As a "contracted service provider" to the Commonwealth, Raaus is quite possibly in breach of the Privacy Act
The RAAus Privacy Policy say:
5.3.Use and disclosure of personal information
RAAus will only use and/or disclose personal information for the purposes for which it was collected (the primary purpose), unless an individual has consented to another use [APP 6].
There are certain limited circumstances in which RAAus may use or disclose information for a different purpose (a secondary purpose) without consent, such as where the secondary purpose is:
• directly related to the primary purpose for which the information was collected
• required or authorised under an Australian law or has been ordered by a court or tribunal
• necessary to lessen or prevent an immediate and serious threat to the life, safety of air
navigation, health or safety of any individual, or public health or safety
• to facilitate the investigation of an occurrence involving an RAAus registered aircraft and the death or serious injury of one or more persons
• a permitted general situation or health situation, as defined by the Privacy Act;
or
•an enforcement related activity and the use or disclosure of the information is reasonably
necessary.
If RAAus uses or discloses personal information for a purpose other than what it was originally collected for, RAAus will keep a written notice of that use or disclosure as required by the APPs.
Clearly the "primary Purpose" is the purpose for which it was originally collected and the envisaged "secondary use does not include passing it on to a third party private company without specific consent.