What you should know about Privacy Law in Australia – it’s changing.

And privacy law is changing around the world as well.

2023 Privacy Awareness Week was the first week of May.

Changes to Australian Privacy Law in December 2022

Privacy law is under review in Australia. In December 2022 the federal government pushed through the Privacy Legislation Amendment (Enforcement and Other Measures) Act 2022 which was tabled in response to the Optus and Medibank personal data hacks.

The legislation was rushed due to several factors. Many people are upset because the Medibank hack perpetrators released all the collected data on the dark web in November 2022. Even politicians have been affected, and they want to take action during their first term to prevent a similar data breach from occurring again.

Cynically, it also provides the government with the potential to recover a little of the budget deficit if it gets to impose penalties at the higher rate, and it is no small jump in penalties. The Australian Information (OAIC/Privacy Commissioner) will have the opportunity to test these recent changes in the law in reviewing the Latitude Finance data breach, where it was discovered that some personal information had been held on to for almost 20 years, and well past Latitude’s legitimate business needs.

The main changes to Privacy law extending the Privacy Commissioner’s powers and increasing in penalties are:

• significant increase in penalties up to $50 million – see more below;
• extension of coverage to foreign entities that carry on a commercial activity in Australia, whether or not having any other Australian link;
• provide the OAIC with greater enforcement and information sharing powers; and
• provide the Australian Communications and Media Authority (ACMA – the body responsible for regulating anti-spam compliance) with greater information sharing powers.

One practical consequence is that conduct complained about as spam could now result in investigations into how the same company manages personal information, with potentially huge penalties for non-compliance.

Privacy Review Recommendations for 2023

Earlier in 2023 the federal government was calling for submissions on the Privacy Act Review Report,  published by the Attorney-General’s Department, which makes 116 recommendations for proposed changes to the Act.    

‘Small business’ is mentioned 207 times in the Report.

Some of the changes proposed to affect small business are:

1. that the exemption for small businesses with a turnover of $3 million or less be removed;
2. that the exemption for small businesses who have obtained consent to trade in the personal information they collect, be removed;
3. that protections be extended to private sector employees (noting that many of these employees are employed by small businesses);
4. OAICs powers to issue penalty notices be extended;
5. criminal offences be introduced;
6. introduce the right of a person to sue for ‘serious invasions of privacy’ and or for a ‘serious invasion of privacy’ to be a criminal offence;
7. Introduce an express requirement in APP 5 that requires collection notices to be clear, up-to-date, concise and understandable with appropriate accessibility measures; and
8. the requirement for risk assessments to be conducted for activities ‘with high privacy risks’. 

What do Changes in Australian Privacy Law mean for Small Business?

Given the changes in technology over the last 20 years and the amount of data collected by small businesses, it is likely the exemption will be lifted because the data collected does put individuals at risk.

One of the examples used in the report referred the amount of information collected by real estate agents in receiving tenancy applications. The risks to individuals relating to the type of information collected (photo identification, earnings, bank account details etc) by real estate agents was considered sufficiently high to warrant a positive obligation on the collecting party.

It was also mentioned that the lack of understanding of data handling practices by small businesses could increase the risk of a data breach occurring.

In our experience, many small business owners have not thought about what systems they use and how that impacts the personal information they collect.

Preparing for the Removal of the Small Business Privacy Law Exemption

Small business owners need to immediately increase their knowledge and understanding of the information you collect, how you collect it, what you do with it, how long you need it, and what you do with it when you no longer need it.

This also means small business owners will need to understand your privacy policies and whether the policy accurately reflects what you do, and whether it is clear enough for your customers to understand.

This means thinking about your customer base in a new way, regardless of whether they are likely to read your policy before the purchase or wait until they have a problem.

“When was the last time you read your privacy policy?”

When the small business privacy law exemptions are removed, as a small business owner you will be exposed to the risks of penalties from the OAIC, being charged with a criminal offence or being sued by an irate customer. 

If you don’t understand how you protect personal information, take the time to review now, and understand your existing systems, or implement new systems. 

Do you know how to complete a risk assessment on the types of information you collect, 

What are the Penalties for Serious Breaches of the Privacy Act?

Penalties for serious breaches of privacy obligations have increased.

