A business is collecting my personal information without explaining why. Is this allowed?

What the Law Says

Australia’s privacy framework is built around the Australian Privacy Principles (APPs), which apply to most businesses with an annual turnover of $3 million or more — and some smaller ones too. The key rule about collecting personal information without explanation is found in APP 5.

APP 5 — 'Notification of the collection of personal information' — says that if an organisation collects personal information about you, it must take reasonable steps to notify you (or ensure you are aware) of several things, including why the information is being collected, who it may be shared with, and how you can access or correct it.

This notification must happen 'at or before the time' the information is collected — not later, and not only if you ask. If the business fails to do this, it breaches the Privacy Act.

There are limited exceptions — for example, if telling you would pose a serious threat to someone’s life or health, or if it’s required or authorised by law — but these are narrow and rarely apply to routine business collection.

Statutory Text

An organisation must take such steps (if any) as are reasonable in the circumstances to notify the individual of certain matters, including the fact that the organisation has collected personal information about the individual, the purpose for which the information was collected, and the organisations or types of organisations to which the organisation usually discloses information of that kind.

— Privacy Act 1988 (Cth), s. 13.5 — Australian Privacy Principle 5

What to Do

Sources