Can You Use Existing Customer Data To Test A New Product?

When you're running a business, collecting customer information is often just part of the process. Whether it's contact details, purchase histories or account information, over time, your business can build up quite a collection of data.

Of course, there are privacy obligations to consider when collecting and handling this information. But once you've got it, you might start thinking about what else it could be useful for.

Perhaps you're developing a new product or service, and the customer data you've collected over the years could help you test your ideas, improve certain features or understand what your customers actually need.

After all, you've already collected the information, so why not put it to good use?

However, just because your business legally collected customer information doesn't necessarily mean you're free to use it for something entirely different.

Before using existing customer data for a new project, there are a few important privacy obligations worth understanding.

Can You Use Existing Customer Data For A Different Purpose?

Potentially, yes. However, it depends on why the information was originally collected and what you're planning to do with it now.

Under Australia's Privacy Act 1988, businesses covered by the Australian Privacy Principles (APPs) generally need to use or disclose personal information for the purpose it was originally collected, unless an exception applies.

This is particularly important under Australian Privacy Principle 6 (APP 6), which deals with using or disclosing personal information for a different purpose.

For instance, say your business collects customer details to process orders and arrange deliveries. You later decide to use those records to test a new product recommendation system.

That testing may be considered a secondary purpose, meaning it's different from the reason you originally collected the information.

Under APP 6, a secondary use may be permitted where customers have consented or another exception applies.

One important exception requires both of the following:

• The customer would reasonably expect their information to be used for the new purpose.
• The new purpose is related to the original purpose of collection, or directly related if sensitive information is involved.

Both conditions must be satisfied to rely on this exception. Simply having a business reason for reusing the information isn't enough.

It's also worth remembering that not every Australian business is covered by the Privacy Act. Businesses with annual turnover of $3 million or less are generally exempt, although important exceptions apply, including to certain health service providers and businesses trading in personal information.

Even where an exemption applies, other legal obligations or contractual commitments may still affect how customer information can be used.

Is Improving An Existing Product Different From Testing A New One?

There's a practical difference between using customer information to improve an existing service and using it to develop something entirely new.

Imagine you operate an online booking platform.

You analyse customer activity to identify booking errors, fix technical issues and improve features that customers already use. Depending on your original collection purpose and what customers were told, this may be part of the original purpose or a reasonably expected, related use.

Now imagine you want to use those same customer records to test an unrelated financial services product.

The connection to your original booking service is much less obvious, and customers may not reasonably expect their information to be used that way.

This doesn't automatically mean you need consent every time you're developing something new. Equally, describing an activity as a product improvement doesn't automatically make it lawful.

What matters is how the proposed use relates to the original purpose and whether there's a valid legal basis for it.

It's worth considering this distinction early in product development, particularly if your testing involves identifiable customer records.

When Do You Need Customer Consent?

If your proposed testing involves a secondary use of personal information that isn't otherwise permitted under APP 6, you will generally need customer consent to proceed on that basis.

However, consent involves more than simply including a statement in your terms and conditions.

Under Australian privacy law, valid consent generally requires customers to be adequately informed, make a voluntary decision, understand what they're agreeing to and provide consent that is current and specific.

Consent can be express or implied, but businesses shouldn't assume that silence, continued use of a service or acceptance of a broad privacy policy necessarily amounts to consent for unrelated product testing.

For instance, if you're developing a new service that involves analysing identifiable customer profiles in ways unrelated to your existing offering, you may need to explain the proposed use and obtain appropriate consent.

Additional care is needed where sensitive information is involved, such as health information or certain biometric information.

Consent isn't always necessary where another APP 6 exception applies. However, where consent is required, it should be obtained before the relevant use takes place.

There can also be consequences for getting this wrong.

Using customer information for an unauthorised purpose may result in privacy complaints, regulatory investigations or enforcement action, depending on the circumstances and seriousness of the breach.

That's why it's important to establish the legal basis for the testing before customer information is used.

Does Your Existing Privacy Policy Cover Product Testing?

Your business might already have a privacy policy explaining how customer information is collected, stored and used.

But does it actually reflect what you're planning to do with that information?

Under APP 1, covered businesses must have a clearly expressed and up-to-date privacy policy explaining their personal information management practices.

There's also APP 5, which requires businesses to take reasonable steps to notify individuals about certain matters when collecting personal information, or otherwise ensure they're aware of those matters.

