Selling personal information and your obligations under the Privacy Act

Selling or sharing personal information is regulated in Australia as a disclosure under the Privacy Act 1988 (Cth) (the Act). There is no provision that says you may sell customer data, and none that says you may not. Instead, the Act and the Australian Privacy Principles (the APPs) control how you collect, use and disclose personal information, and a sale or data-sharing deal is treated as a disclosure. If that disclosure is not for a permitted purpose and you do not have consent, the deal is unlawful, no matter how valuable the data is.

This matters for small and medium businesses because the penalties are no longer academic. A body corporate that seriously interferes with an individual's privacy can face a civil penalty of up to $50 million, and the Office of the Australian Information Commissioner (OAIC) can investigate on its own initiative. This guide sets out who must comply, the duties that apply when you sell or share personal information, what happens if you get it wrong, and a checklist to work through before any data deal.

Who must comply and when

The Act binds APP entities, which includes most businesses. Broadly:

Turnover above $3 million: If your business's annual turnover for the previous financial year was more than $3 million, the APPs apply to you in full.
Turnover of $3 million or less: Your business is a "small business" and is generally exempt from the APPs, unless one of the carve-outs in s 6D(4) of the Act applies.

The small business exemption is narrower than it sounds, and several carve-outs are directly relevant to selling data. Under s 6D(4), a business is not a small business operator if it:

provides a health service and holds health information;
discloses personal information about another individual to anyone else for a benefit, service or advantage;
provides a benefit, service or advantage in exchange for being allowed to collect personal information from someone else;
is a contracted service provider for a Commonwealth contract; or
is a credit reporting body.

The second and third limbs are the ones that catch data sellers. If you sell a customer list for money, you are disclosing personal information for a benefit, and the small business exemption no longer applies. The wording is "benefit, service or advantage", which is broader than cash: if you receive analytics services, advertising credits or anything else of value in exchange for data, the exemption is at risk. If in doubt, assume the APPs apply and comply with them.

Only use or disclose data for a permitted purpose

APP 6 is the core rule. If you hold personal information collected for a particular purpose (the primary purpose), APP 6.1 says you must not use or disclose it for another purpose (a secondary purpose) unless the individual has consented, or one of the limited exceptions applies.

The main exception, in APP 6.2, allows a secondary use or disclosure where:

the individual would reasonably expect it; and
the secondary purpose is related to the primary purpose (for non-sensitive information) or directly related to it (for sensitive information).

A secondary use or disclosure can also be permitted where it is required or authorised by law, or where a "permitted general situation" applies, such as lessening or preventing a serious threat to life, health or safety.

The practical test is straightforward. If you collected email addresses to deliver a product, selling that list to an unrelated advertiser is not related to the primary purpose, and no reasonable customer would expect it. You would need consent that specifically covers disclosing the data to third parties for marketing. Vague consent wording, or a consent buried in terms and conditions, is unlikely to hold up.

Direct marketing has its own limits

APP 7 separately restricts using or disclosing personal information for direct marketing. The default position under APP 7.1 is that you must not use or disclose personal information for direct marketing at all. For non-sensitive information, APP 7.2 allows it where you collected the information from the individual, the individual would reasonably expect the use or disclosure, you provide a simple means to opt out, and they have not already done so. Where direct marketing relies on consent or another basis, the APP still requires a simple opt-out mechanism and for each communication to draw attention to it, with requests honoured within a reasonable period.

If you propose to sell or share a list so a third party can market to those individuals, both the sale and the third party's marketing need to fit within these rules. You must:

have collected the information from the individual yourself;
be able to show the individual would reasonably expect their data to be used for direct marketing;
provide a simple, easily accessible opt-out; and
give effect to opt-out requests promptly and keep suppression lists so opted-out people are not re-added in later batches.

The Spam Act 2003 (Cth) applies on top of the APPs if the marketing is by email or SMS. It requires consent for commercial electronic messages, accurate sender identification and a working unsubscribe facility. Telemarketing calls are restricted under the Do Not Call Register Act 2006 (Cth). Your sale contract should also require the buyer to comply with these laws and to honour opt-outs.

Some data attracts a higher standard. Sensitive information under s 6(1) of the Act includes health information, racial or ethnic origin, political opinions, religious beliefs, sexual orientation and criminal record information, as the OAIC explains.

Under APP 3.3 you cannot even collect sensitive information unless the individual consents and the collection is reasonably necessary for your functions or activities. Under APP 6.2(a)(i), any secondary purpose must be directly related to the primary purpose. For direct marketing, the position is effectively that you need the individual's consent.

There is also no casual approach to children's data. The Act does not set a fixed age at which a child can consent; capacity is assessed in the circumstances, and in practice businesses dealing with young children should look to a parent or guardian for consent. If your data involves sensitive information or children, plan on express, opt-in consent that is specific to the proposed disclosure, and document how and when it was obtained.

Check where the buyer is before disclosing

If the buyer, partner or any data processor is overseas, APP 8 applies before you disclose anything. APP 8.1 requires you to take reasonable steps to ensure the overseas recipient does not breach the APPs in relation to the information.

