The collection notice a car dealership needs (APP 5)
A dealership collects personal information at several points, and APP 5 requires you to give the customer a collection notice at or before each one: the test drive, the finance enquiry, the trade-in, the cameras and your enquiry forms. The notice tells the customer who you are, why you are collecting the information, who you usually disclose it to (for a dealer, that includes finance lenders and insurers), whether it may go overseas, and how to access it or complain.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Your real collection points
A collection notice has to cover where you actually collect, not just a website form. For a dealership those usually include:
- The test drive (a driver's licence or photo ID). Read: the test-drive licence
- The finance enquiry (income, bank and employment details you take to arrange finance). Read: finance and insurance data
- The trade-in (vehicle and sometimes previous-owner details).
- CCTV and any facial-recognition or number-plate cameras across the yard and showroom. Read: yard CCTV and facial recognition
- Enquiry forms, the website and phone enquiries.
What the notice has to cover
Under APP 5, take reasonable steps to make the customer aware, at or before collection, of, among other things:
- Your identity and contact details (the dealership).
- The purposes for which you collect (to arrange a test drive, to broker finance, to process a trade-in, for security, and so on).
- The main consequences if they do not provide it (for example, that you cannot arrange the test drive or the finance).
- The types of third parties you usually disclose to, which for a dealer squarely includes finance lenders and insurers, and any providers you use.
- Whether the information is likely to go overseas (for example if a finance, CRM or cloud tool processes it offshore). Read: offshore finance and cloud tools
- How they can access and correct their information and how to complain, usually by pointing to your privacy policy.
One notice, several touchpoints
The practical approach is a short, plain notice given at each collection point (a line at the test drive, a paragraph on the finance form, signage for the cameras) that points to your fuller privacy policy. The finance touchpoint is the most important to get right, because that is where you take the most sensitive data and disclose it to third parties. Read: what a car dealer's privacy policy must cover
Common questions
Is a privacy policy on our website enough?
A policy and a collection notice do different jobs. The policy is the general standing document; the collection notice is the specific, at-the-point notice of the APP 5 matters. Relying on the website policy alone, with nothing at the test drive or finance desk, is the common gap.
Do we need a notice for the cameras?
Signage that tells people cameras are operating is your APP 5 notice for the CCTV collection point, and it is expected. It is separate from, and in addition to, obeying your state's surveillance-devices law.
What is the most important collection point to get right?
The finance enquiry. That is where you collect the most sensitive personal and financial information and disclose it to lenders and insurers, so the notice there should be clear that you will share the details to arrange the finance.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.