Lead Sharing
Part of Joint webinars and educational events
Agreeing on attendee data permissions
Set attendee data permissions before registration: collection, partner access, event use, later marketing and post-event exports.
Before a joint event form goes live, agree which organisation collects attendee information, what each partner may access, disclose and use, and who holds the records after the event. Put those decisions in a written co-hosting agreement, attendee-data permissions schedule or data-sharing clause, tied to the actual form wording. Co-hosting alone does not authorise both businesses to take every registration record or send later promotions.
Review the schedule after the event against the records created, access granted and exports made. Record any changes to custody, access, use or deletion before closing the event records.
Map the records and access
List the details requested for registration and the records the event may create, such as attendance, submitted questions, chat and participant contributions to a recording. Check the actual event setup: access and exports vary by platform and configuration.
For each field or record, identify the collecting organisation, purpose, people who need access, intended recipients, permission basis and any proposed later use. Ask whether a partner needs identifiable records or whether a summary will do.
Check that a small or unusual summary cannot reasonably identify someone in its context.
Separate delivery, disclosure and marketing
The host may need an address to send joining details without the other partner needing that address. Answering a question, transferring it with the attendee's identity and sending later marketing are separate decisions. Record the intended recipient, purpose and permission basis for each transfer or message.
The Privacy Act 1988 (Cth) includes 13 Australian Privacy Principles (APPs). They apply to some private sector organisations and most Australian Government agencies; the Office of the Australian Information Commissioner (OAIC) publishes guidance on them.
For an organisation covered by the APPs, APP 3 limits collection of personal information to what is reasonably necessary for its functions or activities. Sensitive information may only be collected when those conditions are met and the individual consents, unless an exception applies; collection must also be by lawful and fair means.
APP 6 generally limits use or disclosure to the purpose for which information was collected, unless an exception applies. Exceptions include the individual's consent or, in some circumstances, a related purpose the individual would reasonably expect.
APP 7 restricts an organisation's use or disclosure of personal information for direct marketing unless an exception applies. If an organisation is permitted to use or disclose information for direct marketing, it must provide a simple way to opt out and comply with requests.
Key Australian Privacy Principle (APP) requirements
- 3APP – Collection — Only collect what’s reasonably necessary; sensitive info requires consent
- 6APP – Use/Disclosure — Use only for original purpose unless consented or expected by individual
- 7APP – Direct Marketing — Must provide simple opt-out; comply with requests; no use without exception
Make the form understandable
Put a collection notice in or alongside the form. Identify each organisation collecting information and give its contact details, the circumstances and purposes of collection, usual disclosures, whether collection is required or authorised by law, and the consequences if information is not provided.
The notice should also explain where each organisation's APP Privacy Policy can be found and whether information is likely to be disclosed to overseas recipients, including their countries if practicable. APP 5 requires reasonable steps to notify people of these matters or ensure they are aware of them before or at collection, or as soon as practicable afterwards.
If a partner wants to use details for its own later marketing, name that partner and the proposed purpose, then decide before collection whether the use or disclosure is permitted under APP 6 and APP 7. Notice alone is not automatically consent.
Where consent is the basis for a use or disclosure, record the partner and purpose, the wording and form version, the individual's choice, when it was given, where the evidence is held and how long it will be retained. Include those details in the permissions schedule.
Treat optional marketing separately from the information needed to deliver the event. Review the form as a registrant would see it, including choices, confirmation wording and recording notice. Keep a copy of the version reviewed.
Control access and exports
Give hosts, moderators and speakers access suited to their tasks. Decide before the session whether chat, questions or a recording will be shared or published. Do not put an identifiable private question into a public recap without an appropriate basis.
After the event, compare any proposed export with the agreed field list and uses. Record what is transferred, to whom and why. If the basis for a proposed transfer is unresolved, hold it and use a suitably non-identifying summary for the joint review.
Name in the permissions schedule which partner holds each attendee list and other event record after the event, who may access it, and who is responsible for deletion. Agree a retention period and deletion trigger before the form goes live, then review them at event close-out.
Where an organisation is permitted to use or disclose personal information for direct marketing, APP 7 requires it to provide a simple way for individuals to opt out and to comply with their requests. On request, the organisation must also provide the source of an individual's personal information unless doing so is impracticable or unreasonable.
