EveryAILaw.comDoes Privacy Act 1988 — Automated Decision-Making Reforms require Transparency & Disclosure?
Australia • enacted
Yes — 1 provision
Requirements at a glance
This regulation imposes 5 specific requirements for Transparency & Disclosure across 1 provision:
- Privacy policy disclosure — Must disclose kinds of personal information used in ADM
- Decision type disclosure — Must describe kinds of decisions made solely or substantially by automated systems
- Kinds-of-data/decisions disclosure — Privacy policy must describe, in clear terms, the kinds of personal information used in ADM and the kinds of decisions made or substantially assisted by ADM (APP 1.7-1.9) — not a causal or plain-language explanation of how the AI reaches a decision
- Influential factors (practitioner best-practice, not statutory) — Some practitioner guidance recommends disclosing factors that most significantly influence ADM outcomes as a best practice; this is not a requirement under the text of APP 1.7-1.9
- Substantial role test — Applies even when human reviews if AI is essential part of the process
Automated Decision-Making Transparency (APP 1.7/1.8) #
Australia's Privacy Act reforms make AI transparency mandatory through privacy law — not AI-specific legislation. Any organization using personal information in automated decisions must update its privacy policy to describe, in general terms, the kinds of personal information used and the kinds of decisions made or substantially assisted by ADM. Even "human in the loop" doesn't exempt you if the algorithm plays a substantial role.
Requirements
| Requirement | Details |
|---|---|
| Privacy policy disclosure | Must disclose kinds of personal information used in ADM |
| Decision type disclosure | Must describe kinds of decisions made solely or substantially by automated systems |
| Kinds-of-data/decisions disclosure | Privacy policy must describe, in clear terms, the kinds of personal information used in ADM and the kinds of decisions made or substantially assisted by ADM (APP 1.7-1.9) — not a causal or plain-language explanation of how the AI reaches a decision |
| Influential factors (practitioner best-practice, not statutory) | Some practitioner guidance recommends disclosing factors that most significantly influence ADM outcomes as a best practice; this is not a requirement under the text of APP 1.7-1.9 |
| Substantial role test | Applies even when human reviews if AI is essential part of the process |
Penalties
| Violation | Fine |
|---|---|
| Serious breach | Significant civil penalties per Privacy Act enforcement provisions |