Basically, it states "an organisation must set out in a document clearly expressed policies on its management of personal information. The organisation must make the document available to anyone who asks for it".

In general, the best way is for a link to the site's privacy guidelines. Crikey has one at http://www.crikey.com.au/about/privacy/ - they could easily have published a short link to it on the site shown in the article. I'd say this was an oversight on their part, but from my POV quite a big one!