On 1 March 2008, the Trade Practices (Industry Codes - Franchising) Amendment Regulations 2007 introduced significant amendments to the Franchising Code of Conduct (Code), particularly with regard to the disclosure obligations on franchisors.
Now that these amendments have been in place for two months, there have been a number of issues raised about how the disclosure requirements in the Code should be complied with in practice.
One issue raised by a franchisor recently was how obligations to provide details of current and former franchisees to prospective franchisees interact with any obligations under the Privacy Act 1988 (Cth) (Privacy Act).
Obligations under the Code
Under the Code, a long form disclosure document must include the name, location and contact details of the franchisee for each franchise agreement (as well as the number of franchises) transferred, terminated, not renewed, brought back or ceased to operate in the last three years.
However, a franchisor does not have to provide details of a franchisee if the franchisee has requested in writing that the details not be disclosed.
The Privacy Act
The Privacy Act applies to any entity that is an organisation as defined by the Privacy Act. An organisation means, subject to specified exemptions, an individual, a body corporate, a partnership, an unincorporated association or a trust. Relevantly for franchisors, small business operators (businesses with a turnover of $3,000,000 or less), are excluded from the definition of ‘organisation’ under the Privacy Act.
However, in certain circumstances small business operators will be required to comply with the Privacy Act. In particular, where the business provides the Commonwealth with services, is related to non-small business operators, provides/holds health information or trades in personal information.
Practically speaking, given that franchisors do not (generally speaking) trade in personal information, it is most likely that they will only need to comply with the Privacy Act where they have a turnover of more than $3,000,000 or are related to a business which has such a turnover.
Complying with Privacy Act obligations - what should franchisors do?
If a franchisor does fall within the coverage of the Privacy Act, it will need to comply with the National Privacy Principles (NPPs) which regulate the way personal information is collected, used, disclosed and handled. This means a franchisor will have to comply with the NPPs when collecting and disclosing franchisee information to prospective franchisees.
Relevantly, to comply with NPP 2, a franchisor must not disclose the contact details of a franchisee to prospective franchisees unless the franchisee has consented to such disclosure.
To comply with the NPPs and the obligations under the Code, we recommend that ‘best practice’ dictates that franchisors take the following steps when collecting and disclosing information of current and former franchisees to prospective franchisees:
- When collecting information from a current franchisee let the franchisee know what information is being kept and that the information could be disclosed to prospective franchisees in accordance with the Code. Also, have the franchisee consent in writing to the information being disclosed to potential franchisees in accordance with the Code.
- With regard to a former franchisee (who falls within the three year disclosure period), write to the franchisee indicating that their contact details have been kept on file and:
- that if they do not object, within a particular timeframe (eg 14 days), their contact details will be provided to prospective franchisees in accordance with the Code; or
- have the former franchisee sign a ‘consent form’ consenting to the disclosure of their contact/personal details and have that consent form returned.
It is important to ensure all consent forms are retained, that the information kept is accurate and up-to-date and that appropriate steps are taken to store the information securely. Franchisors should also bear in mind that in certain circumstances a franchisee may be able to access and, if necessary, correct the information which is kept in their records.