The collection notice a car dealership needs (APP 5)
A dealership collects personal information at several points: the test drive, the finance enquiry, the trade-in, the cameras and your enquiry forms. If the APPs bind you, APP 5 asks for such steps (if any) as are reasonable in the circumstances to make the customer aware, at or before collection or, if that is not practicable, as soon as practicable after: who you are, why you are collecting, who you usually disclose to (for a dealer, finance lenders and insurers), whether the information is likely to go overseas, and that your privacy policy explains how to access, correct and complain.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Your real collection points
A collection notice has to cover where you actually collect, not just a website form. For a dealership those usually include:
- The test drive (a driver's licence or photo ID). Read: the test-drive licence
- The finance enquiry (income, bank and employment details you take to arrange finance). Read: finance and insurance data
- The trade-in (vehicle and sometimes previous-owner details).
- CCTV and any facial-recognition or number-plate cameras across the yard and showroom. Read: yard CCTV and facial recognition
- Enquiry forms, the website and phone enquiries.
What the notice has to cover
APP 5 binds APP entities. A dealership whose turnover has passed A$3 million is covered and stays covered (s 6D(4)(a)); below that, the exemption turns on how your finance referrals actually work. Read: does the Privacy Act apply to car dealers? If it binds you, take such steps (if any) as are reasonable in the circumstances to make the customer aware, at or before collection or, if that is not practicable, as soon as practicable after, of, among other things:
- Your identity and contact details (the dealership).
- The purposes for which you collect (to arrange a test drive, to broker finance, to process a trade-in, for security, and so on).
- The main consequences if they do not provide it (for example, that you cannot arrange the test drive or the finance).
- The types of third parties you usually disclose to, which for a dealer squarely includes finance lenders and insurers, and any providers you use.
- Whether the information is likely to go overseas (for example if a finance, CRM or cloud tool processes it offshore) and, where it is practicable to specify them, the countries those recipients are likely to be in (5.2(i) and (j)). Read: offshore finance and cloud tools
- That your privacy policy explains how they can access and correct their information and how to complain, which is what 5.2(g) and (h) ask you to notify.
- If an Australian law or a court order requires the collection, the fact that it does, including the name of that law (5.2(c)).
One notice, several touchpoints
The practical approach is a short, plain notice given at each collection point (a line at the test drive, a paragraph on the finance form, signage for the cameras) that points to your fuller privacy policy. The finance touchpoint is the one to get right first: it is where you collect the most detailed identity and financial information and disclose it to third parties, which is matter 5.2(f). Read: what a car dealer's privacy policy must cover
Common questions
Is a privacy policy on our website enough?
A policy and a collection notice do different jobs. APP 1.3 requires the standing policy; APP 5 is what you do at the point of collection, and matters 5.2(g) and (h) assume the policy exists for the notice to point at. So ask your own question: at the test drive and the finance desk, is there anything that makes the customer aware, or only a link in the website footer?
Do we need a notice for the cameras?
Signage that tells people cameras are operating is how a dealership normally gives the APP 5 notice for that collection point, and cameras are the clearest case for one: matter 5.2(b) bites where the individual may not be aware you have collected their information. It is separate from, and in addition to, obeying your state's surveillance-devices law.
What is the most important collection point to get right?
The finance enquiry. That is where you collect the most detailed personal and financial information and disclose it to lenders and insurers, so the notice there should name them as the types of third parties you usually disclose to (matter 5.2(f)) and say that you will share the details to arrange the finance.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. For advice on your specific circumstances, consult a qualified Australian legal practitioner.