Finance and insurance data at a car dealership: the privacy rules when you broker a loan
When you help a buyer finance a car, you collect a concentrated set of personal and financial information, income, bank statements, ID and employment details, and you disclose it to lenders and insurers. If the Privacy Act applies to your dealership, that flow is governed by it: notify the customer you will share the data (APP 5), use and disclose it for the finance purpose they expect or with their consent (APP 6.1 and 6.2), keep it secure (APP 11), and mind APP 8 if any of it goes offshore. The finance flow is also the arrangement that can decide whether the Act applies to a smaller dealership at all (s 6D(4)(c)). Privacy law covers how you handle the data; credit reporting under Part IIIA and the credit legislation are their own regime.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice, and this page does not cover your credit-law or credit-reporting obligations.
The finance flow is a disclosure to third parties
Brokering finance is one of the highest-stakes data flows in a dealership. You take a buyer's income and bank details and pass them to one or more lenders and insurers to get an approval, usually for a commission.
That commission is also what can decide whether the Privacy Act binds a smaller dealership at all. A business is not a small business operator if it "discloses personal information about another individual to anyone else for a benefit, service or advantage" (s 6D(4)(c)), and passing a buyer's details to a financier for a commission engages those words on their face. But s 6D(7) carves out a disclosure made "with the consent of the other individual", and a signed finance application is normally exactly that consent, so in the ordinary case the exemption is likely to survive. It is fact-specific and turns on your own paperwork. The mirror limb runs the other way: paying to obtain personal information, such as buying a lead list, is s 6D(4)(d). Read: does the Privacy Act apply to car dealers?
In privacy terms:
- You collect high-value personal and financial information from the buyer. It is not "sensitive information" in the Privacy Act's special sense (that s 6 definition is a closed list: health, genetic, biometric, racial, political, religious, trade union, sexual orientation and criminal record information, and financial data is not on it), but it is exactly the sort of data that causes serious harm if it leaks, so handle it carefully.
- You disclose it to third parties (the lenders and insurers). Disclosure for the primary purpose the data was collected for is what APP 6.1 permits; any secondary purpose needs the customer's consent or an APP 6.2 ground, the usual one being a purpose they would reasonably expect and that is related to the primary purpose. Your collection notice is what makes that expectation real.
The privacy rules that apply
- APP 5, notice. Tell the buyer, at the point you take their finance details, that you will disclose them to lenders and insurers to arrange finance, and to whom in general terms. APP 5.2(f) asks for the types of bodies you usually disclose that kind of information to, not a list of every name. Read: the collection notice a dealership needs
- APP 6, use and disclosure. Arranging the finance the customer asked for is the primary purpose; anything beyond it is a secondary purpose needing their consent or an APP 6.2 ground (APP 6.1). Do not shop a buyer's financial details around to lenders they did not agree to, or reuse them for unrelated marketing.
- APP 11, security. APP 11.1 asks for steps that are reasonable in the circumstances, and income and bank details raise what is reasonable: secure storage, limited access, and no leaving finance paperwork or scans lying around the yard or on personal devices.
- APP 8, overseas. If you disclose the finance data to a lender, insurer, aggregator or cloud tool outside Australia, APP 8.1 requires reasonable steps to ensure the recipient does not breach the APPs, and s 16C can treat that recipient's mishandling as your own breach unless an APP 8.2 exception applies. Read: car dealers, offshore finance and cloud tools
The line we do not cross: privacy is not credit law
Brokering finance also engages credit law and the credit-reporting system, which is a separate regime with its own rules (including Part IIIA of the Privacy Act on credit reporting, and the credit legislation that governs credit assistance). Those rules are distinct from the general privacy handling this page covers, and we keep to the privacy side. If you obtain credit reports, act as a credit assistance provider, or take on credit-provider obligations, get advice on those requirements specifically. This page is about handling the personal information properly, not about your credit-law duties.
This is general information and document templates you tailor to your own business, not legal advice.
Common questions
Is a customer's financial information "sensitive information"?
Not in the Privacy Act's technical sense. The s 6 definition is a closed list, covering health, genetic, biometric, racial, political, religious, trade union, sexual orientation and criminal record information, and financial data is not on it. But financial data is high-value and high-risk, so you should handle it with strong security and tight purpose limits even though it is "ordinary" personal information legally.
Can we send a buyer's details to several lenders to find the best rate?
Only for the finance purpose the customer expects and has been told about, and generally to the lenders they are actually applying with. Be transparent in your collection notice about disclosing to lenders and insurers, and do not disclose beyond what the buyer would reasonably expect. Worth checking: does your finance authority name the lenders, or does it just say "our panel"?
Does this cover our credit-reporting obligations?
No. Credit reporting and credit law are a separate regime with their own rules. This page covers the general privacy handling of the finance data. Take specific advice on any credit-reporting or credit-assistance obligations your dealership has.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice, and does not cover credit-reporting or credit-law obligations, which are a separate regime. For advice on your specific circumstances, consult a qualified Australian legal practitioner.