Peter A Clarke

The small business exemption is a real weakness in the Privacy Act. The exemption applies to businesses with a turnover of $ 3 million or less. It was included in the amendments which brought the private sector under the regulation of the Privacy Act in 2001. The rationale for the exemption was not legal. Far from it. The stated reason was a concern about regulatory burden and cost of compliance. Given other universal regulatory obligations at the time and since, exempting small business operators from keeping records secure and not interfering with customers privacy was poor public policy. It remains so. In 2001 the volume of data held by the typical small business was modest compared with now. As costs of storing data decrease and the speed of processing increases coupled with programs to analyse data small businesses are as enthusiastic in collectng and analysing personal information as their larger counterparts. It is not hard setting up loyalty schemes and email lists. Or just want the information full stop. Real Estate agents are, generally speaking, voracious collectors of data. Of more concern is that many Real Estate agents collect more information than they need to deal with renters and register interest of potential purchasers. They have also been the subject of significant data breaches (see here, here, here, here and here).

It is then more than passing strange that the President of the Real Estate Institute of Australia, Hayden Groves, resists reform to the Privacy Act by removing the small business exemption as reported in Real estate agents push back against Australian privacy law changes designed to protect personal data. The arguments encompass the original justification for the exemption, the cost fo compliance, and then moves onto a claim that other form of regulations make coverage by the Privacy Act unnecessary. No details are provided. Of course. The additional cost complained off is not specified. There has never been a persuasive study showing that adopting necessary minimum private protections creates a heavy cost to business. It has long been the case that the regulator looks to both the size and capacity of the entity as well as the sensitivity of the information when determining whether there has been adequate compliance. That is, on those rare occasions when the Commissioner does anything.

In short the claim by the Real Estate Institute of Australia is spurious.

The article provides:

Real estate agents are pushing back against proposed privacy law changes, saying small businesses should not face more red tape to keep customer and tenant data safe.

The Real Estate Institute of Australia president, Hayden Groves, said an “additional layer of responsibility is really not necessary” on top of agents’ existing duties and increased regulatory risks could be “the last straw” for smaller agencies.

Groves acknowledged in the wake of data breaches at Optus and Medibank that there was legitimate debate about the personal information collected by agents. Franchises of real estate agents Harcourts and LJ Hooker were hit by data breaches in 2022.

But Groves suggested a code of practice could help guide agents to collect only necessary information, without bringing them within scope of the federal Privacy Act.

In February the Attorney General’s Department released a review calling for Australians to gain greater control of their personal information. Users would have the ability to opt out of targeted ads, erase their data and sue for serious breaches of privacy.

Despite a consensus on the need to update privacy laws, aspects of the proposal are under attack from social media and tech companies concerned about limits on “targeting” of users, and media organisations who want an exemption from the proposed right to sue.

Now the REIA has called on the government to retain the small business exemption to the Privacy Act, because otherwise an estimated two-thirds of agencies with a turnover of less than $3m will be captured. REIA’s submission also proposes that a new penalty regime should be delayed until 2025.

Groves said “unilaterally” removing the exemption “might not bring tangible benefits to consumers, while adding unnecessary additional risks on small businesses”.

“We’re not against protecting consumers, of course,” he said. “They’re our customers.”

He said the REIA had reminded members to only collect “sufficient” data that they need to assess prospective tenants’ ability to meet obligations under a lease, check that “they are who they say they are” and nothing further.

Groves noted agents are already subject to state and territory legislation that they exercise “due skill and diligence” in all aspects of their business.

“We are already, as an industry, heavily regulated, and appropriately so … this would be another component of risk that might prove detrimental to free enterprise.”

But the consumer group Choice has submitted that the reforms do not go far enough, suggesting that the requirement that data collection be “fair and reasonable in the circumstances” could be strengthened with a duty to act in customers’ best interests.

Choice’s consumer data advocate, Kate Bower, said it was “critical” that small businesses be covered by the act because of the “huge” scope of information collected.

“The risk of data breaches in terms of identity theft and scams is quite serious and real. For consumers it makes absolutely no difference if the business [subject of a breach] had a turnover of $3m or more.”

Bower said it was “disingenuous” for businesses to lobby against the changes.

“They are the ones that benefit from this data collection, they really need to be responsible with it and they shouldn’t have any objections to regulations that would assist that.”

“They haven’t put enough work and effort into appropriate data collection and security and that indicates the regulation is needed because, left to their own devices, they’re not doing enough.”

The attorney general, Mark Dreyfus, has promised to consult on the reforms.