A business is ‘trading’ in personal information if they collect or disclose an individual’s personal information to someone else for a benefit, service or advantage. A benefit, service or advantage can be any kind of financial payment, concession, subsidy or some other advantage or service.
Trading in personal information generally means buying, selling or bartering personal information. For example, buying a mailing list without first getting the consent of all the individuals on that list, or disclosing customer details to someone else for some commercial gain.
If a business trades in personal information they have to comply with the Australian Privacy Principles in the Privacy Act 1988.
A business is not trading in personal information if they give or receive personal information for a benefit, service or advantage and they:
- have the consent of all the individuals concerned, or
- only do so when authorised or required by law.
When buying or selling a business
The sale of a whole business is not trading in personal information. The Privacy Act doesn’t apply if the sale involves a change of ownership or sale of shares of the business, but the personal information they hold is kept within the business. The business may now have new shareholders, but they haven’t given the personal information to anyone outside the business.
If a business is buying or selling personal information and doesn’t want to be subject to the Privacy Act, they will need the consent of every individual concerned before the sale is complete.
For more information about the scope and meaning of consent, see Chapter B of the Australian Privacy Principle Guidelines
