Automated Decision Making Under the Privacy Act

What Counts as Automated Decision Making

Automated decision making falls within the new duty when all the conditions in Australian Privacy Principle (APP) 1.7 apply. The entity must have arranged for software to make a decision or perform a task substantially and directly related to it. The software must use personal information about the person concerned. The decision must reasonably be expected to significantly affect that person’s rights or interests.

The threshold concerns the decision’s likely effect. A minor administrative action does not automatically meet it. Assess the person’s circumstances, including vulnerability and their reliance on the service. Beneficial decisions, refusals and failures to decide can qualify.

The Office of the Australian Information Commissioner (OAIC) explains that human review does not automatically remove a process from scope. Its APP 1 guidance also distinguishes using software to document a decision from using it to help make the decision.

For example, consider these hypothetical processes:

• A credit application is approved or declined using personal information processed by software. This calls for an APP 1.7 assessment.
• An employee makes a decision independently and types the outcome into a document. Recording the outcome alone does not bring that process within the new duty.

The technology need not use artificial intelligence. The OAIC’s transparency fact sheet covers rule-based programs as well as AI. Start with what the program does and how its output affects the decision.

The New Transparency Duties

APP 1.8 requires privacy policies to describe the kinds of personal information used by covered programs. Policies must also identify decisions made solely by programs and decisions for which programs perform substantially and directly related tasks.

These are separate disclosure categories. A general statement that your organisation uses AI does not describe which personal information feeds which decision processes.

The Privacy and Other Legislation Amendment Act 2024 introduces the duty through Schedule 1, Part 15. Commencement follows the statutory 24-month period after Royal Assent. The Act’s commencement table gives the exact boundary in 2026. Before that boundary, prepare the disclosures. Once the provisions commence, apply them to covered decisions made afterwards, including decisions using older systems or previously collected information.

This is a privacy-policy transparency requirement. Publishing the disclosure does not itself authorise a collection or use of personal information. The wider Privacy Act obligations remain relevant to the underlying activity.

Updating Your Privacy Policy

Update your privacy policy by tracing each covered decision from its personal-information inputs to the outcome. Keep the technical inventory behind the policy so the published wording stays understandable.

1. List decision processes across business units. Ask process owners about customer approvals, account restrictions and other decisions affecting people. Include outsourced services.
2. Record what each program receives and produces. Identify the personal-information categories, the output and the decision-maker who uses it.
3. Assess the APP 1.7 conditions for each process. Explain the expected effect on the person and whether the program makes or substantially supports the decision. Keep the reasons for excluding a process.
4. Separate fully automated decisions from decisions supported by software. Ask the operational owner to confirm how staff actually use the output. A nominal human approval step does not explain that relationship.
5. Draft the policy from the inventory. Describe the information types and the kinds of decisions in ordinary language. Use the privacy policy template to organise the wider policy around those disclosures.
6. Compare the draft with a worked process before approval. A reader must be able to identify the relevant information types and understand the role software plays in the decision.

For a hypothetical lender, a disclosure could explain that software uses income and existing-debt information to approve or decline credit applications. If staff make the final decision using a software-generated assessment, describe that supported decision process instead. Use only the description that matches the lender’s actual operation.

Assign the inventory to a named owner. Require that owner to review the policy when a new system changes the information used or the kinds of decisions made.