EveryAILaw.comDoes Privacy Act 1988 — Automated Decision-Making Reforms require Transparency & Disclosure?
Australia • enacted
Yes — 1 provision
Requirements at a glance
This regulation imposes 7 specific requirements for Transparency & Disclosure across 1 provision:
- Actor and arrangement — The actor is an APP entity that has arranged for a computer program to make a decision or do a thing substantially and directly related to making it
- Significant-effect condition — The decision must be one that could reasonably be expected to significantly affect an individual's rights or interests, adversely or beneficially
- Personal-information condition — Personal information about that individual must be used in the program to make the decision or do the substantially and directly related thing
- Kinds of personal information — The privacy policy must state the kinds of personal information used in such programs
- Solely automated decisions — The privacy policy must state the kinds of covered decisions made solely by such programs
- Computer-assisted decisions — The privacy policy must state the kinds of covered decisions for which such programs do a thing substantially and directly related to making the decision
- Application after commencement — The amendment applies to decisions made after 10 December 2026 even if the arrangement, data use, or acquisition or creation of the personal information occurred earlier
Automated Decision-Making Transparency (APP 1.7/1.8)
From 10 December 2026, APP 1.7 requires an APP entity's privacy policy to contain the APP 1.8 information only when the entity has arranged for a computer program to make, or do a thing substantially and directly related to making, a decision; the decision could reasonably be expected to significantly affect an individual's rights or interests; and personal information about that individual is used in the program for that decision or related thing. This is an APP-entity duty with statutory conditions, not a rule for every AI provider or every use of personal information.
Requirements
| Requirement | Details |
|---|---|
| Actor and arrangement | The actor is an APP entity that has arranged for a computer program to make a decision or do a thing substantially and directly related to making it |
| Significant-effect condition | The decision must be one that could reasonably be expected to significantly affect an individual's rights or interests, adversely or beneficially |
| Personal-information condition | Personal information about that individual must be used in the program to make the decision or do the substantially and directly related thing |
| Kinds of personal information | The privacy policy must state the kinds of personal information used in such programs |
| Solely automated decisions | The privacy policy must state the kinds of covered decisions made solely by such programs |
| Computer-assisted decisions | The privacy policy must state the kinds of covered decisions for which such programs do a thing substantially and directly related to making the decision |
| Application after commencement | The amendment applies to decisions made after 10 December 2026 even if the arrangement, data use, or acquisition or creation of the personal information occurred earlier |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | A breach of an APP can constitute an interference with privacy; remedies and penalties depend on the applicable Privacy Act enforcement provisions and facts |