The Office of the Australian Information Commissioner has published its guidance on the new transparency obligations for the use of AI and automated decision-making.
Separately, the Privacy Commissioner has explained how current and proposed privacy laws could strengthen protections and increase obligations on companies collecting personal information through smart glasses or other wearables.
Automated decision-making
From 10 December 2026, Australian Privacy Principle 1.3 requires regulated entities to disclose in their privacy policies where a “computer program” makes, or is substantially and directly related to making, a decision that could reasonably be expected to significantly affect an individual’s rights or interests.
The OAIC has published a transparency obligation flow chart (PDF) to help the decision process.
APP 1.7 requires APP entities to include the information outlined in APP 1.8 in their APP Privacy Policy if:
* the entity has arranged for a computer program to make, or do a thing that is substantially and directly related to making a decision (APP 1.7(a)); and
* the decision could reasonably be expected to significantly affect the rights or interests of an individual (APP 1.7(b)); and
* personal information about the individual is used in the operation of the computer program to make the decision or do the thing that is substantially and directly related to making the decision (APP 1.7(c)).
APP 1.8 outlines the information which must be included in an entity’s APP privacy policy if the conditions in APP 1.7 are met.
This includes:
* the kinds of personal information used in the operation of such computer programs; and
* the kinds of such decisions made solely by the operation of such computer programs; and
* the kinds of such decisions for which a thing, that is substantially and directly related to making the decision, is done by the operation of such computer programs.
Privacy and surveillance wearables including smart glasses
The Privacy Commissioner has responded to public discussion about ambient recording devices that enable always-on, concealed and even covert surveillance of images, sounds and other personal information, and community concern about smart glasses at sensitive public spaces such as swimming pools, playgrounds and gyms.
While the Privacy Act does not apply to individuals who collect others’ personal information, only to companies and Commonwealth agencies, the Privacy Commissioner has expressed the view that retailers that sell smart glasses – for example on an ecommerce website – or companies that manufacture them, may not have any Privacy Act obligations if they do not collect any personal information with respect to those devices. Instead, the entity providing the software used in the device is likely to be the entity that collects and holds the information for the purpose of privacy law.
The Commissioner notes that forthcoming changes to the Privacy Act broaden the definition of “personal information” so that it is likely that it will include images of an individual or recordings of their voice, depending on the context and capabilities of the regulated entity as to whether and in which circumstances the personal information they are collecting is personal information.
If you found this article helpful, then subscribe to our news emails to keep up to date and look at our video courses for in-depth training. Use the search box at the top right of this page or the categories list on the right hand side of this page to check for other articles on the same or related matters.
Author: David Jacobson
Principal, Bright Corporate Law
Email:
About David Jacobson
The information contained in this article is not legal advice. It is not to be relied upon as a full statement of the law. You should seek professional advice for your specific needs and circumstances before acting or relying on any of the content.
