Skip to content
Get the Strata Kit

Home › Strata › Is the Privacy Act a shield against strata record access?

Is the Privacy Act a shield against strata record access?

No. A strata manager cannot use the Privacy Act to refuse a lawful inspection of the owners roll. The Australian Privacy Principles permit a disclosure that is required or authorised by law, and state strata legislation requires the roll to be made available to entitled people. So privacy is not a lawful ground to refuse a proper request. But a covered manager must still secure that data and use it only for authorised purposes.

By Jon Oates, Founder of Privaproof · Last updated

General information, document templates and tools you tailor, not legal advice. Privaproof is not a law practice.

The short version: two duties that both apply to the same roll

Strata privacy has a tension at its centre, and most templates only handle one half of it. On one side, state strata law compels you to disclose the roll and records to owners and other entitled people, so you cannot hide behind the Privacy Act to refuse. On the other side, a manager who is covered by the Privacy Act still owes duties to keep that same data secure and to use and disclose it only for proper purposes. Both are true at once. The skill is knowing which one applies to the request in front of you, and this page walks through the line.

Why the law compels disclosure, not the other way around

The owners corporation must keep a strata roll (s 177) and make the scheme's records available for inspection (s 182(3)), and a managing agent carries those duties out where they have been delegated to it under s 52. In New South Wales, the Strata Schemes Management Act 2015 sets what the roll must contain (each owner's name and address for service, plus an email address where the owners corporation holds one, under s 178; a phone number is not prescribed roll content), how long records are kept (about seven years, under s 180), and the right of an owner, mortgagee or covenant chargee to inspect the records on written request and on payment of the prescribed fee (s 182(1), (2)). In Walker v The Owners - Strata Plan No 1992 [2020] NSWCATAP 192 the NSW Civil and Administrative Tribunal Appeal Panel held that privacy did not defeat that entitlement, finding "no issue of 'privacy' which in this case derogates from the statutory right of an owner to access financial information and accounting records where such a right is expressly provided under the SSM Act" (at [42]). The scheme's members are entitled to see how their scheme is run, and that includes the roll.

Victoria and Queensland have their own equivalents. In Victoria the Owners Corporations Act 2006 runs two parallel sets of provisions. Records are kept under s 144 and inspected under s 146; an owners corporation of more than two lots also keeps a register, established under s 147, with its contents at s 148 and inspection at s 150. Retention periods sit at s 145. Inspection is free in Victoria; only copies attract a capped fee. In Queensland the right to inspect sits in the Body Corporate and Community Management Act 1997 itself. Section 205 lets an "interested person", defined at s 205(13) to include an owner, a mortgagee, a buyer under a contract of sale and a person who satisfies the body corporate of a proper interest, inspect or copy the records within seven days of a written request and payment of the prescribed fee. What the fee is, which records are kept and how long they are kept are set by the module that applies to the scheme, so check yours. We have checked New South Wales, Victoria and Queensland. The other states and territories run their own strata legislation under different names and section numbers, so read your own state's Act rather than assuming New South Wales applies nationally.

The practical upshot: when an owner, a mortgagee or covenant chargee, or a person they have authorised, makes a proper request, the starting position is that you disclose, because disclosure is what the law requires. Refusing on privacy grounds is not a ground the strata Acts recognise.

Why "required or authorised by law" is the key that unlocks it

If you are a covered APP entity, your instinct might be that APP 6 stops you handing personal information to a third party. It does restrict use and disclosure, but it has an exception that matters here. A use or disclosure that is required or authorised by or under an Australian law is permitted. State strata legislation is exactly that kind of law. So when strata law requires you to make the roll available to an entitled person, giving them that access is a permitted disclosure, not a breach. The Privacy Act and strata law are not in conflict; the Privacy Act builds in room for the strata law's disclosure requirement.

