Samantha Yorke, IAB Australia’s director of regulatory affairs, is here to answer your questions about regulatory issues affecting online advertising including self regulation, consumer privacy and online behavioural advertising, advertising standards and media convergence.

To submit a question for Sam, email [email protected] (your personal data will be de-identified before publishing).

Q: What are the key regulatory issues marketers need to watch in 2013?

There are three big issues marketers need to keep on top of. The first is around the Privacy Act reforms that will be implemented in the second half of 2013. These reforms will see a focus on information which about an individual who is ‘reasonably identifiable’ which will make the concept of personal information a little harder for marketers to ring-fence away from anonymous or de-identified data. Australian businesses will also need to look out for increased liability if they transfer personal information internationally (eg. using an offshore cloud storage solution).

The second issue will be around the increasing collection and use of anonymous or de-identified ‘behavioural’ data. Discussions around who owns and controls this data will become interesting and more pointed, particularly given how many sets of hands the data is passing through these days and how valuable this data is becoming. This is one of the issues that the IAB is working on right now and marketers who are interested in getting involved in developing best practice guidelines for site tagging, data usage and control, and ad exchanges and networks should get in touch with us.

The final big issue will be around ensuring that industry self-regulatory efforts continue to grow next year. Expect to see ongoing development of industry guidelines, as well as industry promotion of the benefits of more relevant and personal experiences for online users. We plan on clearly demonstrating that our industry is responsible and accountable for our business practices.

Q: If our business collects anonymous or behavioural data is this regulated by the Privacy Act?

Strictly speaking, it’s not. The Privacy Act regulates the collection and use of personal information or information which can be used to ‘reasonably identify’ an individual. If you are only collecting anonymous behavioural or analytics data, you can safely assume that this data will not fall within the scope of the Privacy Act. However, that’s not to say that anything goes.

If you collect data from websites other than your own we recommend that you comply with the cross industry best practice guideline for online behavioural advertising which was developed last year by the Australian Digital Advertising Alliance. The guideline includes recommendations around being transparent with consumers about what data is being collected and what use it will be put to and giving consumers choice about whether they want to receive online behavioural advertising.

Q: Our business uses social media platforms – should we be worried about the recent determination by the Advertising Standards Board that user generated comments are part of an ‘advertising or marketing communication’?

The ASB does not look to the law when they make their determinations; rather, they look to the advertising self-regulatory codes and community standards for guidance. In fact, the law does not impose blanket responsibility upon businesses using social media for all of the user generated comments that are posted on their pages/channels and your risk is therefore reputational rather than legal. However the upshot of the ASB determinations with respect to the Smirnoff and VB pages is that brands are responsible for all user comments on their branded social media pages and therefore should take responsibility for proactively moderating all user comments or risk being the subject of a complaint to the ASB.

No doubt many of you are already keeping a close eye on your social media channels and may even be investing in internal or external moderators to ensure that any offensive or brand threatening posts are promptly removed. Our view is that businesses should have commercial discretion to develop, and then flexibility evolve, their risk-management strategies in accordance with their business reputational risk threshold as some will have a higher threshold for controversy than others.

Of course it is good business practice to moderate your presence on social media but there are practical considerations you will need to weigh up as well. How many user comments does your Facebook page or YouTube channel generate? How do you deal with spikes in volume given finite resources? How do you manage abuse at night or over the weekend? What is an appropriate response to an offensive or inaccurate user post – ignore it, respond to it, delete it, ban the user? What about borderline examples where a user is simply expressing an opinion or point of view? How can you employ technical tools to assist in managing user comments?

There are a lot of variables here and we disagree with the ASB’s decision to impose a one-size-fits-all approach to moderation as the potential for different approaches to these challenges will vary dramatically depending on the business and what you are seeking to promote.

IAB Australia advocates that the starting point of any deliberation is that user comments are not part of an advertising or marketing communication, unless a specific problematic comment has been endorsed or responded to by the business as this indicates awareness and arguably acceptance of the comment. We welcome your support in our efforts to raise awareness of these issues and our position.

Q: We are investigating mobile marketing and advertising for our 2013 programs – are the privacy implications any different?

There are two key areas you need to consider – advertising within apps and location based advertising can involve advertising based on a user’s proximity to a location (such as a restaurant offering a discount voucher) or advertising which is served based on a user’s physical whereabouts either at that time or in the past (eg. delivering car ads to a user who has recently visited a car showroom). In both areas there are no hard and fast legal requirements but there are some good practices that you should definitely adopt.

Firstly, be honest about what you are doing – it pays to be upfront and clear about what data you are collecting and for what purpose. The more you inform users of your data collection practices the more they will trust you with their data. Secondly it’s critical that you obtain consent to use a person’s current location for the purpose of delivering relevant content. The permission model used by most apps that rely on geolocation is often held up by privacy advocates as a great example of contextual consent (ie. asking for permission in the moment that you need to determine location).

Finally, you should ensure that users have the ability to change their mind if they decide they want to retract their consent for you to use their location. This can typically be done through the device’s operating system settings.

Do you have a legal or regulatory affair question about online, mobile or video advertising for IAB Australia? Samantha Yorke, Director of Regulatory Affairs will be happy to help. Just email [email protected]