It’s Time To Be More Transparent- An Update On The Privacy Act

Australia’s privacy law is soon to enter a new phase. From 10 December 2026¹, and as part of the amendments introduced by the Privacy and Other Legislation Amendment Act 2024 (Cth), an agency or organisation that is categorised as being an “APP entity”² under the Privacy Act 1988 (Cth) (“Privacy Act”) will be required to be more transparent with respect to automated decision-making.

These reforms reflect increasing concerns about the use of automated decision-making systems to assist or replace the judgement of human decision makers, as well as the potential privacy risks (and lack of transparency) with respect to such use of an individual’s personal information, which may have a significant impact³.

The Australian Privacy Principles under the Privacy Act regulate how APP entities collect, use, disclose, store, and provide access to “personal information”, being “information or an opinion about an identified individual, or an individual who is reasonably identifiable: (a) whether the information or opinion is true or not; and (b) whether the information or opinion is recorded in a material form or not”⁴. An APP entity under the Privacy Act 1988 (Cth) includes an “organisation”, being “an individual, body corporate, partnership, any other unincorporated association; or a trust; that is not a small business operator, a registered political party, an agency, a State or Territory authority or a prescribed instrumentality of a State of Territory”⁵. Further, a business is a “small business” if “at a time…in a financial year…. its annual turnover for the previous financial year is $3,000,000 or less”, subject to certain exceptions set out in the Privacy Act⁶.

Australian Privacy Principle 1.3 requires an APP entity to have “a clearly expressed and up-to-date policy ….about the management of personal information by the entity.”⁷ This privacy policy must include information such as: the kinds of personal information that the entity collects and holds; how the entity collects and holds personal information; the purposes for which the entity collects, holds, uses and discloses personal information; how an individual may access personal information about the individual that is held by the entity and seek correction of such information; how an individual may complain about a breach of the Australian Privacy Principles or a registered APP code (if any) that binds the entity and how the entity will deal with such complaint; whether the entity is likely to disclose personal information to overseas recipients; and if so, the countries in which such recipients are likely to be located if it is practicable to specify in the policy⁸.

The new provisions require APP entities to include additional information in their privacy policies if the entity “has arranged for a computer program to make, or do a thing that is substantially and directly related to making, a decision; and… the decision could reasonably be expected to significantly affect the rights or interests of an individual; and …..personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision.”⁹ In such circumstances, under these new requirements, an APP entity will also need to include in its privacy policy, information in relation to:

• the kinds of personal information used in the operation of such computer programs;
• the kinds of such decisions made solely by the operation of such computer programs; and
• the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs¹⁰.

These amendments require greater transparency from APP entities with respect to how an APP entity handles an individual’s personal information and for what purposes, and affected businesses should review their automated decision-making programs and privacy policies accordingly.

Footnotes

1. Privacy and Other Legislation Amendment Act 2024 (Cth), section 2, page 2.

2. Privacy Act 1988 (Cth), section 6.

3. Explanatory Memorandum to the Privacy and Other Legislation Amendment Bill 2024 (Cth), paragraph 49.

4. Privacy Act 1988 (Cth), section 6.

5. Privacy Act 1988 (Cth), section 6C.

6. Privacy Act 1988 (Cth), section 6D. Refer also to Section 6D(4).

7. Privacy Act 1988 (Cth), section 1.3 of Schedule 1.

8. Privacy Act 1988 (Cth), section 1.4 of Schedule 1.

9. Privacy Act 1988 (Cth), section 1.7 of Schedule 1.

10. Privacy Act 1988 (Cth), section 1.8 of Schedule 1.