For individuals, such as sole traders and independent contractors, to a maximum of $2.5 million (from $440k).

And, for bodies corporate, such as companies and incorporated associations, from $2.22 million to a maximum of:

• $50 million
• three times the value of any benefit obtained through the misuse of information
• if the value of the benefit cannot be determined, 30% of the body corporate’s adjusted turnover (revenue in Australia) in the relevant period.

As a Small Business Owner, do I need a Privacy Policy?

If you fall within a small business exemption, then before mid-year 2023 you will not be legally required to have one. Your customers or clients might have different expectations.

Proposals for changes in legislation are under consideration in 2023. The government responded to the Optus and Medibank breaches within a few short months, with legislation that had immediate effect. It is likely that changes to small business privacy obligations with have a 6 – 12 month lead time before they become effective.

You can act now to be prepared, or wait for the last minute rush. Again, it might be worthwhile surveying your client base to find out what their expectations are of the systems you have in place to protect their privacy.

Can Small Business Owners just use template Privacy Policies?

Some business owners have a high-risk tolerance and just want to get on with business without worrying too much about compliance issues, and are more inclined to ask for forgiveness rather than consent.

Other business owners are low risk and want to get everything right before they start trading.

Most small businesses are somewhere in between.

The highest risk is copying and pasting something from a source that is not relevant to your country, or from someone else’s website without understanding the implications on your business. If you get it wrong, you can potentially create higher liability than you are legally required to, or no protection at all.

One of the most common problems with privacy policies is that people try and use them without understanding them. If a template comes from a trusted provider and mentions your local laws, and you understand it, and it reflects what you actually do in your business, then it may be appropriate for your business.

We are unable to specifically say if something is right for your business or not without reviewing your business and the terms of the privacy policy. You can book a consultation with one of our team to check any website legal terms you have in place by making an appointment.

What about ChatGPT Privacy Policies?

We have tested ChatGPT and the draft policies it generated were not 100% compliant with privacy laws of any jurisdiction. They were more geared toward the United States law.

The United States does not have a single consistent approach to privacy protection. Laws are different in each state, so there is no clear guidance on compliance, which is probably why the ChatGPT version is a bit vague.

Who Cares about Privacy Laws?

There is privacy, and then there are privacy laws.

Someone wanting privacy may be considering time away from the public eye, and no being disturbed by other people. That is not what privacy law is about.

Privacy law is not about stopping someone from stalking you on social media or keeping someone out of your home or away from your family. As much as you might sometimes like to, privacy law does not support you in telling someone to “keep your nose out of my business”.

Australian privacy law is specific to the protection of personal information.

Personal information is something that can identify you or be combined with other available information to identify you. A photo, an address, a phone number, and all the same information that some social media users freely give away when being asked to participate in a quiz to determine their Star Wars identity.

Many businesses want as much information they can get from a customer or potential customer so that they can target products or advertising to that person. The question is, is the collection of all that information necessary?

The Office of the Australian Information Commissioner completed a survey in 2020 (pre- Optus and Medibank hacks) suggesting that 70% of Australians were concerned for the use of their personal information and 87% wanted more control and choice over the collection and use of their personal information.

In addition, the recommendations for changes to privacy laws include enabling individuals to have their personal information erased, and propose giving individuals the right to sue controllers or processers of personal information for serious invasions of privacy.

It is also likely that there will be penalties for collecting more personal information than is reasonably required for the services being delivered, and for coercing people to provide personal information, such as using provisions that do not entitle someone to obtain a free quote unless they provide their name and email address.

If you worry about what is happening every time you give another business your personal information, then imagine how your customers feel. Now is the right time, before there are significant consequences for non-compliance, to consider reviewing and updating your privacy policy and procedures.

This article contains general legal information and should not be relied upon without seeking appropriate legal advice specific to your circumstances. 

What is the purpose of a restraint of trade?

Thank you to The Project & Procurement Professional Community of Practice for asking for more information on this topic.

A restraint of trade is usually requested to protect business revenue and reputation. Some areas where restraints are commonly requested are:

• where an employee is leaving a business
• where a contractor is engaged to work with a business temporarily
• where a shareholder or investor is exiting a company and they were more than a silent partner
• on the sale of a business to new owners

Restrictions on trade must be reasonably necessary and proportionate to the legitimate interests being protected. In general, for a restraint of trade provision to be enforceable, it must protect a legitimate interest, such as protecting trade secrets, confidential information, or customer relationships, and it must be reasonable in scope, duration, and geographic area.

