Cyberspace Law materials – Consumer Protection
1.	Consumers and Technology
2.	Trust and Confidence
3.	Case Study: Online Financial Services
3.1.	Complexity of Products
3.2.	Online Calculators
3.3.	Independence
3.4.	Disclosure
3.5.	Identification
3.6.	Complaints
3.7.	Privacy
3.8.	Access and cost
3.9.	Jurisdiction
3.10.	Terms and Conditions
4.	Policy Framework
4.1.	Contract
4.2.	Payment
4.3.	Conduct
5.	Legislation
5.1.	Consumer Credit Code
5.2.	Trade Practices Act
6.	Australian Codes of Conduct
6.1.	EFT Code of Conduct
6.2.	Smart Card Code
6.3.	Telecommunications Codes
6.4.	Internet Industry Association Code of Conduct
6.5.	Australian Direct Marketing Association (ADMA) Industry Code of Practice
6.6.	The Model Code
7.	International regimes
7.1.	EU Directive
7.2.	OECD Guidelines
8.	Conclusion

 
1.	 Consumers and Technology
There is something of a divergence between business views on new technology and consumer views on new technology.
The business view concentrates on the benefits of new technology - the convenience, the speed, the ability to manage customer relationships in new ways, and of course the efficiency that new technology will deliver to work processes, thus reducing costs and increasing profits.
The consumer view is often less swept up in the hype of new technology, and includes concerns about privacy and security risks, whether or not new technology will be affordable to all consumers, whether or not traditional legal rights will be eroded, and the impact of new technology on traditional services.
If there is room for agreement it usually centres around the notion of trust and confidence. That is, consumers want to use technologies that they can trust, and businesses want consumers to have the confidence to try new technology services and products.
How do we achieve trust and confidence in new technology electronic commerce like smart cards, online broking and Internet shopping?
2.	Trust and Confidence
It appears that trust and confidence can be won in a number of ways. Some businesses simply offer money back guarantees for emerging technology. This is quite common in Internet shopping and some online payment systems in the United States.
For example, the Powells online bookstore provides the following guarantee:
We're confident that our security system is the best in the business, and you should be, too. That's why we guarantee that every transaction you make at Powells.com will be 100% safe. If unauthorized charges are made to your card as a result of shopping at Powells.com, you will pay nothing. (http://www.powells.com/info/security.html) 
American Express (http://www.americanexpress.com) also guarantees all transactions made online using an American Express credit card. However, they announced in May 2000 that they will no longer provide American Express merchant facilities to online providers of adult content, as customers of those sites were disputing too many charges to their accounts. 
Other businesses have decided to win trust and confidence by signing up to a ‘seal’ or ‘tick’ program. These seals appear on products or websites and provide certain assurances that the seal can only be displayed by organisations which adhere to strict privacy principles and security measures, and perhaps are audited on a regular basis against privacy and security criteria. See for example the Internet Industry Association’s (IIA) Family Friendly ISP Seal (http://www.iia.net.au/index.php?option=com_content&task=view&id=416&Itemid=9#ff_seal ). 
It is unclear how useful these seals and ticks are in practice. There may be no redress for consumers who choose to use sites carrying the seal but are later disappointed. The seals themselves are not backed up by privacy or consumer protection laws, especially in the United States. There is an argument that a failure to abide by the principles behind a seal could lead to a claim that the organisation had engaged in misleading or deceptive conduct, thereby breaching trade practices laws. However, this argument is untested and will be an impractical solution for many consumers (see “From Privacy to Portals: Implications for Seals of Assurance”, Allan Asher Deputy Chairperson ACCC, 24 November 1999. http://www.accc.gov.au/content/index.phtml/itemId/102189 ). 
Some seal programs also provide a dispute resolution process, which is certainly preferable for consumers. However, the many inconsistencies between the various seal programs operating today mean that trust and confidence in electronic commerce as a whole has probably not been greatly helped by seal programs alone.
An additional option for improving trust and confidence in electronic commerce is to provide detailed information about the policies and procedures behind a product or service. 
