OIC SUBMISSION E-COMMERCE BPM 25/11/99:

D - PRIVACY & OTHER ISSUES


Treasury Public Consultation on Electronic Commerce Best Practice Model Oct 1999
Issues in the Public Interest
Electronic Notary

INDEX
30Privacy - 30-31
32Payment - 32-33
34Security & Authentication
35Code Administration
36Review of Best Practice Model (BPM)
37Glossary
PRIVACY

	30	If purchasers are members of an Association much of the information required will be
		available.

		The Association can keep a record for a member of who is accessing their details, 
		in the same way a purchaser can access the Credit Reference Association of Australia
		(CRAA) details if they are a member of the CRAA

	31	The problem is that a business may have a policy of how it handles personal information 
		but that policy can be breached.

		There should be a set of penalties if that policy is breached or not followed properly.

PAYMENT

	32	As the majority of payments will be by credit cards there should be a mechanism that 
		enable payment to be stopped if the goods are faulty, terms and conditions breached or 
		the service not fulfilled. 

		A possible way is for the Association to hold the credit card details and authorise the
		payment in stages eg :

		a	25% deposit to confirm order

		b	50% on delivery

		c2	5% when member confirms satisfaction with goods and service

	33	We have to think about new methods of Intellectual Property payments including electronic 
		credits processes

SECURITY & AUTHENTICATION 34 (a) Security should also include security of credit card details. This issue can be addressed by the Electronic Notary (or Association) holding the details of credit cards on behalf of members . The purchaser could send his/her membership number to a supplier as part of the payment authority and copy in the association automatically. The supplier would then access the membership details on the association file and confirm payment (b) Authentication is a problem for Electronic Commerce. Authentication is required for the purchaser and the supplier. One problem that confronts the supplier is to know if the person who is purchasing is using their own card or someone else's card. The problem that the purchaser has is to know if the e-mail is sent from someone with the appropriate authority to change process and conditions. This issue extends beyond business to consumer e-commerce and in particular business to business e-commerce. (c) Members of the OIC have proposed that a way of overcoming the authentication issue is to be able to link into the corporate web site of the supplier to view the organisation or personnel structure to confirm if the person who sent the e-mail has the authority to vary terms or commit an organisation to a delivery schedule. (d) This means the e-mail naming convention of any organisation has to be relevant to the Human Resource software package that defines job specification and authority/responsibility levels to each job function. (e) In essence this implies that a consumer can check that the person who sent the e-mail to vary/confirm terms and delivery schedules has the authority to perform that function. This will be a critical issue for resolving complaints and disputes over late delivery and re-crediting of credit card payments. (f) This problem will be compounded if ordering over the Internet from different countries with different languages. CODE ADMINISTRATION 35 (a) The OIC agrees that there needs to be a body to administer the successful implementation of the code by members. (b) This will probably be a committee or work group which may be prepared to evaluate the OIC Electronic Committee Information Management module of the Electronic Association Information Management (EAIM) process which has been specified and prototyped by the Open Interchange Consortium EAIM project team. Further details are available on http://www.oic.org/3b1.htm REVIEW OF BEST PRACTICE MODEL (BPM) 36 The OIC EAIM process can assist business and industry organisations monitor progress with the adoption of the Best Practice Model and report on the progress with different modifications within each industry code. GLOSSARY The following terms should be added: 1 AGENT An individual/organisation that acts on behalf of/for the interests of a supplier/service provide. The contract to purchase is with the supplier/service provider 2 BROKER An individual/organisation that acts on behalf of the consumer to provide a product or service. The contract to purchase is with the broker however the terms for delivery may be directly supplied by manufacturer/service provider 3 PURCHASER A natural person who represents an organisation but may be purchasing goods and services on behalf of an organisation and will use their own credit card rather than a company credit card.