What may an online store do with its customer list?

The threshold, in the Act's words

The Privacy Act's s 6D carries the small business test in its own words: a business is a small business at a time (the test time) in a financial year (the current year) if its annual turnover for the previous financial year is $3,000,000 or less. A business with no time in the previous financial year when it was carried on is a small business at the test time only if its annual turnover for the current year is $3,000,000 or less. Section 6D(4) then takes the exemption away from an individual, body corporate, partnership, unincorporated association or trust that carries on a business that has had an annual turnover of more than $3,000,000 for a financial year that has ended after the later of the time it started to carry on the business and the commencement of section 6D.

The OAIC explains why the line matters to a store: most small businesses are not covered by the Privacy Act 1988, but some are. For the Act's purposes, annual turnover includes all income from all sources. It does not include assets held, capital gains or proceeds of capital sales.

Trading in personal information

The OAIC lists what puts a business on the covered side of the line regardless of its turnover: a health service provider; trading in personal information; a contractor that provides services under a Commonwealth contract; an operator of a residential tenancy database; a credit reporting body; a reporting entity under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006; employee associations registered or recognised under the Fair Work (Registered Organisations) Act 2009; a business that conducts protection action ballots; a business accredited under the Consumer Data Right system; a business related to a business the Privacy Act covers; a business prescribed by the Privacy Regulation 2013; and a business that has opted in to be covered by the Privacy Act.

For a store with a customer list, the live question is the second item. The OAIC's checklist defines it: a business is considered to trade in personal information if it provides a benefit, service or advantage to collect personal information, or discloses personal information for a benefit, service or advantage. A benefit, service or advantage can be any kind of financial payment, concession, subsidy or some other advantage or service. What that catches is the exchange: a list disclosed for a benefit, service or advantage, or personal information collected by offering one.

A worked example from the regulator

The OAIC's own example of the exchange is a store's list at work: where a small business sells their customer list to a marketing company, or gives their own list in return for another list. Done without the customers' consent, and without being required or authorised by law, either half of that example puts the business on the covered side of the line even though its turnover is under the threshold, and the obligations that follow are the Australian Privacy Principles.

The OAIC adds a note that matters before a business assumes the worst of its own list: complying with the Privacy Act does not prevent you handling personal information for your business needs.

Sharing or selling a list

Where the list is not sold but shared, the same test decides it: a disclosure of personal information for a benefit, service or advantage is trading in personal information, and a benefit, service or advantage can be any kind of financial payment, concession, subsidy or some other advantage or service.

There is also a route across the line by choice. The Privacy Act provides a mechanism to allow an organisation that is a small business operator to opt in to the Act, and the OAIC says a small business that opts in could experience a number of benefits, including increased consumer confidence and trust in their operations. Its checklist also frames the default for a business that stays outside: as a matter of best practice, protect any personal information you hold.

A list stored overseas

A store's platform may be the thing holding the list, and it may be overseas. The OAIC's framework: in most circumstances, providing personal information to an overseas recipient, including to a contractor located overseas to perform services on the entity's behalf, is considered a disclosure, to which APP 8 and s 16C apply. In relatively limited circumstances, however, an organisation or agency might retain such a degree of control over the information that it is considered to be using it.

The OAIC's example of that limited case is the storage arrangement itself: where an organisation or agency provides personal information to a cloud service provider located overseas, this may be a use if the information is provided for the limited purpose of performing the services of storing and ensuring the entity may access the personal information, and a binding contract between the parties requires the provider only to handle the personal information for these limited purposes, requires any subcontractors to agree to the same obligations, and gives the organisation or agency effective control of how the personal information is handled by the provider.

Where it is a disclosure, the Privacy Act is clear about an organisation or agency's accountability where an overseas recipient handles personal information in a way that would breach one or more APPs. And where the arrangement is a use rather than a disclosure, the store still holds the information, and a number of APPs apply to it, such as APPs 6, 11, 12 and 13.