This approach to delivering ‘transparency’ is most useful when it is provided as a complement to some other form of guarantee or seal. Again, American Express has backed up its ‘guarantee’ with detailed information about its privacy policies, use of cookies, security arrangements and information processes. See: http://www.americanexpress.com/corp/consumerinfo/consumerfaqs.asp  
For a good Australian example of a complicated electronic commerce service which is trying to provide transparency to consumers, see the privacy policy and other documents at: http://ninemsn.com.au/support/privacy.asp.
The banks in an effort to gain consumer trust and confidence operate under a loose rule sometimes known as the 120 day rule. The rule states that where a credit transaction is effected without any signed documentation and the bank cannot obtain payment from the customer within 120 days after the transaction was allegedly effected, the merchant must repay the money previously paid to it by the bank plus any administration costs incurred by the bank. The bank will generally obtain redress from the merchant and it is for the merchant to prove the transaction against the customer. 
Of course, an alternative way to provide trust and confidence in electronic commerce is to be able to point to a regulatory structure that provides appropriate privacy and consumer protections. It is this last option which is explored in sections 5 and 6.
3.	Case Study: Online Financial Services
It is useful at this point to consider one particular aspect of electronic commerce - online financial services - and examine what consumer issues arise and how they might be dealt with in law or self-regulation. 
Some specific consumer issues that arise for online financial services are:
3.1.	Complexity of Products
Most online financial services are not as simple as checking the news or weather online, or buying a book or CD online. The products themselves are extremely complex - online mortgage applications, online banking, online broking, electronic payment systems etc. The complexity of these products raises consumer issues because the element of human interaction and explanation which usually accompanies these products may be missing.
3.2.	Online Calculators 
Many online financial services include access to online calculators. These tools are used to predict repayments, compare competing products, or estimate the future value of investments. Obviously these tools are extremely useful, but they lead to opportunities for abuse. Some sites have taken the opportunity to ‘fiddle’ with the calculators so that the results are always skewed towards particular products - those which will earn the promoters higher commissions. Other sites always seem to be out of date when comparing competitor’s products, when it is to the promoter’s advantage. 
3.3.	Independence 
There has been a trend to re-brand certain financial services and products for the online marketplace, and an attempt to promote some online financial services as independent - especially where sites provide comparative tables or broking services. However, claims of independence can be misleading in many circumstances, and it is important to know who owns or backs financial services being offered online. 
3.4.	Disclosure 
The jury is still out on whether or not disclosure can be effectively performed via electronic means. The key regulator - the Australian Securities and Investments Commission has taken the view that disclosure can be permitted online (rather than requiring face to face disclosure or the provision of hard copy documents), however it will keep a close watching brief on developments and issue specific guidance for some products. (For example, guidance is available for the disclosure requirements if superannuation is to be sold online: http://www.asic.gov.au.) 
Naturally, a range of generic consumer issues in electronic commerce also apply to online financial services:
3.5.	Identification 
How can consumers identify the business? Does the ACN/ABN appear on the website? Is there a physical address? It is important for consumers to be confident that online stores and service providers are not shams, and that any consumer complaints can be followed up with a physical business. Consumers are also advised to check ACNs of some companies, especially those selling investment products.
3.6.	Complaints 
Does the service have a dispute resolution mechanism and belong to an external dispute resolution scheme? As we will see below, there is no generic dispute resolution scheme for Australian companies trading online. However, many telecommunications companies, Internet Service Providers and financial services organisations will belong to established dispute resolution schemes.
3.7.	Privacy 
Does the organisation provide protection of consumer’s personal information and have a privacy policy? A 2000 survey of the 100 most poplar websites visited by Australian consumers found that although 72% of the sites collected personal information, only 51% had a published privacy policy and only 28% of those sites notified their users about the specific personal information being collected (Anderson Legal / Arthur Anderson Internet Privacy Survey 2000 http://www.iia.net.au/files/IIA/Task%20Forces/Privacy/aasurvey.PDF The current privacy regime created under the Privacy Act 1988 (Cth) (http://scaletext.law.gov.au/html/comact/6/3324/top.htm) and its various amendments is the chief instrument for protecting consumer privacy, it is discussed in detail in the Privacy Course Materials. 
