining verifiable consent from a parent, including requiring the parent to mail or fax a signed form, provide a credit card number, provide an electronic signature or call a toll-free number staffed by trained personnel.

We believe any of these methods would be suitable for obtaining verifiable parental consent to use or disclosure of a child’s personal information for direct marketing.
Need for cut-off age to determine children’s and young people’s capacity We believe that there is also a clear need for the NPPs to prescribe a cut-off age below which private sector organisations must assume that children are incapable of making decisions about their personal information and be required to obtain express parental consent to use or disclosure of the children’s personal information for direct marketing.
As discussed above, case-by-case assessment of children’s decision-making capacity is impossible and inappropriate in the context of assessing the validity of children’s consent to use or disclosure of their personal information for direct marketing.
Private sector organisations that collect children’s personal information for direct marketing are not necessarily appropriately skilled or qualified to assess children’s decision-making capacity or likely to have any direct contact with children that would enable them to do so.

Nor is it in private sector organisations’ interests to exercise diligence in this regard.
We acknowledge that since children’s cognitive abilities develop at different rates, a cut-off age model would involve the disadvantage that some children who are younger than the cut- 18 15 USC 6501(9).
10 off age would be capable of making their own decisions about whether to allow the use or disclosure of their personal information for direct marketing but would be prevented from doing so, and that some children older than the cut-off age who lack decision-making capacity would nevertheless be permitted to make their own decisions.
However, for the reasons discussed above, we believe that age is the only possible and appropriate basis for determining children’s decision-making capacity when information is collected by private sector organisations for direct marketing.

In our view, it is clearly preferable for the age at which children can be assumed to possess this capacity to be prescribed by the NPPs than to be left to the discretion of private sector organisations.
The legislature is likely to be in a better position than such organisations to decide upon the age at which most children are likely to have decision-making capacity, and a cut-off age would promote clarity, certainty, and consistency in private sector organisations’ practices.

Other legislation intended to protect children is based on cut-off ages due to the impracticality of assessing children’s capacity on an individual basis and/or the need for the legislation to provide clarity and certainty.
For example, state and territory liquor legislation prohibits the sale of alcohol to children and young people under the age of 18.19 We also acknowledge that a cut-off age model would present practical difficulties for private sector organisations in ascertaining and verifying children’s ages.
However, we agree with the Commission’s statement in Chapter 9 of the Issues Paper that a cut-off age model would allow the collector of children’s personal information to ‘focus on developing a system for establishing the age of the individual, rather than an assessment of his or her decision-making capacity’.
We believe private sector organisations should be required to obtain parental consent in all cases where the organisations know, or the circumstances indicate a reasonable likelihood, that personal information proposed to be used or disclosed for direct marketing belongs to children younger than 14, unless they are able to establish that this is not the case.
For example, where personal information is collected through websites, competitions or promotions directed to children younger than 14, private sector organisations would be required to obtain parental consent before they could use or disclose the information for direct marketing, unless they could verify that the information belonged to a person aged 14 or over.
This approach would be similar to the requirement in the US under COPPA for all operators of websites directed to children under 13 in the US to obtain parental consent to collection of children’s personal information.20 In determining whether a website is targeted at children, the US Federal Trade Commission (which enforces COPPA) considers the website’s subject matter, multimedia content, the age of the models, the language used and whether the site uses features such as games, puppets, animated characters or child oriented activities.21 We believe that such measures could go some way towards protecting children and their personal information.
At the same time, we are aware that it is possible to circumvent rules and standards that hinge on a concept of material being ‘directed’ or ‘aimed’ at children, by designing the material in such a way that it could be seen as addressed at parents.
For example a television advertisement for a sugared breakfast cereal, usually of primary appeal to children, and featuring a children’s television presenter, was held not to be directed at children because the script made the presenter appear to be addressing parents.

We therefore submit that these restrictions on the collection of personal information should be triggered when any one element of a website, competition or promotion points towards it being directed at children.
19 Liquor Act 1975 (ACT), s 152; Liquor Act 1982 (NSW), s 113; Liquor Act (NT), s. 106C; Liquor Act 1992 (Qld), s 155A; Liquor Licensing Act 1997(SA), s. 110; Liquor Licensing Act (Tas), s 70; Liquor Control Reform Act 1998 (Vic), s 119; Liquor Licensing Act 1998 (WA), ss 121, 122.

20 15 U.S.C.

6502(b)(1)(A)(ii).

21 Children’s Online Privacy Protection Rule, 16 C.F.R.

312.2 (2001).
312.2 (2001).

11 We believe that difficulties in ascertaining children’s ages would be reduced by introducing a prohibition in the NPPs against making consent to the use or disclosure of personal information for direct marketing a condition for participation in any competition, promotion or other activity where a private sector organisation knows, or the circumstances indicate a reasonable likelihood, that the organisation is seeking to collect personal information from children younger than 14.
This would remove the incentive for children younger than 14 to lie about their age to be able to participate in such activities without obtaining parental consent, and would reduce the likelihood of parent-child conflict in situations where parents of children under the cut-off age decide not to consent to the use of children’s personal information for direct marketing.