A confidentiality agreement regarding the use of confidential information may have some of the same effects as a restraint of trade, but they are not the same thing. 

What is reasonably necessary and proportionate for a restraint of trade? 

Different types of restraint will be considered differently by the courts if a decision needs to be made about the reasonableness of the restraint. 

The parameters of a restraint need to be considered for each different type of agreement and circumstance. Restrictions on stealing clients or customers are the most likely to be enforceable. Having regard to the difficulty in attracting and retaining those clients, and the value they bring to the restraining business is what will impact the reasonableness or otherwise of a timeframe for restraint.  

For some businesses, a restraint framed in time and area is more easily applied and makes more sense. In cases where business can be conducted online with international partners, a limit by location will have no benefit. Note also that a court may be limited by its territorial jurisdiction in enforcing a restraint, so an employee leaving a job in Australia and taking up with a direct competitor in the US might only be able to be sued if they steal clients and that is what they are restrained from doing.

Employment 

Where a restraint of trade is stated to apply to an employee, then it will NOT be reasonable if it has the practical effect of stopping someone from earning a living or requires them to move away from their usual home to be able to get a job. 

How an employee restraint takes effect may be different if the person had ownership in the business. A more restrictive restraint of trade is likely to be reasonable when applied to a former owner, rather than an unrelated employee. See ‘sale of business’ below. 

Restraints on employees also must take into consideration the nature of the work completed by the employee. 

It is unlikely to be considered reasonable to attempt to restrain someone who is a barista from working in another local café. This is because the barista is unlikely to hold any unique or confidential information that could be detrimental to the original business. The barista is unlikely to control where the coffee is sourced, how it is priced, who the customers are or what the business serves in addition to coffee. 

Compare a barista with a chef. The chef may have a following of people who really appreciate their style of food and will follow them. In that case, a form of restraint might be reasonable. 

At the other end of the scale, a C-suite executive is likely to have a restraint in their contract of employment because of the nature of the work they do and the amount of knowledge they have. 

Examples of what could make a restraint reasonable (restraints don’t usually contain all) are:

Limits on time

A 6-month restraint will be more reasonable than a 5 year restraint, however, you must think about the impact on the business.  Think about the cycle of change applying to customers or clients of the business. If they come back every week, then a shorter restraint is likely to be reasonable. If they purchase products or services only once every few months, then a 12-month restraint might be reasonable. The more knowledge a person has about the management and operations of the business, and they risk that knowledge has to their competitive advantage, will also impact the length of time that is considered reasonable. 

The impact on the business to be minimised is the loss of customers. If customers purchase again getting used to working with a new member of staff, then the restraint has had the desired effect.

Limits on geography

I’ve seen people request restraints from as little as 3km to worldwide restraints. What is reasonable, will depend on the potential impact on the business. 

So, an accountant who works with clients predominantly located in Queensland, Australia, might be able to be restrained form working within a radius of their former office, but are still unlikely to be able to be restrained in the whole of Queensland. If their work is conducted in Queensland and their client base is not, then a geographical limitation might not be supportable at all, and a different type of restraint should be considered. 

Limits on contact with existing clients of the former employer

Limiting contact with existing clients and prospects is the most commonly supportable form of restraint because it is easy to demonstrate the benefit/ loss to the business. If a client that has spent $100,000 a year with their insurance broker suddenly leaves to follow the particularly broker they were working with, then that is a quantifiable impact on the broking business. 

Limits on roles or the nature of work

It would be difficult to justify a restraint on anyone who does customer facing work in retail or hospitality simply because of the nature of the work, and personal service industries like hairdressing and beauty therapy may also be challenging. Someone in general management might be restrained from working in the same industry or for a competitor, but not as a general manager and not from managements roles. 

Investors/ shareholders 

Common sense dictates that a restraint won’t stop a former investor or shareholder from purchasing shares on the share market. This is sometimes specified as a carve of from a restraint in the restraint clauses. 