3.8.	Access and cost
Can all consumers gain affordable access to this service? What impact will the provision of this service online have on traditional services? Many of these issues have now been rolled up in a debate about what has become known as the “digital divide”. A recent study by the National Centre for Social and Economic Modelling and the Communications Law Centre found that the main barriers to Internet access in Australia were education and income, and that geographical location was less relevant than previously thought. So affordable access will remain a key consumer issue in electronic commerce (http://www.natsem.canberra.edu.au). Access issues are of course looked at in greater detail in the Access Course Materials.
3.9.	Jurisdiction 
What is the applicable law of any transactions entered into with this service? Will consumers be able to resolve a dispute with the service in their own jurisdiction? This issue may act as a significant deterrent for some consumers considering using electronic commerce involving a foreign party. Consistent with current common law rules, the place of formation of an electronic contract is the place where the offeror receives acceptance of the offer (Brinkibon Ltd v Stahag Stahl GmbH (1983) 2 AC 34). Therefore, the court that will have jurisdiction over an electronic contract dispute will be the court that has jurisdiction in the location where acceptance of the offer was received. 
3.10.	Terms and Conditions
Are there plain language terms and conditions available and do they reduce or enhance the rights of consumers? Is there fine print that consumers should be concerned about?
The combination of these specific and generic issues shows how quickly consumer confidence and trust in electronic commerce can be eroded. Let’s now turn to the response to these issues in Australia.
4.	Policy Framework
More by luck than planning Australia has developed a reasonably effective policy framework for dealing with consumer issues in electronic commerce. Despite the lack of overall coordination, several government agencies and regulators have developed effective tools for protecting consumers online. In the future, coordination of these activities may be better coordinated through the creation of the Australian Government Information Management Office (AGIMO), which has recently been given a stronger role in this area (http://www.agimo.gov.au/). See also older publications from the National Office of the Information Economy (now merged into AGIMO) (http://www.noie.gov.au). 
All electronic commerce can be broken down into three key consumer issues - the formation of a contract, the payment for goods or services, and the conduct of the organisation providing the good or service (both before and after a sale). Each of these issues are discussed below:
4.1.	Contract 
Any agreement to make an online purchase or use an electronic commerce service requires the formation of a contract. Contract law was initially developed around certain requirements for hard copy documents, writing and in some cases witnessing. These concepts are not so useful when the transaction is to take place via electronic communication between two parties who may never share the same physical location. A reasonable compromise in recent years has been for contracts to be entered into through the exchange of hard copy documents, and many electronic commerce services still require some element of hard copy documentation today.
However, for electronic commerce to take full advantage of the speed and convenience delivered by new communication technology, full electronic contract formation must be possible.
At the international level, UNCITRAL (The United Nations Commission on International Trade Law) has developed model provisions for the formation of electronic contracts and the recognition of digital signatures (http://www.uncitral.org). This development is mirrored in Australia by the passage of the Commonwealth Electronic Transactions Act 1999 (http://scaletext.law.gov.au/html/comact/10/6074/top.htm) and the development of mirror legislation in each state. The Act forms the first step in ensuring consumer confidence in electronic commerce, however only has limited application in that it deals solely with transactions by consumers with government departments. These developments are not discussed in this topic but more information can be obtained from the E-commerce Course Materials.
4.2.	Payment
The second vital step in ensuring consumer confidence in electronic commerce is to deal with consumer concerns arising from the use of electronic payments systems. This has been one area in which there is a definite degree of consumer hesitancy. While there is a proliferation of alternative online payment systems at the trial or early roll out stage, the use of credit cards has remained dominant.
Developments in Australia regarding the regulation of payment systems are discussed in detail in section 6.1. on the revision of the EFT Code of Conduct.
