Question 8a) short answer, Mark Kelly says the law which covers that car dealer's responsibility (who works in Victoria and earns over 3mil) for this info, is the Privacy Act 1988...
Doesn't the Privacy Act only apply to federal government agencies though?
And the Privacy Amendment (Private Sector) Act 2000 is like the Privacy Act that applies to non-government and private organisation instead...
Which is what that car dealer is because he owns a second hand business as it says in the question....
So is Mark Kelly wrong?
Nope, because the Privacy Amendment (Privacy Sector) Act 2000 is an act to amend the Privacy Act (Cth) 1988 to include provisions, among other things, that require private business comply with certain privacy requirements. These include, among other things, businesses with a turnover of $3 million.
I'm not quite sure if this applies to all business or just corporations (as there is the question of jurisdiction), but it is not expected knowledge for the purposes of IT:A - an assumption is made that it applies to all businesses.