This is why the Privacy Act is not a shield. The very framework people reach for to refuse access is the framework that authorises the access. There is one route to restricting access that we have found, and it is not a privacy one: under the Owners Corporations Act 2006 (Vic) s 172 a person whose personal information is in the records or on the register may apply to VCAT for an order restricting access, and VCAT may make one if it considers exceptional circumstances exist. It is the individual's application to VCAT, not a discretion you hold, and the disclosure provisions apply until VCAT orders otherwise.

But "you must disclose" is not "anyone can have anything"

Holding the other side of the tension is just as important, and getting it wrong is where covered managers create risk. A lawful right of access has limits, and outside those limits the ordinary privacy duties come back into force.

If you are covered, APP 6 and APP 11 still bind the same data

Whether the Privacy Act reaches your business at all depends on your turnover and structure. A manager under A$3 million turnover and not part of a larger group may fall within the small-business exemption, which s 6D(1) makes the default position. The exemption is displaced only by a specific trigger. But if you are covered (because your business has had an annual turnover of more than A$3 million in a financial year that has ended, which under s 6D(4)(a) is a one-way test rather than a year-by-year one, or because you are a related body corporate of a covered entity under s 6D(9)), two obligations sit over the roll at all times, alongside the duty to disclose it:

Even if your business is inside the exemption and the APPs do not bind you, none of this makes the data less worth protecting, and state strata law still compels disclosure to entitled people. The exemption is a reason the federal Act may not reach you, not a reason to disclose loosely or to lock records away from people entitled to see them.

How to hold both sides in practice

Common questions

Can a strata manager refuse a records request on privacy grounds?

Generally no. State strata legislation requires the roll and records to be made available to entitled persons on a proper request, and the Privacy Act permits a disclosure that is required or authorised by law. So privacy is not a lawful ground to refuse a proper inspection. You can decline a requester who has no statutory entitlement, but that is because the request is unauthorised, not because the data is "private".

Does the Privacy Act override state strata law here?

No, and it is not meant to. The two work together. Strata law compels disclosure to entitled people; the Privacy Act's "required or authorised by law" exception makes that disclosure a permitted one. The Privacy Act's role is to govern how you secure the data and stop it being reused or leaked outside those lawful channels.

If I am covered by the Privacy Act, am I breaching it by handing over the roll?

Not when you are handing it to an entitled person under strata law, because that disclosure is authorised by law and permitted under APP 6. You would risk a breach if you disclosed the roll to someone with no statutory entitlement, or reused it for your own purposes, or failed to keep it secure under APP 11.

Do owners' contact details have to be handed over in full?

Usually yes, to an entitled inspector. In New South Wales the roll must record each owner's address for service and an email address where one is held (SSMA 2015 s 178), and s 182(3) exposes the records broadly, with only secret-ballot voting records carved out (s 182(5)). In Queensland the body corporate gives access to the records as it keeps them, and the only statutory withholding ground for an interested person is material it reasonably believes is defamatory (BCCMA 1997 s 205(3)). Privacy is not a stated basis to redact in any of the three states we have checked. Confirm your own state's current position before you withhold anything.

We are a small manager under $3 million. Does any of this apply to us?

The Privacy Act's APP 6 and APP 11 duties may not bind you if you are genuinely within the small-business exemption. But your state strata law still compels you to keep and disclose the roll to entitled people, and your management agreement and state surveillance law apply regardless of turnover. So the "must disclose to entitled people" half applies to you either way; the "must secure under the APPs" half depends on whether you are covered.

Keep reading

This is general information and document templates you tailor to your own business, not legal advice. Privaproof is not a law practice and does not provide legal advice. Whether the Privacy Act 1988 (Cth) applies to your business depends on your turnover and structure; state strata legislation on record access and state surveillance-devices law apply separately and vary by jurisdiction. Section numbers and prescribed fees change with amendments, so confirm your own state's current requirements. For advice on your specific circumstances, consult a qualified Australian legal practitioner.