Privacy and AI use

Is your business subject to the Australian Privacy Principles (APPs)? If so, you may need to update your public-facing Privacy Policy to comply with new APP 1.7 by 10 December 2026.

APP 1.7 was introduced by the Commonwealth Privacy and Other Legislation Amendment Act 2024, adding further requirements for transparency in the handling and management of personal information. It comes into effect this December and requires APP entities to declare:

• if they are using computer programs to undertake automated (or substantially automated) decision-making (ADM) that could have a significant impact an individual’s rights or interests (beneficial or adverse); and
• whether that decision-making is reliant on supplied personal information.

“Computer program” is construed quite broadly by the Office of the Australian Information Commissioner (OAIC) to include everything from AI and machine learning to simple rules engines and Excel spreadsheets.

Automated decisions that might have “significant” impact on individual’s rights or interests include: credit approvals, job applications, remuneration decisions, eligibility for benefits and access to housing, education, health services, health products, insurance or other significant goods or services. The necessity of the benefit and an individual’s vulnerability can be factors in determining whether the impact from an automated decision will be significant.

If you do employ ADM in any of these contexts, or pay for a third party to provide services that rely on ADM, APP 1.8 sets out the information which must be included in your Privacy Policy:

• the nature of the personal information used in relation to the program;
• the kinds of decisions made solely by the program; and
• the kinds of decisions that are substantially and directly affected by the ADM undertaken by the program.

The disclosure provided in your privacy policy must be meaningful to a reasonable person and enable them to understand how their personal information is being handled.

Displacing the requirement to disclose ADM requires a human decision-maker to have meaningful visibility of a computer program’s outputs and extensive human oversight of, and involvement in, any final decision. The OAIC has indicated entities should err towards transparency if in doubt. The assessment underpinning the decision to disclose (or not) is the core exercise that the OAIC wants businesses to undertake.

There is an exemption relating to trade secrets or commercially sensitive information if disclosure could harm an entity’s commercial interests. However, this exemption will not apply simply because information has commercial value, or could cause ridicule, criticism or embarrassment.

As a reminder, APP entities include Federal government departments, agencies, and office holders; business or corporations with an annual turnover of more than $3 million and certain small businesses, such as those that provide health services, hold health information, buy and sell personal information, are Commonwealth contractors, operate tenancy databases or act as reporting agencies under the consumer credit reporting system.

At this stage, Tasmania’s Personal Information Protection Act 2004 has not been amended to feature any comparable provisions targeting automated decision-making, computer algorithms, or artificial intelligence transparency.

If you require any assistance reviewing or updating your business’ privacy policy before December 2026, please contact us.