If you are buying or selling a business you should be aware of the new privacy law reforms and how they impact on the due diligence process which is conducted to enable buyers to examine the business of the seller.
The Australian Law Reform Commission ("ALRC") has released its final report titled 'For your information: Australian Privacy Law and Practice' ("Final Report"), recommending, amongst other things, the removal of the employee records exemption and the small business exemption from the Privacy Act 1988 (Cth) ("the Act").
Should the government remove the employee records exemption, employee information would come under the protection of the Act. This has implications for vendors and purchasers buying or selling a business, who disclose and collect a number of different types of personal information about employees in the process of due diligence.
It is anticipated that the small business and employee records exemptions will be removed in the second stage of legislation, to be implemented by the government within the next 18 months.
Removal of Exemptions for Small Businesses
The ALRC proposed removing the exemption in the Act for small businesses. Currently, the small business exemption applies to businesses, non-profit bodies and unincorporated associations with an annual turnover of less than $3 million.
This will mean that small businesses previously exempt from the operation of the Act, will now be subject to privacy laws.
Removal of Employee Records Exemption
The ALRC recommended that the employee record exemption be removed as an employee's record contains a significant amount of personal information, including sensitive information.
Under the employee records exemption, the acts and practices of an organisation are exempt from the operation of the Act if they are directly related to a current or former employment relationship1. Therefore, under the existing law, the employee records exemption may apply to exempt the disclosure of employee records by a vendor organisation during the potential sale of its business.
There is some concern that removing the employee records exemption would impede the due diligence process.
In its Final Report, the ALRC considered that the removal of the employee records exemption would not hinder the ability of organisations to buy and sell businesses. It remains to be seen if the Privacy Commissioner adopts the same view. In order to protect employee's personal information it has been suggested that:
- vendors should provide aggregate, non-identifiable information about employees to a prospective purchaser, thereby not constituting 'personal information' under the Act; and
- potential purchasers should inspect records as opposed to recording employee's details, which would not constitute 'collection' of the personal information under the Act.
It is also arguable that disclosure of personal information to a potential purchaser of a business is directly related to the primary purpose of collection, and within the employee's reasonable expectation.
Conclusion
Vendors and purchasers of a business should watch these developments carefully to ensure that due diligence under the proposed new laws do not breach privacy obligations. This will take on greater importance under the new laws because there will be enhanced reporting2 and enforcement powers3 of the Office of the Privacy Commissioner.
Accordingly, processes for disclosing and collecting employee information in a due diligence process may need to be reviewed.
Footnotes
1 Sections 7(1)(ee), 7B(3) of the Act
2 Chapter 51 of the Final Report
3 Chapter 50 of the Final Report
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.