Privacy rules for licence scans, finance data and dealership CCTV

Motor dealing is not one of the designated services the 2026 AML/CTF reforms switched on for real estate agents, lawyers and accountants (AML/CTF Act s 6, Tables 5 and 6), so a dealership has no single switch-on date. Here is the honest position:

• Turnover over A$3 million? Your dealership is a covered APP entity and the Australian Privacy Principles apply. One completed financial year over the line is enough, and a later fall in turnover does not put you back (s 6D(4)(a)).
• A smaller independent dealer under A$3 million? You may fall within the small-business exemption (s 6D), so the APPs may not bind your whole business. The exemption can be lost if you disclose personal information about another individual to anyone else for a benefit, service or advantage (s 6D(4)(c)), and a dealer who brokers finance and passes a buyer's details to lenders or insurers for a commission engages those words on their face. But s 6D(7) carves that out where the individual consented, or where the disclosure is required or authorised by law, and a signed finance application is normally exactly that consent, so in the ordinary case the exemption is likely to survive. It turns on your own paperwork: does your finance authority actually name the lenders and insurers you send a buyer's details to? Read: does the Privacy Act apply to car dealers?
• Your yard and showroom cameras are governed regardless. Your state's surveillance and listening-device laws reach your cameras and any audio they record whatever your turnover, and what they cover varies by state, so "we are a small dealer" is not an answer to a surveillance-law problem.

So the honest first step is not to assume you are exempt, and to remember the camera rules apply either way.

You hold, across the yard, a concentrated set of high-value personal and financial information:

• Driver-licence and ID captures from every test drive and finance enquiry.
• Finance and insurance data: income, bank details, and the results of finance applications you broker to lenders. Read: finance and insurance data at a dealership
• Trade-in and PPSR data, including details about a vehicle's previous owner.
• CCTV, and increasingly facial-recognition or number-plate cameras, across the yard and showroom. Read: yard CCTV and facial recognition

A breach of this exposes people to identity theft and financial fraud, which is exactly what makes it serious. Read: a data-breach response plan for car dealers

1. The test-drive licence. Taking a driver's licence for a test drive is a collection of personal information, and often the dealership photographs or photocopies it and keeps the copy. The privacy discipline is to tell the customer why you are taking it (APP 5), collect only what you actually need, and prefer sighting and recording the details over keeping a photo pile. The OAIC's 2026 compliance sweep picked car dealerships as one of six sectors, for the "collection of personal information to enable an individual to conduct a vehicle test drive", and assessed their privacy policies against APP 1.4 (OAIC, 9 Dec 2025). Read: the test-drive licence and your privacy duties

2. Yard cameras and facial recognition. CCTV across a dealership is governed first by your state's surveillance and listening-device laws, which bind you regardless of turnover, and facial-recognition or number-plate cameras raise the bar sharply because a facial template is sensitive information. Does anything in your yard read faces or number plates, and does your signage say so? Read: yard CCTV and facial recognition

3. Brokering finance. When you take a buyer's income and bank details and pass them to lenders and insurers, you are collecting and disclosing sensitive financial information to third parties, which brings APP 6 and, if anything goes offshore, APP 8 into play. Privacy law governs how you handle that data; it is separate from credit law, and we keep to the privacy side. Read: finance and insurance data

• A privacy policy written for a dealership, covering test-drive ID, finance data, trade-ins and CCTV, not a generic website template.
• Collection notices (APP 5) for the real points: the test drive, the finance enquiry, and the cameras.
• A CCTV and surveillance procedure scoped to your state, with the facial-recognition risk called out.
• A data-breach response plan for the identity and financial data you hold.
• A retention and destruction schedule. There is no AML record-keeping floor here; you keep most business records for five years (ATO record-keeping rules, under the Income Tax Assessment Act 1936 s 262A), and any state motor-dealer licensing records for the period your licence requires, then destroy customer identity data you no longer need.

Open whatever privacy document you have and check it for three things: the licence capture, the finance flow, and your state's camera and audio rules.