A shareholder who has been involved in a startup and been involved in the initial ideation, strategy, implementation and changes required to develop the business is likely to be restrained from seeking to be involved (other than through the stock exchange) in a competing business for a period consistent with the initial development phase of that business – which might be 2 -3 years.  

Sale of business 

When buying a business, it is common to restrain the seller from competing for a period of time which reflects your investment in that purchase. If the purchase price has been based on a multiplier of the business revenue or profits, then that multiplier might also support a period of restraint. So if the business was sold for 3 x the value of the profits, then a 3 year restraint might be considered reasonable as the seller should recover its purchase price in that time frame.  

Contractors

It is difficult to restrain contractors. The nature of what they do requires a level of flexibility in what they deliver, and there is less certainty in their roles than that of employees. A contractor can be restrained from using or misusing confidential information and can be reasonably restrained from poaching clients and staff, but geographical restraints are rarely supportable. It might be reasonable to restrain a contractor from working with a direct competitor within a certain period, but that restraint will be more focused on how the use of confidential information might cause detriment to the party applying the restraint, or benefit to a future contracting partner. 

Do restraints get enforced?

It is not unusual for businesses to send cautionary or potentially threatening letters when they are of the view that a restraint has been infringed. As with any kind of dispute, most are resolved without ever going to court. There are a variety of restraint cases reported in superior courts around the country in the last ten years including:

A 2014 Queensland Supreme Court case involving an ophthalmologist who sold his Rockhampton practice to a publicly listed company. 

The restraint provision was held to be reasonable only in prohibiting the doctor from poaching clients or offering services to clients of the business he sold.

The court found the restraint unreasonable where it attempted to restrain the doctor from working as an ophthalmologist within any of the decreasing radii of 20, 15, 10, 5 or 2 kilometres of a clinic owned by the buyer, or him being employed by a competitor. It was also considered unreasonable to attempt to stop the doctor from attempting to poach employees from the buyer.  

 The reasonableness of the restraints in this case is impacted significantly by the standing of the buyer and might have been considered reasonable if the buyer was another small business owner. 

A 2020 ACT Federal Court case involving a restraint against a shareholder of a financial planning business. 

In that case the “restraint provisions were clearly the work of lawyers, each with one eye on drafting the greatest possible protection for the applicants and with the other eye firmly shut to the limits that the law places on such restraints by requiring them to be the least necessary to protect the applicants’ interests in the business of New Civic. The result is restraint provisions that are impossibly convoluted and complex and unjustifiably broad” and therefore unenforceable.

Can there be compensation offered in exchange for agreeing to a restraint?

Yes, it is possible for compensation (payment) to be offered in exchange for agreeing to a restraint of trade provision, which can be used as a way to “sweeten the deal.” However, the enforceability of such provisions and the compensation offered will depend on various factors, including the reasonableness of the restraint and the specific circumstances of the agreement.

The amount of the payment should have a direct correlation to the reasonableness of the restraint. So, if an executive is to be broadly restrained for 12 months in a way that impacts their ability to seek other employment, reasonable compensation for that restraint might be the equivalent of that person’s annual wage. However, the specific circumstances, the scope and duration of the restraint, and the legitimate interests being protected will all still need to be considered in determining the reasonableness of a restraint. It may still be challenged in a court. 

Unless a restraint has been written into an agreement, such as an employment agreement, at the start of employment and therefore agreed in advance, an employer must offer some form of consideration for that restraint to form a binding and enforceable contract. Compensation offered as consideration can include monetary payments, shares, benefits, or other forms of value.

However, it’s important to note that even if compensation is offered, a restraint of trade provision may still be found unenforceable if it is found to be unreasonable or against public policy. 

It’s recommended to seek legal advice from qualified professionals when drafting or entering into agreements containing restraint of trade provisions and compensation arrangements in Australia to ensure compliance with applicable laws and regulations.

What type of action could be taken against somebody if they were to breach the restriction?

A breach of a restraint provision is usually challenged as a breach of contract in superior court. Depending on the way in which the claim is stated, it may be open to the court to make orders such as:

An injunction
A court order that requires the person who breached the restraint to stop the prohibited activity. Injunctions can be sought to prevent further breaches of the restraint and to protect the legitimate interests of the party seeking enforcement.

