OAIC AI Guidance: Privacy Act Duties When Using AI

What the OAIC Guidance Covers

The OAIC has two complementary guidance documents for organisations subject to the Privacy Act 1988.

Guidance on using commercially available AI products addresses organisations deploying AI, including for internal work. It covers purchased products and freely accessible tools.

Guidance on developing and training generative AI models addresses developers, including organisations adapting models through fine-tuning. It also covers organisations supplying personal information to a developer for that work.

A business can occupy both roles. Buying a summarisation service raises deployment questions. Supplying customer records to fine-tune a model also raises development and training questions.

Using Commercial AI Products

The OAIC expects due diligence before adoption and ongoing review afterwards. Assess suitability for the intended task, human oversight and who can access the information. Its best-practice recommendation is to keep personal information, particularly sensitive information, out of publicly available generative AI tools.

A paid account does not answer the privacy questions by itself. Establish how the proposed service handles the records your team intends to send.

Under APP 6, use or disclosure must be for the primary collection purpose unless an exception applies. An exception can include consent. Another requires reasonable expectations and a related purpose, or a directly related purpose for sensitive information. A broad statement that the business “uses technology” does not establish those conditions for every AI use.

AI Output About a Person Is Personal Information

AI output is personal information when it is about an identified or reasonably identifiable individual. The OAIC expressly includes inferences and incorrect or artificially generated information. A fabricated allegation about a named customer still needs privacy controls.

Generating personal information also raises collection obligations under APP 3. Organisations must assess reasonable necessity and lawful, fair collection. Sensitive information generally requires consent unless an exception applies.

For accuracy, APP 10 requires reasonable steps at collection and again when information is used or disclosed. At the latter stage, relevance to that purpose also matters. For example, an AI-generated client summary needs an accuracy check before staff use its assertions in a decision.

Transparency requires more than a vendor policy link. The OAIC expects clear explanations of AI use and identification of public-facing AI tools. APP 5 notification requirements include collection purposes and usual disclosures, with notice at or before collection where practicable.

Training and Developing AI

The OAIC’s development guidance requires organisations to examine the personal information in training datasets, including publicly accessible material. Public availability does not provide permission to train a model on it.

Before using records already held, establish the collection purpose and whether training is an authorised secondary use. Where reasonable expectations cannot be established, the guidance recommends seeking consent and providing a meaningful, informed ability to opt out. An opt-out alone does not establish compliance with every collection or use requirement.

Developers also need to address sensitive information and the quality of training data. The OAIC calls for accuracy testing proportionate to the privacy risk, clear communication of limitations and a process for correcting inaccurate information.

A hypothetical firm fine-tuning a model on past client files therefore needs to assess the people described throughout those files. Authority from one client does not settle the handling of information about everyone else named in the material.

A Checklist From the Guidance

Use the OAIC’s commercial-AI checklist to structure an approval record. For each item below, keep the evidence and name the person responsible for the control.

1. Define the task and records involved. Include personal information the AI might generate, not only the files you upload.
2. Record the lawful basis for collection and use. Identify consent or another applicable exception where the proposed activity needs it.
3. Establish access and processing arrangements. Record the vendor’s purposes and the other parties that receive information.
4. Complete a privacy impact assessment. Assess the proposed use before real records enter the service.
5. Review notices and staff instructions. Explain AI use to affected people and make the permitted workflow clear to staff.
6. Assign output checks. Specify who verifies assertions about people before staff rely on them, and how errors reach the correction process.
7. Set review triggers. Reassess changes to the service, its terms or the information processed.

Keep this record within the broader AI risk assessment. A vendor questionnaire supplies evidence for a decision. Approval needs to state the permitted task and the controls that must remain in place.