4.3.	Conduct 
Once you have formed a contract and sorted out the payment, the only outstanding issue is the conduct of the organisation providing the goods or service. Will the goods actually arrive? Will advertising be misleading? What will happen to a consumer’s personal information?
In Australia, the issue of conduct is dealt with through the development of industry codes of conduct, such as the Internet Industry Association (IIA) Codes of Practice (http://www.iia.net.au/index.php?option=com_content&task=section&id=3&Itemid=33). There is an additional layer of guidance provided by the Model Code (The Model Code is actually titled “Building Consumer Sovereignty in Electronic Commerce – A Best Practice Model for Business”. http://www.ecommerce.treasury.gov.au/bpmreview/content/DiscussionPaper/01_Summary.asp). These developments are discussed in greater detail in section 6, and the IIA Codes are also discussed in section 6 of the Content Regulation Course Materials.
Note that privacy is a specific consumer issue which arises within each of the above fields - contract, payment and conduct. Privacy issues are discussed in detail in the Privacy Course Materials.
With these three policy settings in place, consumers can be reasonably confident in engaging in electronic commerce. However, as we will see, the devil is in the detail. For payment systems and business conduct we have to rely heavily on codes of conduct, many of which are unsatisfactory, and some of which only exist in theory.
5.	Legislation
5.1.	Consumer Credit Code
The Uniform Consumer Credit Code applies to credit purchases generally, and is not restricted to electronic transactions. Consumers who purchase goods or services or other things using credit are protected under the Consumer Credit Code 1996 (http://www.legislation.qld.gov.au/LEGISLTN/CURRENT/C/ConsumCredCode.pdf). Despite what the title suggests, the Code actually is a legislative instrument, it operates Australia wide and each State has enacted mirror legislation (e.g. Consumer Credit (NSW) Act 1995 (NSW) (http://www.austlii.edu.au/au/legis/nsw/consol_act/ccswa1995346/index.html).  
The Credit Code will regulate a credit transactions when a consumer uses the credit for household or domestic purposes, the period for repayment exceeds 62 days and there is a charge made for the provision of credit (e.g interest). In most cases the Credit Code regulates credit cards, home loans, personal loans and also regulates associated mortgages and leases.
The most important consumer protection aspects of the Credit Code are: 
•	the disclosure requirements in the pre-contract and contract documentation; 
•	the disclosure requirements in the statements of account; 
•	mechanism for disputing liabilities entered on a consumer’s account; 
•	standards for advertising; 
•	the contract variation provisions on the grounds of consumer hardship; 
•	the unjust contract provisions which enable contracts to be re-opened; 
•	the notice provisions in relation to default and regulation of enforcement; and 
•	the provision which, in certain cases, make credit providers liable for the misrepresentations of suppliers of the goods or services bought on credit. 
More information about the Code can be obtained from its website – http://www.creditcode.gov.au, and the following factsheets – http://www.moneymanager.com.au/tools/factsheets/credit_code.html and http://www.oznetlaw.net/facts.asp?action=content&categoryid=216 (Part B).
5.2.	Trade Practices Act 
In Australia, the Trade Practices Act 1974 (Cth) (TPA) generally applies to corporations rather than individuals. It will apply to individuals who are engaging in interstate trade or commerce or aiding or abetting a breach of the Act by a corporation. The actions of individuals are otherwise covered by equivalent State or Territory trade practices legislation (e.g Fair Trading Act 1987 (NSW) (http://www.austlii.edu.au/au/legis/nsw/consol_act/fta1987117) and the Sale of Goods Act 1923 (NSW) (http://www.austlii.edu.au/au/legis/nsw/consol_act/soga1923128).  
If an organisation is incorporated in or carries out business within Australia it is bound by the trade practices legislation. Breach of the trade practices legislation by a corporation or individual may result in significant fines and in some cases criminal liability. The TPA defines a consumer as a purchaser of goods or services for less than A$40,000 or if the price exceeds A$40,000, where the goods or services are of a kind ordinarily acquired for personal, domestic or household use or consumption (s 4B).	
