Does the Privacy Act apply to my business’s online form?

The turnover line, in the Act’s words

The Privacy Act, at s 6D(4): an individual, body corporate, partnership, unincorporated association or trust is not one of the Act's small business operators if he, she or it carries on a business that has had an annual turnover of more than $3,000,000 for a financial year that has ended after the later of the time he, she or it started to carry on the business, or the commencement of the section.

So the line the Act sets is an annual turnover of more than $3,000,000, measured over a financial year. The Act's privacy rules apply to what it calls organisations, and the OAIC's glossary gives the working summary: organisations include all businesses and non-government organisations with an annual turnover of more than $3 million, all health service providers regardless of turnover, and a range of small businesses.

Two wordings, one Act

Government pages do not always use the Act's exact words, and the difference is worth naming rather than smoothing over. One OAIC page says the Privacy Act covers organisations with an annual turnover of more than $3 million that operate in Australia, and some other organisations, and it notes that a number of factors go into deciding whether an organisation operates in Australia, including a presence in Australia or carrying on a business in Australia.

The Attorney-General's Department's page puts the same line as an annual turnover of $3 million or more. The Act itself says more than $3,000,000. Where the shorter wordings differ from the Act's words at the edge, this page follows the Act, and the OAIC's own questions below are the practical way to settle a real business.

Whatever the turnover

Turnover is not the only route in. The OAIC's glossary makes the clearest case: organisations include all health service providers regardless of turnover, and a range of small businesses, and it points to ss 6D and 6E of the Act for the detail. The Act's own list, at s 6D(4), continues past the turnover limb. Reading on, the list also includes these. An individual, body corporate, partnership, unincorporated association or trust is not one of the Act's small business operators if he, she or it:

1. discloses personal information about another individual to anyone else for a benefit, service or advantage; or provides a benefit, service or advantage to collect personal information about another individual from anyone else; or
2. is a contracted service provider for a Commonwealth contract, whether or not a party to the contract; or is a credit reporting body.

There is one way back in. Section 6D(5) says subsection (4) does not prevent an individual from being a small business operator merely because he or she does something described in paragraph (4)(b), (c) or (d) otherwise than in the course of a business he or she carries on, and only for the purposes of, or in connection with, his or her personal, family or household affairs.

And one related-body point: despite the general test, a body corporate is not one of the Act's small business operators if it is related to a body corporate that carries on a business that is not a small one.

A health service provider, on the OAIC's small business page, provides services in relation to physical, emotional, psychological and mental health. Its listed examples are traditional health service providers, such as private hospitals, day surgeries, medical practitioners, pharmacists and allied health professionals; complementary therapists; child care centres; private schools and private tertiary educational institutions.

One OAIC page gives the general shape of all of this as well: the Privacy Act covers Australian Government agencies and organisations with an annual turnover of more than $3 million, and some other organisations.

Checking your own business

The OAIC's small business page works through the test in questions, and the turnover one is direct: has your small business had an annual turnover of more than $3,000,000 in any financial year since 2002?

It also records what counts on the other side of the line: a small business is one with an annual turnover of $3 million or less, and annual turnover for the purposes of the Privacy Act includes all income from all sources.

For a business the Act covers, the rest of this site runs from here: the notice the form has to give, the questions it may ask, the tick that can sign it, and what happens after Submit.