These obligations serve different purposes.

Your privacy policy provides a broader explanation of how your business handles personal information, while a collection notice helps customers understand relevant details when their information is collected.

If your business originally collected information to provide one service, but now intends to use it for substantially different product testing, your existing documentation may not adequately explain that activity.

However, updating your privacy policy doesn't automatically give you permission to use customer information for a new purpose.

You'll still need to determine whether the proposed use is permitted under APP 6.

Having a tailored Privacy Policy and appropriate Privacy Collection Notice can help your business communicate its information-handling practices clearly.

Can You Use De-Identified Customer Data Instead?

What if you don't actually need to know who your customers are to test your new product?

In some cases, using properly de-identified information could be a more suitable approach.

De-identification involves taking steps to ensure information no longer identifies, or could reasonably identify, an individual.

However, simply removing names or email addresses isn't necessarily enough.

Transaction histories, locations and other details may still allow individuals to be identified, particularly when information is combined with other datasets.

Where information has been properly de-identified and individuals are no longer reasonably identifiable, it will generally no longer be considered personal information under the Privacy Act.

However, the initial process of de-identifying personal information may itself involve privacy obligations.

Businesses also need to consider whether the information could become identifiable again, especially if it will be shared with external providers.

Before using customer records for product testing, it's worth asking whether the project genuinely needs identifiable information, or whether de-identified or synthetic data could achieve the same result.

What If You're Using A Third-Party Testing Platform Or AI Tool?

Developing a new product often involves working with external software providers.

You might use an analytics platform to assess customer behaviour, a testing environment to experiment with new features or an AI tool to evaluate how your product performs.

But what happens to your customer information once it's uploaded to those systems?

If an external provider receives personal information, your business needs to understand how that information will be handled and whether the arrangement complies with applicable privacy obligations.

Under APP 11, covered businesses must take reasonable steps to protect personal information from misuse, interference, loss and unauthorised access, modification or disclosure.

There may also be obligations under APP 8 where personal information is disclosed to an overseas recipient, although not every arrangement involving an overseas cloud provider automatically constitutes an overseas disclosure.

Before using an external testing platform, it's worth reviewing the provider's terms and any relevant data processing agreement.

In particular, consider whether the agreement addresses confidentiality, security, the provider's permitted uses of customer information, subcontractors, overseas handling and what happens to the information when the arrangement ends.

This is particularly important with AI tools, as some providers may seek to use uploaded information to develop or improve their own systems.

Businesses should also consider how long customer information will remain in testing environments.

Under APP 11, where personal information is no longer needed for a purpose permitted under the APPs, businesses must generally take reasonable steps to destroy or de-identify it, subject to relevant legal exceptions.

Having appropriate Data Processing Agreements and reviewing a provider's data-handling practices can help reduce the risks involved in using external systems.

What Should You Check Before Using Customer Data For Product Testing?

Before using existing customer information for a new project, it's worth making sure your plans align with your legal obligations.

A few useful questions include:

• What information will you use? Consider whether the testing requires identifiable or sensitive information.
• Why was it originally collected? Check the original collection purpose and what customers were told.
• Is the new use legally permitted? Determine whether it falls within the original purpose, an APP 6 exception applies or consent is needed.
• Can you minimise the information used? Consider whether de-identified or synthetic data could achieve the same result.
• Who will have access? Review third-party arrangements, security measures and any overseas disclosures.

For more complex projects involving sensitive information, extensive profiling or emerging technologies, a privacy impact assessment may also be appropriate.

If you're planning to contact existing customers to promote the new product, separate direct marketing obligations may apply, including under APP 7 and the Spam Act 2003.

Taking these matters into account before testing begins can help avoid privacy issues becoming a much bigger problem once your new product is ready to launch.

Need Help With Your Business's Privacy Obligations?

Existing customer information can be valuable when developing a new product, but it's important to understand what your business can legally do with it.

Whether you're reviewing how customer information is used, updating your privacy documentation or working with third-party testing providers, getting the legal side right early can help avoid complications later.

Sprintlaw can assist with Privacy Policies, Privacy Collection Notices and Data Processing Agreements to help businesses manage their privacy obligations.

Get in touch with our team on 1800 730 617 or email team@sprintlaw.com.au to find out how we can help.