The TPA impacts on the Internet in the following areas: 
•	Implies terms and warranties into certain transactions – the TPA implies into all consumer contracts a number of non-excludable conditions and warranties including that goods are supplied with a matching description (s 70); of merchantable quality (s 71(1)); fit for purpose (s 71(2); and, any warranty of services will be rendered with due care and skill (s 74(1)). Any term of a contract that has the effect of excluding, restricting or modifying rights or liability under these implied terms will be void.
•	Prohibits unconscionable conduct and contracts – generally unconscionable conduct occurs whenever one party to a transaction is at a special disadvantage in dealing with the other party because of illness, ignorance, inexperience, impaired faculties, financial need or other circumstances affecting their ability to conserve their own interests, and the other party unconscionably takes advantage of this opportunity (Blomley v Ryan (1956) 99 CLR 362 per Kitto J (at 415) (http://www.austlii.edu.au/au/cases/cth/high_ct/99clr362.html)). Whether a Court will identify conduct as unconscionable will depend on all the circumstances of the case. 
•	Prohibits misleading or deceptive conduct – with regard to the Internet, it may be misleading or deceptive conduct where a consumer is or is likely to be mislead or deceived by a statement on the website or if it is unclear when you connect from one website to another. The use on websites of internal and external links, frames, metatags, the location and prominence of disclaimers and content generally must not be misleading or deceptive to the extent goods or services of A are passed off as those of B. Misleading and Deceptive conduct is prohibited under s 52 of the TPA.  
6.	Australian Codes of Conduct
There are numerous codes of conduct which have some relevance to consumer protection in electronic commerce. Many of the specific industry codes, such as the Code of Banking Practice, will have electronic commerce implications in that particular niche. However, there are several codes of conduct which stand out as the most relevant:
•	EFT Code of Conduct;
•	Smart Card Code of Conduct;
•	Telecommunications Codes;
•	Internet Industry Association Code of Conduct;
•	Australian Direct Marketing Association (ADMA) Industry Code of Practice; and
•	The Federal Government’s ‘Model Code’.
6.1.	EFT Code of Conduct 
The Electronic Funds Transfer Code of Conduct (http://www.asic.gov.au/fido/fido.nsf/byheadline/Electronic+Funds+Transfer+(EFT)+Code+of+Conduct?openDocument) is the main regulatory instrument in Australia for providing consumer protection in electronic payment systems. However the pre-2001 Code is limited in scope because it contained a technology specific definition of which transactions were within the Code’s jurisdiction:
Transactions intended to be initiated by an individual through an electronic terminal by the combined use of an EFT card and a personal identification number (PIN).
The Code was therefore the subject of a lengthy review, chaired by the Australian Securities and Investments Commission (ASIC). The EFT Code review working group issued two discussion papers and a final version of the revised Code was published on April 1, 2001. All available at http://www.asic.gov.au  
The revision of the Code was intended to ensure that an up to date, technology neutral Code will be in place for all electronic transfers of value. The review did not consider all of the issues faced in electronic payment systems, and specifically “set aside” certain contentious issues for separate discussion in order not to hold up the Code review further. The most notable of these issues set aside was the requirement for the disclosure of the costs of an electronic transaction at the point of sale. 
The revised EFT Code covers any business to consumer electronic transfer of value. Business to business electronic transfers of value will be excluded where the product being used was intended primarily for business use.
An ‘electronic transfer of value’ includes coverage of credit cards in some circumstances, but not where a signature is obtained. It certainly includes EFTPOS, ATM transactions, most Internet and telephone banking transactions, direct debits and direct transfers.
Stored value products, such as electronic purses and stored value smart cards, are now included in a new section of the Code - Part B.
Specific requirements of the Code include:
•	Terms and conditions must be provided to consumers;
•	Records of transactions must be available to consumers;
•	Audit trails must be kept;
•	Privacy provisions mirroring the new federal privacy legislation for the private sector must be complied with, plus some specific EFT industry privacy guidelines; and
•	Complaint investigation and resolution procedures must be in place.