Damages
The party seeking to enforce the restraint may also seek damages, which are monetary compensation for the losses suffered as a result of the breach. Damages may be awarded to compensate for financial losses incurred due to the breach of the restraint, such as lost profits or other damages directly resulting from the breach.

An account of profits
In some cases, the party seeking to enforce the restraint may seek an account of profits, which requires the person who breached the restraint to account for any profits they have gained due to the breach. This can be a remedy to prevent unjust enrichment by the person who breached the restraint.

Specific performance
In certain circumstances, the party seeking to enforce the restraint may seek specific performance, which is a court order that requires the person who breached the restraint to fulfill their obligations under the restraint. This may be sought when damages are not an adequate remedy or when the party seeking enforcement wants to ensure compliance with the terms of the restraint.

Could a restriction of trade be seen as anti-competitive?

It is more likely that a court will consider a restraint provision to be unreasonable if it has the effect of limiting competition, rather than reviewing the restraint under competition law. This will depend on how a claim is structured when made to the Court. 

If mutually agreed by all parties, could the restriction be waived or amended?

Any contractual provision can be waived or amended by later mutual agreement between parties. 

This article contains general legal information and should not be relied upon without seeking appropriate legal advice specific to your circumstances. 

Distributor Agreements

As a small business operator in Australia, entering into a distribution agreement can be a beneficial way to expand your reach and increase sales. Distribution agreements are contracts between two parties where one party agrees to distribute the products or services of the other party in a particular territory or market. They are contracts that define the terms and conditions under which a manufacturer or wholesale supplier allows a distributor to sell or distribute its products. These agreements provide a framework for the relationship between the parties involved, including the roles, responsibilities, and obligations of each party.

For small business operators such as software providers or trade supply wholesalers, distribution agreements are particularly critical, as they provide a means of expanding their reach and increasing their customer base. They outline the terms and conditions under which the distributor is authorised to sell or distribute the manufacturer’s products. These agreements typically cover a wide range of issues, including pricing, payment terms, delivery schedules, marketing and advertising, and territory restrictions.

Key Terms in Distribution Agreements

Before we delve into the specifics of distribution agreements, it’s essential to understand the key terms that are commonly used in these agreements. The following terms are some of the most important ones:

1. Territory: This refers to the geographic area in which the distributor is authorised to sell the products or services. This will be particularly important to define when distributors use online marketing channels. 
2. Products: This refers to the products or services that are being distributed.
3. Term: This is the length of time that the distribution agreement will be in effect.
4. Minimum purchase requirements: This is the minimum amount of products that the distributor is required to purchase during a specified period. 
5. Exclusivity: This refers to the exclusive rights granted to the distributor to sell the products or services in the specified territory. Not all distribution agreements are exclusive. 
6. Termination: This refers to the circumstances under which the distribution agreement can be ended.
7. Intellectual property: This refers to the ownership and use of any intellectual property, such as trademarks and copyright, associated with the products or services.

Why are Distribution Agreements Important?

Distribution agreements are essential for several reasons. Firstly, they provide a legal framework for the relationship between the parties involved, including the roles and responsibilities of each party. This helps to ensure that both parties are clear on what is expected of them and what they can expect in return.

Secondly, distribution agreements can help to protect the interests of small business operators. By defining the terms and conditions of the relationship, they can help to prevent misunderstandings, disputes, and legal issues down the track. This is particularly important for small business operators who may not have the resources to fight protracted legal battles.

Finally, distribution agreements can help small business operators to expand their reach and increase their revenue. By partnering with distributors, they can reach new markets and customers, without having to invest significant resources in marketing and advertising.

Important Considerations for Small Business Operators

As a small business operator, there are some critical considerations you should take into account when negotiating a distribution agreement. These include:

Territory 

It’s important to define the territory clearly in the agreement to avoid any ambiguity. This will ensure that the distributor understands their specific rights and obligations within the designated area and there is no overlap with other distributors. 

Where distribution can be promoted online, particularly through platforms like Facebook, it is important to be clear about what distributors can and cannot do, and what happens if a purchaser falls within a different territory. 

Minimum Purchase Requirements

Be careful when setting minimum purchase requirements. The requirements should be reasonable and take into account the distributor’s ability to sell the products or services in the designated territory. A failure to meet a minimum can be a trigger for ending the contract. 

