When does the Privacy Act apply?
Where turnover exceeds $3 million, the Privacy Act applies to:
- businesses not for profit organisations (charities and community sector organisations)
- clubs and associations
- unions and employee organisations.
Where turnover is less than $3 million, you may still be caught by the Privacy Act where, for example, your organisation:
- provides a health service to another individual and holds any health information that is not about your employees. ‘Health service’ includes not just medical and allied health care, but also pharmaceutical services, complementary therapies such as acupuncturists and chiropractors, and services such as gyms and health spas.
- is a credit reporting body or a business that trades in personal information
- is a service provider under contract to the Commonwealth government
- is created under the Privacy Regulations (eg if you operate a residential tenancy database)
- is related to a company that is caught by the legislation (eg a holding company or subsidiary of a larger company)
- has opted to be regarded as an organisation for these purposes. A register of these businesses is kept by the Australian Office of the Information Commissioner (OIC). Some businesses benefit from greater customer confidence and trust that may come from operating under the Privacy Act even where they are not strictly required to do so.
When does the Privacy Act not apply?
The Privacy Act does not cover:
- small businesses (with a turnover below $3 million) that aren’t covered by one of the exceptions above
- an individual collecting information not in the course of running a business but for personal, family or household reasons
- a university other than a private university or the Australian National University
- public schools
- a registered political party
- a member of Parliament or a local government Councillor, performing actions in relation to, or facilitating, elections, referendums, or other aspects of the political process, or a contractor or volunteer engaged to do the same
- a media organisation engaged in journalism which has made a public commitment to observe privacy standards
- state or territory government agencies, unless certain exceptions apply
- information that has originated, or has been received, from an intelligence agency, Defence Intelligence Organisation, Defence Signals Directorate, Defence Imagery and Geospatial Organisation, or the Australian Crime Commission.