Of course, the most important section of the existing EFT Code was the section apportioning liability for unauthorised transactions. This section has been completely updated and revised, and includes coverage of:
•	access methods;
•	security and disguise of codes;
•	contribution to loss;
•	fraud and negligence;
•	lost and stolen cards or devices; and
•	system or equipment malfunction.
While the EFT Code has always been voluntary, it has in the past been a very successful and popular code with both business and consumers – and has achieved a very high rate of industry coverage.
More information about the general provisions of the EFT Code can be obtained from ASIC webpage cited above and Part D of the OzNetLaw Consumer Protection factsheet – http://www.oznetlaw.net/facts.asp?action=content&categoryid=216. 
The code was reviewed again, in 2007. The review is published at (http://www.asic.gov.au/fido/fido.nsf/lkuppdf/FIDO+PDFW?opendocument&key=eft_review_2007_pdf). The recent review aimed at resolving several key issues, including:
•	The applicability of the code to small business.
•	Consumer rights to exchange and refund stored value items.
•	Mistaken payment issues. 
•	Ways to broaden membership of the EFT code
•	The process for monitoring code compliance.

6.2.	Smart Card Code
Despite the likely comprehensive coverage of electronic payment systems by a revised EFT Code of Conduct, there is one other Code which is relevant in this field. The Asia Pacific Smart Card Forum Code of Conduct (http://www.smartcardforum.asn.au/code.htm)**BROKEN LINK, FOUND REFERENCES TO CODE ONLINE THOUGH NO SITE HOSTING IT – suggest deleting link, keeping references** was first envisaged in 1995 and published in 1997. It remains the world’s only comprehensive smart card code of conduct, and about 70 organisations have signed.
The Code serves three functions. The first is to provide a Code for members of the Smart Card Forum where no industry specific code is developed. The second is to provide minimum standards which must be observed in industry specific codes. The third is to provide the basis upon which Code Subscribers can use a ‘compliance logo’.
The Code is voluntary and is administered by a small code advisory committee and a sanctions committee. It contains:
•	Privacy provisions;
•	Security provisions;
•	Access and correction rights;
•	Special requirements for terms and conditions;
•	Provisions for loss and misuse of cards;
•	Provisions regarding advertising; and
•	Complaints procedure.
The role of the Smart Card Code in electronic payment systems has been reduced after the 2002 revisions to the EFT Code which added a specific section (Part B) covering stored value products, including stored value smart cards.
6.3.	Telecommunications Codes 
The Australian Communications Alliance (http://www.commsalliance.com.au/) is developing codes of conduct under the Telecommunications Act 1975 (Cth) (http://scaletext.law.gov.au/html/comact/1/971/top.htm) and its many amendments which may have some relevance for consumer protection in electronic commerce. The impact of telecommunications codes on electronic commerce varies, as many are designed only to cover the standard telephone service. In the future, telecommunications codes are likely to play a greater role in the regulation of electronic commerce services. 
Some specific codes which already have an impact on electronic commerce include:
•	Protection of Personal Information of Customers of Telecommunications Providers; 
•	Customer and Network Fault Management; and 
•	Customer Information on Prices, Terms and Conditions. 
Links to these Codes can be obtained from: http://www.commsalliance.com.au/documents/codes . More information about these Codes and the work of the Australian Communications Industry Forum can be found at: http://www.commsalliance.com.au .  
6.4.	Internet Industry Association Code of Conduct 
The Internet Industry Association has developed a number of Codes of Practice (http://www.iia.net.au/index.php?option=com_content&task=section&id=3&Itemid=33), namely the Content Regulation Code of Practice and the Interactive Gambling Industry Code which are currently in place, and the Cybercrime Code, and Privacy Code which are still in their draft stages. 
