Privacy compliance for Australian buyers agents

A buyers agency with an annual turnover of A$3 million or less may be a small business operator under s 6D, in which case the Australian Privacy Principles do not apply to it. Turnover is not the only test: s 6D(4) also puts you outside the exemption if you disclose personal information for a benefit, service or advantage, provide a benefit to collect it, hold health information, are a contracted service provider for a Commonwealth contract, or are a credit reporting body. Section 6D(4)(a) runs one way, so a single financial year that has ended above A$3 million takes the exemption away for good. Becoming an AUSTRAC reporting entity is a separate route in. Via Privacy Act s 6E(1A), the Act applies to you as if you were an organisation in relation to the activities you carry on for the purposes of, or in connection with, activities relating to the AML/CTF Act, which reaches the identity, verification, source-of-funds and beneficial-ownership information you handle for customer due diligence, regardless of turnover. Read: does the Privacy Act apply to buyers agents under $3 million?

Scope, stated honestly: s 6E(1A) is scoped to activities, not to a category of data. Where a small business operator is a reporting entity, the Act applies "in relation to the activities carried on by the small business operator for the purposes of, or in connection with, activities relating to" the AML/CTF Act, its regulations and the AML/CTF Rules, as if the operator were an organisation. Information you handle only for general marketing, such as a newsletter list or a property alert, sits outside that route, while the same client record can sit inside it to the extent you handle it for your customer due diligence. The rest of your practice stays under the small-business exemption unless a separate trigger applies. This route does not make your whole business an organisation under the Act, and it is not a category exemption for anything you choose to file elsewhere.

You hold few files, but each one is deep. To act for a buyer you gather, and actively assess, a concentrated set of financial and identity information:

• Identity and verification documents (VOI) for the buyer.
• Financial-capacity evidence: mortgage pre-approvals, bank and savings statements, proof of deposit and borrowing capacity.
• Source-of-funds and source-of-wealth evidence, where a client is higher-risk under your customer due diligence. (This is data you may hold, not every file.)
• Beneficial-ownership, PEP and sanctions-screening results.
• The buyer brief, which often carries sensitive context (a relocation, a divorce, an inheritance, an SMSF purchase).

Few, deep, often high-net-worth records. Under the Notifiable Data Breaches scheme a breach is only an eligible data breach where "a reasonable person would conclude that the access or disclosure would be likely to result in serious harm to any of the individuals to whom the information relates" (Privacy Act 1988 (Cth) s 26WE(2)), and identity documents held alongside bank statements and borrowing capacity are the kind of combination that assessment has to weigh. The assessment is made case by case, on the facts of the breach. Read: your data-breach response plan · Read: VOI and source-of-funds privacy rules

If your service genuinely never finds or identifies a specific property and never negotiates, only advises, you may fall outside the brokering definition. A buyers agency retained to find, identify or negotiate the purchase of a property is doing what the designated service describes. This is fact-specific, so confirm your own position with AUSTRAC rather than assuming either way. Read: advice-only buyers agents and AML

• 1. A privacy policy (APP 1) written for a buyers agent rather than adapted from a selling-agency template.
• 2. Collection notices (APP 5), including the AML customer-due-diligence notice at engagement, and cover for information you collect about people from third parties.
• 3. A data-breach response plan for the NDB scheme, tuned to the concentrated financial-capacity data you hold.
• 4. A retention and destruction schedule that reconciles the AML/CTF record-keeping period with APP 11.2, which requires reasonable steps to destroy or de-identify personal information you no longer need, unless an Australian law or a court or tribunal order requires you to keep it.

You do not need a rent roll, a tenancy-database notice, a rental-application form or an open-home register, and none of them are in this kit. Read: the privacy kit no RE-agency tool covers

An AML document pack is built around the customer due diligence the AML/CTF Act requires. The Privacy Act documents are a different set of instruments, addressed to the Australian Privacy Principles. A generic privacy template is not written for buy-side broking, and whether any given supplier updates theirs as the law changes is worth asking them. Read: AML kit vs privacy kit