Ecommerce lawyers in Melbourne and Victoria

In Australia, the Privacy Act covers how organisations handle personal information. It includes the collection, use, storage and disclosure of personal information.

The laws apply throughout Australia, although there are special rules for some public and private-sector organisations. 

For privately operated businesses, the Act applies to those with an annual turnover of more than $3 million. For those small businesses with an annual turnover of less than $3 million, the Act won’t apply except in specific circumstances, for example, if the small business:

• Operates another business which has a turnover of $3 million or more; or
• Provides a health service or holds health information; or
• Collects or discloses personal information for a benefit, service, or advantage; or
• Is contracted by the Australian Government to provide services; or 
• Is a credit reporting body

However, even if the Act doesn’t apply to your business, we recommend implementing a privacy policy. The policy should set out what personal information your business collects and how it’s used. Suppose your business has a website with an international reach. In that case, you may also need a privacy policy to ensure compliance with Europe’s General Data Protection Regulation (GDPR).

Contact us to learn more about Privacy Act compliance requirements. 

The Privacy Act sets out rules and requirements for the collection, use, and disclosure of someone’s personal information. There are special requirements for sensitive information, so it’s important to understand the differences between the two. 

Personal information is information which can identify a person. It doesn’t have to be accurate, and it can be spoken or written. Some examples of personal information include an individual’s:  

• Name
• Signature
• Home or postal address
• Email address
• Phone number
• Date of birth
• Medical records
• Photographs
• Voice, print, and facial recognition biometrics
• Internet protocol (IP) addresses
• Bank account details

Sensitive information is a category of personal information. It includes information or an opinion about an individual’s:

• Race or ethnic origin 
• Political opinions or membership of a political association
• Religious or philosophical beliefs
• Membership of a professional or trade association
• Sexual orientation or practices
• Criminal record
• Health and genetic information 
• Some aspects of biometric information (for example,  facial recognition biometrics that could reveal more sensitive information, such as race)

Generally, sensitive information is more protected than other personal information.  

If you have questions or concerns about personal or sensitive information, contact us for advice. 

If the Privacy Act applies to your organisation, it sets out the rules and requirements for how organisations collect and handle <personal information.

Your organisation’s privacy policy must cover:

• Why your organisation is collecting personal information
• How it will use the information 
• To whom the personal information is disclosed 
• If relevant, that the individual can provide de-identified information 
• If relevant, that the individual can use a pseudonym 
• How the individual can access their personal information
• How the individual can opt-out of direct marketing
• That the individual has the right to ask for corrections to any inaccurate personal information  
• How an individual can complain if they believe their personal information is mishandled

We can help your organisation create a compliant privacy policy. Contact us to find out more.  

If your organisation is required to comply with the Privacy Act, you must take reasonable steps to notify the person of certain things. This is known as a collection notice. Australian privacy laws require you to provide the collection notice:

• Before you collect their personal information; or
• At the time of collecting their personal information; or
• Soon after collecting the personal information (if this is possible)

You must also provide other information in the collection notice, including: 

• Your organisation’s name and contact details
• That the information has been (or is to be) collected
• The purpose of collecting the information 
• Whether the collection is required or authorised by law
• Any consequences if the person refuses to consent to the collection 
• How your business usually discloses personal information  
• Information about your organisation’s privacy policy
• Whether your organisation may give personal information to overseas recipients, and if possible, the countries where those recipients are located 

In addition to the collection notice, if your organisation is required to comply with the Privacy Act, it must also have a privacy policy. 

This requirement aims to ensure that a person has plenty of information about the collection. It allows them to make an informed choice about whether to provide the information.  

Contact us to learn more about privacy policies and collection notices.