Consent to collect a customer's ID at a dealership: what you actually need
A common dealership myth is that you need signed consent for everything you collect. You do not. For a test-drive licence and ordinary customer details, the rule is to collect only what is reasonably necessary, by fair means, and to give a collection notice. Consent is the higher bar, and it applies to sensitive information, which at a dealership means things like a facial-recognition scan, not an ordinary licence or a finance form.
By Jon Oates, Founder of Privaproof · Last updated
General information, not legal advice. Privaproof is not a law practice.
Notice is the baseline, consent is the higher bar
Two different requirements often get merged:
- Collection notice (APP 5) is required whenever you collect personal information. You make the customer aware of who you are, why you are collecting, who you disclose to, and so on. This is notice, not consent. Read: the collection notice a dealership needs
- Consent is a stronger step, required for particular things, most notably sensitive information (which generally needs consent as well as being reasonably necessary).
So for a test-drive licence, ordinary contact details, and even the income and bank details you take for finance, the requirement is usually to collect only what you need and to notify, not to obtain a separate signed consent. Finance data is high-value and needs care, but it is not sensitive information in the Privacy Act's special sense.
The collection rules for customer ID
- Only what is reasonably necessary (APP 3). Collect the ID and detail you actually need to run the test drive or arrange the finance, not more. Read: the test-drive licence
- By lawful and fair means. Collect openly and fairly, and use your notice for anything you collect about a person from a third party.
- The one place consent bites: facial recognition. If you run facial-recognition technology, that creates biometric information, which is sensitive and generally needs consent and a real necessity, a much higher standard. This is the collection at a dealership where consent genuinely matters. Read: yard CCTV and facial recognition
Common questions
Do we need written consent to take a licence for a test drive?
Usually not a formal signed consent, provided you genuinely need it and you notify the customer. The controls for an ordinary licence are necessity and notice: collect only what you need, by fair means, and cover it in your collection notice. Better still, sight it rather than keeping a photo.
Is a customer's finance information sensitive, so we need consent?
Financial information is not sensitive information in the Privacy Act's technical sense, so it does not carry the consent bar that, say, facial recognition does. It is high-value and needs strong security and a clear notice that you disclose it to lenders, but the baseline is notice and necessity, not a separate signed consent. Read: finance and insurance data
When does consent actually matter for us?
Most clearly when you use facial recognition or other biometric technology, which is sensitive information. That is a stop-and-get-advice decision, and consent is one of the things it turns on. For ordinary ID and finance data, notice and necessity are the rule.
This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.