One exception, in APP 8.2, applies where you reasonably believe the recipient is subject to a law or binding scheme that protects the information in a way that, overall, is at least substantially similar to the APPs. You can also disclose with the individual's informed consent where they are told that the APPs may not protect the information overseas.

The real exposure is s 16C of the Act: if you disclose to an overseas recipient and they mishandle the information, their acts are treated as your acts for the purposes of the APPs. That means you can be liable for a data buyer's breaches on the other side of the world. Contractual promises from the buyer help, but they do not automatically stop the Act from treating the recipient's conduct as yours.

Protect the data once it leaves

APP 11 requires you to take reasonable steps to protect personal information from misuse, interference and loss, and from unauthorised access, modification or disclosure. It also requires you to destroy or de-identify information once you no longer need it for any permitted purpose. "Reasonable steps" includes technical and organisational measures, so access controls, encryption and vendor due diligence are part of the duty, not extras.

If a data breach occurs, the Notifiable Data Breaches scheme in Part IIIC of the Act requires you to notify the OAIC and affected individuals where the breach is likely to result in serious harm. If you have sold or shared data, a breach at the buyer's end can still draw you into the notification exercise, so your contract should include breach notification obligations flowing back to you in time to meet your own deadlines.

De-identified data is not a free pass

Data that has been de-identified, so that it no longer relates to an identifiable individual, falls outside the scope of the Act. That is why many businesses prefer to sell aggregated insights rather than raw customer records. But de-identification is not the same as removing names. Information becomes personal information again if it can be reasonably linked back to an individual, including by combining datasets.

If you plan to sell insights or analytics:

apply technical controls that genuinely prevent re-identification;
use thresholds so that no report cell is so small it could single out an individual;
prohibit re-identification and onward disclosure in the contract; and
do not describe data as "anonymous" unless it is.

That last point has teeth outside privacy law. Section 18 of the Australian Consumer Law, in Schedule 2 of the Competition and Consumer Act 2010 (Cth), prohibits misleading or deceptive conduct in trade or commerce. If your marketing overstates how "de-identified" or "anonymous" a dataset is, the claim itself can be a contravention, with the ACCC able to pursue penalties and buyers able to seek remedies.

Consequences of getting it wrong

For a serious interference with privacy under s 13G of the Act, a body corporate faces a maximum civil penalty of the greatest of $50 million, three times the value of any benefit obtained from the conduct, or 30% of adjusted turnover for the breach period. For an individual, the maximum is $2.5 million. An interference that is not serious carries up to 2,000 penalty units under s 13H.

The OAIC can investigate complaints and matters on its own initiative, issue infringement notices and accept enforceable undertakings, and seek civil penalties in the Federal Court. Beyond penalties, a data sale that breaches the APPs can produce compensation determinations in favour of affected individuals, contractual claims from the buyer if the data or the consent basis was misrepresented, and reputational damage that is harder to quantify than any fine.

A practical compliance checklist

Before you sell, share or otherwise monetise personal information:

Map exactly what data will be disclosed and why the recipient wants it.
Identify your legal basis under APP 6: primary purpose, related secondary purpose with reasonable expectation, or consent.
Confirm whether sensitive information or children's data is involved and plan for express, opt-in consent.
Review your privacy policy and collection notices so they plainly disclose the proposed use and the categories of recipients before collection, not after.
Design consent so it is specific, informed, voluntary and easy to withdraw, and keep records of when and how it was given.
Check whether any recipient is overseas and, if so, work through APP 8 and s 16C exposure.
Put a data sharing agreement in place covering purpose limits, security, sub-processors, deletion on termination, audit rights and a ban on re-identification and onward sale.
If marketing is involved, align with the Spam Act and Do Not Call rules and require the buyer to honour opt-outs and maintain suppression lists.
Apply security controls under APP 11, including access restrictions and encryption, and vet the recipient's security before transfer.
Plan for incidents: know how you would assess an eligible data breach and notify the OAIC if required.

Where a privacy lawyer helps

A lawyer's role in a data sale is to test whether the deal has a lawful basis before it happens, not after. That includes assessing whether your business is really exempt or has fallen into a s 6D carve-out, reviewing your collection notices and consent records against the proposed disclosure, negotiating the data sharing agreement with the buyer, and advising on cross-border transfers and breach notification if something goes wrong. If an OAIC complaint or investigation arises, legal advice on responding and on any penalty exposure becomes urgent.

The small business exemption trap

The mistake that costs the most in this area is assuming the small business exemption protects you. The moment you disclose personal information for a benefit, service or advantage, s 6D(4)(c) of the Act removes the exemption, and "benefit" is not limited to cash. A business with $2 million in turnover that barters its customer list for advertising credits is in the same position as a large retailer when it comes to the APPs.

If you are planning any data deal this week, the first question to answer is not what the data is worth, but whether you are disclosing personal information for a benefit. If the answer is yes, assume the APPs apply in full, sort out your legal basis and contracts before you transfer a single record, and treat the data as if a regulator is already looking at it.