(1) A marketer must not collect or use personal information in the course of marketing except for the marketing purposes of the retail supplier who is carrying out the marketing or on whose behalf the marketing is being carried out.

(2) When collecting personal information, a marketer must collect personal information directly from the person to whom it relates unless ¾

(a) the person has given written consent to the information being collected from a particular third party; or

(b) the information to be collected relates to the person's credit history.

(3) A marketer must not disclose personal information, collected by or on behalf of the responsible marketer for marketing purposes, to another person (other than a retail supplier for whom the marketing was carried out) unless ¾

(a) the person to whom the information relates has given written consent to the particular disclosure;

(b) the disclosure is required by law; or

(c) the disclosure is required for the purposes of the investigation of any suspected offence or the conduct of proceedings against any person for an offence.

(4) A responsible marketer must take practicable measures to protect personal information held by the responsible marketer from misuse, loss, unauthorised access or modification.

(5) A responsible marketer who holds personal information that relates to a person must give the person the opportunity, on request, to review the information and correct any errors in it.

(6) If a responsible marketer is prevented by law from giving a person the opportunity to review the information, the responsible marketer must give the person reasons why the person cannot review the information.

(7) A responsible marketer must keep a record of each consent given by a person for the purposes of subclause (2)(a) or (3)(a).

(8) A marketer must comply with the National Privacy Principles set out in Schedule 3 of the Privacy Act 1988 of the Commonwealth (to the extent to which they are not inconsistent with this Code).