Can companies sell my personal data in Australia?
Generally, no, Australian companies are restricted from selling your personal data without your consent or a valid legal basis. The Privacy Act 1988 and Australian Privacy Principles regulate how personal information is handled, emphasizing transparency and individual control.
Was this helpful?
14 readers found this helpful
How it works in practice
Australian Privacy Principles
Companies in Australia are primarily governed by the Privacy Act 1988, which includes the Australian Privacy Principles (APPs). These principles dictate how organizations must collect, use, store, and disclose personal information. Selling your personal data is considered a 'disclosure' and is generally prohibited unless specific conditions are met.
Consent and Disclosure
For a company to legally sell or share your personal data, they must typically obtain your express consent. This consent should be informed, specific, and voluntary. Alternatively, disclosure may be permitted if it is required or authorized by Australian law, or if it is for a directly related secondary purpose that you would reasonably expect.
Your Rights
The APPs grant individuals the right to know what personal information an organization holds about them, why it's collected, and to whom it might be disclosed. You also have the right to request access to your data and ask for corrections if it's inaccurate. These rights aim to provide transparency and control over your personal information.
Important exceptions
Companies may sell or disclose your personal data if they have obtained your explicit consent, which is a key exception. Another exception is when the data has been de-identified, meaning it can no longer be linked to you. Legal obligations, such as court orders or regulatory requirements, can also compel disclosure. Furthermore, small businesses with an annual turnover of less than $3 million are generally exempt from the Privacy Act, unless they deal with sensitive information, provide health services, or are a Commonwealth government contractor. This exemption means smaller entities have fewer restrictions on data sharing.
What you should do now
-
Review the company's privacy policy to understand how they collect, use, and disclose your data.
-
Opt-out of any data sharing or marketing preferences if available through the company's settings or direct contact.
-
Formally withdraw your consent for data processing and disclosure if you previously provided it.
-
Lodge a complaint directly with the company if you believe your data has been sold without consent or a valid reason.
-
If the issue remains unresolved, report the concern to the Office of the Australian Information Commissioner (OAIC).
Expert Notes
No expert notes have been added to this question yet.
People also asked
Explore highly relevant questions and get instant verified short answers.