The Office of the Australian Privacy Commissioner has just released their annual report which shows that there has been a really big increase in privacy complaints (up 60%) and a lot of that has to do with AI. You might think that that’s just an issue for government services and big businesses and, if that is the case, you might well be wrong and get caught out.

Who is covered by the Australian Privacy Principles?

Businesses with an annual turnover of $3,000,000 or more are automatically subject to the Australian Privacy Principles – that base turnover level is commonly still a small business. And, to be captured your small business needs to have generated that $3,000,000 in just one year retrospective all of the way back to 2002. That’s right, if your turnover exceeded that number just once in the past 25 years, you are caught.

Annual turnover for the purposes of the Privacy Act includes all income from all sources. Annual turnover does not include assets held, capital gains or proceeds of capital sales. If your small business has not operated for a whole financial year, you need to make a projection of full year annual turnover based on the income of your business during that period.

And those with less than $3,000,000 in annual turnover can still be captured if they fall into certain categories such as:

• Healthcare, Education, and Child Care: any entity providing a “health service” must comply with the Privacy Act, regardless of its turnover. Under the law, a health service provider is defined as any organisation providing services related to physical, emotional, psychological, or mental health. these include traditional health service providers (private hospitals, day surgeries, medical practitioners, pharmacists, and allied health professionals), complementary therapists, child care centres, private schools, private tertiary educational institutions
• Businesses trading in personal information: A business is considered to trade in personal information if they provide a benefit, service or advantage to collect personal information, or disclose personal information for a benefit, service or advantage. For example, swapping customer email databases with a joint marketing partner, participating in third-party lead exchanges, or disclosing customer details to secure a vendor subsidy or commercial concession all meet the legal threshold of trading data for a benefit or advantage.
• Commonwealth Contracted Service Providers: Small businesses that provide services to, or on behalf of, Australian Government agencies or the Norfolk Island administration under a Commonwealth contract or subcontract are bound by the Act. (This does not apply to entities that merely receive Commonwealth funding for services that are not a function of the agency).
• Related Bodies Corporate: A small business is automatically subject to the Privacy Act if it is related to a larger body corporate that is already covered by the Act. Corporate relatedness is evaluated using the statutory tests set out in the Corporations Act 2001 (such as holding company and subsidiary relationships).
• Finance, Credit & Consumer Data:Operating a residential tenancy database (storing tenant personal data accessible by third parties).Carrying on a credit reporting business under Section 6P of the Privacy Act (governed by Part IIIA and the APPs).Acting as a reporting entity or authorized agent under the Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (compliance with APPs applies specifically to activities in relation to the AML/CTF Act and its regulations and rules).Holding accreditation under the Consumer Data Right (CDR) system under the Competition and Consumer Act 2010 (compliance with APPs applies to personal information held that is not CDR data; where information is CDR data, the specific CDR Privacy Safeguards apply instead).
• Labor & Employment Relations:Operating as a registered or recognized employee association under the Fair Work (Registered Organisations) Act 2009.Functioning as a protected action ballot agent under the Fair Work Act 2009.
• Telecommunications & Data Retention:Providing telecommunications services subject to data retention requirements under Part 5-1A of the Telecommunications (Interception and Access) Act 1979 (compliance with APPs applies specifically to activities regarding data collected and retained under Part 5-1A).

What happens if you don’t comply?

Failing to adhere to these rules when subject to the Act exposes an entity to statutory enforcement. The Office of the Australian Information Commissioner (OAIC) holds regulatory powers to investigate individual privacy complaints, conduct conciliations, issue binding determinations, and initiate Commissioner-initiated investigations under its Privacy Regulatory Action Policy.

Would you like to opt in?

While navigating these specialized statutory rules requires careful operational oversight, legal compliance should not be viewed merely as a regulatory burden. Small businesses that are genuinely exempt can choose to voluntarily opt into the Privacy Act via the OAIC’s public opt-in register. Formally adhering to the Australian Privacy Principles serves as a strategic trust-building tool, signaling strong data stewardship and delivering a distinct competitive advantage in a privacy-conscious market.

Conclusion: Navigating Privacy in an AI World

This is just another compliance issue that businesses have to deal with and that is being aggravated by the uptake of AI.

Our recommendations:

1. Do your due diligence and see if your business is covered by the Australian Privacy Principles? See this assessment tool.
2. Access professional support in setting up your privacy system if it looks like your business is covered
3. Be on the look out for AI generated complaints and obtain advice if you think you have one.