The Content Regulation Code (http://www.iia.net.au/index.php?option=com_content&task=category&sectionid=3&id=19&Itemid=33) is the one of relevance to consumer protection. The Code complies with the content regulation provisions of the Broadcasting Services Amendment (Online Services) Act 1999 (Cth) (http://www.comlaw.gov.au/comlaw/Legislation/Act1.nsf/framelodgmentattachments/6AFE4F9B410FC6DACA256F710082448E ) and also deals with issues such as transactions, advertising, and privacy. The Code has in place complaint handling mechanisms registered under the Commonwealth’s Online Content Co-Regulatory Scheme, which is administered by the Australian Broadcasting Authority (ABA). Like its content regulation counterpart the Gambling Code has also been approved, and is administered by the ABA as part of the Commonwealth scheme (see (http://www.iia.net.au/index.php?option=com_content&task=category&sectionid=3&id=20&Itemid=33 )). This regulatory scheme is discussed in detail in Section 5 of the Content Regulation Course Materials, and Section 6 which deals specifically with the IIA Content Regulation Code.
The Content Regulation and Gambling Codes are aimed at increasing consumer confidence in the Internet through enhanced consumer protection provisions, particularly through improved dispute resolution procedures which now occur though binding arbitration as opposed to mediation (which is what formerly existed). The arbitration is administered by the ABA and is designed to be speedy, low-cost and consumers will avoid the cost unless the claim is frivolous. More information about the new complaint handling scheme can be obtained from the consumer protection section of the IIA Content Regulation Code of Practice website (http://www.iia.net.au/index.php?option=com_content&task=category&sectionid=3&id=19&Itemid=33 ). 
The Privacy Code (http://www.iia.net.au/index.php?option=com_content&task=category&sectionid=3&id=68&Itemid=33 ) has been ratified by the IIA Board but is awaiting approval from the Office of the Federal Privacy Commissioner (http://www.privacy.gov.au) before it becomes operational. The Cybercrime Code on the other hand is still being worked on, and according to the IIA website the IIA Cybercrime Taskforce is currently (as at 26 May 2003) working on the finishing touches of draft version 1.0 of the Code (see http://www.iia.net.au/index.php?option=com_content&task=category&sectionid=3&id=22&Itemid=33 ). When these Codes are operational they too will become part of the Commonwealth scheme. 
6.5.	Australian Direct Marketing Association (ADMA) Industry Code of Practice 
The Australian Direct Marketing Association Industry Code of Practice (http://www.adma.com.au/asp/index.asp?pgid=1985 ) came into effect in early 2000. It contains a short section on electronic commerce (section D) which repeats in general terms the text of the OECD Guidelines (see section 7.2).
The 400 plus members of ADMA are therefore bound by these Code requirements, and there is a full administration and sanctions procedure in place to deal with complaints.
The most notable provision of the Code is that it allows ADMA members to distribute unsolicited commercial email on an opt-out basis. Both the IIA Code (section 6.4) and the Model Code (section 6.6) require organisations to restrict the use of unsolicited commercial email to situations where the consumer has opted in, or is an existing customer. However, both those codes are ‘virtual codes’ with no enforcement mechanisms or administrative structure. For consumers it is unfortunate that the one code which provides the most structure and opportunity to have disputes resolved, provides the weakest consumer protection provisions in relation to spam.
6.6.	The Model Code
The Model Code is actually a document titled “Building Consumer Sovereignty in Electronic Commerce – A Best Practice Model for Business” (http://www.ecommerce.treasury.gov.au/bpmreview/content/DiscussionPaper/01_Summary.asp ). Earlier versions of the document included the words “model code” in the title, and that name has stuck. 
The Model Code repeats (and in part develops) the text of the OECD Guidelines on Consumer Protection in Electronic Commerce discussed below.
It includes key provisions on:
•	Advertising – All Internet advertising must be clearly identifiable as advertising. This is an important development as it provides consumers with an opportunity to complain about buttons, services and searches etc. which are really just paid advertisements.
•	Spam – The Model Code requires consumer “opt-in” before unsolicited commercial email can be used.
The Model Code has no enforcement provisions, complaints process or administrative structure. It is yet to be adopted or implemented by any industry body. In these circumstances it is best seen as another ‘virtual code’ which gives some useful guidance to business, but to date provides no consumer protection. 
