Skip to content
Join the founding list

Home › Car & motor dealers › Does the Privacy Act apply to car dealers?

Does the Privacy Act apply to car dealers?

It depends on your turnover and how you operate. A dealership over A$3 million turnover is covered by the Australian Privacy Principles. A small independent dealer under A$3 million may fall within the small-business exemption. Brokering finance is the likeliest thing to disturb that, because you disclose a buyer's details to lenders for a commission, but it is fact-dependent: the Act carves out disclosures made with the customer's consent, and finance paperwork usually obtains that consent. And whatever your turnover, your state's surveillance-devices law governs your yard and showroom cameras.

By Jon Oates, Founder of Privaproof · Last updated

General information, not legal advice. Privaproof is not a law practice.

The turnover line, and when a small dealer is caught anyway

But it usually does not end there, and the reason cuts in your favour. Section 6D(7) carves the disclosure limb out where the individual consented to the disclosure, or where it is required or authorised by law. A finance application is normally signed precisely to authorise the dealer to send those details to lenders. So in the ordinary case the consent carve-out is likely to apply and the exemption is likely to survive. It is genuinely fact-dependent, and it turns on how your own paperwork and consents are actually drafted confirm against how your dealership actually operates. Note also that s 6D(4)(d) runs the other way: paying for customer data, such as buying a lead list, is a separate limb with its own carve-out in s 6D(8). Read: finance and insurance data at a dealership

So "we are a small yard" does not settle it on its own, though for many small dealers the honest answer is that the exemption does hold. The two things most worth checking are your group structure, which is a clean yes or no, and how your finance consents are drafted. And the cameras are covered either way, which is the part that catches people who assume the exemption settles everything.

The camera rules apply either way

Separately from the Privacy Act, your state's surveillance-devices law governs your yard and showroom cameras, and it binds you regardless of turnover. Even a genuinely exempt small dealer must obey it, and it matters most for facial-recognition or number-plate cameras. Read: yard CCTV and facial recognition

What being covered means

If the APPs apply to you, then for the customer information you hold you owe, among other things:

Common questions

We are a small used-car yard well under A$3 million. Are we exempt?

Maybe, and the finance question is the one to look at, but it does not resolve against you as easily as it first reads. Disclosing personal information about another individual for a benefit is the limb that can remove the exemption (s 6D(4)(c)). However s 6D(7) carves that out where the individual consented to the disclosure, and a signed finance application is normally exactly that consent, so in the ordinary case the exemption is likely to survive. It is fact-dependent, and it runs the other way too: paying for personal information, such as buying a lead list, is caught by s 6D(4)(d). Your cameras are governed by state surveillance law regardless of turnover. Work through your actual operations rather than relying on turnover alone.

We do not do finance, just sell cars. Does the Act apply?

If you are under A$3 million, do not broker finance for a benefit, and are not part of a larger group, you may fall within the small-business exemption for your general data. Your yard cameras are still governed by state surveillance law, and it remains good practice to handle customer identity data carefully.

What is the single most likely thing that makes us covered?

Turnover over A$3 million, or being a related body corporate of a larger covered group. Both are clean tests you can answer today. The finance question is the one people reach for first, and it is more finely balanced than it looks: disclosing a buyer's details to lenders for a commission engages s 6D(4)(c), but s 6D(7) carves out disclosures the individual consented to, and a signed finance application is normally that consent. So it is fact-dependent and often does not remove the exemption. Whatever the answer, your cameras are governed by state surveillance law regardless of turnover.

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your dealership depends on the facts, including your turnover, structure and how you handle finance and customer data. Privaproof's car-dealer documents are self-authored and are not independently reviewed by a solicitor. For advice on your specific circumstances, consult a qualified Australian legal practitioner.

Keep reading