What cut-off age should the NPPs prescribe?
For a child or young person to be capable of making informed decisions, it is generally thought that he or she must possess the ability to: • make a rational decision, which requires being able to: - - - understand the factual information and the issues relevant to the situation; use the information to effectively identify and consider the consequences of different options; and compare the options by evaluating their consequences and how they fit within the framework of the individual’s values and goals; and • make a voluntary decision, i.e.
a deliberate choice that is made freely and not constrained by others.
22 It is thought that children develop the capacity to make rational decisions when they reach the stage of cognitive development that allows them to reason abstractly about hypothetical situations, reason about multiple alternatives and consequences, combine multiple variables in complex ways, and examine information systematically and exhaustively.23 Psychological research generally indicates that children develop the cognitive capacity to make rational decisions between the ages of 11 and 14, and that this capacity appears in most children at least by the age of 14.24 Research also indicates, however, that children’s and young people’s ability to make voluntary decisions emerges with social and emotional maturity and tends to develop later than their cognitive capacity to make rational decisions.25 In early adolescence, children (aged about 11 or 12) are susceptible to coercive influence and tend to respond deferentially to requests.26 Research indicates that young people’s tendency towards conformity peaks in early adolescence (at about age 11 or 12) and declines thereafter,27 but that most adolescents do not become capable of making voluntary decisions that are not unduly influenced by others until between the ages of 15 and 17.28 22 Kuther, T.L.
(2003).

‘Medical decision-making and minors: issues of consent and assent’, Adolescence, 38, 343-358.

23 Keating, D.P., & Clark, L.V.

(1980).

‘Development of physical and social reasoning in adolescence.

Developmental Psychology, 16, 23-30, cited in Kuther, T.L.

(2003).

‘Medical decision-making and minors: issues of consent and assent’, Adolescence, 38, 343-358; J Piaget and B Inhelder, The psychology of the child (Basic Books, New York, 1969).
24 See reviews of empirical research on minors’ decision-making capacity in Kuther, T.L.

(2003).

‘Medical decision-making and minors: issues of consent and assent’, Adolescence, 38, 343-358, Miller, V.A., Dennis, D., & Kodish, E. (2004).

‘Children’s competence for assent and consent: a review of empirical findings’, Ethics & Behavior, 14, 255-295 and New South Wales Law Reform Commission Issues Paper 24 (2004) Minor’s Consent to Medical Treatment.

25 As above.

26 As above.

27 Lewis, C.E.

(1987).


‘Minor’s competence to consent to abortion.

American Psychologist, 42, 84-88, cited in Kuther, T.L.

(2003).

‘Medical decision-making and minors: issues of consent and assent’, Adolescence, 38, 343-358; Grisso, T., & Vierling, L. (1978).

‘Minors’ consent to treatment: a developmental perspective’, Professional Psychology, 9, 412-427, cited in Miller, V.A., Dennis, D., & Kodish, E. (2004).
‘Children’s competence for assent and consent: a review of empirical findings’, Ethics & Behavior, 14, 255-295, Kuther, T.L.

(2003).

‘Medical decision-making and minors: issues of consent and assent’, Adolescence, 38, 343-358, and New South Wales Law Reform Commission Issues Paper 24 (2004) Minor’s Consent to Medical Treatment.

28 Grisso, T., & Vierling, L. (1978).


‘Minors’ consent to treatment: a developmental perspective’, Professional Psychology, 9, 412-427, cited in Miller, V.A., Dennis, D., & Kodish, E. (2004).

‘Children’s competence for assent and consent: a review of empirical findings’, Ethics & Behavior, 14, 255-295, Kuther, T.L.

(2003).

‘Medical decision-making and minors: issues of 12 In our view, the cut-off age prescribed by the NPPs should be 14.
Although research indicates that some adolescents aged 14 or over would not be capable of making voluntary decisions, we believe that a cut-off age of 14 would achieve the most appropriate balance between protecting children who lack decision-making capacity and providing children with autonomy to make their own decisions as they develop this capacity.
Summary of recommendations We recommend that the NPPs should be amended to: • prohibit a private sector organisation, for the purpose of direct marketing, from using or disclosing personal information that the organisation knows belongs, or that in the circumstances is reasonably likely to belong, to a child younger than 14, unless a parent of the child has provided express and verifiable consent to the organisation (or to another organisation that disclosed the personal information), or unless the organisation is able to verify that the personal information belongs to a person aged 14 or older; • • if a child’s parent provides consent to a private sector organisation to use or disclose the child’s personal information for direct marketing, require the organisation to allow the child’s parent to retract the consent at any time, and notify the parent of how to do this at the time he or she provides the consent; if a private sector organisation knows, or the circumstances indicate a reasonable likelihood, that the organisation is seeking to collect personal information from a child younger than 14, prohibit the organisation from making consent to the use or disclosure of personal information for direct marketing a condition for participation in a competition, promotion or other activity.
The OPPC and YMA thank the Commission for the opportunity to participate in the Inquiry into the Privacy Act, and ask the Commission to consider the specific issues we have raised, and the reforms to the NPPs we have recommended to resolve these issues.

consent and assent’, Adolescence, 38, 343-358, and New South Wales Law Reform Commission Issues Paper 24 (2004) Minor’s Consent to Medical Treatment.

13