7.	International regimes
Although international regimes for consumer protection in electronic commerce have been slow to develop, there are two documents which have some impact today – the EU Directive and the OECD Guidelines.
7.1.	EU Directive
The EU Directive is actually “Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data” (http://ec.europa.eu/justice_home/fsj/privacy/docs/95-46-ce/dir1995-46_part1_en.pdf). Fortunately it is usually shortened to the EU Directive or the EU Privacy Directive.
The EU Directive sets out detailed privacy protections which must be implemented by European national governments. The Directive covers both the private sector and public organisations.
The Directive assumes wider international importance because of Article 25, which prohibits organisations from exporting personal information to jurisdictions without adequate privacy protection. This creates a ‘domino effect’ because attempts to protect the privacy of European citizens invariably lead to improved protections for other individuals. For example, attempts by the US to comply with the EU Directive have included provisions (for those organisations participating) that protect the privacy of all their employees and customers.
In 2002 the EU introduced Directive 2002/58/EC (http://register.consilium.eu.int/pdf/en/02/st03/03636en2.pdf) aimed at updating privacy laws to provide technology neutral privacy protection to personal data.
The strength of the EU Directives is the gradual rollout of strong privacy laws across the world in an effort to comply with the Directive, therefore ensuring uninterrupted trade in information with Europe. Its weakness is that it only covers privacy, and has little impact on other areas of consumer concern in electronic commerce such as advertising and transactions. More information can also be obtained from section 11 of the Privacy Course Materials. 
7.2.	OECD Guidelines 
The OECD published Guidelines on Consumer Protection in Electronic Commerce (http://www.oecd.org/document/51/0,3343,en_2649_201185_1824435_1_1_1_1,00.html) in early 2000. They have no direct enforcement powers but may be implemented in various ways at the national or local level.
In Australia the supposed implementation takes the form of the Model Code discussed above. This is an example of one of the main weaknesses of the OECD Guidelines, in that they may mislead consumers into believing that some form of consumer protection exists on line, when actual protection will only be provided by several more effective layers of regulation.
The Guidelines are a comprehensive set of consumer protection measures, with a strong emphasis on the provision of information to the consumer. They also set out the minimum requirements for the formation of a contract in electronic commerce. 
As the Guidelines lack enforcement mechanisms, they serve only as an informative guide to member nations on ideal consumer protection measures. The OECD Guidelines also fail to encourage countries to adopt its provisions in an enforceable Code or other regulatory instrument. The result is that while many nations (Australia being a prime example) have used the Guidelines in their own consumer protection instruments, and these documents like their OECD parent are simply ‘virtual codes’, useless in providing any real consumer protection. (See generally the OECD’s Consumers in the Online Marketplace: The OECD Guidelines Three Years Later (http://www.oecd.org/LongAbstract/0,3425,en_2649_34267_2492387_1_1_1_1,00.html), which highlights this fact).
One issue which was dealt with in earlier drafts of the Guidelines, but has subsequently been dropped because of a lack of consensus, is jurisdiction. The Guidelines now state that the jurisdiction will be decided according to the normal principles of international law. This has been a missed opportunity to settle the jurisdiction issue, and many OECD members had argued that the jurisdiction should be confirmed as the residency of the customer. 
8.	Conclusion
There is no doubt that Australia has put in place the correct general policy framework for protecting consumers who wish to participate in electronic commerce. The electronic transactions legislation, backed by the new EFT Code, added to a layer of industry codes covering the conduct of businesses is the right formula to improve consumer confidence.
The electronic transactions legislation has now achieved nationwide coverage.
The new EFT code will have far reaching consequences - virtually all online services will be covered – and consumer protection in electronic payment systems will be assured.
However, the conduct of a business before or after you have paid for your goods has received plenty of attention, but is not the subject of any effective codes of conduct or other regulations. The international documents have a limited impact unless they are backed up by enforceable industry codes at the national level. The federal Government’s Model Code initiative has been very useful as an education tool, but lacks the necessary teeth and structure to be considered a consumer protection instrument.