Time to dust off your Privacy Policy
If you work for a Government department or an organisation with more than $3M/yr revenue, from 10 December 2026 there are important changes to the Australian Privacy Act that will come into force. If your organisation uses computer systems for Automated Decision Making (ADM), then you need to comply with Australian Privacy Principles guidance outlined in APP 1.7 to 1.9.
Compliance entails detailing in your Privacy Policy:
The kinds of personal information used in your automated decision making.
The kinds of decisions made solely by these systems.
The kinds of decisions they substantially inform.
You have less than 70 days to determine where your organisation uses automated decision making and what personal information is used. Then you need to update your Privacy Policy. Reach out if you could use some help!
See below for a useful page from the OAIC:
Real world examples of Automated Decision Making:
Using a spreadsheet to decide whether to admit an applicant for an aged care service.
Using a Third Party cloud service to decide eligibility of applicants for subsidised housing.
The performance of your sales staff is assessed using a generative AI program and their compensation reflects their performance.
Using computer systems to price products based on the profile and location of the buyer.