We’ve had a client in the past who was responsible for maintaining a minimum order on a product imported from overseas. Once COVID hit, the demand for their product decreased and they were in breach of their agreement. The manufacturer provided leeway in the circumstances but has declined to provide an exclusive distribution agreement going forward, which means our client’s business is now of little value for future sale, as a competitor can now import the same thing. 

Pricing and Payment Terms

Another important consideration is pricing and payment terms. This may be affected by which party holds stock pending sale. A manufacturer will usually want their production costs covered before allowing product to leave the warehouse, but a distributor may not be required to pay the full wholesale cost until the point of sale. The timing and method of payment, as well as any penalties for late payments or failing to meet minimum order requirements, need to be sufficiently clear that an independent third party (not necessarily an accountant) can work out what needs to be paid, and when just from reading the contract.

Marketing and Advertising

Marketing and advertising are critical to the success of any distribution agreement, and distributors are usually selected on the basis that they have an existing market that will purchase the product. Small business operators need to ensure that the distributor has a clear understanding of their products and target market and that they have the resources to market and advertise the products effectively. 

For online retailers, influencers are like distributors. They have an existing market, and that market likes specific products and expects to hear about them from the influencer. 

Exclusivity

Small business operators should carefully consider whether or not to grant exclusivity to the distributor. While exclusivity can provide the distributor with a competitive advantage, it can also limit the wholesaler’s ability to enter into agreements with other distributors in the same territory. If a distributor has exclusivity but is failing to meet minimum orders, then it may be possible to renegotiate terms to reduce their territory to open an area up to another distributor.  

Termination

Termination provisions in the agreement must be clear and reasonable. This will help to avoid any disputes or legal issues if the agreement is terminated. An area that is often overlooked is the right of the manufacturer or wholesaler to revoke the distribution rights in circumstances with the distributor could bring the manufacturer into disrepute. For example, if a business decides to publicly support a particular viewpoint – eg. Margaret Court opposed the Australian same sex marriage bill and Qantas publicly supported it – and the wholesaler does not agree with that viewpoint and believes it will cast them in a poor light, then the wholesaler should have the right to end the distribution agreement. 

Intellectual Property

Small business operators should be clear about their intellectual property rights and how they will be protected in the distribution agreement. The most common thing to be protected is usually a brand. There should be rules around how it can be used and displayed. It should also ensure that only legitimate products are sold and not counterfeits. 

Tips for Negotiating Distribution Agreements

Negotiating distribution agreements can be challenging, whether you represent the wholesaler or manufacturer, or represent the distributor. Here are some tips to help you negotiate a fair and beneficial agreement:

Understand Your Market

Before negotiating a distribution agreement, it’s essential to understand your market and the potential demand for your products or services. This will help you to determine the appropriate territory and minimum purchase requirements.

Be Clear About Your Expectations

Be clear about your expectations regarding sales targets and marketing efforts. This will help the distributor to understand what is required of them and ensure that both parties are working towards the same goals.

Seek Legal Advice

It’s important to seek legal advice before entering into a distribution agreement. A lawyer can help you to understand the terms of the agreement and ensure that your intellectual property rights are protected, as well as making sure that any termination provisions are balanced and realistic. 

Negotiate The Terms

Don’t be afraid to negotiate the terms of the agreement. Small business operators should be willing to compromise, but they should also ensure that the agreement is fair and beneficial to both parties.

Review The Agreement

Once the agreement has been negotiated, it’s essential to do some worked examples of what the terms provide so that all parties are happy the agreement meets their expectations. It is also important to ensure there are no unfair contract terms which could affect the enforceability and profitability of the agreement. 

Distribution agreements are useful for small business operators and work well for businesses such as software providers or trade supply wholesalers. These agreements provide a legal framework for the relationship between a manufacturer or wholesale supplier and a distributor, defining the terms and conditions under which the distributor is authorised to sell or distribute the products. You need to carefully consider the distribution territory, pricing and payment terms, marketing and advertising, exclusivity, and term and termination when entering into a distribution agreement. By doing so, the manufacturer or wholesale supplier can protect their interests and expand their reach, increasing their revenue and success in the market.