Tyro agrees to independent review after sending 150,000 spam messages

Tyro Payments will independently review its policies, procedures and systems after sending more than 150,000 spam email and SMS messages to consumers without an unsubscribe function.

The financial services company has entered into a court enforceable undertaking with the Australian Communications and Media Authority for the breach of the Spam Act.

Tyro was alerted to the breach in March 2020 following a complaint to the communications watchdog and shortly thereafter commenced an internal investigation into its compliance.

The investigation found that between April 2019 and March 2020 the customer engagement team sent emails and SMS messages without a functional unsubscribe function.

Tyro has acknowledged that “its systems, processes and practices were not adequate”, and has since taken action to implement changes such as system improvements to “remove manual processes”.

As part of the undertaking, the company will be required to engage an independent consultant to review the procedures, policies, training and systems relating to its compliance with the Spam Act.

It will also be expected to implement all recommendations made by the independent consultant, unless agreed with the ACMA or the work has already been completed.

The ACMA will be able to apply to the Federal Court to have the undertaking enforced if any breach by Tyro occurs, with other levers such as payment or compensation also available to the court.

“We appreciate that Tyro has come to us with these commitments,” ACMA deputy chair Creina Chapman said in a statement.

“Although it’s clear that its practices and systems were not adequate to comply with the spam laws, its actions since receiving our alert are appropriate to address the issues.

“However, the ACMA will not hesitate to pursue more serious enforcement action, including financial penalties, in appropriate cases.

“We will also be actively monitoring Tyro’s compliance with the spam laws and its commitments.”

Chapman also placed the financial services sector on notice following Tyro’s breach, noting that businesses have paid more than $1.7 million for ACMA-issued infringement notices in 12 months.

“The Spam Act has been in place for 17 years and provides important protections to consumers,” she said.

“Australians should not receive marketing messages they haven’t consented to, and they must be able to easily withdraw their consent when they choose.”