If a business is buying or selling personal information and does not want to be subject to the Privacy Act, it will need the consent of every individual concerned before the sale is completed. People must understand what they are agreeing to and agree voluntarily. The consent is not valid or acceptable if there is extreme pressure or coercion, for example, where consent is given under threat.

Consent can be express or implied. Express consent can be given explicitly either verbally or in writing. Implied consent means that consent may reasonably be understood in the circumstances from the conduct of the person and the small business. It may be possible to infer consent from an individual�s failure to opt-out if the option to opt-out is clearly stated and easy to take up.

If a business fails to obtain consent from any individual before disclosing or collecting personal information about that individual for a benefit service or advantage, then it will be subject to the Privacy Act.