The Privacy Act has a principle written for information collected from someone other than the person it is about. A purchased enquiry is exactly that.
Most privacy questions in lead buying get answered with the word consent, which is the wrong concept for the problem. Consent governs what the consumer agreed to. IPP 3A governs what you have to tell them once you hold their information, and it applies whether or not consent exists.
This explains what the principle requires and how to satisfy it without adding friction to the first call. It describes the principle rather than advising on your circumstances.
IPP 3A is the information privacy principle dealing with indirect collection. Where an agency collects personal information about an individual from someone other than that individual, the agency must take reasonable steps to ensure the individual is aware of a defined set of matters.
| What the individual must be made aware of | What that looks like on a lead |
|---|---|
| That the information has been collected | You hold their enquiry details |
| The purpose of the collection | To contact them about the cover or loan they enquired about |
| The identity of the agency holding it | Your firm, by name |
| The intended recipients of the information | Insurers or lenders you would approach on their behalf |
| Their right to access and correct it | Stated plainly, with a route to exercise it |
The standard is reasonable steps rather than perfect notification, and what is reasonable depends on the circumstances. That flexibility is genuine, and it is not a licence to do nothing.
Because two separate collections occurred. The supplier collected the information from the consumer directly, which engages IPP 3 and the ordinary direct-collection rules. You then collected the same information from the supplier, which is a collection from a source other than the individual, and that is IPP 3A.
The consequence is that a broker who buys an impeccably collected lead and calls it without ever telling the consumer how they came to hold their details has their own IPP 3A problem. The supplier's cleanliness does not transfer.
The most common misunderstanding: A supplier saying "the consumer consented" is answering a different question. Consent to the supplier's collection is not awareness of yours. Both can be required at once, and usually are.
Two mechanisms, and the first one does most of the work if you choose your supplier well.
If the supplier's form tells the consumer, in plain words, that their enquiry will be passed to a licensed adviser who will contact them, the consumer is already aware of the collection and its purpose before you exist to them. That is the highest-value artefact you can ask a supplier for, and it is visible on their live page.
The remaining matters are covered in one line early in the first call. Naming the brand the consumer enquired through does more than satisfy the principle: it is also the fastest way to get a person to remember why they are talking to you, which improves the call.
Two further principles matter for records you did not convert.
IPP 9 requires that personal information is not kept for longer than it is required for the purpose for which it may lawfully be used. An enquiry that never became a client, sitting in a CRM indefinitely because nobody defined a retention rule, is the ordinary way firms fall short of this.
IPP 11 restricts disclosure of personal information to other parties. It is the principle to think about before passing an enquiry to a colleague at another firm, or handing a list to a marketing contractor.
How Lead Foundry answers this: The consumer is told on the form that their enquiry goes to a licensed adviser, and the record carries the brand they enquired through. That means your first call can name the source and the awareness step is grounded in something the consumer actually read.
Yes. IPP 3A governs personal information collected from a source other than the individual concerned, and buying an enquiry from a lead supplier is exactly that. You must take reasonable steps to make the individual aware that you hold their information, the purpose, your identity, the intended recipients, and their access and correction rights.
No. The supplier collected the information from the consumer directly, and you collected it from the supplier. Those are separate collections engaging separate obligations. A supplier with impeccable consent does not discharge your IPP 3A duty, though a supplier whose form discloses onward supply to a broker makes satisfying it far easier.
Say early in the call how you came to hold their details, naming the brand they enquired through, state what you will use the information for, and make your privacy statement reachable. Record that you did it. Buying from a supplier whose form already told the consumer their enquiry goes to a licensed adviser does most of the work before you dial.
IPP 9 requires that personal information is not kept for longer than it is required for the purpose it may lawfully be used for. The Act sets no fixed number of months, so the practical requirement is to define a retention rule tied to a purpose and apply it, rather than letting unconverted enquiries accumulate in a CRM indefinitely.