A small business with less than $3 million turnover mishandled my data. Does the Privacy Act still apply?

What the Law Says

The Privacy Act 1988 (Cth) generally applies to Australian Government agencies and organisations with an annual turnover of more than $3 million. However, important exceptions mean many small businesses are still covered — including yours.

Under section 6C(1) of the Privacy Act, a small business operator (with turnover under $3 million) is *not* an 'organisation' for the purposes of the Act — but this exemption does not apply in several key situations.

One major exception is when the small business collects or holds personal information 'in connection with the provision of a service or product' to you — the individual whose data was mishandled. If your business collected your name, contact details, payment info, health data, or other personal information while delivering goods or services, the exemption does not apply.

Additionally, the exemption does not apply if the business is a 'credit reporting body', handles tax file numbers, is a contracted service provider for a Commonwealth contract, or is related to a larger organisation that *is* covered by the Act.

Statutory Text

A small business operator is not an organisation for the purposes of this Act.

— Privacy Act 1988 (Cth), s. 6C(1) — Small business operators

Statutory Text

This subsection does not apply to a small business operator if: (a) the small business operator collects or holds personal information in connection with the provision of a service or product to the individual.

— Privacy Act 1988 (Cth), s. 6C(4)(a) — Exceptions to small business exemption

What to Do

Sources