AI-powered notetaker tools are embedded across everyday workplace communication and digital platforms, particularly video conferencing tools like Zoom, Webex and Microsoft Teams. With the incorporation of AI, these tools can now join calls to record, transcribe, and generate written notes, action items and summaries of discussions. However, this rapid AI integration has largely outpaced legal and compliance scrutiny within organisations.
As AI notetaker tools record, transcribe and produce records of conversations that contain personal, legal and commercially sensitive information, they activate risks and regulatory frameworks that many Australian organisations may not have considered. This is made more complex where participants join across jurisdictions. These risks are set out below.
Key risks
| Key risk | Overview and explanation |
|---|---|
| Notice and consent gaps | Australian surveillance legislation requires participants to: (1) be notified of the use of AI notetaker tools, (2) to provide consent to the recording and transcription of private conversations or activities, and (3) to consent to records of the private conversations or activities (i.e. transcripts) being published or communicated. |
| Legal privilege | Recording legal conversations using third-party services may unintentionally waive legal privilege where vendors and third-party service providers can access and use the recordings and data e.g. for model training. |
| Collection of sensitive and biometric data | AI notetaker tools can capture sensitive and biometric information such as unique vocal characteristics (voiceprints) and unique facial elements (faceprints) which are subject to higher privacy safeguards. Collection of this information may create data overcollection risks. |
| Cross-border privacy and data challenges | AI notetaker tools create privacy and data risks where meeting participants are located across multiple jurisdictions with differing privacy regulation. This can engage a range of conflicting legal frameworks, even where organisations comply with their own jurisdiction’s rules. |
| Shadow use of AI notetaker tools | Employees may adopt their own AI notetaker tools outside formal procurement or approval processes, creating visibility and oversight gaps regarding where personal information and confidential content is recorded, transcribed, processed and stored. |
The Big Picture: Australian Regulatory Framework for AI Notetaker Tools
The regulatory framework applicable to AI notetaker tools in Australia draws on a combination of federal and state and territory privacy and surveillance device legislation. These regulatory frameworks generally establish requirements regarding notification and consent to use AI notetaker tools and obligations regarding the collection, possession, use, disclosure, quality, security, and access and correction of information and records created from the use of AI notetaker tools.
At the federal level, the Australian Privacy Act 1988 (Cth) (Privacy Act) and Australian Privacy Principles (APPs) establish the foundational framework for the management of personal information and principles regarding the notification, collection, use, disclosure, quality, security, access and correction of personal information. While the Privacy Act and APPs do not directly regulate the deployment or use of AI notetaker tools, they govern how organisations manage and handle personal information that is collected because of their deployment. This means any meeting record created from an AI notetaker tool which captures personal or sensitive information, such as an employee’s meeting with HR about a medical condition and the need for workplace adjustments, will trigger obligations under the Privacy Act and APPs.
Each state and territory has their own surveillance devices legislation which expressly regulates the use of devices capable of recording, monitoring or listening to “private conversations” or otherwise visually recording an “activity” (Surveillance Devices Legislation). Although there are some nuances between the requirements across the state and territories, the legislative regimes are largely uniform. The Surveillance Devices Legislation establishes requirements regarding the notification, collection, use and disclosure of “Surveillance Devices”1 and records created from their deployment.2 This means that the recording of any workplace conversation, call or activity, such as a virtual meeting between employees, may trigger obligations under the Surveillance Devices Legislation.
Importantly, the Privacy Act and Surveillance Devices Legislation establish civil penalties, infringement notices and criminal offences for non-compliances with the respective regimes.
Key Lessons
If your organisation is deploying AI notetaker tools or has upgraded existing tools to integrate AI capabilities, you should:
- ensure you have robust governance in place to maintain visibility and control over how meeting records are created, retained, shared and accessed;
- consider evolving legislative obligations under the:
- Privacy Act and APPs to minimise risks by capturing and processing personal and sensitive information and biometric data (including unique voiceprints collected by AI notetaker tools);
- Surveillance Device Legislation when deploying AI notetaker tools, including consent, use and disclosure; and
- applicable offshore regulatory requirements where conversation participants are located overseas (and consider adopting a highwater mark approach);
- review contracts with AI vendors to ensure an appropriate level of protection of records (including transcripts) being accessed by third parties or stored, processed or used for model training to protect privilege and ensure that vendors are required to comply with Australian legislation (or equivalents in other jurisdictions);
- ensure employees are appropriately notified when AI notetaker tools are deployed and that robust consent mechanisms are in place to collect, use, and disclose recordings and transcripts (e.g. suitability of employment contracts);
- patch any visibility gaps within your organisation to ensure you know where and how AI notetaker tools are being used to minimise risks from shadow AI; and
- evaluate whether your internal and external-facing privacy policies require uplifts to accurately reflect your data handling practices in relation to AI notetaker tools.
Looking Ahead
The regulatory environment governing AI and data use in Australia is developing. Regulators are focused on the interplay between AI, privacy and surveillance and organisations should anticipate heightened regulatory scrutiny of how AI tools, including AI notetaker tools are being deployed. In this context, adopting a proactive “high watermark” approach across Surveillance Devices Legislation and considering emerging Privacy Act and APP issues will be essential to managing legal and reputational risk.
Footnotes
1. The Surveillance Devices Act 2007 (NSW) defines Surveillance Device as a data surveillance device, a listening device, an optical surveillance device or a tracking device, or a device that is a combination of any 2 or more of these devices. Relevantly, a Listening Device is defined as any device capable of being used to overhear, record, monitor or listen to a conversation or words spoken to or by any person in conversation.
2. Generally, a “Private Conversation” means any words spoken by one person to another person in circumstances that may reasonably indicate that any of those persons desires the words to be heard or listened to only by themselves; but does not include a conversation where the parties ought reasonably to expect that it might be overheard by someone else.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
