Skip to content
Get the Car Dealer Kit

Home › Car dealers › Does the Privacy Act apply to car dealers?

Does the Privacy Act apply to car dealers?

It depends on your turnover history and how you operate. A dealership over A$3 million turnover is covered by the Australian Privacy Principles, and s 6D(4)(a) makes that one-way: any completed financial year above the line since you started keeps you covered even if turnover later falls. A dealer that has always been under A$3 million may fall within the small-business exemption. Brokering finance is the likeliest thing to disturb that, because you disclose a buyer's details to lenders for a commission, but it is fact-dependent: s 6D(7) carves out disclosures made with the customer's consent, and finance paperwork usually obtains that consent. And whatever your turnover, your state's surveillance-devices law governs your yard and showroom cameras.

By Jon Oates, Founder of Privaproof · Last updated

General information, not legal advice. Privaproof is not a law practice.

The turnover line, and when a small dealer is caught anyway

But it usually does not end there, and the reason cuts in your favour. Section 6D(7) carves the disclosure limb out where the individual consented to the disclosure, or where it is required or authorised by or under legislation. A finance application is normally signed precisely to authorise the dealer to send those details to lenders. So in the ordinary case the consent carve-out is likely to apply and the exemption is likely to survive. It is fact-dependent, and it turns on your own paperwork: does everyone whose details reach the lender actually consent, including a guarantor, a co-borrower, or the registered owner of a trade-in? Section 6D(7)(a) asks for the consent of the other individual whose information you disclose, not only the buyer's. Note also that s 6D(4)(d) runs the other way: paying for customer data, such as buying a lead list, is a separate limb with its own carve-out in s 6D(8). Read: finance and insurance data at a dealership

So "we are a small yard" does not settle it on its own, and it does not decide against you either. Three things are worth working through: whether any completed financial year since you started went over A$3 million, which s 6D(4)(a) makes permanent; your group structure under s 6D(9), which is a clean yes or no; and how your finance consents are drafted. You can also go the other way on purpose: s 6EA lets a small business operator choose in writing to be treated as an organisation, and the Commissioner keeps a public register of the operators who have. And the cameras are covered either way, which is the part that catches people who assume the exemption settles everything.

What still binds you if you are exempt

Separately from the Privacy Act, your state's surveillance-devices law governs your yard and showroom cameras, and it binds you regardless of turnover. Even a genuinely exempt small dealer must obey it, and it matters most for facial-recognition or number-plate cameras. Read: yard CCTV and facial recognition

Credit information is the other one. Part IIIA of the Privacy Act applies to a credit provider (s 21A(1)), and s 6G writes small business operator into that definition. Hand over a car and let the customer pay part of the price later, with repayment deferred for at least 7 days, and you are a credit provider in relation to that credit (s 6G(2)); process a lender's finance application as the lender's agent, and you are a credit provider while you do it (s 6H(1)). A credit provider must have a clearly expressed and up-to-date policy about the management of credit information and credit eligibility information (s 21B(3)), which is not the same document as your APP 1 privacy policy. Part IIIA is not gated on being an APP entity, so the small-business exemption does not answer it. Do you hold credit information, and do you have that policy? Arranging finance also engages credit law, where suggesting or assisting a consumer to apply for a particular credit contract is credit assistance (National Consumer Credit Protection Act 2009 (Cth), s 8). That is a separate regime with its own licensing rules and Privaproof does not cover it.

What being covered means

If the APPs apply to you, then for the customer information you hold you owe, among other things:

Common questions

We are a small used-car yard well under A$3 million. Are we exempt?

Maybe, and two questions come before the finance one. Has any completed financial year since you started gone over A$3 million? Section 6D(4)(a) makes that permanent, whatever this year looks like. And is your company a body corporate related to a body corporate that is not a small business (s 6D(9))? Then the finance question, which does not resolve against you as easily as it first reads. Disclosing personal information about another individual for a benefit is the limb that can remove the exemption (s 6D(4)(c)). However s 6D(7) carves that out where the individual consented to the disclosure, and a signed finance application is normally exactly that consent, so in the ordinary case the exemption is likely to survive. It runs the other way too: paying for personal information, such as buying a lead list, is caught by s 6D(4)(d). Your cameras are governed by state surveillance law regardless of turnover. Work through your actual operations rather than this year's turnover alone.

We do not do finance, just sell cars. Does the Act apply?

If you have never had a financial year over A$3 million (s 6D(4)(a)), do not broker finance for a benefit, and are not a body corporate related to a body corporate that is not a small business (s 6D(9)), you may fall within the small-business exemption for your general data. Two things still reach you. Your yard cameras are governed by state surveillance law. And if you let a customer take the car and pay part of the price later, with repayment deferred for at least 7 days, s 6G(2) makes you a credit provider in relation to that credit, and Part IIIA applies to a credit provider whether or not it is an APP entity (s 21A(1)).

What is the single most likely thing that makes us covered?

Turnover, and it is your turnover history rather than this year's: s 6D(4)(a) catches a business that has had an annual turnover of more than A$3 million for any financial year that has ended since you started, and a later fall back under the line does not undo it. After that, group structure under s 6D(9). Both are clean tests you can answer today. The finance question is the one people reach for first, and it is more finely balanced than it looks: disclosing a buyer's details to lenders for a commission engages s 6D(4)(c), but s 6D(7) carves out disclosures the individual consented to, and a signed finance application is normally that consent. So it is fact-dependent and often does not remove the exemption. Whatever the answer, your cameras are governed by state surveillance law regardless of turnover.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your dealership depends on the facts, including your turnover, structure and how you handle finance and customer data. For advice on your specific circumstances, consult a qualified Australian legal practitioner.

Keep reading