The Privacy Act does not apply to small businesses with an annual turnover of less than $3 million unless they meet certain criteria, such as providing health services, trading in personal information, or being related to a larger entity.