Does the Privacy Act apply to your business?
The Privacy Act 1988 applies to organisations with an annual turnover of more than $3 million, subject to some exceptions. It also covers some smaller businesses regardless of turnover. The OAIC lists private sector health service providers among them, including medical practitioners, pharmacists, allied health professionals, complementary therapists such as naturopaths and chiropractors, gyms, weight loss clinics, child care centres and private schools. Businesses that sell or buy personal information are also covered. Even if the Act does not apply to you, Google's reply tips tell every business never to share a reviewer's private information.
What did the OAIC decide about the real estate agency?
In 'AQE' and Noonan Real Estate Agency Pty Ltd (Privacy) [2024] AICmr 237, a tenant posted a negative Google review under a profile name similar to his own. The agency's reply disclosed his full name, occupation and financial circumstances, and it refused to delete the reply. The OAIC found the agency had collected that information for property management and disclosed it for an unrelated purpose. The tenant had not consented, would not reasonably expect the disclosure, and the details were not needed to respond to the issues he raised. The agency was ordered to give a written apology within 30 days.
The OAIC's summary of the case says it is not right to expose someone's personal information to pressure them into changing or deleting an adverse online review. The agency itself accepted that it could have answered the review without identifying the tenant.
What counts as personal information in a reply?
Personal information is information about an identified or reasonably identifiable person. In a reply, the risk comes from details the business knows from its own records that the reviewer did not post. The test is easy to apply: if a detail came from your booking system, your files or a staff member's memory of the customer, it does not belong in a public reply. Watch for the items below in particular, because they are the details a person replying in a hurry reaches for when trying to prove a point.
- The reviewer's full or real name when they posted under initials or a nickname.
- Dates, times and addresses of bookings, jobs or deliveries.
- What they bought, what they paid, refunds and account balances.
- Earlier complaints, cancellations or late payments.
- Health information, including the reason for a visit or the treatment given.
- Anything about other people in the household or on the booking.
How should health practices reply to patient reviews?
Health practices have two sets of rules to keep in mind. Health information is sensitive, so a reply should not mention symptoms, diagnoses, treatment or outcomes, and the safest rule is that a reply never confirms the reviewer is or was a patient. Ahpra adds an advertising rule. Testimonials about the clinical aspects of a regulated health service cannot be used in advertising, and Ahpra says practitioners should take care if they choose to engage with reviews on third-party sites, because that may be treated as using a testimonial to advertise. Ahpra also says practitioners do not have to remove reviews on sites they do not control.
A reply that works for most practices: 'Thank you for your feedback. We cannot discuss anyone's care in a public forum. If you would like to talk with us, please call the practice and ask for the practice manager.'
How do you correct a review that gets the facts wrong?
Describe your general process, never the person's case. 'Our records show you cancelled three times' discloses information from your files. 'We confirm appointments by SMS two days ahead and are happy to look into what happened' corrects the impression without revealing anything, provided the process statement is true. Invite the reviewer to contact you directly, and handle the details privately. If the review is fake and you can show it, report it to Google instead of arguing in the reply. The reply is read by future customers, so write it for them.
Who should check replies for privacy before they go out?
Add a privacy check to the approval step for any reply about health, money, legal matters, children or a named staff member. The person approving reads the draft against one question: does any detail come from our records rather than from the review? If it does, it comes out. Google suggests addressing the reviewer by name and signing off personally, which is fine using the display name already on the review. For staff, use first names only, and leave junior staff out of replies about complaints. Keep a list of banned details next to your tone guide.